kiokuko-dsh 0.2.7 → 0.2.9

package/dist/dsh/owned-execution.js

@@ -1,3 +1,8 @@
+import { renameSync, openSync, closeSync, writeFileSync, fsyncSync, fchmodSync, rmSync, statSync } from 'node:fs';
+import { assertProtocolRoute, reserveProtocolFile, applyProtocolFile, withProtocolEffect, reserveProtocolTest, authorizeProtocolTest, finishProtocolTest } from './guardrail/service.js';
+import { runProtocolTests } from './guardrail/engine.js';
+import { retainProtocolResult, protocolReceiptUncertain } from './guardrail/evidence.js';
+import { recordOwnedCompletionObservation } from './owned-completion-evidence.js';
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFile, open, rename, mkdir, rm, realpath, stat } from 'node:fs/promises';
@@ -17,14 +22,43 @@ import { shellArguments } from './execution-command.js';
 import { assertCodingDispatch, assertCodingCommandRetry } from './coding-workflow/service.js';
 import { readCodingWorkflow } from './coding-workflow/store.js';
 import { executionRequestAction } from './coding-workflow/intent.js';
+import { withImmediateTransaction } from '../db/transaction.js';
+import { TASK_AUTHORITY, authorizeTaskLease, readTaskSnapshot } from './task-state.js';
+import { captureExecutionTaskLease, withTaskAuthority, currentTaskAuthority, hasNoTaskAuthority, withNoTaskAuthority } from './task-authority-context.js';
 const hash = (data) => createHash('sha256').update(data).digest('hex');
 const within = (root, target) => { const relative = path.relative(root, target); return relative === '' || !relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative); };
 const safeText = (text) => findSecret(text) ? '[redacted secret-bearing text]' : text;
 const ownedCalls = new WeakSet();
 export const isOwnedExecutionCall = (execution) => ownedCalls.has(execution);
+/** Known effect surfaces. Composite Lisp/PTC programs guard their inner calls;
+ * reading, cancellation and pure evaluation do not acquire execution authority. */
+export function taskEffectTool(name, args) {
+    if (name === 'str_replace_editor')
+        return args?.command !== 'view';
+    return ['kioku_write', 'kioku_edit', 'kioku_remove', 'kioku_exec', 'write', 'edit', 'bash', 'spawn', 'fork', 'subagent', 'enno_delegate', 'task_operation'].includes(name);
+}
 const fileInput = z.object({ path: z.string().min(1), content: z.string().optional(), expectedHash: z.string().nullable().optional(), oldText: z.string().optional(), newText: z.string().optional() }).strict();
 const commandInput = z.object({ command: z.string().min(1), cwd: z.string().optional(), shell: z.enum(['bash', 'zsh']).default('bash'), background: z.boolean().default(false), timeoutMs: z.number().int().min(1).max(3600000).default(300000), destructiveTargets: z.array(z.string()).optional() }).strict();
 const resultInput = z.object({ operationId: z.string().min(1), cancel: z.boolean().default(false) }).strict();
+const runtimeServices = new WeakMap();
+/** Host-only stop observation. A crash receipt is not proof of a stopped child. */
+export async function stopTaskOwnedExecutions(runtime, identity, signal) {
+    signal?.throwIfAborted();
+    await Promise.all([...runtimeServices.get(runtime) ?? []].map(service => service.stopTask(identity, signal)));
+    signal?.throwIfAborted();
+    try {
+        return await runtime.withDatabase(db => db.prepare('SELECT receipt_json FROM dsh_owned_operations WHERE run_id=?')
+            .all(identity.taskId).every(row => {
+            const receipt = JSON.parse(row.receipt_json);
+            if (receipt.repositoryRoot !== identity.repositoryRoot || receipt.state === 'started')
+                return false;
+            return receipt.kind !== 'kioku_exec' || receipt.state === 'completed' && receipt.processStopped === true;
+        }));
+    }
+    catch {
+        return false;
+    }
+}
 /** One owner for effects and observed evidence. Saved-result reads never execute an effect. */
 export class OwnedExecutionService {
     host;
@@ -32,13 +66,62 @@ export class OwnedExecutionService {
     #legacyRuns = new Set();
     constructor(host) {
         this.host = host;
+        const services = runtimeServices.get(host.runtime) ?? new Set();
+        services.add(this);
+        runtimeServices.set(host.runtime, services);
     }
     current(execution) {
         execution.signal.throwIfAborted();
         const identity = this.host.resolve(execution);
         if (!identity)
             throw new Error('No current admitted execution owner');
-        return identity;
+        return Object.freeze({ ...identity });
+    }
+    assertAuthority(identity, lease, database) {
+        const current = this.host.resolve({ agent: identity.agent, callId: 'task-authority', name: 'kioku_exec', signal: new AbortController().signal });
+        if (!current || current.runId !== identity.runId || current.sessionId !== identity.sessionId
+            || current.repositoryRoot !== identity.repositoryRoot || current.generation !== identity.generation
+            || lease.taskId !== identity.runId || lease.sessionId !== (identity.workflowSessionId ?? identity.sessionId)
+            || lease.repositoryRoot !== identity.repositoryRoot)
+            throw new KiokukoError('CONFLICT', 'Task execution owner changed');
+        authorizeTaskLease(database, lease);
+    }
+    async checkAuthority(identity, lease) {
+        await this.host.runtime.withDatabase(db => this.assertAuthority(identity, lease, db));
+    }
+    /** The caller may carry an earlier lease (for example an asynchronous Lisp job).
