mtech-ai-local-runner 0.1.32 → 0.1.34

package/dist/src/publication/installed-host.js

@@ -49,9 +49,11 @@ export async function loadInstalledLocalFixHost(input) {
         const raw = await readPrivateJson(file);
         if (raw.schema === 'local-fix-host-installation-v2') {
             const config = raw;
-            if (config.enabled !== true || config.verification_mode !== 'gateway_ci_v1' || config.runnerId !== input.runnerId)
+            if (config.enabled !== true || !['gateway_ci_v1', 'gateway_publish_v1'].includes(config.verification_mode) || config.runnerId !== input.runnerId)
                 throw denied();
             assertServerCiRegistration(config.registration);
+            if (config.verification_mode !== (config.registration.verification_mode ?? 'gateway_ci_v1'))
+                throw denied();
             const packageRoot = await realpath(fileURLToPath(new URL('../../../', import.meta.url)));
             const assertReleaseCurrent = () => verifyLocalFixRuntime(packageRoot, config.runtimeFiles, config.registration.receipt);
             await assertReleaseCurrent();

package/dist/src/publication/isolated-verifier.js

@@ -6,25 +6,29 @@ import { protocolHash } from './candidate.js';
 /** Reuses the exact registered-command sandbox: no ambient credentials, network,
  * subprocess permissions, repository writes, or additional dependency grants.
  * Unsupported PHP/Node project commands remain denied by existing confinement. */
-function buildIsolatedVerifier(input, allowCandidateReads = false) {
+export async function createIsolatedCommandPolicy(input, allowCandidateReads = false) {
     const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
-    return async (snapshot) => {
-        const executionCommands = [];
-        for (const command of options.commands) {
-            const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
-            if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+    const executionCommands = [];
+    for (const command of options.commands) {
+        const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
+        if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+            throw Error('ISOLATED_VERIFICATION_REJECTED');
+        for (const name of names) {
+            if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
                 throw Error('ISOLATED_VERIFICATION_REJECTED');
-            for (const name of names) {
-                if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                const file = path.join(options.root, name);
-                if (await realpath(file) !== file)
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                derived.integrity.readFiles[name] = await measureCommandFile(file);
-            }
-            executionCommands.push(derived);
+            const file = path.join(options.root, name);
+            if (await realpath(file) !== file)
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            derived.integrity.readFiles[name] = await measureCommandFile(file);
         }
-        const policy = new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+        executionCommands.push(derived);
+    }
+    return new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+}
+function buildIsolatedVerifier(input, allowCandidateReads = false) {
+    const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
+    return async (snapshot) => {
+        const policy = await createIsolatedCommandPolicy(options, allowCandidateReads);
         try {
             if (snapshot.commands.length !== options.commands.length)
                 throw Error('ISOLATED_VERIFICATION_REJECTED');

package/dist/src/publication/project-registration.js

@@ -5,7 +5,7 @@ import { evaluateCommand } from '../safety/command-policy.js';
 import { protocolHash } from './candidate.js';
 const denied = () => new Error('PROJECT_REGISTRATION_REJECTED');
 const privateSegment = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
-function exactName(name) { return typeof name === 'string' && !!name && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
+function exactName(name) { return typeof name === 'string' && !!name && !name.startsWith('-') && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
 function blocked(name, scopes) { return scopes.some(scope => scope === '.env.*' ? name.startsWith('.env.') : name === scope || name.startsWith(scope.replace(/\/\*\*$/, '') + '/')); }
 /** Validates reviewed exact registrations against the current host and scope.
  * Receipt authenticity/ownership belongs to host release attestation; this API

