intentdna 1.9.0 → 1.9.3

package/dist/runtime/local-provider-sandbox.d.ts

@@ -0,0 +1,42 @@
+import type { ExecutionProvider } from "./execution-provider.js";
+export declare const MACOS_PROVIDER_DENY_ALL_NETWORK_PROFILE: string;
+interface ExecutableIdentity {
+    readonly real_path: string;
+    readonly device: number;
+    readonly inode: number;
+    readonly mode: number;
+    readonly size: number;
+    readonly modified_at_ms: number;
+}
+type SandboxAvailability = {
+    readonly available: true;
+    readonly executable_path: string;
+    readonly executable_identity: ExecutableIdentity;
+} | {
+    readonly available: false;
+    readonly reason: "unsupported_platform" | "mechanism_unavailable" | "probe_failed";
+};
+export interface LocalProviderNetworkSandboxOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly sandbox_exec_path?: string;
+    readonly probe_timeout_ms?: number;
+}
+export declare class LocalProviderNetworkSandboxError extends Error {
+    readonly code: "unsupported";
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Wraps a provider launch only when the host proves deny-all network support.
+ * Capability discovery is separate so attach can fail before a worker starts.
+ */
+export declare class LocalProviderNetworkSandbox {
+    readonly network_policy_enforcement: boolean;
+    readonly unavailable_reason: Exclude<SandboxAvailability, {
+        available: true;
+    }>["reason"] | null;
+    private readonly availability;
+    private readonly probeTimeoutMs;
+    constructor(options?: LocalProviderNetworkSandboxOptions);
+    wrap(provider: ExecutionProvider): ExecutionProvider;
+}
+export {};

package/dist/runtime/local-provider-sandbox.js

@@ -0,0 +1,154 @@
+import { spawnSync } from "node:child_process";
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+const DEFAULT_SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
+const PROBE_PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+export const MACOS_PROVIDER_DENY_ALL_NETWORK_PROFILE = [
+    "(version 1)",
+    "(allow default)",
+    "(deny network*)",
+    "",
+].join("\n");
+const NETWORK_DENIAL_PROBE = [
+    "const net=require('node:net');",
+    "let socket;",
+    "try{socket=net.connect({host:'127.0.0.1',port:9});}",
+    "catch(error){process.exit(error&&(error.code==='EPERM'||error.code==='EACCES')?0:72);}",
+    "socket.once('connect',()=>process.exit(73));",
+    "socket.once('error',error=>process.exit(error&&(error.code==='EPERM'||error.code==='EACCES')?0:74));",
+    "setTimeout(()=>process.exit(75),2000);",
+].join("");
+export class LocalProviderNetworkSandboxError extends Error {
+    code = "unsupported";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "LocalProviderNetworkSandboxError";
+    }
+}
+function executableIdentity(path) {
+    accessSync(path, constants.X_OK);
+    const realPath = realpathSync(path);
+    const stats = statSync(realPath);
+    if (!stats.isFile())
+        throw new Error("sandbox executable is not a regular file");
+    return {
+        real_path: realPath,
+        device: stats.dev,
+        inode: stats.ino,
+        mode: stats.mode,
+        size: stats.size,
+        modified_at_ms: stats.mtimeMs,
+    };
+}
+function sameExecutableIdentity(left, right) {
+    return left.real_path === right.real_path
+        && left.device === right.device
+        && left.inode === right.inode
+        && left.mode === right.mode
+        && left.size === right.size
+        && left.modified_at_ms === right.modified_at_ms;
+}
+function probeNetworkDenial(sandboxExecPath, timeoutMs) {
+    try {
+        const result = spawnSync(sandboxExecPath, [
+            "-p",
+            MACOS_PROVIDER_DENY_ALL_NETWORK_PROFILE,
+            process.execPath,
+            "-e",
+            NETWORK_DENIAL_PROBE,
+        ], {
+            env: { PATH: PROBE_PATH },
+            stdio: "ignore",
+            timeout: timeoutMs,
+            windowsHide: true,
+        });
+        return result.error === undefined
+            && result.signal === null
+            && result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function detectAvailability(platform, sandboxExecPath, timeoutMs) {
+    if (platform !== "darwin") {
+        return { available: false, reason: "unsupported_platform" };
+    }
+    let identity;
+    try {
+        identity = executableIdentity(sandboxExecPath);
+    }
+    catch {
+        return { available: false, reason: "mechanism_unavailable" };
+    }
+    if (identity.real_path !== DEFAULT_SANDBOX_EXEC_PATH) {
+        return { available: false, reason: "mechanism_unavailable" };
+    }
+    if (!probeNetworkDenial(identity.real_path, timeoutMs)) {
+        return { available: false, reason: "probe_failed" };
+    }
+    return {
+        available: true,
+        executable_path: identity.real_path,
+        executable_identity: identity,
+    };
+}
+function sandboxedLaunch(launch, executablePath) {
+    return {
+        command: executablePath,
+        args: [
+            "-p",
+            MACOS_PROVIDER_DENY_ALL_NETWORK_PROFILE,
+            launch.command,
+            ...launch.args,
+        ],
+        stdin: launch.stdin,
+        cwd: launch.cwd,
+        ...(launch.env ? { env: launch.env } : {}),
+    };
+}
+/**
+ * Wraps a provider launch only when the host proves deny-all network support.