+     * Never replace it with the current task after a stop/resume or owner change. */
+    async captureAuthority(execution, identity = this.current(execution)) {
+        return this.host.runtime.withDatabase(db => {
+            const lease = captureExecutionTaskLease(db, {
+                taskId: identity.runId, sessionId: identity.workflowSessionId ?? identity.sessionId, repositoryRoot: identity.repositoryRoot,
+            }, execution);
+            this.assertAuthority(identity, lease, db);
+            execution[TASK_AUTHORITY] = lease;
+            return lease;
+        });
+    }
+    /** A pure composite may run in any state, but its later inner effects must
+     * retain the task (or absence of one) observed when the composite began. */
+    async composite(execution, next) {
+        if (hasNoTaskAuthority())
+            return withNoTaskAuthority(next);
+        const inherited = execution[TASK_AUTHORITY] ?? currentTaskAuthority();
+        if (inherited)
+            return withTaskAuthority(inherited, next);
+        let lease;
+        try {
+            const identity = this.host.resolve(execution) ?? await this.host.resolveRead?.(execution);
+            if (execution[TASK_AUTHORITY])
+                return withTaskAuthority(execution[TASK_AUTHORITY], next);
+            if (identity)
+                lease = await this.host.runtime.withDatabase(db => {
+                    const task = readTaskSnapshot(db, { taskId: identity.runId, sessionId: identity.workflowSessionId ?? identity.sessionId, repositoryRoot: identity.repositoryRoot });
+                    return { taskId: task.taskId, sessionId: task.sessionId, repositoryRoot: task.repositoryRoot, revision: task.revision, generation: task.generation };
+                });
+        }
+        catch { /* Pure calculations remain available; inner effects fail closed. */ }
+        return lease ? withTaskAuthority(lease, next) : withNoTaskAuthority(next);
     }
     async persist(receipt, digest) {
         const journal = this.journal(receipt.repositoryRoot);
@@ -82,6 +165,8 @@ export class OwnedExecutionService {
             return;
         try {
             await this.host.runtime.withDatabase(db => {
+                const lease = captureExecutionTaskLease(db, { taskId: identity.runId, sessionId: identity.workflowSessionId ?? identity.sessionId, repositoryRoot: identity.repositoryRoot }, execution);
+                this.assertAuthority(identity, lease, db);
                 // Coding checks carry source/config/artifact dependencies. Assessment
                 // invalidates the affected checks instead of discarding unrelated items.
