mtech-ai-local-runner 0.1.110 → 0.1.112

package/README.md

@@ -1,3 +1,33 @@
+## 0.1.112: a failed Claude job says why it stopped
+
+When a Claude job fails, the runner now tells the Gateway why, as one code: `auth` (the Claude account's sign-in was
+refused or expired), `usage_limit`, `model_unavailable`, `rate_limited`, `provider_error`, `budget_exceeded`,
+`cli_error` or `unknown` (Gateway Work Item 2ee28765). The Sentry "AI fix failed" card then says, for example, "Claude
+stopped before the first answer: usage limit reached on the runner's Claude account." The runner reads only the Claude
+CLI's error kind and HTTP status; it never sends the CLI's own text. If the card says `auth`, sign Claude in again on
+this Mac (or renew the runner's token with `setup --claude-token`) and retry.
+
+0.1.112 also carries the D4 work merged after 0.1.111 (PRs #943, #949, #957). Reviewed-host registration stays empty,
+so D4 execution stays closed.
+
+## 0.1.111: Work Rooms in the menu bar app
+
+The menu bar window now has a **Rooms** tab (Gateway Work Item b35d65cb); the menu's **Show Rooms (n unread)…** opens
+it. Pick a Room, then a thread: it shows the newest 20 messages and every unread one, with unread ones marked.
+**Mark read (n)** marks them read. Write a reply and press **Review reply**; it is posted only after you confirm the
+members it goes to ("Post to 3 members: …?"). If the members changed meanwhile, the window shows the new list and asks
+again. A Room notice opens the Rooms tab at that Room while the runner is connected.
+
+- For the Rooms tab the runner calls only `work_room_read`, `work_room_receipt_report` and `work_room_write` operation
+  `post`, one at a time, with your own runner sign-in. Room creation, members, new threads and outcome shares stay in
+  your AI session; archived Rooms are read-only.
+- Room names, titles and messages stay in memory: neither the runner nor the app writes them to disk or a log.
+  Notifications stay generic.
+- A reply is at most 8,000 bytes, the Gateway's own limit.
+
+0.1.111 also carries the D4 bounded CLI review wiring merged after 0.1.110 (PR #938). Nothing supplies a D4 execution
+host yet, so D4 execution stays closed.
+
 ## 0.1.110: Claude returns its report through `--json-schema`
 
 Claude jobs now pass `--json-schema`, and the model returns its completion report by calling Claude Code's