package/dist/src/publication/raw-git-objects.js

@@ -0,0 +1,42 @@
+import { createHash } from 'node:crypto';
+import { deflateSync, inflateSync } from 'node:zlib';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/** Local raw objects only: no filters, hooks, Git identity/config or transport. */
+export class RawGitObjects {
+    checkout;
+    constructor(checkout) {
+        this.checkout = checkout;
+    }
+    async object(type, bytes, write) {
+        const raw = Buffer.concat([Buffer.from(`${type} ${bytes.length}\0`), bytes]), oid = createHash('sha1').update(raw).digest('hex');
+        if (write) {
+            const dir = path.join(this.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
+            await mkdir(dir, { recursive: true, mode: 0o700 });
+            try {
+                await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
+            }
+            catch (e) {
+                if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
+                    throw Error('GIT_OBJECT_REJECTED');
+            }
+        }
+        return oid;
+    }
+    async tree(entries, write, prefix = '') {
+        const names = new Map(), children = new Set();
+        for (const entry of entries) {
+            if (!entry.path.startsWith(prefix))
+                continue;
+            const rest = entry.path.slice(prefix.length), slash = rest.indexOf('/');
+            if (slash >= 0)
+                children.add(rest.slice(0, slash));
+            else
+                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
+        }
+        for (const child of children)
+            names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });
+        const chunks = [...names].sort(([a, av], [b, bv]) => Buffer.compare(Buffer.from(a + (av.mode === '40000' ? '/' : '')), Buffer.from(b + (bv.mode === '40000' ? '/' : '')))).map(([name, v]) => Buffer.concat([Buffer.from(`${v.mode} ${name}\0`), Buffer.from(v.oid, 'hex')]));
+        return this.object('tree', Buffer.concat(chunks), write);
+    }
+}

package/dist/src/publication/recovery.js

@@ -32,7 +32,7 @@ export async function recoverLocalFixPublication(input) {
     let session;
     try {
         session = await input.host.prepare({ job, checkoutPath: r.checkoutPath, bindingId, lifecycle: { isFrozen: () => true, isCurrent: () => current, securityReceipt: () => r.securityReceipt } });
-        const receipt = await session.finalize();
+        const receipt = await session.finalize(event);
         if (heartbeatError)
             throw new PublicationOutcomeUnknownError();
         const cursor = await input.gateway.syncLocalPublicationCursor(bindingId, s.eventCursor ?? 0);