                 if (readCodingWorkflow(db, identity.runId)) {
@@ -94,11 +179,13 @@ export class OwnedExecutionService {
         }
         catch { /* Missing auxiliary evidence never rejects development. */ }
     }
-    async evidence(identity, receipt, command, execute) {
+    async evidence(identity, receipt, command, lease, execute) {
         let completion = false, memory = false;
         let sourcePaths = [];
+        await this.checkAuthority(identity, lease);
         try {
             await this.host.runtime.withDatabase(db => {
+                this.assertAuthority(identity, lease, db);
                 completion = beginTaskCompletionExecution(db, { runId: identity.runId, callId: receipt.operationId, command, repositoryRoot: identity.repositoryRoot, cwd: receipt.cwd });
                 if (completion) {
                     const method = db.prepare(`SELECT b.method_json FROM dsh_completion_executions e JOIN dsh_completion_bindings b
@@ -110,7 +197,7 @@ export class OwnedExecutionService {
         }
         catch { /* Evidence failure is exposed as unknown; effects continue. */ }
         try {
-            memory = await this.host.runtime.withDatabase(db => beginMemoryExecution(db, identity, receipt.operationId, command, receipt.cwd));
+            memory = await this.host.runtime.withDatabase(db => { this.assertAuthority(identity, lease, db); return beginMemoryExecution(db, identity, receipt.operationId, command, receipt.cwd); });
         }
         catch { /* Memory bookkeeping cannot suppress completion observations. */ }
         for (const source of sourcePaths) {
@@ -130,7 +217,8 @@ export class OwnedExecutionService {
         const argv = shellArguments(command);
         const readOnly = argv && ['cat', 'head', 'tail', 'ls', 'pwd', 'wc', 'stat', 'readlink'].includes(path.basename(argv[0] ?? ''));
         if (!completion && !readOnly)
-            await this.unknownEffects({ agent: identity.agent, callId: receipt.operationId, name: 'kioku_exec', signal: new AbortController().signal });
+            await this.unknownEffects({ agent: identity.agent, callId: receipt.operationId, name: 'kioku_exec', signal: new AbortController().signal, [TASK_AUTHORITY]: lease });
+        await this.checkAuthority(identity, lease);
         const result = await execute();
         for (const target of receipt.targets) {
             try {
@@ -145,36 +233,41 @@ export class OwnedExecutionService {
                 }
             }
         }
-        if (this.host.resolve({ agent: identity.agent, callId: receipt.operationId, name: 'kioku_exec', signal: new AbortController().signal })?.generation === identity.generation) {
-            try {
-                await this.host.runtime.withDatabase(db => {
-                    if (completion) {
-                        finishTaskCompletionExecution(db, { runId: identity.runId, callId: receipt.operationId, result });
-                        saveTaskCompletionReceipt(db, identity.runId);
-                        const row = db.prepare(`SELECT e.source_digest,e.outcome,b.method_json FROM dsh_completion_executions e
+        try {
+            await this.host.runtime.withDatabase(db => withImmediateTransaction(db, () => {
+                this.assertAuthority(identity, lease, db);
+                if (completion) {
+                    finishTaskCompletionExecution(db, { runId: identity.runId, callId: receipt.operationId, result });
+                    saveTaskCompletionReceipt(db, identity.runId);
+                    const row = db.prepare(`SELECT e.source_digest,e.outcome,b.method_json FROM dsh_completion_executions e
             JOIN dsh_completion_bindings b ON b.run_id=e.run_id AND b.method_digest=e.method_digest WHERE e.run_id=? AND e.call_id=? LIMIT 1`)
-                            .get(identity.runId, receipt.operationId);
-                        if (row) {
-                            const method = JSON.parse(row.method_json);
-                            let postSourceDigest;
-                            try {
-                                postSourceDigest = completionSourceDigest(db, identity.runId, identity.repositoryRoot, method.sourcePaths);
-                            }
-                            catch { /* Missing inputs remain unknown. */ }
-                            receipt.checks = [{ sourcePaths: method.sourcePaths, sourceDigest: row.source_digest, ...(postSourceDigest ? { postSourceDigest } : {}), outcome: row.outcome, assertion: method.assertion }];
-                            receipt.verification = row.outcome === 'passed' ? 'passed' : row.outcome === 'failed' ? 'failed' : 'unknown';
+                        .get(identity.runId, receipt.operationId);
+                    if (row) {
+                        const method = JSON.parse(row.method_json);
+                        let postSourceDigest;
+                        try {
+                            postSourceDigest = completionSourceDigest(db, identity.runId, identity.repositoryRoot, method.sourcePaths);
                         }
+                        catch { /* Missing inputs remain unknown. */ }
+                        receipt.checks = [{ sourcePaths: method.sourcePaths, sourceDigest: row.source_digest, ...(postSourceDigest ? { postSourceDigest } : {}), outcome: row.outcome, assertion: method.assertion }];
+                        receipt.verification = row.outcome === 'passed' ? 'passed' : row.outcome === 'failed' ? 'failed' : 'unknown';
                     }
-                    if (memory)
