mtech-ai-local-runner 0.1.111 → 0.1.112

package/README.md

@@ -1,3 +1,15 @@
+## 0.1.112: a failed Claude job says why it stopped
+
+When a Claude job fails, the runner now tells the Gateway why, as one code: `auth` (the Claude account's sign-in was
+refused or expired), `usage_limit`, `model_unavailable`, `rate_limited`, `provider_error`, `budget_exceeded`,
+`cli_error` or `unknown` (Gateway Work Item 2ee28765). The Sentry "AI fix failed" card then says, for example, "Claude
+stopped before the first answer: usage limit reached on the runner's Claude account." The runner reads only the Claude
+CLI's error kind and HTTP status; it never sends the CLI's own text. If the card says `auth`, sign Claude in again on
+this Mac (or renew the runner's token with `setup --claude-token`) and retry.
+
+0.1.112 also carries the D4 work merged after 0.1.111 (PRs #943, #949, #957). Reviewed-host registration stays empty,
+so D4 execution stays closed.
+
 ## 0.1.111: Work Rooms in the menu bar app
 
 The menu bar window now has a **Rooms** tab (Gateway Work Item b35d65cb); the menu's **Show Rooms (n unread)…** opens

package/dist/src/adapters/claude-code/adapter.js

@@ -7,6 +7,7 @@ import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCa
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
+import { runtimeFailure } from "../runtime-failure.js";
 import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 import { compilePrompt } from "./prompt-compiler.js";
 import { CLAUDE_COMPLETION_SCHEMA } from "../completion-report.js";
@@ -180,7 +181,8 @@ export class ClaudeCodeAdapter {
                     || this.options.securityPolicy?.pin.toolsSha256 !== profile.tools_sha256 || this.options.securityPolicy?.pin.requirementsSha256 !== profile.cli_security_fingerprint
                     || this.options.securityPolicy?.pin.securityMode !== CLAUDE_RELEASE_MODE)
                     throw Error('D4_REVIEW_HOST_REQUIRED');
-                await host.assertCurrent(structuredClone(descriptor));
+                await host.assertCurrent(structuredClone(descriptor), { jobId: this.options.jobId ?? ctx.bindingId, bindingId: ctx.bindingId, generation: ctx.generation,
+                    launchFingerprint: ctx.securityBinding?.launchFingerprint ?? '', contractFingerprint: ctx.securityBinding?.contractFingerprint ?? '', taskPackageFingerprint: ctx.securityBinding?.taskPackageFingerprint ?? '' });
             };
             if (this.d4Limits)
                 await assertD4Host();
@@ -193,7 +195,8 @@ export class ClaudeCodeAdapter {
             if (!cwd || !path.isAbsolute(cwd) || rel === "" || (!rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel)))
                 throw new Error("trusted cwd must live outside the assigned worktree");
             const unbounded = isUnboundedLocalExecution(ctx.taskPackage);
-            if (!unbounded && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
+            const recordOnly = !!this.d4Limits && !('max_total_tokens' in this.d4Limits);
+            if (!unbounded && !recordOnly && (!Number.isFinite(this.options.maxBudgetUsd) || this.options.maxBudgetUsd <= 0)) {
                 throw new Error("refusing to start: no positive remaining contract budget was supplied");
             }
             if (!this.options.worktreeRoot) {
@@ -216,9 +219,9 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
-            const maxBudgetUsd = unbounded
+            const maxBudgetUsd = unbounded || recordOnly
                 ? null
-                : Math.min(this.options.maxBudgetUsd, this.d4Limits ? this.d4Limits.max_estimated_cost_microusd / 1_000_000 : contractBudget(ctx.taskPackage));
+                : Math.min(this.options.maxBudgetUsd, this.d4Limits && 'max_estimated_cost_microusd' in this.d4Limits ? this.d4Limits.max_estimated_cost_microusd / 1_000_000 : contractBudget(ctx.taskPackage));
             const hookPolicy = buildHookPolicy({
                 taskPackage: ctx.taskPackage,
                 worktreeRoot: this.options.worktreeRoot,
@@ -309,6 +312,9 @@ export class ClaudeCodeAdapter {
             exitInfo.signal = signal;
         });
         let sawTerminal = false;
+        // The CLI names an API error's kind on the assistant message before the result (stream-parser.ts); a later
+        // assistant message without one replaces it.
+        let assistantError;
         try {
             const lines = this.d4Guard ? this.d4Lines(handle, this.d4Guard) : handle.stdout;
             for await (const line of lines) {
@@ -348,7 +354,9 @@ export class ClaudeCodeAdapter {
                         return;
                     }
                 }
-                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1 });
+                if (message.type === "assistant")
+                    assistantError = typeof message.error === "string" ? message.error : undefined;
+                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1, assistantError });
                 if (!parsed)
                     continue;
                 if (parsed.eventType === "completed") {
@@ -357,7 +365,7 @@ export class ClaudeCodeAdapter {
                     if (this.candidateReview)
                         parsed = candidateReviewCompletion(parsed);
                     if (d4Usage)
-                        parsed = { ...parsed, payload: { ...parsed.payload, d4_usage: { ...d4Usage, policy: 'observed_stop_possible_overshoot' } } };
+                        parsed = { ...parsed, payload: { ...parsed.payload, d4_usage: { ...d4Usage, policy: this.d4Limits && 'max_total_tokens' in this.d4Limits ? 'observed_stop_possible_overshoot' : 'record_only' } } };
                     if (this.p1)
                         parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }
@@ -370,7 +378,8 @@ export class ClaudeCodeAdapter {
                 }
             }
             if (!sawTerminal) {
-                yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
+                yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})`,
+                    payload: { runtime_failure: runtimeFailure("cli_error") } };
             }
         }
         catch (error) {