package/dist/src/publication/server-ci-host.js

@@ -5,6 +5,7 @@ import { constants } from 'node:fs';
 import { lstat, open, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
+import { MAX_EVENT_SUMMARY_CHARS } from '../protocol.js';
 import { protocolHash } from './candidate.js';
 import { FilePublicationJournal } from './journal.js';
 import { GitSnapshotHost } from './git-snapshot.js';
@@ -15,21 +16,59 @@ const matches = (p, s) => s.endsWith('/**') ? safePath(s.slice(0, -3)) && (p ===
 const bindingFields = ['binding_id', 'actor_id', 'runner_id', 'job_id', 'generation', 'attempt_id', 'execution_contract_id', 'work_loop_id', 'repository_lease_id', 'repository_key', 'base_commit_sha', 'working_branch', 'contract_fingerprint', 'task_package_fingerprint', 'launch_fingerprint'];
 const bindingProof = (v) => { const b = Object.fromEntries(bindingFields.map(k => [k, v[k]])); if (!Number.isSafeInteger(b.generation) || b.generation < 1 || bindingFields.some(k => k !== 'generation' && (typeof b[k] !== 'string' || !b[k])))
     throw denied(); return b; };
-export function assertServerCiRegistration(r) { const { review, ...manifest } = r; if (!review || review.status !== 'reviewed' || review.fingerprint !== protocolHash(manifest) || !r.project || r.ci_profile_fingerprint !== protocolHash(r.ci_profile) || Object.values(r.receipt).length !== 3 || Object.values(r.receipt).some(v => !/^[a-f0-9]{64}$/.test(v)))
-    throw denied(); }
+export function assertServerCiRegistration(r) {
+    const { review, ...manifest } = r;
+    if (r.verification_mode !== undefined && !['gateway_ci_v1', 'gateway_publish_v1'].includes(r.verification_mode))
+        throw denied();
+    const p = r.ci_profile;
+    if (r.verification_mode === 'gateway_publish_v1' && (!p || Object.keys(p).some(k => !['review_status', 'validation_policy', 'destination_branch', 'trusted_files'].includes(k)) || p.review_status !== 'reviewed' || p.validation_policy !== 'disclose_unverified' || typeof p.destination_branch !== 'string' || !p.destination_branch))
+        throw denied();
+    // Both server modes use the Gateway's ordered list of pinned file records.
+    // Older CI registrations without a local profile schema remain compatible.
+    if (r.verification_mode === 'gateway_publish_v1' || p?.trusted_files !== undefined) {
+        const files = p?.trusted_files, seen = new Set();
+        if (!Array.isArray(files) || !files.length || files.length > 50)
+            throw denied();
+        for (const file of files) {
+            if (!file || typeof file !== 'object' || Array.isArray(file) || Object.keys(file).some(k => !['path', 'sha256'].includes(k)) || typeof file.path !== 'string' || !safePath(file.path) || !/^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(file.path) || /(^|\/)(vendor|node_modules|secrets)(\/|$)/.test(file.path) || seen.has(file.path) || typeof file.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(file.sha256))
+                throw denied();
+            seen.add(file.path);
+        }
+        if (!seen.has('bitbucket-pipelines.yml'))
+            throw denied();
+    }
+    if (!review || review.status !== 'reviewed' || review.fingerprint !== protocolHash(manifest) || !r.project || r.ci_profile_fingerprint !== protocolHash(r.ci_profile) || Object.values(r.receipt).length !== 3 || Object.values(r.receipt).some(v => !/^[a-f0-9]{64}$/.test(v)))
+        throw denied();
+}
+/** Executor text is disclosure only; never derive trusted statuses from it. */
+function validationReport(event) {
+    if (event === undefined)
+        return { summary: 'No executor validation report was provided.', evidence: [] };
+    if (event.eventType !== 'completed' || typeof event.summary !== 'string' || event.summary.length > MAX_EVENT_SUMMARY_CHARS || !event.summary.trim())
+        throw denied();
+    const evidence = event.payload?.completion_evidence === undefined ? [] : event.payload.completion_evidence;
+    if (!Array.isArray(evidence) || evidence.length > 20 || evidence.some(v => typeof v !== 'string' || v.length > 500 || !v.trim()))
+        throw denied();
+    const clean = (v) => v.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, '').trim();
+    const summary = clean(event.summary), items = evidence.map(clean);
+    if (!summary || items.some(v => !v))
+        throw denied();
+    return { summary, evidence: items };
+}
 /** Only host-owned frozen bytes cross the Gateway boundary. Git is exclusively
  * a pinned credential-free object reader; verification/publication run remotely. */
 export function createServerCiLocalFixHost(options) {
     const registration = structuredClone(options.registration);
     assertServerCiRegistration(registration);
-    return { requiresOwnedFreeze: true, verificationMode: 'gateway_ci_v1', prepare: async (input) => {
+    const mode = registration.verification_mode ?? 'gateway_ci_v1';
+    return { requiresOwnedFreeze: true, verificationMode: mode, prepare: async (input) => {
             await options.assertReleaseCurrent?.();
             const lifecycle = input.lifecycle;
             if (!lifecycle)
                 throw denied();
             const { job } = input, pkg = job.taskPackage, scope = pkg.local_fix_scope, repo = pkg.repository, limits = scope?.candidate_limits, allowed = scope?.allowed_paths;
             const root = await realpath(options.privateRoot), st = await lstat(root);
-            if (!lifecycle.isCurrent() || pkg.runtime_adapter !== 'codex_cli' || !scope || scope.verification_mode !== 'gateway_ci_v1' || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || !limits || ['max_changed_files', 'max_diff_bytes', 'max_file_bytes'].some(k => !Number.isSafeInteger(limits[k]) || limits[k] < 1) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