-                        completeMemoryExecution(db, identity, receipt.operationId, result);
-                });
+                }
+                if (memory)
+                    completeMemoryExecution(db, identity, receipt.operationId, result);
+            }));
+            receipt.authority = 'current';
+        }
+        catch (error) {
+            receipt.verification = 'unknown';
+            try {
+                await this.checkAuthority(identity, lease);
             }
             catch {
-                receipt.verification = 'unknown';
+                receipt.authority = 'stale';
+                receipt.error = safeText(error instanceof Error ? error.message : String(error));
             }
         }
-        else
-            receipt.verification = 'unknown';
         return result;
     }
     async approve(identity, detail, signal) {
@@ -191,7 +284,13 @@ export class OwnedExecutionService {
         return { ...value, receipt, ...(replayed ? { replayed: true } : {}), status: { work: receipt.state, verification: receipt.verification ?? 'unknown', receiptPersistence: receipt.persistence, memoryStorage } };
     }
     async execute(name, raw, execution) {
-        const identity = this.current(execution);
+        const identity = (name === 'kioku_read' || name === 'kioku_result') && this.host.resolveRead
+            ? await this.host.resolveRead(execution).then(value => {
+                execution.signal.throwIfAborted();
+                if (!value)
+                    throw new Error('No current execution result owner');
+                return Object.freeze({ ...value });
+            }) : this.current(execution);
         const action = executionRequestAction(identity.requestIntent, identity.requestIntentContext, name);
         ownedCalls.add(execution);
         if (name === 'kioku_read' || name === 'kioku_result') {
@@ -205,6 +304,7 @@ export class OwnedExecutionService {
         if (name === 'kioku_result')
             return this.result(identity, resultInput.parse(raw));
         const input = name === 'kioku_exec' ? commandInput.parse(raw) : fileInput.parse(raw);
+        const lease = name === 'kioku_read' ? await this.captureAuthority(execution, identity).catch(() => undefined) : await this.captureAuthority(execution, identity);
         if (name !== 'kioku_read') {
             try {
                 await this.host.runtime.withDatabase(db => {
@@ -264,7 +364,7 @@ export class OwnedExecutionService {
             await this.persist(prior, digest);
             return this.reply(prior, {}, true);
         }
-        const receipt = { version: 1, operationId, runId: identity.runId, sessionId: identity.sessionId, generation: identity.generation, kind: name, repositoryRoot: identity.repositoryRoot, cwd: identity.repositoryRoot, targets: [], state: 'started', evidenceRef: `owned:${operationId}`, persistence: 'pending' };
+        const receipt = { version: 1, operationId, runId: identity.runId, sessionId: identity.sessionId, generation: identity.generation, kind: name, repositoryRoot: identity.repositoryRoot, cwd: identity.repositoryRoot, targets: [], state: 'started', evidenceRef: `owned:${operationId}`, persistence: 'pending', ...(lease ? { taskAuthority: Object.freeze({ ...lease }) } : {}) };
         const controller = new AbortController();
         const operation = { digest, receipt, controller };
         // A second concurrent call may have completed the database lookup too.
@@ -304,8 +404,8 @@ export class OwnedExecutionService {
         await this.persist(receipt, digest);
         const done = (async () => {
             try {
-                operation.value = name === 'kioku_exec' ? await this.command(identity, receipt, input, signal)
-                    : await this.file(identity, receipt, name, input, signal);
+                operation.value = name === 'kioku_exec' ? await this.command(identity, receipt, input, signal, lease)
+                    : await this.file(identity, receipt, name, input, signal, lease);
                 receipt.state = 'completed';
             }
             catch (error) {
@@ -315,6 +415,18 @@ export class OwnedExecutionService {
                 receipt.verification = 'unknown';
             }
             await this.persist(receipt, digest);
+            if (name === 'kioku_exec') {
+                try {
+                    await finishProtocolTest(action => this.host.runtime.withDatabase(action), receipt);
+                    await this.host.runtime.withDatabase(db => saveTaskCompletionReceipt(db, identity.runId));
+                }
+                catch (error) {
+                    receipt.verification = 'unknown';
+                    receipt.error = safeText(error instanceof Error ? error.message : String(error));
+                    await this.persist(receipt, digest);
+                }
+            }
+            await this.host.runtime.withDatabase(db => withImmediateTransaction(db, () => recordOwnedCompletionObservation(db, receipt))).catch(() => { });
             return this.reply(receipt, operation.value);
         })();
         operation.done = done;
@@ -322,7 +434,7 @@ export class OwnedExecutionService {
             return this.reply(receipt);
         return done;
     }
-    async file(identity, receipt, name, input, signal) {
+    async file(identity, receipt, name, input, signal, lease) {
         const target = path.resolve(identity.repositoryRoot, input.path);
         // Resolve the parent as well as existing target to identify symlink exits.