package/dist/src/adapters/claude-code/adapter.js

@@ -1,4 +1,4 @@
-import { assertD4PackageLimitSupport, assertCurrentD4LimitSupport } from '../../safety/d4-execution-limits.js';
+import { assertD4PackageLimitSupport, assertCurrentD4LimitSupport, D4ObservedLimitWatchdog, D4CliUsageTracker } from '../../safety/d4-execution-limits.js';
 import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from "../../safety/claude-runner-token.js";
 import { candidateReviewCompletion } from '../../safety/candidate-review-report.js';
 import path from "node:path";
@@ -7,6 +7,7 @@ import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCa
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
+import { runtimeFailure } from "../runtime-failure.js";
 import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 import { compilePrompt } from "./prompt-compiler.js";
 import { CLAUDE_COMPLETION_SCHEMA } from "../completion-report.js";
@@ -104,6 +105,9 @@ export class ClaudeCodeAdapter {
     started = false;
     p1 = false;
     candidateReview = false;
+    d4Limits;
+    d4Guard;
+    d4Usage = new D4CliUsageTracker();
     startupAcquisition;
     revokedTools;
     revokeFailed = false;
@@ -135,7 +139,9 @@ export class ClaudeCodeAdapter {
         let acquired;
         this.startupAcquisition = new Promise(resolve => { acquired = resolve; });
         try {
-            assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+            this.d4Limits = assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+            if (this.d4Limits && !this.options.d4ExecutionHost)
+                throw Error('D4_REVIEW_HOST_REQUIRED');
             const generation = ctx.generation;
             if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
                 throw new Error("JOB_SECURITY_REJECTED");
@@ -160,8 +166,26 @@ export class ClaudeCodeAdapter {
             assertAdmission();
             const toolInventory = claudeJobToolInventory(this.options.securityPolicy);
             this.candidateReview = toolInventory === 'local-tools-d4-review-v1';
-            if (this.candidateReview)
+            if (this.candidateReview && !this.d4Limits)
                 assertCurrentD4LimitSupport();
+            if (this.d4Limits && !this.candidateReview)
+                throw Error('D4_REVIEW_INVENTORY_REJECTED');
+            const assertD4Host = async () => {
+                if (!this.d4Limits)
+                    return;
+                // Recheck both immutable packages around asynchronous preparation; equality alone is not host authority.
+                assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+                const descriptor = ctx.approvedTaskPackage.candidate_review_execution;
+                const profile = descriptor.profile, host = this.options.d4ExecutionHost;
+                if (ctx.generation !== 1 || resolvedModelId !== profile.model_id || host.runnerReleaseSha256 !== profile.runner_release_sha256 || host.hostPolicySha256 !== profile.host_policy_sha256
+                    || this.options.securityPolicy?.pin.toolsSha256 !== profile.tools_sha256 || this.options.securityPolicy?.pin.requirementsSha256 !== profile.cli_security_fingerprint
+                    || this.options.securityPolicy?.pin.securityMode !== CLAUDE_RELEASE_MODE)
+                    throw Error('D4_REVIEW_HOST_REQUIRED');
+                await host.assertCurrent(structuredClone(descriptor), { jobId: this.options.jobId ?? ctx.bindingId, bindingId: ctx.bindingId, generation: ctx.generation,
+                    launchFingerprint: ctx.securityBinding?.launchFingerprint ?? '', contractFingerprint: ctx.securityBinding?.contractFingerprint ?? '', taskPackageFingerprint: ctx.securityBinding?.taskPackageFingerprint ?? '' });
+            };
+            if (this.d4Limits)
+                await assertD4Host();
             if (!ctx.securityBinding)
                 throw new Error('SECURITY_REQUIREMENTS_REJECTED');
             this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
@@ -171,7 +195,8 @@ export class ClaudeCodeAdapter {
             if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))
                 throw new Error("trusted cwd must live outside the assigned worktree");