package/dist/src/adapters/claude-code/stream-parser.js

@@ -1,6 +1,7 @@
 import { isAbsolute, relative, resolve } from "node:path";
 import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
 import { p1ModelEvent } from '../../verification/p1-execution-host.js';
+import { runtimeFailure } from "../runtime-failure.js";
 const EDIT_TOOL_NAMES = new Set(["Edit", "Write", "MultiEdit"]);
 function bounded(summary) {
     return summary.length > MAX_EVENT_SUMMARY_CHARS ? summary.slice(0, MAX_EVENT_SUMMARY_CHARS) : summary;
@@ -69,7 +70,66 @@ function parseSystemMessage(message) {
     }
     return null;
 }
-function parseResultMessage(message) {
+/*
+ * How Claude Code 2.1.308 (the listed release) says why a turn failed. An API error comes as a top-level assistant
+ * message with `error`, a coarse kind such as "authentication_failed", then a result with subtype "success",
+ * is_error true, `api_error_status` and, for some causes, `api_error`, a finer kind such as "usage_limit_reached".
+ * The CLI's own stops end with an error_* subtype. Only these identifiers and the status are read; the result text and
+ * `errors` hold provider wording and are never copied. Kinds this table does not name fall through to the status.
+ */
+const AUTH_KINDS = new Set(["authentication_failed", "oauth_org_not_allowed", "account_on_hold", "verification_required",
+    "cloud_credential_error"]);
+const AUTH_API_ERRORS = new Set(["invalid_credential_header", "org_disabled_credential", "api_key_auth_disabled",
+    "provider_credentials", "gateway_signin_required", "gateway_session_expired"]);
+const USAGE_API_ERRORS = new Set(["usage_limit_reached", "model_requires_usage_credits", "long_context_credits_required"]);
+const KIND_CODES = new Map([["billing_error", "usage_limit"], ["rate_limit", "rate_limited"],
+    ["model_not_found", "model_unavailable"], ["overloaded", "provider_error"], ["server_error", "provider_error"],
+    ["max_output_tokens", "cli_error"]]);
+const FAILURE_SUMMARIES = {
+    auth: "execution failed: Claude account sign-in refused",
+    usage_limit: "execution failed: Claude usage limit reached",
+    model_unavailable: "execution failed: model unavailable to the Claude account",
+    rate_limited: "execution failed: rate limited",
+    provider_error: "execution failed: provider API error",
+    budget_exceeded: "execution failed: budget exceeded",
+    cli_error: "execution failed: Claude CLI error",
+    unknown: "execution failed",
+};
+/** `assistantError` is the `error` of the last top-level assistant message before this result, if it had one. */
+export function classifyClaudeFailure(message, assistantError) {
+    const subtype = String(message.subtype ?? "");
+    // The CLI ended the turn itself; no API error can be the cause.
+    if (subtype === "error_max_budget_usd" || subtype === "error_max_budget_exceeded")
+        return "budget_exceeded";
+    if (subtype === "error_max_turns")
+        return "cli_error";
+    const apiError = typeof message.api_error === "string" ? message.api_error : "";
+    if (AUTH_API_ERRORS.has(apiError))
+        return "auth";
+    if (USAGE_API_ERRORS.has(apiError))
+        return "usage_limit";
+    const kind = assistantError ?? "";
+    if (AUTH_KINDS.has(kind))
+        return "auth";
+    const mapped = KIND_CODES.get(kind);
+    if (mapped)
+        return mapped;
+    const status = message.api_error_status;
+    if (status === 401 || status === 403)
+        return "auth";
+    if (status === 402)
+        return "usage_limit";
+    if (status === 404)
+        return "model_unavailable";
+    if (status === 429)
+        return "rate_limited";
+    if (typeof status === "number" && Number.isInteger(status) && status >= 500 && status <= 599)
+        return "provider_error";
+    if (kind === "invalid_request" || subtype === "error_during_execution" || message.terminal_reason === "turn_setup_failed")
+        return "cli_error";
+    return "unknown";
+}
+function parseResultMessage(message, assistantError) {
     const isError = message.is_error === true;
     const costUsd = typeof message.total_cost_usd === "number" ? message.total_cost_usd : undefined;
     if (!isError) {
@@ -90,8 +150,9 @@ function parseResultMessage(message) {
         return { eventType: "failed", summary: "execution failed: structured output missing",
             payload: { ...(costUsd !== undefined ? { cost_usd: costUsd } : {}), completion_rejection: { version: "completion-rejection-v1", code } } };
     }
-    const summary = subtype === "error_max_budget_exceeded" ? "execution failed: budget exceeded" : "execution failed";
-    return { eventType: "failed", summary, payload: costUsd !== undefined ? { cost_usd: costUsd } : undefined };
+    const code = classifyClaudeFailure(message, assistantError);
+    return { eventType: "failed", summary: FAILURE_SUMMARIES[code],
+        payload: { ...(costUsd !== undefined ? { cost_usd: costUsd } : {}), runtime_failure: runtimeFailure(code, message.api_error_status) } };
 }
 export function parseClaudeLine(line, worktreeRoot, options = {}) {
     let message;
@@ -110,7 +171,7 @@ export function parseClaudeLine(line, worktreeRoot, options = {}) {
             case "user":
                 return parseUserMessage(message.message ?? {});
             case "result":
-                return parseResultMessage(message);
+                return parseResultMessage(message, options.assistantError);
             default:
                 return null;
         }