         let actual;
@@ -351,8 +463,20 @@ export class OwnedExecutionService {
         await this.persist(receipt, this.#operations.get(receipt.operationId).digest);
         if (input.expectedHash !== undefined && input.expectedHash !== before)
             throw new Error('File changed before the operation');
-        if (name === 'kioku_read')
-            return { content: (await readFile(actual, 'utf8')), hash: before };
+        if (name === 'kioku_read') {
+            const content = await readFile(actual, 'utf8'), observedHash = hash(content);
+            if (lease && observedHash === before) {
+                try {
+                    await this.checkAuthority(identity, lease);
+                    receipt.authority = 'current';
+                    receipt.verification = 'passed';
+                }
+                catch {
+                    receipt.authority = 'stale';
+                }
+            }
+            return { content, hash: observedHash };
+        }
         const disposable = await this.disposable(identity, actual);
         const database = before !== null && (/\.(?:db|sqlite3?)(?:-(?:wal|shm|journal))?$/iu.test(actual) || (await readFile(actual)).subarray(0, 16).equals(Buffer.from('SQLite format 3\0')));
         if (!disposable && (!within(identity.repositoryRoot, actual) || name === 'kioku_remove' || database))
@@ -360,8 +484,11 @@ export class OwnedExecutionService {
         signal.throwIfAborted();
         if (await this.snapshot(actual) !== before)
             throw new Error('File changed during operation approval');
-        if (name === 'kioku_remove')
+        const protocol = await this.host.runtime.withDatabase(db => reserveProtocolFile(db, lease, receipt.operationId, name, actual, this.#operations.get(receipt.operationId).digest));
+        if (name === 'kioku_remove') {
+            await this.checkAuthority(identity, lease);
             await rm(actual, { recursive: false, force: false });
+        }
         else {
             const existing = before === null ? '' : await readFile(actual, 'utf8');
             let content = input.content;
@@ -372,30 +499,61 @@ export class OwnedExecutionService {
             }
             if (content === undefined)
                 throw new Error('Write content is required');
-            await mkdir(path.dirname(actual), { recursive: true });
-            const mode = before === null ? 0o644 : (await stat(actual)).mode;
-            const temporary = path.join(path.dirname(actual), `.kioku-${randomUUID()}.tmp`);
-            try {
-                const file = await open(temporary, 'wx', mode);
+            if (protocol && Buffer.byteLength(content) > 8 * 1024 * 1024)
+                throw new Error('Protocol file byte limit');
+            if (protocol) {
+                // Existing parents were bound at enrollment. Stage and commit inside the same final
+                // synchronous authority boundary; cancellation committed before it prevents all writes.
+                await this.host.runtime.withDatabase(db => applyProtocolFile(db, lease, receipt.operationId, signal, () => {
+                    const mode = before === null ? 0o644 : statSync(actual).mode & 0o7777;
+                    const temporary = path.join(path.dirname(actual), `.kioku-${randomUUID()}.tmp`);
+                    try {
+                        const file = openSync(temporary, 'wx', mode);
+                        try {
+                            fchmodSync(file, mode);
+                            writeFileSync(file, content);
+                            fsyncSync(file);
+                        }
+                        finally {
+                            closeSync(file);
+                        }
+                        renameSync(temporary, actual);
+                    }
+                    finally {
+                        rmSync(temporary, { force: true });
+                    }
+                }));
+            }
+            else {
+                await this.checkAuthority(identity, lease);
+                await mkdir(path.dirname(actual), { recursive: true });
+                const mode = before === null ? 0o644 : (await stat(actual)).mode;
+                const temporary = path.join(path.dirname(actual), `.kioku-${randomUUID()}.tmp`);
                 try {
-                    await file.chmod(mode & 0o7777);
-                    await file.writeFile(content);
-                    await file.sync();
+                    const file = await open(temporary, 'wx', mode);
+                    try {
+                        await file.chmod(mode & 0o7777);
+                        await file.writeFile(content);
+                        await file.sync();
+                    }
+                    finally {
+                        await file.close();
+                    }
+                    signal.throwIfAborted();
+                    await this.checkAuthority(identity, lease);
+                    await rename(temporary, actual);
                 }
                 finally {
-                    await file.close();
+                    await rm(temporary, { force: true });
                 }
-                signal.throwIfAborted();
-                await rename(temporary, actual);
-            }
-            finally {
-                await rm(temporary, { force: true });
             }
             if (await this.snapshot(actual) !== hash(content))
                 throw new Error('Written content differs from requested content');
         }
         receipt.targets[0].after = await this.snapshot(actual);
+        await this.checkAuthority(identity, lease);
         receipt.verification = 'passed';
+        receipt.authority = 'current';
         return { applied: true };
     }
     async disposable(identity, target) {
@@ -403,50 +561,78 @@ export class OwnedExecutionService {
             return /^(?:dist|build|target|node_modules)(?:[/\\]|$)/u.test(path.relative(identity.repositoryRoot, target));
         return within(await realpath(tmpdir()), target);
     }
-    async command(identity, receipt, input, signal) {
-        receipt.cwd = await realpath(path.resolve(identity.repositoryRoot, input.cwd ?? '.'));
-        receipt.command = safeText(input.command);
-        receipt.commandDigest = hash(input.command);
-        await this.persist(receipt, this.#operations.get(receipt.operationId).digest);
-        // Known destructive intent gets a concrete review. Unknown arbitrary code
-        // is executed without pretending that static analysis can prove its effects.