+            if (!lifecycle.isCurrent() || pkg.runtime_adapter !== 'codex_cli' || !scope || scope.verification_mode !== mode || scope.ci_profile_fingerprint !== registration.ci_profile_fingerprint || protocolHash(scope.ci_profile) !== protocolHash(registration.ci_profile) || !Array.isArray(scope.required_commands) || scope.required_commands.length || !scope.registered_tests || typeof scope.registered_tests !== 'object' || Object.keys(scope.registered_tests).length || !Array.isArray(allowed) || !allowed.length || allowed.some(p => typeof p !== 'string' || !(safePath(p) || p.endsWith('/**') && safePath(p.slice(0, -3)))) || protocolHash(allowed) !== protocolHash(pkg.allowed_paths) || repo.key !== registration.project || job.gatewayTaskPackageFingerprint !== protocolHash(pkg) || Object.entries(registration.receipt).some(([k, v]) => scope[k] !== v) || !limits || ['max_changed_files', 'max_diff_bytes', 'max_file_bytes'].some(k => !Number.isSafeInteger(limits[k]) || limits[k] < 1) || root !== options.privateRoot || !st.isDirectory() || st.isSymbolicLink() || (st.mode & 0o077) !== 0 || (process.getuid && st.uid !== process.getuid()) || root === input.checkoutPath || root.startsWith(input.checkoutPath + path.sep))
                 throw denied();
             const fence = { jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, launchGrant: job.launchGrant, bindingId: input.bindingId };
             const binding = bindingProof((await options.gateway.localPublicationContext(fence)).context);
@@ -39,8 +78,9 @@ export function createServerCiLocalFixHost(options) {
             const current = async () => { if (closed || !lifecycle.isCurrent() || !lifecycle.isFrozen())
                 throw denied(); await options.assertReleaseCurrent?.(); if (protocolHash(bindingProof((await options.gateway.localPublicationContext(fence)).context)) !== protocolHash(binding) || closed || !lifecycle.isCurrent() || !lifecycle.isFrozen())
                 throw denied(); await seal?.assertUnchanged(); };
-            return { close: async () => { closed = true; }, finalize() {
+            return { close: async () => { closed = true; }, finalize(completedEvent) {
                     return finalization ??= (async () => {
+                        const report = mode === 'gateway_publish_v1' ? validationReport(completedEvent) : undefined;
                         await current();
                         const host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: limits.max_file_bytes, maxTotalBytes: 128 * 1024 * 1024 });
                         const observed = await host.observe();
@@ -99,7 +139,7 @@ export function createServerCiLocalFixHost(options) {
                                 await fd.close();
                             }
                         }
-                        const journal = new FilePublicationJournal(root), key = protocolHash({ mode: 'gateway_ci_v1', binding }), deltaFingerprint = protocolHash({ binding, files, profile: registration.ci_profile_fingerprint });
+                        const journal = new FilePublicationJournal(root), key = protocolHash({ mode, binding }), deltaFingerprint = protocolHash({ binding, files, profile: registration.ci_profile_fingerprint, ...(report ? { validation_report: report } : {}) });
                         return journal.exclusive(key, async () => {
                             const previous = await journal.load(key);
                             if (previous && previous.candidate_fingerprint !== deltaFingerprint)
@@ -114,7 +154,7 @@ export function createServerCiLocalFixHost(options) {
                             let result;
                             stageStarted = true;
                             try {
-                                result = (await options.gateway.executeServerCiPublication({ ...fence, operation: 'stage', files, securityReceipt: { ...security }, hostReceipt: { ...registration.receipt } })).result;
+                                result = (await options.gateway.executeServerCiPublication({ ...fence, operation: 'stage', files, ...(report ? { validationReport: report } : {}), securityReceipt: { ...security }, hostReceipt: { ...registration.receipt } })).result;
                             }
                             catch {
                                 throw new PublicationOutcomeUnknownError();
@@ -135,7 +175,7 @@ export function createServerCiLocalFixHost(options) {
                                 if (result.status === 'completed') {
                                     await current();
                                     const ci = result.ci;
-                                    if (result.verification_mode !== 'gateway_ci_v1' || ci?.status !== 'passed' || typeof result.commit_sha !== 'string' || !/^[a-f0-9]{40}$/.test(result.commit_sha) || ci.commit_sha !== result.commit_sha || result.working_branch !== binding.working_branch)
+                                    if (result.verification_mode !== mode || (mode === 'gateway_ci_v1' ? ci?.status !== 'passed' || ci.commit_sha !== result.commit_sha : ci?.status !== 'not_run' || result.verification?.status !== 'unverified') || typeof result.commit_sha !== 'string' || !/^[a-f0-9]{40}$/.test(result.commit_sha) || result.working_branch !== binding.working_branch)
                                         throw new PublicationOutcomeUnknownError();
                                     return result;
                                 }