package/dist/src/adapters/runtime-failure.js

@@ -0,0 +1,34 @@
+/**
+ * Why a provider CLI stopped, as one bounded code (no provider text). The Claude parser sets it on a failed terminal
+ * event; the daemon copies it into the job completion so the Gateway can tell an account problem from a code problem.
+ *
+ * - auth: the CLI's account was signed out, expired or refused.
+ * - usage_limit: the account's usage limit or credit ran out.
+ * - model_unavailable: the account cannot use the requested model.
+ * - rate_limited: the provider throttled the account for a short time.
+ * - provider_error: the provider's API failed or was overloaded.
+ * - budget_exceeded: the job's own cost budget ran out.
+ * - cli_error: the CLI stopped on its own error, not the account's or the provider's.
+ * - unknown: an error the CLI reported without a recognisable kind.
+ */
+export const RUNTIME_FAILURE_CODES = ["auth", "usage_limit", "model_unavailable", "rate_limited", "provider_error",
+    "budget_exceeded", "cli_error", "unknown"];
+export function runtimeFailure(code, httpStatus) {
+    return { version: "runtime-failure-v1", code, ...(isHttpErrorStatus(httpStatus) ? { http_status: httpStatus } : {}) };
+}
+/** The exact v1 shape or undefined; copies nothing else. */
+export function runtimeFailureDiagnostic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const d = value;
+    if (d.version !== "runtime-failure-v1" || !RUNTIME_FAILURE_CODES.includes(d.code))
+        return undefined;
+    if (Object.keys(d).some(key => !["version", "code", "http_status"].includes(key)))
+        return undefined;
+    if (d.http_status !== undefined && !isHttpErrorStatus(d.http_status))
+        return undefined;
+    return runtimeFailure(d.code, d.http_status);
+}
+function isHttpErrorStatus(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 400 && value <= 599;
+}

package/dist/src/daemon/execution-coordinator.js

@@ -1,7 +1,8 @@
 import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
+import { runtimeFailureDiagnostic } from '../adapters/runtime-failure.js';
 import { assertCandidateReviewPackages, candidateReviewReport } from '../safety/candidate-review-report.js';
-import { D4_OBSERVED_EXECUTION_SCHEMA } from '../safety/d4-execution-limits.js';
+import { isD4ExecutionSchema } from '../safety/d4-execution-limits.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
 import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
@@ -179,7 +180,7 @@ export class ExecutionCoordinator {
             assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
             if (executionAttempt && binding.bindingReplayed !== false)
                 throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
-            if (pkg.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+            if (isD4ExecutionSchema(pkg.candidate_review_execution?.schema_version)
                 && (job.generation !== 1 || binding.bindingReplayed !== false))
                 throw Error('D4_BINDING_RECONCILIATION_REQUIRED');
             binding = immutable(structuredClone(binding));
@@ -449,7 +450,7 @@ export class ExecutionCoordinator {
             if (isP1 && !hostProof)
                 event = p1ModelEvent(event);
             const previousStage = executionStage;
-            const d4StopAck = job.taskPackage.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+            const d4StopAck = isD4ExecutionSchema(job.taskPackage.candidate_review_execution?.schema_version)
                 && ['failed', 'cancelled', 'blocked'].includes(event.eventType);
             let payload = event.payload;
             if (isTerminalEventType(event.eventType) && !d4StopAck) {
@@ -833,6 +834,8 @@ export class ExecutionCoordinator {
         const reportDiagnostic = diagnostic && (status === "blocked"
             ? diagnostic.code === "CODEX_COMPLETION_REPORT_BLOCKED" : diagnostic.code !== "CODEX_COMPLETION_REPORT_BLOCKED") ? diagnostic : undefined;
         const rejectedCompletion = completionRejectionDiagnostic(terminal.payload?.completion_rejection);
+        // Why the provider CLI stopped, as a bounded code; only on a failed job.
+        const runtimeFailure = status === 'failed' ? runtimeFailureDiagnostic(terminal.payload?.runtime_failure) : undefined;
         const rejectedCounts = reportDiagnostic?.rejection_counts;
         if (rejectedCompletion || rejectedCounts) {
             try {
@@ -842,7 +845,7 @@ export class ExecutionCoordinator {
         }
         const securityReceipt = adapter.securityReceipt?.();
         const reads = safeLocalReadObservations(adapter.localReadObservations?.());
-        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
+        const completionRequest = structuredClone({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, status, result: { binding_id: binding.bindingId, event_type: terminal.eventType, summary: terminal.summary, ...(localFixPublication ? { local_fix_publication: structuredClone(localFixPublication) } : {}), ...(reason ? { reason } : {}), ...(reads ? { local_read_observations: reads } : {}), ...(failureDiagnostic ? { execution_failure: { ...failureDiagnostic } } : {}), ...(reportDiagnostic ? { completion_report: reportDiagnostic } : {}), ...(rejectedCompletion ? { completion_rejection: rejectedCompletion } : {}), ...(runtimeFailure ? { runtime_failure: runtimeFailure } : {}), ...(securityReceipt ? { security_receipt: securityReceipt } : {}) } });
         await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken,
             phase: "terminal_pending", bindingId: binding.bindingId, terminalEventType: terminal.eventType,
             completionRequest: structuredClone(completionRequest) });