+ * Capability discovery is separate so attach can fail before a worker starts.
+ */
+export class LocalProviderNetworkSandbox {
+    network_policy_enforcement;
+    unavailable_reason;
+    availability;
+    probeTimeoutMs;
+    constructor(options = {}) {
+        this.probeTimeoutMs = options.probe_timeout_ms ?? DEFAULT_PROBE_TIMEOUT_MS;
+        if (!Number.isSafeInteger(this.probeTimeoutMs) || this.probeTimeoutMs <= 0) {
+            throw new TypeError("probe_timeout_ms must be a positive safe integer");
+        }
+        this.availability = detectAvailability(options.platform ?? process.platform, options.sandbox_exec_path ?? DEFAULT_SANDBOX_EXEC_PATH, this.probeTimeoutMs);
+        this.network_policy_enforcement = this.availability.available;
+        this.unavailable_reason = this.availability.available
+            ? null
+            : this.availability.reason;
+    }
+    wrap(provider) {
+        const availability = this.availability;
+        if (!availability.available) {
+            throw new LocalProviderNetworkSandboxError(`local provider deny_all network enforcement is unavailable: ${availability.reason}`);
+        }
+        return {
+            name: provider.name,
+            createLaunch: (packet) => {
+                let currentIdentity;
+                try {
+                    currentIdentity = executableIdentity(availability.executable_path);
+                }
+                catch (error) {
+                    throw new LocalProviderNetworkSandboxError("pinned local provider sandbox mechanism is unavailable", { cause: error });
+                }
+                if (!sameExecutableIdentity(currentIdentity, availability.executable_identity)
+                    || !probeNetworkDenial(availability.executable_path, this.probeTimeoutMs)) {
+                    throw new LocalProviderNetworkSandboxError("pinned local provider sandbox mechanism cannot prove deny_all");
+                }
+                return sandboxedLaunch(provider.createLaunch(packet), availability.executable_path);
+            },
+            parseResult: (context) => provider.parseResult(context),
+        };
+    }
+}

package/dist/runtime/local-verifier-execution.d.ts

@@ -0,0 +1,24 @@
+import { type CanonicalVerifierExecutionAuthorityDescriptor, type CanonicalVerifierExecutionAuthorityReceipt, type CanonicalVerifierExecutionPort, type CanonicalVerifierExecutionRequest } from "./canonical-run-service.js";
+import type { CanonicalResultDigest } from "./run-contracts.js";
+import { type VerifierCommandExecutionResult } from "./verifier.js";
+export interface ProductionLocalVerifierExecutionPortOptions {
+    readonly root_directory: string;
+    readonly authority_instance_id?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly architecture?: NodeJS.Architecture;
+    readonly helper_path?: string;
+    readonly expected_digest?: CanonicalResultDigest;
+    readonly resolve_shell_executable?: (platform: NodeJS.Platform) => string;
+}
+export declare class ProductionLocalVerifierExecutionPort implements CanonicalVerifierExecutionPort {
+    readonly authority_descriptor: CanonicalVerifierExecutionAuthorityDescriptor;
+    private readonly authorityDescriptorDigest;
+    private readonly authority;
+    private readonly shellExecutable;
+    private readonly platform;
+    constructor(options: ProductionLocalVerifierExecutionPortOptions);
+    execute(request: CanonicalVerifierExecutionRequest): Promise<{
+        readonly execution: VerifierCommandExecutionResult;
+        readonly authority: CanonicalVerifierExecutionAuthorityReceipt;
+    }>;
+}

package/dist/runtime/local-verifier-execution.js

@@ -0,0 +1,290 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, win32 as win32Path } from "node:path";
+import { canonicalizeJson } from "./canonical-json.js";
+import { CanonicalRunServiceError, } from "./canonical-run-service.js";
+import { LocalAttemptExecutionAuthority, } from "./local-execution-authority.js";
+import { summarizeCommandEvidence } from "./verifier.js";
+const VERIFIER_PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+const SHA256_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+function digest(value) {
