mtech-ai-local-runner 0.1.32 → 0.1.34

package/dist/src/safety/subprocess-sandbox.js

@@ -1,6 +1,7 @@
 import { spawn } from 'node:child_process';
 import { realpathSync } from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 const quote = (value) => JSON.stringify(value);
 /** Deny-default Seatbelt profile. No inherited profile, environment or shell. */
 export function sandboxProfile(request) {
@@ -17,46 +18,79 @@ export function sandboxProfile(request) {
     const write = (request.writeFiles ?? []).map(file => `(literal ${quote(file)})`).join(' ');
     return `(version 1)(deny default)(allow process-exec (literal ${quote(executable)}))(allow sysctl-read)(allow file-read-metadata)(allow file-map-executable (subpath "/System/Library") (subpath "/usr/lib") (literal ${quote(executable)}))(allow file-read-data (subpath "/System/Library") (subpath "/usr/lib") (subpath "/usr/share") ${read})${write ? `(allow file-write* ${write})` : ''}`;
 }
-export async function runSandboxed(request) {
+/** One restricted execution primitive. P1 retains no output; only legacy callers
+ * opt into bounded stdout retention. Completion waits for close (stream drain),
+ * never exit or a timeout callback. No grants differ from sandboxProfile. */
+async function executeSandboxed(request, retainStdout) {
+    const start = performance.now();
+    const empty = (status, reason) => ({ measurement: { status, reason, exit_code: null, duration_ms: Math.max(0, Math.floor(performance.now() - start)), stdout_sha256: null, stderr_sha256: null, stdout_bytes: 0, stderr_bytes: 0 }, output: '' });
+    if (request.signal?.aborted)
+        return empty('cancelled', 'aborted');
     if (process.platform !== 'darwin')
-        throw new Error('LOCAL_SANDBOX_UNAVAILABLE: macOS Seatbelt required');
-    const profile = sandboxProfile(request);
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0, settled = false;
-        const child = spawn('/usr/bin/sandbox-exec', ['-p', profile, realpathSync(request.executable), ...request.argv], {
-            cwd: request.cwd ?? '/', env: { PATH: '/usr/bin:/bin', LANG: 'C', HOME: '/nonexistent', TMPDIR: '/nonexistent' }, stdio: ['ignore', 'pipe', 'pipe'], detached: true, signal: request.signal,
-        });
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
+        return empty('blocked', 'sandbox_unavailable');
+    const limit = request.maxOutputBytes ?? 1024 * 1024;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1024 * 1024 || (request.timeoutMs !== undefined && (!Number.isSafeInteger(request.timeoutMs) || request.timeoutMs < 1)))
+        return empty('blocked', 'invalid_bounds');
+    let profile, executable;
+    try {
+        profile = sandboxProfile(request);
+        executable = realpathSync(request.executable);
+    }
+    catch {
+        return empty('blocked', 'spawn_failed');
+    }
+    return new Promise(resolve => {
+        const stdout = createHash('sha256'), stderr = createHash('sha256'), chunks = [];
+        let outBytes = 0, errBytes = 0, reason, timer;
+        let child;
+        try {
+            child = spawn('/usr/bin/sandbox-exec', ['-p', profile, executable, ...request.argv], {
+                cwd: request.cwd ?? '/', env: { PATH: '/usr/bin:/bin', LANG: 'C', HOME: '/nonexistent', TMPDIR: '/nonexistent' }, stdio: ['ignore', 'pipe', 'pipe'], detached: true,
+            });
+        }
+        catch {
+            resolve(empty('blocked', 'spawn_failed'));
+            return;
+        }
+        const kill = () => { try {
+            if (child.pid)
+                process.kill(-child.pid, 'SIGKILL');
+        }
+        catch { /* own group already exited */ } };
+        const stop = (why) => { reason ??= why; kill(); };
+        const abort = () => stop('aborted');
+        request.signal?.addEventListener('abort', abort, { once: true });
+        if (request.signal?.aborted)
+            abort();
+        if (request.timeoutMs !== undefined)
+            timer = setTimeout(() => stop('timeout'), request.timeoutMs);
+        child.stdout.on('data', (chunk) => { outBytes += chunk.length; stdout.update(chunk); if (outBytes + (retainStdout ? 0 : errBytes) > limit)
+            stop('output_limit');
+        else if (retainStdout)
+            chunks.push(chunk); });
+        // Legacy callers bounded stdout only and drained arbitrary stderr.
+        // P1 bounds both streams together, without retaining either stream.