             const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
-            if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
+            const recordOnly = !!this.d4Limits && !('max_total_tokens' in this.d4Limits);
+            if (!unbounded && !recordOnly && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
                 throw new Error("refusing to start: no positive remaining contract budget was supplied");
             }
             if (!this.options.worktreeRoot) {
@@ -194,9 +219,9 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
-            const maxBudgetUsd = unbounded
+            const maxBudgetUsd = unbounded || recordOnly
                 ? null
-                : Math.min(this.options.maxBudgetUsd, contractBudget(ctx.taskPackage));
+                : Math.min(this.options.maxBudgetUsd, this.d4Limits && 'max_estimated_cost_microusd' in this.d4Limits ? this.d4Limits.max_estimated_cost_microusd / 1_000_000 : contractBudget(ctx.taskPackage));
             const hookPolicy = buildHookPolicy({
                 taskPackage: ctx.taskPackage,
                 worktreeRoot: this.options.worktreeRoot,
@@ -227,12 +252,43 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error('adapter startup cancelled');
             assertAdmission();
+            if (this.d4Limits)
+                await assertD4Host();
+            if (this.d4Limits)
+                await this.options.assertCurrentInputs?.();
+            if (this.cancelled)
+                throw new Error('adapter startup cancelled');
+            if (this.d4Limits) {
+                assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+                assertAdmission();
+            }
             const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
                 cwd,
                 env,
                 ...(claudeToken === null ? {} : { secretFd3: claudeToken }),
             });
             this.handle = handle;
+            if (this.d4Limits) {
+                this.d4Guard = new D4ObservedLimitWatchdog(this.d4Limits, { revoke: () => {
+                        this.localReadObservations();
+                        this.revokeSecurity();
+                        this.revokeTools(this.tools);
+                        if (this.revokeFailed)
+                            throw Error('D4_STOP_UNCONFIRMED');
+                    } });
+                try {
+                    this.d4Guard.attach(handle);
+                }
+                catch (error) {
+                    // We own this spawn but cannot certify its process group. Stop the child best-effort;
+                    // cleanup remains unconfirmed and must never turn into a passing review.
+                    try {
+                        handle.kill('SIGKILL');
+                    }
+                    catch { /* Preserve the failed ownership proof. */ }
+                    throw error;
+                }
+            }
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             handle.stdin.write(claudeUserInput(prompt));
@@ -256,8 +312,12 @@ export class ClaudeCodeAdapter {
             exitInfo.signal = signal;
         });
         let sawTerminal = false;
+        // The CLI names an API error's kind on the assistant message before the result (stream-parser.ts); a later
+        // assistant message without one replaces it.
+        let assistantError;
         try {
-            for await (const line of handle.stdout) {
+            const lines = this.d4Guard ? this.d4Lines(handle, this.d4Guard) : handle.stdout;
+            for await (const line of lines) {
                 let message;
                 try {
                     const value = JSON.parse(line);
@@ -271,7 +331,32 @@ export class ClaudeCodeAdapter {
                 // A nested agent message is not evidence that the executor has finished.
                 if (message.parent_tool_use_id != null)
                     continue;
-                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1 });
+                if (this.d4Guard && message.type === 'assistant') {
+                    const observed = this.d4Usage.assistant(message);
+                    if (observed) {
+                        await this.d4Guard.observe(observed);