+    return `sha256:${createHash("sha256").update(canonicalizeJson(value), "utf8").digest("hex")}`;
+}
+function textDigest(value) {
+    return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
+}
+function assertExactKeys(value, required, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new CanonicalRunServiceError("invalid_request", `${label} must be an object`);
+    }
+    const expected = [...required].sort();
+    const actual = Object.keys(value).sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+        throw new CanonicalRunServiceError("invalid_request", `${label} has invalid fields`);
+    }
+}
+function assertDigest(value, label) {
+    if (typeof value !== "string" || !SHA256_DIGEST_PATTERN.test(value)) {
+        throw new CanonicalRunServiceError("invalid_request", `${label} must be a sha256 digest`);
+    }
+}
+function assertCanonicalTimestamp(value, label) {
+    if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value)
+        || !Number.isFinite(Date.parse(value)) || new Date(Date.parse(value)).toISOString() !== value) {
+        throw new CanonicalRunServiceError("invalid_request", `${label} must be a canonical UTC timestamp`);
+    }
+}
+function environmentBindingDigest(environment) {
+    return digest(Object.fromEntries(Object.entries(environment)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => [name, textDigest(value)])));
+}
+function canonicalEqual(left, right) {
+    try {
+        return canonicalizeJson(left) === canonicalizeJson(right);
+    }
+    catch {
+        return false;
+    }
+}
+function assertExecutionRequest(request, authorityDescriptorDigest, platform) {
+    assertExactKeys(request, ["request_digest", "descriptor", "plan_id", "verifier_id", "verifier_definition_digest", "resolved_command", "resolved_command_digest", "cwd", "cwd_identity", "environment", "environment_binding_digest", "timeout_ms", "requested_at", "network_policy", "inherit_parent_environment", "load_startup_files"], "verifier execution request");
+    assertExactKeys(request.descriptor, ["schema_version", "plan_id", "verifier_id", "verifier_definition_digest", "raw_command_digest", "cwd", "supplied_environment", "shell", "timeout_ms", "requested_at", "network_mode", "expected_authority_descriptor_digest"], "verifier execution descriptor");
+    assertExactKeys(request.descriptor.cwd, ["workspace_id", "workspace_allocation_digest", "relative_working_directory", "absolute_path_digest"], "verifier execution cwd identity");
+    assertExactKeys(request.descriptor.supplied_environment, ["binding_digest", "variable_names", "inherit_parent", "startup_files"], "verifier execution supplied environment");
+    assertExactKeys(request.descriptor.shell, ["executable", "arguments"], "verifier execution shell");
+    assertDigest(request.request_digest, "verifier execution request digest");
+    assertDigest(request.plan_id, "verifier execution plan id");
+    assertDigest(request.verifier_definition_digest, "verifier definition digest");
+    assertDigest(request.resolved_command_digest, "resolved verifier command digest");
+    assertDigest(request.environment_binding_digest, "verifier environment binding digest");
+    assertDigest(request.cwd_identity.workspace_allocation_digest, "workspace allocation digest");
+    assertDigest(request.cwd_identity.absolute_path_digest, "workspace absolute path digest");
+    assertCanonicalTimestamp(request.requested_at, "verifier execution requested_at");
+    let descriptorDigest;
+    let actualEnvironmentDigest;
+    try {
+        descriptorDigest = digest(request.descriptor);
+        canonicalizeJson(request.environment);
+        actualEnvironmentDigest = environmentBindingDigest(request.environment);
+    }
+    catch (error) {
+        throw new CanonicalRunServiceError("invalid_request", "verifier execution request must contain canonical JSON data", { cause: error });
+    }
+    const environmentNames = Object.keys(request.environment).sort();
+    const platformEnvironmentNames = platform === "win32"
+        ? new Set(["PATH", "PATHEXT", "SystemRoot", "ComSpec"])
+        : new Set(["PATH"]);