package/dist/src/daemon/runtime.js

@@ -1,3 +1,5 @@
+import { composeReviewedD4Host } from '../safety/d4-host-composition.js';
+import { protocolHash } from '../publication/candidate.js';
 import { createClaudeProductionHost } from '../safety/claude-production-host.js';
 import { adapterStatus } from '../adapters/status.js';
 import { loadInstalledLocalFixHost } from '../publication/installed-host.js';
@@ -15,7 +17,7 @@ import { CodexPlugin } from "../adapters/codex/plugin.js";
 import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
-import { D4_OBSERVED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
+import { D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
 import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
 import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from "../safety/claude-runner-token.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
@@ -76,6 +78,27 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    // Only this daemon's currently executing claim may revalidate a D4 pre-spawn request.
+    let activeD4Job, activeD4Binding;
+    let d4Host = input.d4ExecutionHost;
+    if (!d4Host) {
+        const composition = await composeReviewedD4Host({ binaryIdentity: () => claude.binaryIdentity(), revalidateJob: async (descriptor, context) => {
+                const job = activeD4Job;
+                if (!job || context.jobId !== job.id || context.bindingId !== activeD4Binding || context.generation !== 1 || job.generation !== 1
+                    || context.launchFingerprint !== job.launchFingerprint || context.contractFingerprint !== job.gatewayContractFingerprint
+                    || context.taskPackageFingerprint !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage) !== job.gatewayTaskPackageFingerprint
+                    || protocolHash(job.taskPackage.candidate_review_execution) !== protocolHash(descriptor))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                const { job: current } = await gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken });
+                if (activeD4Job !== job || activeD4Binding !== context.bindingId || current.id !== job.id || current.generation !== 1
+                    || !['claimed', 'shadowing', 'running'].includes(current.status) || !Number.isSafeInteger(current.lease_expires_at)
+                    || current.lease_expires_at <= Math.floor(Date.now() / 1000))
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+            } });
+        d4Host = composition.host;
+        process.stderr.write(`${JSON.stringify({ event: 'd4_host', status: composition.status })}\n`);
+    }
     // The menu bar app (Work Item b9218937): counts and clickable notices; osascript stays the fallback.
     let roomActivityEnabled = false;
     const menubar = buildMenubar({ stateRoot: input.stateRoot, home: input.env.HOME ?? "", gatewayMcpUrl: input.gatewayMcpUrl,
@@ -124,7 +147,7 @@ export async function buildDaemon(input) {
             securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
             pullRequestEvidence: (args, signal) => gateway.readPullRequestEvidence(args, signal),
             readCandidateReviewContext: loopId => gateway.readCandidateReviewContext(loopId),
-            d4ExecutionHost: input.d4ExecutionHost,
+            d4ExecutionHost: d4Host,
         }),
     });
     const codex = new CodexPlugin({
@@ -156,10 +179,15 @@ export async function buildDaemon(input) {
             shadow: (job, signal) => gateway.localJobShadow({ workLoopId: job.workLoopId,
                 contractFingerprint: job.gatewayContractFingerprint ?? "",
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
-            createBinding: async (job, signal) => gateway.createLocalJobBinding({
-                jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
-            }, signal),
+            createBinding: async (job, signal) => {
+                const binding = await gateway.createLocalJobBinding({
+                    jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
+                    launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
+                }, signal);
+                if (activeD4Job?.id === job.id)
+                    activeD4Binding = binding.bindingId;
+                return binding;
+            },
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
             confirmServerPublicationCompletion: (bindingId, cursor, job, receipt) => gateway.confirmServerPublicationCompletion(bindingId, cursor, job, receipt),
@@ -221,7 +249,22 @@ export async function buildDaemon(input) {
             return { status: "claimed", job };
         },
         execute: async (job) => {
-            await coordinator.execute(job);
+            const claimed = job;
+            if (claimed.taskPackage.candidate_review_execution) {
+                if (activeD4Job)
+                    throw Error('D4_JOB_CONTEXT_REJECTED');
+                activeD4Job = structuredClone(claimed);
+                activeD4Binding = undefined;
+                try {
+                    await coordinator.execute(claimed);
+                }
+                finally {
+                    activeD4Job = undefined;
+                    activeD4Binding = undefined;
+                }
+            }
+            else
+                await coordinator.execute(claimed);
         },
         requestSync: reason => { transport?.requestSync(reason); },
         // Until now the heartbeat said this runner takes no jobs; tell the Gateway at once, and ask whether one waits.
@@ -298,10 +341,16 @@ export async function buildDaemon(input) {
             }
             const askInbox = await asks.advertisement();
             const guidance = await guide.advertisement();
+            let d4Ready;
+            try {
+                if (d4Host && (!d4Host.ready || await d4Host.ready()))
+                    d4Ready = d4Host;
+            }
+            catch { /* D4 readiness never disables other workflows. */ }
             return {
                 deviceFingerprint: runnerDeviceFingerprint(input.gatewayMcpUrl),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], input.d4ExecutionHost), poller.accepting),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], d4Ready), poller.accepting),
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
@@ -471,7 +520,7 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
     return probes.map(probe => {
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
-        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY);
+        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY && value !== D4_RECORDED_EXECUTION_CAPABILITY);
         if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
             if (modes.includes('gateway_ci_v1'))
@@ -484,7 +533,7 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
             capabilities.push('pull_request_evidence_v1');
         const d4 = authenticated && probe.id === 'claude_code_cli' && d4Host;
         if (d4)
-            capabilities.push(D4_OBSERVED_EXECUTION_CAPABILITY);
+            capabilities.push(...(d4.capabilities ?? [D4_OBSERVED_EXECUTION_CAPABILITY, D4_RECORDED_EXECUTION_CAPABILITY]));
         return { adapter: probe.id, version: probe.version, ...status, capabilities, ...(d4 ? { runner_release_sha256: d4.runnerReleaseSha256, host_policy_sha256: d4.hostPolicySha256 } : {}) };
     });
 }