+                        if (this.d4Guard.diagnostic().status !== 'active') {
+                            yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+                            return;
+                        }
+                    }
+                }
+                let d4Usage;
+                if (this.d4Guard && message.type === 'result') {
+                    try {
+                        d4Usage = this.d4Usage.final(message);
+                        await this.d4Guard.complete(d4Usage);
+                    }
+                    catch (error) {
+                        if (this.d4Guard.diagnostic().status === 'active')
+                            await this.d4Guard.complete().catch(() => { });
+                        yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+                        return;
+                    }
+                }
+                if (message.type === "assistant")
+                    assistantError = typeof message.error === "string" ? message.error : undefined;
+                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1, assistantError });
                 if (!parsed)
                     continue;
                 if (parsed.eventType === "completed") {
@@ -279,6 +364,8 @@ export class ClaudeCodeAdapter {
                     parsed = structuredCompletionEvent(message, parsed.payload?.cost_usd);
                     if (this.candidateReview)
                         parsed = candidateReviewCompletion(parsed);
+                    if (d4Usage)
+                        parsed = { ...parsed, payload: { ...parsed.payload, d4_usage: { ...d4Usage, policy: this.d4Limits && 'max_total_tokens' in this.d4Limits ? 'observed_stop_possible_overshoot' : 'record_only' } } };
                     if (this.p1)
                         parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }
@@ -291,14 +378,24 @@ export class ClaudeCodeAdapter {
                 }
             }
             if (!sawTerminal) {
-                yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
+                yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})`,
+                    payload: { runtime_failure: runtimeFailure("cli_error") } };
             }
         }
+        catch (error) {
+            if (!this.d4Guard)
+                throw error;
+            if (this.d4Guard.diagnostic().status === 'active')
+                await this.d4Guard.complete().catch(() => { });
+            yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+        }
         finally {
             await this.cleanup();
         }
     }
     async command(command) {
+        if (this.candidateReview)
+            throw Error('D4_SUPERVISOR_CONTINUATION_REJECTED');
         if (!ALLOWED_SUPERVISOR_COMMANDS.has(command.command)) {
             throw new Error(`unsupported supervisor command: ${command.command} is not allowed for this adapter`);
         }
@@ -394,7 +491,9 @@ export class ClaudeCodeAdapter {
                 failed = true;
             }
             try {
-                if (handle?.terminateOwned)
+                if (this.d4Guard)
+                    await this.d4Guard.cancel();
+                else if (handle?.terminateOwned)
                     await handle.terminateOwned();
                 else
                     handle?.kill('SIGKILL');
@@ -415,6 +514,18 @@ export class ClaudeCodeAdapter {
             this.cleanupPromise = operation;
         return operation;
     }
+    /** Race a silent CLI against the owned watchdog; stop evidence never depends on another stdout line. */
+    async *d4Lines(handle, guard) {
+        const iterator = handle.stdout[Symbol.asyncIterator]();
+        for (;;) {
+            const next = await Promise.race([iterator.next(), guard.stopped().then(() => null)]);
+            if (next === null)
+                throw Error(guard.diagnostic().reason_code ?? 'D4_STOP_UNCONFIRMED');
+            if (next.done)
+                return;
+            yield next.value;
+        }
+    }
     /** Claude Code treats a hook it cannot run as no objection, so the hook runs through Node. */
     requireTrustedHookCommand() {
         return formatHookCommand({