-        const argv = shellArguments(input.command);
-        const removals = argv && path.basename(argv[0] ?? '') === 'rm' ? argv.slice(1).filter(arg => arg !== '--' && !arg.startsWith('-')) : undefined;
-        const disposableRemoval = removals?.length && (await Promise.all(removals.map(async (target) => {
-            const absolute = path.resolve(receipt.cwd, target);
-            try {
-                return this.disposable(identity, await realpath(absolute));
-            }
-            catch {
-                return false;
+    async command(identity, receipt, input, signal, lease) {
+        let launchAttempted = false;
+        try {
+            receipt.cwd = await realpath(path.resolve(identity.repositoryRoot, input.cwd ?? '.'));
+            receipt.command = safeText(input.command);
+            receipt.commandDigest = hash(input.command);
+            await this.persist(receipt, this.#operations.get(receipt.operationId).digest);
+            // Known destructive intent gets a concrete review. Unknown arbitrary code
+            // is executed without pretending that static analysis can prove its effects.
+            const argv = shellArguments(input.command);
+            const removals = argv && path.basename(argv[0] ?? '') === 'rm' ? argv.slice(1).filter(arg => arg !== '--' && !arg.startsWith('-')) : undefined;
+            const disposableRemoval = removals?.length && (await Promise.all(removals.map(async (target) => {
+                const absolute = path.resolve(receipt.cwd, target);
+                try {
+                    return this.disposable(identity, await realpath(absolute));
+                }
+                catch {
+                    return false;
+                }
+            }))).every(Boolean);
+            let durableSql = !!(argv && ['sqlite3', 'psql', 'mysql'].includes(path.basename(argv[0] ?? '')) && /\b(?:insert|update|delete|replace|drop|alter|truncate|create)\b/iu.test(argv.slice(1).join(' ')));
+            if (durableSql && path.basename(argv[0]) === 'sqlite3' && argv[1] && !argv[1].startsWith('-')) {
+                const database = path.resolve(receipt.cwd, argv[1]);
+                durableSql = argv[1] !== ':memory:' && await this.snapshot(database) !== null && !await this.disposable(identity, database);
             }
-        }))).every(Boolean);
-        let durableSql = !!(argv && ['sqlite3', 'psql', 'mysql'].includes(path.basename(argv[0] ?? '')) && /\b(?:insert|update|delete|replace|drop|alter|truncate|create)\b/iu.test(argv.slice(1).join(' ')));
-        if (durableSql && path.basename(argv[0]) === 'sqlite3' && argv[1] && !argv[1].startsWith('-')) {
-            const database = path.resolve(receipt.cwd, argv[1]);
-            durableSql = argv[1] !== ':memory:' && await this.snapshot(database) !== null && !await this.disposable(identity, database);
-        }
-        if (input.destructiveTargets?.length || durableSql || removals?.length && !disposableRemoval || !disposableRemoval && /(?:^|[;&|]\s*)(?:rm\s|git\s+(?:reset\s+--hard|clean\s+-[a-z]*f)|(?:drop\s+(?:table|database)|truncate\s+table)\b)/iu.test(input.command))
-            await this.approve(identity, `Command: ${safeText(input.command)}\nCwd: ${receipt.cwd}\nTargets: ${input.destructiveTargets?.join(', ') ?? 'see command'}`, signal);
-        return this.evidence(identity, receipt, input.command, async () => {
-            const result = await runOwnedProcess(input.command, receipt.cwd, input.shell, signal, input.timeoutMs, () => { receipt.processStarted = true; });
-            const output = result.content[0].text;
-            receipt.exitCode = result.value.exitCode;
-            receipt.signal = result.value.signal;
-            receipt.cancelled = result.value.aborted;
-            receipt.timedOut = result.value.timedOut;
-            receipt.processStarted = result.value.processStarted === true;
-            receipt.outputComplete = result.value.outputComplete === true;
-            receipt.observedBytes = Buffer.byteLength(output);
-            receipt.outputDigest = hash(output);
-            if (result.value.summary)
-                receipt.summary = result.value.summary;
-            receipt.verification = result.isError ? 'failed' : 'unknown';
-            const preview = safeText(output).slice(-24000);
-            receipt.displayedBytes = Buffer.byteLength(preview);
-            // Evidence consumes the full output here, before the public preview.