package/dist/src/safety/codex-exec-production-host.js

@@ -9,6 +9,8 @@ import { parse } from 'smol-toml';
 import { CODEX_REPORT_SCHEMA } from '../adapters/codex/prompt-compiler.js';
 import { lstatSync } from 'node:fs';
 import { readStableText, regularFileStamp as stamp } from './stable-file-read.js';
+import { observePinnedGitHead } from './pinned-git-head.js';
+import { executionError } from './execution-failure.js';
 import { readCodexCredentialStatus, registeredCommandValid } from './codex-production-host.js';
 import { securityRequirementsFingerprint as hash, requireSecurityRequirements } from './security-requirements.js';
 import { fingerprint } from '../daemon/execution-coordinator.js';
@@ -101,13 +103,13 @@ export function createCodexExecProductionHost(original) {
             const close = () => { revoked = true; return closing ??= (Promise.resolve().then(() => cleanup?.())); };
             let revoked = false, prepared = false, selected, ctx;
             const baseline = new Map(), directories = new Map(), accountDirectories = new Map();
-            let boundPlan;
+            let boundPlan, headObservation;
             const dirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || (s.mode & 63n) !== 0n || process.getuid && s.uid !== BigInt(process.getuid()))
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const accountDirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || s.isSymbolicLink())
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const current = () => { try {
-                return !revoked && !!selected && !!ctx && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
+                return !revoked && !!selected && !!ctx && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
             }
             catch {
                 return false;
@@ -118,34 +120,19 @@ export function createCodexExecProductionHost(original) {
                         throw reject();
                     prepared = true;
                     ctx = structuredClone(value);
+                    let stage = 'codex_prepare_release';
                     try {
                         selected = await inspect();
+                        stage = 'codex_prepare_binding';
                         const r = requireSecurityRequirements(p.security_requirements, { adapterId: 'codex_cli', adapterVersion: '1' }), release = selected.release;
                         if (r.mdm_verification !== release.mdmVerification || !isDeepStrictEqual(r.policy_observer, release.policyObserver) || r.security_mode !== release.securityMode || value.generation !== j.generation || value.resolvedModelId !== p.resolved_model_id || !release.modelIds.includes(value.resolvedModelId) || fingerprint(value.approvedTaskPackage) !== c.task_package_fingerprint || value.securityBinding?.contractFingerprint !== c.contract_fingerprint || value.securityBinding?.taskPackageFingerprint !== c.task_package_fingerprint || value.securityBinding?.launchFingerprint !== j.launch_fingerprint || r.release_manifest_sha256 !== execReleaseFingerprint(release) || r.binary_sha256 !== release.binarySha256 || r.fixtures_sha256 !== release.fixturesFingerprint || r.commands_sha256 !== commandRegistryFingerprint(release.commands) || r.tools_sha256 !== fingerprint({ tools: localToolInventory() }) || JSON.stringify(r.model_ids) !== JSON.stringify(release.modelIds))
                             throw reject();
+                        stage = 'codex_prepare_source';
                         const source = await realpath(sourceRoot), home = await realpath(account);
                         if (inside(source, home) || inside(home, source))
                             throw reject();
-                        const dot = path.join(source, '.git');
-                        const ds = await lstat(dot);
-                        let head;
-                        if (ds.isFile()) {
-                            const gitData = await readStableText(dot, 4096), git = gitData.text;
-                            if (!git.startsWith('gitdir: '))
-                                throw reject();
-                            const dir = path.resolve(source, git.slice(8).trim());
-                            if (inside(home, dir))
-                                throw reject();
-                            head = path.join(dir, 'HEAD');
-                            baseline.set(dot, gitData.stamp);
-                        }
-                        else if (ds.isDirectory() && !ds.isSymbolicLink())
-                            head = path.join(dot, 'HEAD');
-                        else
-                            throw reject();
-                        const headData = await readStableText(head, 4096);
-                        if (headData.text.trim() !== p.repository?.base_commit_sha)
-                            throw reject();
+                        headObservation = await observePinnedGitHead(source, p.repository, home);
+                        stage = 'codex_prepare_instructions';
                         const wrapper = CODEX_GLOBAL_INSTRUCTION_WRAPPER, ws = await lstat(wrapper);
                         if (!ws.isFile() || ws.isSymbolicLink() || ws.uid !== 0 || (ws.mode & 0o022) || await realpath(wrapper) !== wrapper)
                             throw reject();
@@ -156,9 +143,9 @@ export function createCodexExecProductionHost(original) {
                                 throw reject();
                             accountDirectories.set(ancestor, accountDirStamp(ancestor));
                         }
-                        baseline.set(head, headData.stamp);
                         baseline.set(selected.binary, selected.binaryStamp);
                         baseline.set(selected.config, selected.configStamp);
+                        stage = 'codex_prepare_commands';
                         for (const command of release.commands) {
                             const paths = command.readPaths ?? [], files = paths.map(v => path.join(source, v));
                             const measured = [command.executable, ...files].map(f => [f, stamp(f)]);
@@ -169,13 +156,14 @@ export function createCodexExecProductionHost(original) {
                                 baseline.set(f, s);
                             }
                         }
+                        stage = 'codex_prepare_current';
                         if (!current())
                             throw reject();
                         return { binary: selected.binary, release: structuredClone(release), actorId: c.security_context.actor_id, runnerId: input.runnerId };
                     }
-                    catch {
+                    catch (error) {
                         revoked = true;
-                        throw reject();
+                        throw executionError(error, stage, 'CODEX_EXEC_PREFLIGHT_REJECTED');
                     }
                 },
                 async inspect(plan) {