package/dist/src/safety/claude-review-provider.js

@@ -23,6 +23,14 @@ function textOf(content) {
     const parts = content.filter((block) => record(block) && block.type === 'text' && typeof block.text === 'string').map(block => block.text);
     return parts.length ? parts.join('') : null;
 }
+/** Tool evidence accepts text only. Never discard an unrecognized block and salvage a passing JSON object. */
+function toolResultText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content) || content.length === 0 || !content.every((block) => record(block) && Object.keys(block).length === 2 && block.type === 'text' && typeof block.text === 'string'))
+        return 'CLAUDE_REVIEW_TOOL_RESULT_CONTENT_REJECTED';
+    return content.map(block => block.text).join('');
+}
 const REMINDER = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
 /** The user's own text. The real CLI prepends context in system-reminder tags, in its own block or the same one. */
 function userText(content) {
@@ -131,7 +139,7 @@ export async function startClaudeReviewProvider(script) {
                         continue;
                     toolResultIds.push(block.tool_use_id);
                     if (!toolResults.has(block.tool_use_id))
-                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: typeof block.content === 'string' ? block.content : JSON.stringify(block.content ?? '') });
+                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: toolResultText(block.content) });
                 }
         const firstUser = messages.find(message => message.role === 'user'), { text: firstUserText, reminders } = firstUser ? userText(firstUser.content) : { text: null, reminders: 0 };
         // The scripted turn: the launched model, the exact review prompt as the first user text and an offered tool list.