-            return result;
-        }).then(result => ({ exitCode: receipt.exitCode, output: safeText(result.content[0].text).slice(-24000) }));
+            if (input.destructiveTargets?.length || durableSql || removals?.length && !disposableRemoval || !disposableRemoval && /(?:^|[;&|]\s*)(?:rm\s|git\s+(?:reset\s+--hard|clean\s+-[a-z]*f)|(?:drop\s+(?:table|database)|truncate\s+table)\b)/iu.test(input.command))
+                await this.approve(identity, `Command: ${safeText(input.command)}\nCwd: ${receipt.cwd}\nTargets: ${input.destructiveTargets?.join(', ') ?? 'see command'}`, signal);
+            const protocol = await this.host.runtime.withDatabase(db => reserveProtocolTest(db, lease, receipt.operationId, input.command, receipt.cwd));
+            return await this.evidence(identity, receipt, input.command, lease, async () => {
+                signal.throwIfAborted();
+                await this.checkAuthority(identity, lease);
+                launchAttempted = true;
+                const result = protocol
+                    ? await this.host.runtime.withDatabase(db => { const current = authorizeProtocolTest(db, lease, receipt.operationId, signal); return runProtocolTests(current, receipt.operationId, signal, input.timeoutMs, () => { receipt.processStarted = true; }, launch => withProtocolEffect(db, () => { authorizeProtocolTest(db, lease, receipt.operationId, signal); return launch(); })); })
+                    : await runOwnedProcess(input.command, receipt.cwd, input.shell, signal, input.timeoutMs, () => { receipt.processStarted = true; });
+                if (protocol)
+                    retainProtocolResult(receipt, result);
+                const output = result.content[0].text;
+                receipt.exitCode = result.value.exitCode;
+                receipt.signal = result.value.signal;
+                receipt.cancelled = result.value.aborted;
+                receipt.timedOut = result.value.timedOut;
+                receipt.processStarted = result.value.processStarted === true;
+                receipt.processStopped = result.value.processStopped === true;
+                receipt.outputComplete = result.value.outputComplete === true;
+                receipt.observedBytes = Buffer.byteLength(output);
+                receipt.outputDigest = hash(output);
+                if (protocol && protocolReceiptUncertain(receipt))
+                    throw Error('Protocol launch transaction outcome is uncertain; reconcile the pending operation before explicit resume/rebind');
+                if (result.value.summary)
+                    receipt.summary = result.value.summary;
+                receipt.verification = result.isError ? 'failed' : 'unknown';
+                const preview = safeText(output).slice(-24000);
+                receipt.displayedBytes = Buffer.byteLength(preview);
+                // Evidence consumes the full output here, before the public preview.
+                return result;
+            }).then(result => ({ exitCode: receipt.exitCode, output: safeText(result.content[0].text).slice(-24000) }));
+        }
+        catch (error) {
+            // Before the only launch boundary, cancellation proves that no child ran.
+            // Once launch was attempted, preserve unknown outcomes and reconcile them.
+            if (!signal.aborted || launchAttempted)
+                throw error;
+            receipt.processStarted = false;
+            receipt.processStopped = true;
+            receipt.cancelled = true;
+            receipt.exitCode = null;
+            receipt.signal = null;
+            receipt.outputComplete = false;
+            receipt.verification = 'failed';
+            return { exitCode: null, output: '' };
+        }
     }
     async result(identity, input) {
         const operation = this.#operations.get(input.operationId);
@@ -470,13 +656,24 @@ export class OwnedExecutionService {
             await this.persist(receipt, journal.digest);
         return this.reply(receipt.state === 'started' ? { ...receipt, state: 'unknown', error: 'Host restarted before final process result was saved; effects will not be replayed.' } : receipt);
     }
-    async close() { for (const op of this.#operations.values())
-        op.controller.abort(); await Promise.allSettled([...this.#operations.values()].map(op => op.done)); }
+    async stopTask(identity, signal) {
+        const operations = [...this.#operations.values()].filter(op => op.receipt.runId === identity.taskId && op.receipt.repositoryRoot === identity.repositoryRoot);
+        for (const operation of operations)
+            operation.controller.abort();
+        await Promise.allSettled(operations.map(operation => operation.done));
+        signal?.throwIfAborted();
+    }
+    async close() {
+        for (const op of this.#operations.values())
+            op.controller.abort();
+        await Promise.allSettled([...this.#operations.values()].map(op => op.done));
+        runtimeServices.get(this.host.runtime)?.delete(this);
+    }
 }
 /** Normal user environment, process group cancellation, bounded complete output. */
 export function runOwnedProcess(command, cwd, shell, signal, timeoutMs, onStarted) {