package/dist/src/safety/job-tool-policy.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { protocolHash } from '../publication/candidate.js';
 function object(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error('Invalid Job policy');
@@ -51,6 +52,14 @@ export function jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, runt
     const approvedCommands = strings(approved.required_commands);
     if (commands.length !== approvedCommands.length || JSON.stringify([...commands].sort()) !== JSON.stringify([...approvedCommands].sort()))
         throw new Error('Job required commands differ from approval');
+    if (approved.verification !== undefined) {
+        const verification = object(approved.verification);
+        if (runtime.runtimeAdapter !== 'codex_cli' || runtime.runtimeAdapterVersion !== '1' || approved.runtime_transport !== 'official_exec_v1' || verification.runtime_adapter !== runtime.runtimeAdapter || verification.runtime_transport !== approved.runtime_transport || verification.policy_key !== 'local-runner-verified-v1' || protocolHash(repo.blocked_paths) !== protocolHash(source.blocked_paths))
+            throw new Error('P1 Job runtime or scope differs from approval');
+        if (approved.local_fix_scope !== undefined || verification.mode !== 'runner_observed_v1' || verification.schema_version !== 'local-runner-verification-v1' || pkg.verification !== undefined && protocolHash(verification) !== protocolHash(pkg.verification) || protocolHash(verification) !== protocolHash(object(pkg.contract).verification) || protocolHash(repo.allowed_paths) !== protocolHash(approved.allowed_paths) || protocolHash(verification.allowed_paths) !== protocolHash(approved.allowed_paths))
+            throw new Error('P1 Job verification differs from approval');
+        return { worktreeRoot, access: repo.access === 'write' && source.access === 'write' ? 'write' : 'read', allowedPaths: strings(approved.allowed_paths), blockedPaths: strings(repo.blocked_paths), requiredCommands: [] };
+    }
     // Writable local Fix checks run only after the owned model/tool endpoint is
     // closed, in the reviewed host verifier. They are not model command grants.
     const localFix = approved.local_fix_scope;