package/dist/src/safety/d4-execution-limits.js

@@ -1,6 +1,14 @@
 import { protocolHash } from '../publication/candidate.js';
 import { D4_REVIEW_INVENTORY } from './local-tool-policy.js';
 const LIMIT_KEYS = ['max_candidates', 'max_process_starts', 'max_runtime_seconds', 'automatic_retries', 'max_total_tokens', 'max_estimated_cost_microusd'];
+export function parseD4RecordLimits(value) {
+    const names = LIMIT_KEYS.slice(0, 4);
+    if (!object(value) || !keys(value, names) || !names.every(k => integer(value[k]))
+        || value.max_candidates !== 1 || value.max_process_starts !== 1 || value.automatic_retries !== 0
+        || !integer(value.max_runtime_seconds, 1) || value.max_runtime_seconds > 900)
+        return reject('D4_LIMIT_PROFILE_REJECTED');
+    return Object.freeze({ ...value });
+}
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const keys = (v, expected) => Object.keys(v).length === expected.length && expected.every(k => Object.hasOwn(v, k));
 const integer = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
@@ -26,9 +34,12 @@ const d4 = (p) => ['candidate_review', 'candidate_review_record', 'candidate_rev
 export const D4_OBSERVED_EXECUTION_SCHEMA = 'd4-review-execution-v2';
 export const D4_OBSERVED_EXECUTION_STAGE = 'cli_observed_usage_v1';
 export const D4_OBSERVED_EXECUTION_CAPABILITY = 'd4_review_observed_usage_v1';
+export const D4_RECORDED_EXECUTION_SCHEMA = 'd4-review-execution-v3';
+export const D4_RECORDED_EXECUTION_CAPABILITY = 'd4_review_recorded_usage_v1';
+export const isD4ExecutionSchema = (s) => s === D4_OBSERVED_EXECUTION_SCHEMA || s === D4_RECORDED_EXECUTION_SCHEMA;
 const PROFILE_KEYS = ['schema_version', 'decision_revision_id', 'runtime_adapter', 'provider', 'model_id', 'tool_inventory', 'tools_sha256', 'cli_security_fingerprint',
     'runner_release_sha256', 'host_policy_sha256', 'review_status', 'limits', 'usage_enforcement'];
-/** Version 2 accepts observed-stop limits only. It does not make strict caps available or authorize a launch. */
+/** Immutable v2 observed-stop and v3 recording-only packages; neither grants launch authority. */
 export function assertD4PackageLimitSupport(bound, approved, resume) {
     if (![bound, approved].some(p => object(p) && d4(p)))
         return;
@@ -43,19 +54,20 @@ export function assertD4PackageLimitSupport(bound, approved, resume) {
         return reject('D4_LIMIT_PROFILE_REQUIRED');
     if (protocolHash(a) !== protocolHash(b))
         return reject('D4_LIMIT_PROFILE_CHANGED');
-    if (a.schema_version !== D4_OBSERVED_EXECUTION_SCHEMA)
+    if (!isD4ExecutionSchema(a.schema_version))
         return assertCurrentD4LimitSupport();
+    const recordOnly = a.schema_version === D4_RECORDED_EXECUTION_SCHEMA;
     const p = a.profile, u = p.usage_enforcement;
-    if (!keys(a, ['schema_version', 'stage', 'profile', 'profile_fingerprint', 'registration_fingerprint']) || a.stage !== D4_OBSERVED_EXECUTION_STAGE
-        || !keys(p, PROFILE_KEYS) || p.schema_version !== 'd4-review-execution-profile-v2' || p.review_status !== 'reviewed'
+    if (!keys(a, ['schema_version', 'stage', 'profile', 'profile_fingerprint', 'registration_fingerprint']) || a.stage !== (recordOnly ? 'cli_recorded_usage_v1' : D4_OBSERVED_EXECUTION_STAGE)
+        || !keys(p, PROFILE_KEYS) || p.schema_version !== (recordOnly ? 'd4-review-execution-profile-v3' : 'd4-review-execution-profile-v2') || p.review_status !== 'reviewed'
         || p.runtime_adapter !== 'claude_code_cli' || p.provider !== 'anthropic' || p.model_id !== 'claude-sonnet-5-5' || p.tool_inventory !== D4_REVIEW_INVENTORY
         || typeof p.decision_revision_id !== 'string' || !(/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/).test(p.decision_revision_id)
         || !['tools_sha256', 'cli_security_fingerprint', 'runner_release_sha256', 'host_policy_sha256'].every(k => typeof p[k] === 'string' && /^[a-f0-9]{64}$/.test(p[k]))
         || typeof a.registration_fingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(a.registration_fingerprint)
         || a.profile_fingerprint !== protocolHash(p) || !object(u) || !keys(u, ['tokens', 'estimated_cost', 'hard_stop'])
-        || u.tokens !== 'observed_stop' || u.estimated_cost !== 'observed_stop' || u.hard_stop !== false)
+        || u.tokens !== (recordOnly ? 'record_only' : 'observed_stop') || u.estimated_cost !== (recordOnly ? 'record_only' : 'observed_stop') || u.hard_stop !== false)
         return reject('D4_LIMIT_PROFILE_REJECTED');
-    return parseD4Limits(p.limits);
+    return recordOnly ? parseD4RecordLimits(p.limits) : parseD4Limits(p.limits);
 }
 /** Conservative diagnostic interpretation only. All token partitions and the CLI's estimated cost must be explicit.
  * This does not establish that a CLI result is cumulative, timely, complete or an invoice/weekly-limit measurement. */
@@ -106,8 +118,8 @@ export class D4CliUsageTracker {
     }
 }
 const STOP_TIMEOUT_MS = 6000;
-/** Local owned-process primitive for synthetic feasibility tests and a future reviewed runtime.
- * It grants no admission; the production adapter above remains blocked. Observed caps may already have overshot.
+/** Local owned-process watchdog. It grants no admission; the adapter also requires a trusted reviewed host.
+ * V2 stops on observed thresholds (possible overshoot); V3 records usage without numeric stopping.
  * In-memory start accounting is not a durable restart fence; existing Job/lease owners must provide that later. */
 export class D4ObservedLimitWatchdog {
     host;
@@ -124,7 +136,7 @@ export class D4ObservedLimitWatchdog {
     signalStopped;
     constructor(limits, host) {
         this.host = host;
-        this.limits = parseD4Limits(limits);
+        this.limits = object(limits) && !Object.hasOwn(limits, 'max_total_tokens') ? parseD4RecordLimits(limits) : parseD4Limits(limits);
         this.stoppedSignal = new Promise(resolve => { this.signalStopped = resolve; });
     }
     now() { const n = (this.host.now ?? (() => performance.now()))(); if (!Number.isFinite(n) || n < this.lastNow)
@@ -167,9 +179,9 @@ export class D4ObservedLimitWatchdog {
                 return this.stop('D4_USAGE_UNAVAILABLE');
         }
         this.last = { ...s };
-        if (s.total_tokens >= this.limits.max_total_tokens)
+        if ('max_total_tokens' in this.limits && s.total_tokens >= this.limits.max_total_tokens)
             return this.stop('D4_OBSERVED_TOKEN_LIMIT');
-        if (s.estimated_cost_microusd >= this.limits.max_estimated_cost_microusd)
+        if ('max_estimated_cost_microusd' in this.limits && s.estimated_cost_microusd >= this.limits.max_estimated_cost_microusd)
             return this.stop('D4_OBSERVED_COST_LIMIT');
     }
     cancel() { return this.stop('D4_CANCELLED'); }