+        child.stderr.on('data', (chunk) => { errBytes += chunk.length; stderr.update(chunk); if (!retainStdout && outBytes + errBytes > limit)
+            stop('output_limit'); });
+        child.stdout.on('error', () => stop('spawn_failed'));
+        child.stderr.on('error', () => stop('spawn_failed'));
+        child.on('error', () => stop('spawn_failed'));
+        child.on('close', (code, signal) => {
             clearTimeout(timer);
-            if (error)
-                reject(error);
-            else
-                resolve(Buffer.concat(chunks).toString('utf8'));
-        };
-        const kill = () => {
-            try {
-                if (child.pid)
-                    process.kill(-child.pid, 'SIGKILL');
-            }
-            catch { /* already exited */ }
-        };
-        const timer = request.timeoutMs === undefined ? undefined : setTimeout(() => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: command timed out')); }, request.timeoutMs);
-        child.stdout.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > 1024 * 1024) {
-                kill();
-                finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: output limit'));
-            }
-            else
-                chunks.push(chunk);
+            request.signal?.removeEventListener('abort', abort);
+            kill();
+            if (request.signal?.aborted)
+                reason = 'aborted';
+            reason ??= signal ? 'signal' : code === 0 ? undefined : 'nonzero_exit';
+            const status = reason === 'aborted' ? 'cancelled' : reason === 'timeout' ? 'timed_out' : reason === 'output_limit' || reason === 'spawn_failed' ? 'blocked' : reason ? 'failed' : 'passed';
+            resolve({ measurement: { status, exit_code: code, duration_ms: Math.max(0, Math.floor(performance.now() - start)), stdout_sha256: reason === 'spawn_failed' ? null : stdout.digest('hex'), stderr_sha256: reason === 'spawn_failed' ? null : stderr.digest('hex'), stdout_bytes: outBytes, stderr_bytes: errBytes, ...(reason ? { reason } : {}) }, output: retainStdout && status === 'passed' ? Buffer.concat(chunks).toString('utf8') : '' });
         });
-        // Do not disclose arbitrary subprocess stderr or paths to the model.
-        child.stderr.resume();
-        child.on('error', () => { kill(); finish(new Error('LOCAL_SANDBOX_UNAVAILABLE: could not start restricted process')); });
-        child.on('close', (code) => { kill(); finish(code === 0 ? undefined : new Error('LOCAL_SANDBOX_UNAVAILABLE: restricted process failed')); });
     });
 }
+export async function runSandboxedMeasured(request) { return (await executeSandboxed(request, false)).measurement; }
+export async function runSandboxed(request) {
+    const result = await executeSandboxed(request, true);
+    if (result.measurement.status !== 'passed')
+        throw new Error('LOCAL_SANDBOX_UNAVAILABLE: restricted process failed');
+    return result.output;
+}

package/dist/src/verification/p1-execution-host.js

@@ -0,0 +1,78 @@
+import { RunnerObservedVerifier } from './runner-observed-verifier.js';
+import { isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { protocolHash } from '../publication/candidate.js';
+export class RunnerObservedExecutionHost {
+    privateRoot;
+    registration;
+    constructor(privateRoot, registration) {
+        this.privateRoot = privateRoot;
+        this.registration = structuredClone(registration);
+    }
+    options(input) {
+        const p = input.job.taskPackage, r = p.repository;
+        return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: p.verification,
+            fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: r.base_commit_sha, working_branch: r.working_branch },
+            allowedPaths: p.allowed_paths, blockedPaths: r.blocked_paths, candidateLimits: p.candidate_limits,
+            current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal };
+    }
+    assertEligible(job) {
+        const r = this.registration;
+        if (r.manifest.schema !== 'local-project-verification-v1' || !r.review.receiptId?.trim() || !r.review.reviewer?.trim() || r.review.manifestFingerprint !== protocolHash(r.manifest))