package/dist/src/adapters/claude-code/runtime-options.js

@@ -73,6 +73,7 @@ export function createClaudeCodeAdapterOptions(input) {
         throw new Error('Claude account configuration path must be absolute');
     const tokenStore = new ClaudeRunnerTokenStore({ stateRoot: state });
     return {
+        d4ExecutionHost: input.d4ExecutionHost,
         processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, claudeToken: () => tokenStore.load(), keychainStub: () => ensureClaudeKeychainStub(state), get securityPolicy() { return securityPolicy; },
         ...(input.securityHost ? { prepareSecurity: async (ctx) => {
                 try {

package/dist/src/adapters/claude-code/stream-parser.js

@@ -1,6 +1,7 @@
 import { isAbsolute, relative, resolve } from "node:path";
 import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
 import { p1ModelEvent } from '../../verification/p1-execution-host.js';
+import { runtimeFailure } from "../runtime-failure.js";
 const EDIT_TOOL_NAMES = new Set(["Edit", "Write", "MultiEdit"]);
 function bounded(summary) {
     return summary.length > MAX_EVENT_SUMMARY_CHARS ? summary.slice(0, MAX_EVENT_SUMMARY_CHARS) : summary;
@@ -69,7 +70,66 @@ function parseSystemMessage(message) {
     }
     return null;
 }
-function parseResultMessage(message) {
+/*
+ * How Claude Code 2.1.308 (the listed release) says why a turn failed. An API error comes as a top-level assistant
+ * message with `error`, a coarse kind such as "authentication_failed", then a result with subtype "success",
+ * is_error true, `api_error_status` and, for some causes, `api_error`, a finer kind such as "usage_limit_reached".
+ * The CLI's own stops end with an error_* subtype. Only these identifiers and the status are read; the result text and
+ * `errors` hold provider wording and are never copied. Kinds this table does not name fall through to the status.
+ */
+const AUTH_KINDS = new Set(["authentication_failed", "oauth_org_not_allowed", "account_on_hold", "verification_required",
+    "cloud_credential_error"]);
+const AUTH_API_ERRORS = new Set(["invalid_credential_header", "org_disabled_credential", "api_key_auth_disabled",
+    "provider_credentials", "gateway_signin_required", "gateway_session_expired"]);
+const USAGE_API_ERRORS = new Set(["usage_limit_reached", "model_requires_usage_credits", "long_context_credits_required"]);
+const KIND_CODES = new Map([["billing_error", "usage_limit"], ["rate_limit", "rate_limited"],
+    ["model_not_found", "model_unavailable"], ["overloaded", "provider_error"], ["server_error", "provider_error"],
+    ["max_output_tokens", "cli_error"]]);
+const FAILURE_SUMMARIES = {
+    auth: "execution failed: Claude account sign-in refused",
+    usage_limit: "execution failed: Claude usage limit reached",
+    model_unavailable: "execution failed: model unavailable to the Claude account",
+    rate_limited: "execution failed: rate limited",
+    provider_error: "execution failed: provider API error",
+    budget_exceeded: "execution failed: budget exceeded",
+    cli_error: "execution failed: Claude CLI error",
+    unknown: "execution failed",
+};
+/** `assistantError` is the `error` of the last top-level assistant message before this result, if it had one. */
+export function classifyClaudeFailure(message, assistantError) {
+    const subtype = String(message.subtype ?? "");
+    // The CLI ended the turn itself; no API error can be the cause.
+    if (subtype === "error_max_budget_usd" || subtype === "error_max_budget_exceeded")
+        return "budget_exceeded";
+    if (subtype === "error_max_turns")
+        return "cli_error";
+    const apiError = typeof message.api_error === "string" ? message.api_error : "";
+    if (AUTH_API_ERRORS.has(apiError))
+        return "auth";
+    if (USAGE_API_ERRORS.has(apiError))
+        return "usage_limit";
+    const kind = assistantError ?? "";
+    if (AUTH_KINDS.has(kind))
+        return "auth";
+    const mapped = KIND_CODES.get(kind);
+    if (mapped)
+        return mapped;
+    const status = message.api_error_status;
+    if (status === 401 || status === 403)
+        return "auth";
+    if (status === 402)
+        return "usage_limit";
+    if (status === 404)
+        return "model_unavailable";
+    if (status === 429)
+        return "rate_limited";
+    if (typeof status === "number" && Number.isInteger(status) && status >= 500 && status <= 599)
+        return "provider_error";
+    if (kind === "invalid_request" || subtype === "error_during_execution" || message.terminal_reason === "turn_setup_failed")
+        return "cli_error";
+    return "unknown";
+}
+function parseResultMessage(message, assistantError) {
     const isError = message.is_error === true;
     const costUsd = typeof message.total_cost_usd === "number" ? message.total_cost_usd : undefined;
     if (!isError) {
@@ -90,8 +150,9 @@ function parseResultMessage(message) {
         return { eventType: "failed", summary: "execution failed: structured output missing",
             payload: { ...(costUsd !== undefined ? { cost_usd: costUsd } : {}), completion_rejection: { version: "completion-rejection-v1", code } } };
     }
-    const summary = subtype === "error_max_budget_exceeded" ? "execution failed: budget exceeded" : "execution failed";
-    return { eventType: "failed", summary, payload: costUsd !== undefined ? { cost_usd: costUsd } : undefined };
+    const code = classifyClaudeFailure(message, assistantError);
+    return { eventType: "failed", summary: FAILURE_SUMMARIES[code],
+        payload: { ...(costUsd !== undefined ? { cost_usd: costUsd } : {}), runtime_failure: runtimeFailure(code, message.api_error_status) } };
 }
 export function parseClaudeLine(line, worktreeRoot, options = {}) {
     let message;
@@ -110,7 +171,7 @@ export function parseClaudeLine(line, worktreeRoot, options = {}) {
             case "user":
                 return parseUserMessage(message.message ?? {});
             case "result":
-                return parseResultMessage(message);
+                return parseResultMessage(message, options.assistantError);
             default:
                 return null;
         }