+    const environmentIsValid = Object.entries(request.environment).every(([name, value]) => name.length > 0 && !name.includes("=") && !name.includes("\0") && typeof value === "string" && !value.includes("\0"))
+        && (platform === "win32" || request.environment.PATH === VERIFIER_PATH)
+        && environmentNames.every((name) => (platformEnvironmentNames.has(name)
+            || /^INTENTDNA_VERIFIER_[0-9]+_[A-Z0-9_]+$/u.test(name)
+            || /^INTENTDNA_HANDOFF_[1-9][0-9]*$/u.test(name)));
+    const shellArguments = request.descriptor.shell.arguments;
+    const checks = [
+        ["schema_version", request.descriptor.schema_version === "intentdna.verifier_execution_request.v1"],
+        ["request_digest", request.request_digest === descriptorDigest],
+        ["authority_descriptor", request.descriptor.expected_authority_descriptor_digest === authorityDescriptorDigest],
+        ["plan_id", request.plan_id === request.descriptor.plan_id],
+        ["verifier_id", request.verifier_id === request.descriptor.verifier_id],
+        ["verifier_definition", request.verifier_definition_digest === request.descriptor.verifier_definition_digest],
+        ["resolved_command_descriptor", request.resolved_command_digest === request.descriptor.raw_command_digest],
+        ["resolved_command", request.resolved_command_digest === textDigest(request.resolved_command)],
+        ["environment_descriptor", request.environment_binding_digest === request.descriptor.supplied_environment.binding_digest],
+        ["environment", request.environment_binding_digest === actualEnvironmentDigest],
+        ["timeout", request.timeout_ms === request.descriptor.timeout_ms && Number.isSafeInteger(request.timeout_ms) && request.timeout_ms > 0],
+        ["requested_at", request.requested_at === request.descriptor.requested_at],
+        ["network_policy", request.network_policy === request.descriptor.network_mode && (request.network_policy === "allow" || request.network_policy === "deny_all")],
+        ["process_environment", request.inherit_parent_environment === false && request.load_startup_files === false],
+        ["descriptor_environment", request.descriptor.supplied_environment.inherit_parent === false && request.descriptor.supplied_environment.startup_files === false],
+        ["shell", request.descriptor.shell.executable === "bash" && Array.isArray(shellArguments) && canonicalEqual(shellArguments, ["--noprofile", "--norc", "-c"])],
+        ["verifier_identity", typeof request.verifier_id === "string" && request.verifier_id.length > 0],
+        ["command_text", typeof request.resolved_command === "string" && !request.resolved_command.includes("\0")],
+        ["cwd", typeof request.cwd === "string" && isAbsolute(request.cwd)],
+        ["cwd_digest", request.cwd_identity.absolute_path_digest === textDigest(request.cwd)],
+        ["cwd_descriptor", canonicalEqual(request.cwd_identity, request.descriptor.cwd)],
+        ["environment_shape", environmentIsValid && canonicalEqual(request.descriptor.supplied_environment.variable_names, environmentNames)],
+    ];
+    const mismatches = checks.filter(([, passed]) => !passed).map(([name]) => name);
+    if (mismatches.length > 0) {
+        throw new CanonicalRunServiceError("invalid_request", `verifier execution request does not match its canonical descriptor: ${mismatches.join(", ")}`);
+    }
+}
+function frozenAuthorityDescriptor(authorityInstanceId, configurationDigest, platform) {
+    return Object.freeze({
+        schema_version: "intentdna.verifier_execution_authority.v1",
+        authority_instance_id: authorityInstanceId,
+        adapter_kind: platform === "win32" ? "local_windows_job_keeper" : "local_posix_managed_process_group",
+        adapter_version: "v2",
+        configuration_digest: configurationDigest,
+        process_tree_containment: true,
+        network_policies: Object.freeze(["allow"]),
+    });
+}
+function resolveWindowsBash() {
+    const located = spawnSync("where.exe", ["bash.exe"], {
+        encoding: "utf8",
+        env: process.env,
+        windowsHide: true,
+    });
+    if (located.status !== 0) {
+        throw new CanonicalRunServiceError("unsupported", "Windows verifier execution requires a host-installed bash.exe");