+            throw Error('P1_REGISTRATION_REJECTED');
+        new RunnerObservedVerifier(this.options({ job, checkoutPath: '', bindingId: 'preflight', signal: new AbortController().signal, current: async () => false, freezeOwnedModel: async () => { throw Error('P1_NOT_FROZEN'); }, assertModelFrozen: async () => { throw Error('P1_NOT_FROZEN'); } })).assertContract();
+    }
+    verify(input) { return new RunnerObservedVerifier(this.options(input)).verify(); }
+}
+const record = (v) => { if (!v || typeof v !== 'object' || Array.isArray(v))
+    throw Error('P1_CONTRACT_REJECTED'); return v; };
+const equal = (a, b) => a !== undefined && b !== undefined && protocolHash(a) === protocolHash(b);
+export const hasP1 = (p) => {
+    const v = p.verification, policy = p.policy;
+    return policy?.policy_key === 'local-runner-verified-v1' || !!v && (v.schema_version !== undefined || v.mode !== undefined);
+};
+/** Compare host launch claims to authoritative WEC/bundle fields before start. */
+export function assertP1Bindings(p, canonical, bundle = false) {
+    const v = record(p.verification), r = record(p.repository), limits = record(p.candidate_limits);
+    if (p.local_fix_scope !== undefined || p.verification_mode === 'gateway_ci_v1' || p.runtime_adapter !== 'codex_cli' || p.runtime_adapter_version !== '1' || p.runtime_transport !== 'official_exec_v1' || v.schema_version !== 'local-runner-verification-v1' || v.policy_key !== 'local-runner-verified-v1' || v.mode !== 'runner_observed_v1' || v.runtime_adapter !== p.runtime_adapter || v.runtime_transport !== p.runtime_transport || r.access !== 'write' || !isP1WorkingBranch(r.working_branch) || !equal(p.allowed_paths, v.allowed_paths) || !equal(r.allowed_paths, v.allowed_paths) || !Array.isArray(r.blocked_paths))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (Object.keys(limits).sort().join(',') !== 'max_changed_files,max_diff_bytes,max_file_bytes' || Object.values(limits).some(n => !Number.isSafeInteger(n) || Number(n) < 1))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (!canonical)
+        return;
+    const execution = canonical.agent_execution;
+    if (canonical.local_fix_scope !== undefined || execution?.local_fix_scope !== undefined || execution?.publication_mode === 'gateway_ci_v1')
+        throw Error('P1_CONTRACT_REJECTED');
+    if (!bundle) {
+        const policy = record(canonical.policy);
+        if (policy.policy_key !== 'local-runner-verified-v1' || policy.loop_type !== 'agent_runtime_implementation')
+            throw Error('P1_CONTRACT_REJECTED');
+    }
+    const repos = canonical.repositories;
+    if (!Array.isArray(repos) || repos.length !== 1)
+        throw Error('P1_CONTRACT_REJECTED');
+    const repo = record(repos[0]);
+    const bound = bundle ? record(canonical.contract) : canonical;
+    if (!equal(v, bound.verification) || !equal(limits, record(bound.policy).candidate_limits) || repo.repository_key !== r.key || repo.access !== r.access || repo.base_commit_sha !== r.base_commit_sha || repo.working_branch !== r.working_branch || !equal(repo.allowed_paths, r.allowed_paths) || !equal(repo.blocked_paths, r.blocked_paths))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (bundle && (bound.content_fingerprint !== p.contract_fingerprint || canonical.verification !== undefined && !equal(v, canonical.verification) || canonical.candidate_limits !== undefined && !equal(limits, canonical.candidate_limits)))
+        throw Error('P1_CONTRACT_REJECTED');
+}
+/** P1 model events carry narrative/progress only. Proof is injected afterwards. */
+export function p1ModelEvent(event) {
+    if (event.eventType === 'test_started' || event.eventType === 'test_result')
+        return { eventType: 'progress', summary: 'model tool activity', payload: { kind: 'tool_activity' } };
+    const payload = {};
+    for (const key of ['reason', 'investigation_summary', 'question']) {
+        const value = event.payload?.[key];
+        if (typeof value === 'string')
+            payload[key] = value.slice(0, 6000);
+    }
+    // Only parsers can attach these provider observations; never completion text.