package/dist/src/adapters/runtime-failure.js

@@ -0,0 +1,34 @@
+/**
+ * Why a provider CLI stopped, as one bounded code (no provider text). The Claude parser sets it on a failed terminal
+ * event; the daemon copies it into the job completion so the Gateway can tell an account problem from a code problem.
+ *
+ * - auth: the CLI's account was signed out, expired or refused.
+ * - usage_limit: the account's usage limit or credit ran out.
+ * - model_unavailable: the account cannot use the requested model.
+ * - rate_limited: the provider throttled the account for a short time.
+ * - provider_error: the provider's API failed or was overloaded.
+ * - budget_exceeded: the job's own cost budget ran out.
+ * - cli_error: the CLI stopped on its own error, not the account's or the provider's.
+ * - unknown: an error the CLI reported without a recognisable kind.
+ */
+export const RUNTIME_FAILURE_CODES = ["auth", "usage_limit", "model_unavailable", "rate_limited", "provider_error",
+    "budget_exceeded", "cli_error", "unknown"];
+export function runtimeFailure(code, httpStatus) {
+    return { version: "runtime-failure-v1", code, ...(isHttpErrorStatus(httpStatus) ? { http_status: httpStatus } : {}) };
+}
+/** The exact v1 shape or undefined; copies nothing else. */
+export function runtimeFailureDiagnostic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const d = value;
+    if (d.version !== "runtime-failure-v1" || !RUNTIME_FAILURE_CODES.includes(d.code))
+        return undefined;
+    if (Object.keys(d).some(key => !["version", "code", "http_status"].includes(key)))
+        return undefined;
+    if (d.http_status !== undefined && !isHttpErrorStatus(d.http_status))
+        return undefined;
+    return runtimeFailure(d.code, d.http_status);
+}
+function isHttpErrorStatus(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599;
+}

package/dist/src/daemon/execution-coordinator.js

@@ -1,6 +1,8 @@
 import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
+import { runtimeFailureDiagnostic } from '../adapters/runtime-failure.js';
 import { assertCandidateReviewPackages, candidateReviewReport } from '../safety/candidate-review-report.js';
+import { isD4ExecutionSchema } from '../safety/d4-execution-limits.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
 import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
@@ -178,6 +180,9 @@ export class ExecutionCoordinator {
             assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
             if (executionAttempt && binding.bindingReplayed !== false)
                 throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+            if (isD4ExecutionSchema(pkg.candidate_review_execution?.schema_version)
+                && (job.generation !== 1 || binding.bindingReplayed !== false))
+                throw Error('D4_BINDING_RECONCILIATION_REQUIRED');
             binding = immutable(structuredClone(binding));
             assertCandidateReviewPackages(pkg, binding.taskPackage);
             if (isP1)
@@ -445,8 +450,10 @@ export class ExecutionCoordinator {
             if (isP1 && !hostProof)
                 event = p1ModelEvent(event);
             const previousStage = executionStage;
+            const d4StopAck = isD4ExecutionSchema(job.taskPackage.candidate_review_execution?.schema_version)
+                && ['failed', 'cancelled', 'blocked'].includes(event.eventType);
             let payload = event.payload;
-            if (isTerminalEventType(event.eventType)) {
+            if (isTerminalEventType(event.eventType) && !d4StopAck) {
                 await fenced(observeCleanup());
                 executionStage = 'terminal_evidence';
                 requireControlFence();
@@ -456,6 +463,8 @@ export class ExecutionCoordinator {
                 if (isP1 && event.eventType === 'completed' && p1Result)
                     payload = { ...payload, candidate_commit_sha: p1Result.candidate_commit_sha, snapshot_fingerprint: p1Result.snapshot_fingerprint, changed_paths: p1Result.changed_paths, verification_receipt_ids: [...p1ReceiptIds] };
             }
+            if (d4StopAck)
+                await fenced(observeCleanup());
             // A vendor report cannot supply host observations, even when its shape looks valid.
             if (payload) {
                 payload = { ...payload };
@@ -463,10 +472,10 @@ export class ExecutionCoordinator {
                 delete payload.local_fix_publication;
             }
             // Memory use is bound to this binding's bundle receipt by the runner, never taken from the model (WI 35a84e52).
-            payload = withMemoryUsage(payload, binding.taskPackage, isTerminalEventType(event.eventType));
+            payload = d4StopAck ? undefined : withMemoryUsage(payload, binding.taskPackage, isTerminalEventType(event.eventType));
             if (event.eventType === "completed" && localFixPublication)
                 payload = { ...payload, local_fix_publication: structuredClone(localFixPublication) };
-            if (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict') {
+            if (!d4StopAck && (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict')) {
                 const reads = safeLocalReadObservations(adapter.localReadObservations?.());
                 if (reads)
                     payload = { ...payload, local_read_observations: reads };
@@ -825,6 +834,8 @@ export class ExecutionCoordinator {
         const reportDiagnostic = diagnostic && (status === "blocked"
             ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
         const rejectedCompletion = completionRejectionDiagnostic(terminal.payload?.completion_rejection);
+        // Why the provider CLI stopped, as a bounded code; only on a failed job.
+        const runtimeFailure = status === 'failed' ? runtimeFailureDiagnostic(terminal.payload?.runtime_failure) : undefined;
         const rejectedCounts = reportDiagnostic?.rejection_counts;
         if (rejectedCompletion || rejectedCounts) {
             try {
@@ -834,7 +845,7 @@ export class ExecutionCoordinator {
         }
         const securityReceipt = adapter.securityReceipt?.();
         const reads = safeLocalReadObservations(adapter.localReadObservations?.());
-        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
+        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(runtimeFailure ? { runtime_failure: runtimeFailure } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
             phase: "terminal_pending", bindingId: binding.bindingId, terminalEventType: terminal.eventType,
             completionRequest: structuredClone(completionRequest) });