package/dist/src/safety/d4-host-composition.js

@@ -0,0 +1,100 @@
+import { D4_REVIEW_REGISTRY_FILE, d4RuntimeReleaseFingerprint } from './d4-runtime-release.js';
+import path from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { protocolHash } from '../publication/candidate.js';
+import { measureLocalFixRuntime } from '../publication/runtime-release.js';
+import { measureCommandFile } from './registered-command-integrity.js';
+import { assertCurrentClaudeBinary, claudeBinaryLaunchPath } from './claude-binary-identity.js';
+import { localToolInventory } from './local-tool-server.js';
+import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
+import { assertD4PackageLimitSupport, D4_RECORDED_EXECUTION_SCHEMA, D4_RECORDED_EXECUTION_CAPABILITY } from './d4-execution-limits.js';
+import { REVIEWED_D4_HOST_REGISTRATIONS } from './d4-reviewed-hosts.js';
+const denied = () => Error('D4_HOST_INPUT_REJECTED');
+const hex = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const exact = (v, names) => Object.keys(v).sort().join() === names.sort().join();
+/** Reuses the full packaged runtime/dependency measurement. A matching digest is not a review:
+ * only the compiled reviewed registration supplies authority, and Gateway still owns execution grants. */
+export async function composeReviewedD4Host(input) {
+    const registrations = input.registrations ?? REVIEWED_D4_HOST_REGISTRATIONS;
+    if (registrations.length === 0)
+        return { status: 'absent' };
+    if (registrations.length !== 1)
+        return { status: 'mismatch' };
+    try {
+        const r = structuredClone(registrations[0]), p = r.policy;
+        if (!exact(r, ['schema_version', 'review_status', 'review_receipt_id', 'runner_release_sha256', 'host_policy_sha256', 'policy'])
+            || r.schema_version !== 'd4-trusted-host-registration-v1' || r.review_status !== 'reviewed' || !uuid(r.review_receipt_id)
+            || !hex(r.runner_release_sha256) || !hex(r.host_policy_sha256) || !p || typeof p !== 'object'
+            || !exact(p, ['schema_version', 'decision_revision_id', 'model_id', 'tool_inventory', 'tools_sha256', 'cli_security_fingerprint', 'claude_binary_sha256', 'claude_launch_config_sha256', 'node', 'usage_policy', 'max_candidates', 'max_process_starts', 'max_runtime_seconds', 'automatic_retries', 'automatic_resume'])
+            || p.schema_version !== 'd4-trusted-readonly-policy-v1' || !uuid(p.decision_revision_id) || p.model_id !== 'claude-sonnet-5-5'
+            || p.tool_inventory !== 'local-tools-d4-review-v1' || p.tools_sha256 !== protocolHash({ tools: localToolInventory('local-tools-d4-review-v1') })
+            || !hex(p.cli_security_fingerprint) || !hex(p.claude_binary_sha256) || p.claude_launch_config_sha256 !== protocolHash(CLAUDE_LAUNCH_CONFIG)
+            || !p.node || !exact(p.node, ['executable', 'sha256']) || !path.isAbsolute(p.node.executable) || !hex(p.node.sha256)
+            || p.usage_policy !== 'record_only' || p.max_candidates !== 1 || p.max_process_starts !== 1 || p.max_runtime_seconds !== 900 || p.automatic_retries !== 0 || p.automatic_resume !== false
+            || r.host_policy_sha256 !== protocolHash(p))
+            throw denied();
+        const root = await realpath(input.packageRoot ?? fileURLToPath(new URL('../../../', import.meta.url)));
+        if (input.packageRoot !== undefined && root !== input.packageRoot)
+            throw denied();
+        const registrySha256 = await measureCommandFile(path.join(root, D4_REVIEW_REGISTRY_FILE));
+        const runtimeCurrent = async () => {
+            if (await realpath(process.execPath) !== p.node.executable || await measureCommandFile(p.node.executable) !== p.node.sha256)
+                throw denied();
+            const { files } = await measureLocalFixRuntime(root);
+            if (files[D4_REVIEW_REGISTRY_FILE] !== registrySha256 || d4RuntimeReleaseFingerprint(files) !== r.runner_release_sha256)
+                throw denied();
+        };
+        await runtimeCurrent();
+        const localCurrent = async () => {
+            await runtimeCurrent();
+            const identity = await input.binaryIdentity();
+            if (identity.sha256 !== p.claude_binary_sha256)
+                throw denied();
+            await assertCurrentClaudeBinary(identity, claudeBinaryLaunchPath(identity), p.claude_binary_sha256);
+        };
+        const descriptorCurrent = (d) => {
+            if (d.schema_version !== D4_RECORDED_EXECUTION_SCHEMA)
+                throw denied();
+            assertD4PackageLimitSupport({ candidate_review_execution: d }, { candidate_review_execution: d });
+            const profile = d.profile;
+            for (const key of ['decision_revision_id', 'model_id', 'tool_inventory', 'tools_sha256', 'cli_security_fingerprint'])
+                if (profile[key] !== p[key])
+                    throw denied();
+            if (profile.runner_release_sha256 !== r.runner_release_sha256 || profile.host_policy_sha256 !== r.host_policy_sha256)
+                throw denied();
+        };
+        const host = Object.freeze({ capabilities: Object.freeze([D4_RECORDED_EXECUTION_CAPABILITY]), runnerReleaseSha256: r.runner_release_sha256, hostPolicySha256: r.host_policy_sha256,
+            ready: async () => { try {
+                await localCurrent();
+                return true;
+            }
+            catch {
+                return false;
+            } },
+            assertCurrent: async (d, job) => {
+                try {
+                    const descriptor = structuredClone(d), context = structuredClone(job);
+                    if (!context || !context.jobId || !context.bindingId || context.generation !== 1
+                        || !hex(context.launchFingerprint) || !hex(context.contractFingerprint) || !hex(context.taskPackageFingerprint))
+                        throw denied();
+                    descriptorCurrent(descriptor);
+                    await localCurrent();
+                    await input.revalidateJob(descriptor, context);
+                    // Recheck original inputs after the asynchronous authority lookup, before returning to spawn.
+                    if (protocolHash(d) !== protocolHash(descriptor) || protocolHash(job) !== protocolHash(context))
+                        throw denied();
+                    descriptorCurrent(descriptor);
+                    await localCurrent();
+                }
+                catch {
+                    throw denied();
+                }
+            } });
+        return { status: 'composed', host };
+    }
+    catch {
+        return { status: 'mismatch' };
+    }
+}