+    }
+    const candidate = located.stdout.split(/\r?\n/u).map((line) => line.trim()).find(Boolean);
+    if (candidate === undefined) {
+        throw new CanonicalRunServiceError("unsupported", "Windows verifier bash.exe resolution returned no executable");
+    }
+    return candidate;
+}
+function pinnedShell(platform, resolver) {
+    if (platform !== "win32")
+        return { executable: "bash", identity: { logical_name: "bash" } };
+    const selected = resolver?.(platform) ?? resolveWindowsBash();
+    if (!win32Path.isAbsolute(selected) || !existsSync(selected)) {
+        throw new CanonicalRunServiceError("unsupported", "Windows verifier bash.exe must resolve to an existing absolute path");
+    }
+    const executable = realpathSync(selected);
+    const metadata = statSync(executable);
+    if (!metadata.isFile())
+        throw new CanonicalRunServiceError("unsupported", "Windows verifier bash.exe is not a regular file");
+    return {
+        executable,
+        identity: {
+            real_path_digest: textDigest(executable),
+            content_digest: `sha256:${createHash("sha256").update(readFileSync(executable)).digest("hex")}`,
+            byte_count: metadata.size,
+            modified_at_ms: metadata.mtimeMs,
+        },
+    };
+}
+function verifierIdentity(request) {
+    const token = digest({
+        schema_version: "intentdna.verifier_execution_identity.v1",
+        plan_id: request.plan_id,
+        verifier_id: request.verifier_id,
+        verifier_definition_digest: request.verifier_definition_digest,
+        resolved_command_digest: request.resolved_command_digest,
+        cwd_identity: request.cwd_identity,
+        environment_binding_digest: request.environment_binding_digest,
+        timeout_ms: request.timeout_ms,
+        network_policy: request.network_policy,
+    }).slice("sha256:".length);
+    const namespace = `verifier:${token}`;
+    return {
+        run_id: `${namespace}:run`,
+        step_id: `${namespace}:step`,
+        activation_id: `${namespace}:activation`,
+        attempt_id: `${namespace}:attempt`,
+        execution_claim_epoch: 1,
+        worker_session_id: `${namespace}:authority`,
+        execution_instance_id: `local-verifier:${token}`,
+    };
+}
+function terminalOutcome(result, timeoutMs) {
+    if (result.timedOut)
+        return { kind: "timeout", exit_code: result.status, signal: result.signal, timeout_ms: timeoutMs };
+    if (result.error !== undefined)
+        return { kind: "launch_error", exit_code: null, signal: null, error: result.error.message };
+    if (result.signal !== null)
+        return { kind: "signal", exit_code: null, signal: result.signal };
+    if (result.status === 0)
+        return { kind: "success", exit_code: 0, signal: null };
+    return { kind: "non_zero_exit", exit_code: result.status ?? -1, signal: null };
+}
+function verifierResult(result) {
+    const outcome = result.timedOut
+        ? { kind: "timed_out", exitCode: result.status, signal: result.signal, timedOut: true, launchError: null }
+        : result.error !== undefined
+            ? { kind: "launch_error", exitCode: null, signal: null, timedOut: false, launchError: { code: String(result.error.code ?? "SPAWN_ERROR").toUpperCase().replaceAll(/[^A-Z0-9_]/gu, "_") || "SPAWN_ERROR", messageDigest: textDigest(result.error.message) } }
+            : result.signal !== null
+                ? { kind: "signaled", exitCode: null, signal: result.signal, timedOut: false, launchError: null }
+                : { kind: "exited", exitCode: result.status ?? -1, signal: null, timedOut: false, launchError: null };
+    return {
+        outcome,
+        processTreeDrained: result.processTreeDrained,
+        ...(summarizeCommandEvidence(result.stdout, result.stderr) === undefined ? {} : { evidence: summarizeCommandEvidence(result.stdout, result.stderr) }),
+        startedAt: result.startedAt,
+        completedAt: result.completedAt,
+        stdoutDigest: result.stdoutDigest,
+        stdoutBytes: result.stdoutBytes,
+        stderrDigest: result.stderrDigest,
+        stderrBytes: result.stderrBytes,
+    };
+}
+export class ProductionLocalVerifierExecutionPort {