package/dist/src/daemon/runtime.js

@@ -1,3 +1,5 @@
+import { composeReviewedD4Host } from '../safety/d4-host-composition.js';
+import { protocolHash } from '../publication/candidate.js';
 import { createClaudeProductionHost } from '../safety/claude-production-host.js';
 import { adapterStatus } from '../adapters/status.js';
 import { loadInstalledLocalFixHost } from '../publication/installed-host.js';
@@ -15,6 +17,7 @@ import { CodexPlugin } from "../adapters/codex/plugin.js";
 import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
+import { D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
 import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
 import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from "../safety/claude-runner-token.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
@@ -75,6 +78,27 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    // Only this daemon's currently executing claim may revalidate a D4 pre-spawn request.
+    let activeD4Job, activeD4Binding;
+    let d4Host = input.d4ExecutionHost;
+    if (!d4Host) {
+        const composition = await composeReviewedD4Host({ binaryIdentity: () => claude.binaryIdentity(), revalidateJob: async (descriptor, context) => {
+                const job = activeD4Job;
+                if (!job || context.jobId !== job.id || context.bindingId !== activeD4Binding || context.generation !== 1 || job.generation !== 1
+                    || context.launchFingerprint !== job.launchFingerprint || context.contractFingerprint !== job.gatewayContractFingerprint
+                    || context.taskPackageFingerprint !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage) !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage.candidate_review_execution) !== protocolHash(descriptor))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                const { job: current } = await gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken });
+                if (activeD4Job !== job || activeD4Binding !== context.bindingId || current.id !== job.id || current.generation !== 1
+                    || !['claimed', 'shadowing', 'running'].includes(current.status) || !Number.isSafeInteger(current.lease_expires_at)
+                    || current.lease_expires_at <= Math.floor(Date.now() / 1000))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+            } });
+        d4Host = composition.host;
+        process.stderr.write(`${JSON.stringify({ event: 'd4_host', status: composition.status })}\n`);
+    }
     // The menu bar app (Work Item b9218937): counts and clickable notices; osascript stays the fallback.
     let roomActivityEnabled = false;
     const menubar = buildMenubar({ stateRoot: input.stateRoot, home: input.env.HOME ?? "", gatewayMcpUrl: input.gatewayMcpUrl,
@@ -123,6 +147,7 @@ export async function buildDaemon(input) {
             securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
             pullRequestEvidence: (args, signal) => gateway.readPullRequestEvidence(args, signal),
             readCandidateReviewContext: loopId => gateway.readCandidateReviewContext(loopId),
+            d4ExecutionHost: d4Host,
         }),
     });
     const codex = new CodexPlugin({
@@ -154,10 +179,15 @@ export async function buildDaemon(input) {
             shadow: (job, signal) => gateway.localJobShadow({ workLoopId: job.workLoopId,
                 contractFingerprint: job.gatewayContractFingerprint ?? "",
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
-            createBinding: async (job, signal) => gateway.createLocalJobBinding({
-                jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
-            }, signal),
+            createBinding: async (job, signal) => {
+                const binding = await gateway.createLocalJobBinding({
+                    jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
+                    launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
+                }, signal);
+                if (activeD4Job?.id === job.id)