package/dist/src/safety/d4-reviewed-hosts.js

@@ -0,0 +1,2 @@
+/** Release review input, not employee config. No operational D4 host is registered by this source change. */
+export const REVIEWED_D4_HOST_REGISTRATIONS = Object.freeze([]);

package/dist/src/safety/d4-runtime-release.js

@@ -0,0 +1,9 @@
+import { protocolHash } from '../publication/candidate.js';
+/** The compiled owner-reviewed registration is the trust anchor, not runtime payload.
+ * Including its embedded expected digest in that digest would require a fixed point.
+ * The composer separately pins these exact file bytes for every current-host check. */
+export const D4_REVIEW_REGISTRY_FILE = 'dist/src/safety/d4-reviewed-hosts.js';
+export function d4RuntimeReleaseFingerprint(files) {
+    const runtime = Object.fromEntries(Object.entries(files).filter(([file]) => file !== D4_REVIEW_REGISTRY_FILE));
+    return protocolHash({ role: 'd4_review_host', files: runtime });
+}

package/dist/src/verification/p1-execution-host.js

@@ -3,6 +3,7 @@ import { RunnerObservedVerifier, assertGatewayVerificationScope } from './runner
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 import { protocolHash } from '../publication/candidate.js';
 import { resolveRunnerVerification, assertVerificationHostVersion, REVIEWED_POLICY, REVIEWED_LOOP_TYPE } from './reviewed-runner-contract.js';
+import { runtimeFailureDiagnostic } from '../adapters/runtime-failure.js';
 export class RunnerObservedExecutionHost {
     privateRoot;
     supportedVerificationSchemas;
@@ -101,6 +102,9 @@ export function p1ModelEvent(event) {
     }
     if (Array.isArray(event.payload?.memory_usage_items))
         payload.memory_usage_items = event.payload.memory_usage_items;
+    const failure = event.eventType === 'failed' ? runtimeFailureDiagnostic(event.payload?.runtime_failure) : undefined;
+    if (failure)
+        payload.runtime_failure = failure;
     // Only parsers can attach these provider observations; never completion text.
     const usage = event.payload?.usage;
     if (usage && typeof usage === 'object' && !Array.isArray(usage)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.111",
+  "version": "0.1.112",
   "private": false,
   "license": "UNLICENSED",
   "bin": {