package/dist/src/safety/local-tool-policy.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
 import { evaluateCommand } from './command-policy.js';
-import { runSandboxed } from './subprocess-sandbox.js';
+import { runSandboxed, runSandboxedMeasured } from './subprocess-sandbox.js';
 import { LOCAL_TOOL_WORKER } from './local-tool-worker.js';
 import { verifyCommandIntegrity } from './registered-command-integrity.js';
 export const LOCAL_TOOL_NAMES = ['local_read', 'local_search', 'local_edit', 'local_test'];
@@ -86,7 +86,9 @@ export class LocalToolPolicy {
             throw new Error('DENIED_SIZE');
         return file;
     }
-    async test(input) {
+    async prepareTest(input) {
+        if (this.abort.signal.aborted)
+            throw new Error('DENIED_REVOKED');
         const command = this.options.requiredCommands.find(command => command.id === input.command);
         if (!command || !path.isAbsolute(command.executable) || command.argv.some(arg => typeof arg !== 'string'))
             throw new Error('DENIED_COMMAND');
@@ -99,7 +101,19 @@ export class LocalToolPolicy {
         const argv = executable === await realpath(process.execPath) ? ['--no-addons', '--no-global-search-paths', ...command.argv] : command.argv;
         const readFiles = await Promise.all((command.readPaths ?? []).map(file => this.authorizedFile(file)));
         await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
-        const output = await runSandboxed({ executable, argv, readFiles, cwd: this.options.worktreeRoot, signal: this.abort.signal });
+        return { command, executable, readFiles, request: { executable, argv, readFiles, cwd: this.options.worktreeRoot, signal: this.abort.signal } };
+    }
+    /** Same scope/integrity preparation and sandbox as legacy local_test, with
+     * no raw output retained. Only host verification calls this API. */
+    async measureTest(commandId, bounds, signal) {
+        const { command, executable, readFiles, request } = await this.prepareTest({ command: commandId });
+        const measurement = await runSandboxedMeasured({ ...request, ...bounds, signal: signal ? AbortSignal.any([this.abort.signal, signal]) : this.abort.signal });
+        await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
+        return measurement;
+    }
+    async test(input) {
+        const { command, executable, readFiles, request } = await this.prepareTest(input);
+        const output = await runSandboxed(request);
         await verifyCommandIntegrity(command.integrity, executable, command.readPaths ?? [], readFiles);
         if (this.abort.signal.aborted)
             throw new Error('DENIED_REVOKED');