+                    activeD4Binding = binding.bindingId;
+                return binding;
+            },
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
             confirmServerPublicationCompletion: (bindingId, cursor, job, receipt) => gateway.confirmServerPublicationCompletion(bindingId, cursor, job, receipt),
@@ -219,7 +249,22 @@ export async function buildDaemon(input) {
             return { status: "claimed", job };
         },
         execute: async (job) => {
-            await coordinator.execute(job);
+            const claimed = job;
+            if (claimed.taskPackage.candidate_review_execution) {
+                if (activeD4Job)
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                activeD4Job = structuredClone(claimed);
+                activeD4Binding = undefined;
+                try {
+                    await coordinator.execute(claimed);
+                }
+                finally {
+                    activeD4Job = undefined;
+                    activeD4Binding = undefined;
+                }
+            }
+            else
+                await coordinator.execute(claimed);
         },
         requestSync: reason => { transport?.requestSync(reason); },
         // Until now the heartbeat said this runner takes no jobs; tell the Gateway at once, and ask whether one waits.
@@ -296,10 +341,16 @@ export async function buildDaemon(input) {
             }
             const askInbox = await asks.advertisement();
             const guidance = await guide.advertisement();
+            let d4Ready;
+            try {
+                if (d4Host && (!d4Host.ready || await d4Host.ready()))
+                    d4Ready = d4Host;
+            }
+            catch { /* D4 readiness never disables other workflows. */ }
             return {
                 deviceFingerprint: runnerDeviceFingerprint(input.gatewayMcpUrl),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])]), poller.accepting),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], d4Ready), poller.accepting),
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
@@ -462,12 +513,14 @@ export async function reconcilePreparationState(previous, deps) {
     return true;
 }
 /** Vendor capability text cannot claim a host-owned publication facility. */
-export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode, pullRequestEvidenceAdapters = []) {
+export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode, pullRequestEvidenceAdapters = [], d4Host) {
+    if (d4Host && (!/^[a-f0-9]{64}$/.test(d4Host.runnerReleaseSha256) || !/^[a-f0-9]{64}$/.test(d4Host.hostPolicySha256) || typeof d4Host.assertCurrent !== 'function'))
+        throw Error('D4_REVIEW_HOST_REQUIRED');
     const modes = verificationMode === undefined ? [] : typeof verificationMode === 'string' ? [verificationMode] : verificationMode;
     return probes.map(probe => {
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
-        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1');
+        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY && value !== D4_RECORDED_EXECUTION_CAPABILITY);
         if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
             if (modes.includes('gateway_ci_v1'))
@@ -478,6 +531,9 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
         // The host owns the Gateway call behind local_pull_request_read, so only the host can claim it (Work Decision 842179e6).
         if (authenticated && pullRequestEvidenceAdapters.includes(probe.id))
             capabilities.push('pull_request_evidence_v1');
-        return { adapter: probe.id, version: probe.version, ...status, capabilities };
+        const d4 = authenticated && probe.id === 'claude_code_cli' && d4Host;
+        if (d4)
+            capabilities.push(...(d4.capabilities ?? [D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY]));
+        return { adapter: probe.id, version: probe.version, ...status, capabilities, ...(d4 ? { runner_release_sha256: d4.runnerReleaseSha256, host_policy_sha256: d4.hostPolicySha256 } : {}) };
     });
 }