     if (signal.aborted)
-        return Promise.resolve(observeProcessResult({ isError: true, value: { exitCode: null, signal: null, timedOut: false, aborted: true, processStarted: false, outputComplete: false }, content: [{ type: 'text', text: '' }] }));
+        return Promise.resolve(observeProcessResult({ isError: true, value: { exitCode: null, signal: null, timedOut: false, aborted: true, processStarted: false, processStopped: true, outputComplete: false }, content: [{ type: 'text', text: '' }] }));
     return new Promise(resolve => {
         const env = { ...process.env };
         delete env.NODE_TEST_CONTEXT;
@@ -519,12 +716,14 @@ export function runOwnedProcess(command, cwd, shell, signal, timeoutMs, onStarte
             clearTimeout(timer);
             signal.removeEventListener('abort', abort);
             const output = Buffer.concat(chunks).toString('utf8') + (error ? `\n${error}` : '');
+            let processStopped = false;
             try {
                 const reported = terminal.trim().split('\n').map(line => JSON.parse(line)).find(item => item.kind === 'completed' || item.kind === undefined);
-                if (!reported)
+                if (!reported || reported.processStarted !== true || !(reported.exitCode === null || Number.isInteger(reported.exitCode)) || !(reported.signal === null || typeof reported.signal === 'string'))
                     throw new Error('Missing completion');
                 exitCode = reported.exitCode;
                 termSignal = reported.signal;
+                processStopped = true;
             }
             catch {
                 error ||= 'Missing final process report';
@@ -532,7 +731,7 @@ export function runOwnedProcess(command, cwd, shell, signal, timeoutMs, onStarte
             const outputComplete = !capped && !error && !timedOut && !signal.aborted && !termSignal;
             const summary = outputComplete ? parseTestSummary(output, true) : undefined;
             resolve(observeProcessResult({ isError: exitCode !== 0 || !!termSignal || timedOut || signal.aborted || capped || !!error,
-                value: { exitCode, signal: termSignal, timedOut, aborted: signal.aborted, processStarted, outputComplete, ...(summary ? { summary } : {}) }, content: [{ type: 'text', text: output }] }));
+                value: { exitCode, signal: termSignal, timedOut, aborted: signal.aborted, processStarted, processStopped, outputComplete, ...(summary ? { summary } : {}) }, content: [{ type: 'text', text: output }] }));
         });
     });
 }
@@ -547,12 +746,37 @@ export function mountOwnedExecution(ctx, host) {
             parameters: JSON.parse(JSON.stringify(z.toJSONSchema(name === 'kioku_exec' ? commandInput : name === 'kioku_result' ? resultInput : fileInput))),
             output: { schema: {}, render: (_, value) => [{ type: 'text', text: JSON.stringify(value) }] }, execute }));
     }
-    if (ctx.on && ctx.tools.get)
-        disposers.push(ctx.on('tools/pre-execute', (execution, next) => {
-            if (implementations.has(ctx.tools.get(execution.name, execution.agent)?.execute))
+    if (ctx.on)
+        disposers.push(ctx.on('tools/pre-execute', async (execution, next) => {
+            if (implementations.has(ctx.tools.get?.(execution.name, execution.agent)?.execute))
                 ownedCalls.add(execution);
-            return next();
+            const effect = taskEffectTool(execution.name, execution.arguments) && host.isTaskControl?.(execution) !== true;
+            // Pin an admitted owner before an approval can await a human. On-demand
+            // admission without a task is allowed to finish before the first capture.
+            if (effect && host.resolve(execution))
+                await service.captureAuthority(execution);
+            const decision = await next();
+            if (decision?.kind === 'deny')
+                return decision;
+            if (effect && host.isTaskControl?.(execution) !== true && host.unownedNative?.(execution) !== true)
+                await service.captureAuthority(execution);
+            return decision;
         }, { prepend: true }));
+    if (ctx.on)
+        disposers.push(ctx.on('tools/execute', async (execution, next) => {
+            if (host.isTaskControl?.(execution) === true)
+                return next();
+            if (execution.name === 'bash' && host.unownedNative?.(execution) === true)
+                return withNoTaskAuthority(next);
+            if (execution.name === 'run_code')
+                return service.composite(execution, next);
+            if (!taskEffectTool(execution.name, execution.arguments))
+                return next();
+            const lease = await service.captureAuthority(execution);
+            await host.runtime.withDatabase(db => assertProtocolRoute(db, lease, execution.name, isOwnedExecutionCall(execution)));
+            execution.signal.throwIfAborted();
+            return withTaskAuthority(lease, next);
+        }));
     if (ctx.on)
         disposers.push(ctx.on('tools/pre-execute', async (execution, next) => {
             if (['lisp_eval', 'lisp_call', 'lisp_define', 'lisp_hot_install', 'lisp_hot_call'].includes(execution.name))