package/dist/src/safety/pinned-git-head.js

@@ -0,0 +1,113 @@
+import path from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { lstatSync, realpathSync } from 'node:fs';
+import { readStableText, regularFileStamp } from './stable-file-read.js';
+const denied = () => Error('PINNED_GIT_HEAD_REJECTED');
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const branchValid = (value) => typeof value === 'string' && value.length <= 255
+    && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)
+    && value.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
+// Packed refs may have no loose-ref parent yet. Check the nearest existing
+// ancestor too, so a symlink to an empty directory cannot evade absence checks.
+function canonicalParent(file) {
+    let parent = path.dirname(file);
+    for (;;) {
+        try {
+            return lstatSync(parent).isDirectory() && realpathSync(parent) === parent;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT' || parent === path.dirname(parent))
+                return false;
+            parent = path.dirname(parent);
+        }
+    }
+}
+/** Observe Git metadata only: no Git process, filters, hooks, account or config reads.
+ * A symbolic HEAD is permitted only for the exact approved writable branch. */
+export async function observePinnedGitHead(source, repository, excludedRoot) {
+    const files = new Map(), absent = new Set();
+    const directory = async (file) => { if (inside(excludedRoot, file) || inside(file, excludedRoot) || await realpath(file) !== file || !(await lstat(file)).isDirectory())
+        throw denied(); return file; };
+    const read = async (file, max = 4096) => { if (await realpath(file) !== file)
+        throw denied(); const value = await readStableText(file, max); files.set(file, value.stamp); return value.text; };
+    const optional = async (file, max = 4096) => { try {
+        return await read(file, max);
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+        if (!canonicalParent(file))
+            throw denied();
+        absent.add(file);
+        return undefined;
+    } };
+    const expected = repository.base_commit_sha;
+    if (typeof expected !== 'string' || !/^[a-f0-9]{40}$/.test(expected))
+        throw denied();
+    const dot = path.join(source, '.git'), entry = await lstat(dot);
+    let gitdir;
+    if (entry.isFile()) {
+        const value = await read(dot), match = /^gitdir: ([^\r\n\0]+)\n?$/.exec(value);
+        if (!match)
+            throw denied();
+        gitdir = await directory(path.resolve(source, match[1]));
+    }
+    else if (entry.isDirectory() && !entry.isSymbolicLink())
+        gitdir = await directory(dot);
+    else
+        throw denied();
+    const head = (await read(path.join(gitdir, 'HEAD'))).trim();
+    if (/^[a-f0-9]{40}$/.test(head)) {
+        if (head !== expected)
+            throw denied();
+    }
+    else {
+        const branch = repository.working_branch;
+        if (repository.access !== 'write' || !branchValid(branch) || head !== `ref: refs/heads/${branch}`)
+            throw denied();
+        const commonText = await optional(path.join(gitdir, 'commondir'));
+        if (commonText !== undefined && !/^[^\r\n\0]+\n?$/.test(commonText))
+            throw denied();
+        const common = commonText === undefined ? gitdir : await directory(path.resolve(gitdir, commonText.trim()));
+        const ref = `refs/heads/${branch}`, loose = await optional(path.join(common, ref));
+        let commit;
+        if (loose !== undefined) {
+            if (!/^[a-f0-9]{40}\n?$/.test(loose))
+                throw denied();
+            commit = loose.trim();
+        }
+        else {
+            const packed = await read(path.join(common, 'packed-refs'), 1_048_576);
+            for (const line of packed.split('\n')) {
+                if (!line || line.startsWith('#') || /^\^[a-f0-9]{40}$/.test(line))
+                    continue;
+                const match = /^([a-f0-9]{40}) (refs\/[^\s\0]+)$/.exec(line);
+                if (!match)
+                    throw denied();
+                if (match[2] === ref) {
+                    if (commit !== undefined)
+                        throw denied();
+                    commit = match[1];
+                }
+            }
+        }
+        if (commit !== expected)
+            throw denied();
+    }
+    const isCurrent = () => { try {
+        return [...files].every(([file, stamp]) => realpathSync(file) === file && regularFileStamp(file) === stamp) && [...absent].every(file => { if (!canonicalParent(file))
+            return false; try {
+            lstatSync(file);
+            return false;
+        }
+        catch (e) {
+            return e.code === 'ENOENT';
+        } });
+    }
+    catch {
+        return false;
+    } };
+    if (!isCurrent())
+        throw denied();
+    return { isCurrent };
+}