+    authority_descriptor;
+    authorityDescriptorDigest;
+    authority;
+    shellExecutable;
+    platform;
+    constructor(options) {
+        const platform = options.platform ?? process.platform;
+        this.platform = platform;
+        const shell = pinnedShell(platform, options.resolve_shell_executable);
+        this.shellExecutable = shell.executable;
+        this.authority = new LocalAttemptExecutionAuthority({
+            root_directory: options.root_directory,
+            authority_instance_id: options.authority_instance_id,
+            platform,
+            architecture: options.architecture,
+            helper_path: options.helper_path,
+            expected_digest: options.expected_digest,
+        });
+        const authorityInstanceId = this.authority.authority_instance_id;
+        this.authority_descriptor = frozenAuthorityDescriptor(authorityInstanceId, digest({
+            schema_version: "intentdna.local_verifier_execution_configuration.v2",
+            platform,
+            architecture: options.architecture ?? process.arch,
+            shell: { executable: "bash", arguments: ["--noprofile", "--norc", "-c"], pinned_identity: shell.identity },
+            process_tree_containment: platform === "win32" ? "windows_job_keeper" : "managed_posix_process_group",
+            network_policy: "allow",
+        }), platform);
+        this.authorityDescriptorDigest = digest(this.authority_descriptor);
+    }
+    async execute(request) {
+        assertExecutionRequest(request, this.authorityDescriptorDigest, this.platform);
+        if (request.network_policy !== "allow")
+            throw new CanonicalRunServiceError("unsupported", "local verifier execution cannot enforce deny_all network policy");
+        const authority = this.authority;
+        const identity = verifierIdentity(request);
+        let binding;
+        const startedAt = request.requested_at;
+        const recovered = authority.recoverExecutionForPreparation(identity);
+        if (recovered !== null) {
+            binding = recovered.binding;
+        }
+        else {
+            const prepared = authority.recoverPreparedExecution(identity) ?? authority.prepareExecution(identity);
+            binding = authority.bindExecution(prepared, { started_at: startedAt });
+        }
+        const processResult = await binding.executeProcessTree(this.shellExecutable, ["--noprofile", "--norc", "-c", request.resolved_command], {
+            cwd: request.cwd,
+            env: request.environment,
+            timeoutMs: request.timeout_ms,
+        });
+        if (!processResult.processTreeDrained)
+            throw new CanonicalRunServiceError("verification_failed", "local verifier process tree could not be drained");
+        await binding.processTreeCompleted({
+            started_at: processResult.startedAt,
+            completed_at: processResult.completedAt,
+            outcome: terminalOutcome(processResult, request.timeout_ms),
+            process_id: processResult.processId,
+            process_tree_drained: true,
+        });
+        return {
+            execution: verifierResult(processResult),
+            authority: {
+                authority_instance_id: this.authority_descriptor.authority_instance_id,
+                request_digest: request.request_digest,
+                authority_descriptor_digest: this.authorityDescriptorDigest,
+                launch_descriptor_digest: request.request_digest,
+                process_tree_drained: true,
+                network_enforced: false,
+                enforcement_kind: "not_required",
+                enforcement_digest: null,
+                enforcement_descriptor: null,
+            },
+        };
+    }
+}

package/dist/runtime/local-windows-execution-supervisor-script.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Dependency-free Windows supervisor. The native keeper owns the Job Object;
+ * this process owns durable CAS transitions and the authenticated named pipe.
+ */
+export declare const LOCAL_WINDOWS_EXECUTION_SUPERVISOR_SOURCE: string;
+export declare const LOCAL_WINDOWS_EXECUTION_SUPERVISOR_DIGEST: `sha256:${string}`;