+    const usage = event.payload?.usage;
+    if (usage && typeof usage === 'object' && !Array.isArray(usage)) {
+        const u = usage, provider = ['openai', 'anthropic'].includes(String(u.provider)) ? u.provider : null;
+        const source = ['codex_cli.turn.completed', 'codex_app_server.thread/tokenUsage/updated', 'claude_code_cli.result'].includes(String(u.source)) ? u.source : null;
+        payload.usage = { provider, source, ...Object.fromEntries(['input_tokens', 'cached_input_tokens', 'output_tokens', 'duration_ms'].map(k => [k, typeof u[k] === 'number' && Number.isSafeInteger(u[k]) && Number(u[k]) >= 0 && Number(u[k]) <= 2147483647 ? u[k] : null])) };
+    }
+    return { ...event, payload };
+}

package/dist/src/verification/runner-observed-verifier.js

@@ -0,0 +1,147 @@
+import { createHash } from 'node:crypto';
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { protocolHash, protocolJson } from '../publication/candidate.js';
+import { GitSnapshotHost, isP1WorkingBranch } from '../publication/git-snapshot.js';
+import { createIsolatedCommandPolicy } from '../publication/isolated-verifier.js';
+import { buildReviewedProjectRegistration } from '../publication/project-registration.js';
+const denied = () => Error('RUNNER_VERIFICATION_REJECTED');
+const hex = (v, n) => typeof v === 'string' && new RegExp(`^[a-f0-9]{${n}}$`).test(v);
+const same = (a, b) => protocolHash(a) === protocolHash(b);
+const ceilings = { max_commands: 8, max_command_runtime_ms: 120000, max_output_bytes: 1048576, max_manifest_entries: 100, max_manifest_bytes: 32768, max_contract_bytes: 65536 };
+const privatePart = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
+const exactPath = (name) => typeof name === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(name) && name.split('/').every(p => p !== '.' && p !== '..' && !privatePart.test(p));
+const isBlocked = (name, scopes) => scopes.some(p => p === '.env.*' ? name.startsWith('.env.') : p === '**' || name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/'));
+function keys(object, allowed) { if (!object || typeof object !== 'object' || Array.isArray(object) || Object.keys(object).some(k => !allowed.includes(k)))
+    throw denied(); }
+/** Canonical P1 domain. Never uses legacy terminal T/U bytes or diff hashing. */
+export function buildP1ChangedPaths(input, bounds) {
+    const entries = [...input.entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    if (!hex(input.candidate_commit_sha, 40) || !hex(input.base_commit_sha, 40) || entries.length < 1 || entries.length > bounds.max_manifest_entries || new Set(entries.map(e => e.path)).size !== entries.length || entries.some(e => !exactPath(e.path) || !['added', 'modified', 'deleted'].includes(e.status)))
+        throw denied();
+    const value = { schema_version: 'runner-changed-paths-v1', candidate_commit_sha: input.candidate_commit_sha, base_commit_sha: input.base_commit_sha, digest_domain: 'p1-changed-paths-v1', entries };
+    const manifest = { ...value, manifest_sha256: protocolHash(value) };
+    if (Buffer.byteLength(protocolJson(manifest)) > bounds.max_manifest_bytes)
+        throw denied();
+    return manifest;
+}
+/** Verification-only host composition. All temporary artifacts are disposed
+ * before resolving, including failed commands; cleanup failure rejects the
+ * entire result. No publisher, remote, model report or credentials are used. */
+export class RunnerObservedVerifier {
+    options;
+    constructor(input) { this.options = { ...input, verification: structuredClone(input.verification), fence: structuredClone(input.fence), registration: input.registration && structuredClone(input.registration), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths], candidateLimits: { ...input.candidateLimits } }; }
+    assertContract() { try {
+        this.validate();
+    }
+    catch {
+        throw denied();
+    } }
+    validate() {
+        const o = this.options, v = o.verification, p = v.profile_definition, r = o.registration, f = o.fence;
+        keys(v, ['schema_version', 'mode', 'policy_key', 'profile_id', 'profile_fingerprint', 'project_id', 'runtime_adapter', 'runtime_transport', 'profile_definition', 'frozen_criteria_fingerprint', 'frozen_loop_contract', 'commands', 'command_manifest', 'bounds', 'allowed_paths', 'required_commands', 'qa_scenario_ids', 'required_criteria', 'independent_review_required']);
+        keys(p, ['schema_version', 'reviewed', 'project_ids', 'runtime_adapters', 'runtime_transports', 'allowed_paths', 'bounds', 'commands', 'bindings']);
+        keys(v.bounds, Object.keys(ceilings));
+        if (!r || !r.review || ![f.binding_id, f.job_id].every(id => typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(id)) || !Number.isSafeInteger(f.generation) || f.generation < 1 || !hex(f.contract_fingerprint, 64) || !hex(f.base_commit_sha, 40) || !isP1WorkingBranch(f.working_branch) || v.schema_version !== 'local-runner-verification-v1' || v.mode !== 'runner_observed_v1' || v.policy_key !== 'local-runner-verified-v1' || !v.profile_id || p.schema_version !== 'local-runner-profile-v1' || p.reviewed !== true || r.profileId !== v.profile_id || r.profileFingerprint !== v.profile_fingerprint || protocolHash(p) !== v.profile_fingerprint || protocolHash(v.frozen_loop_contract) !== v.frozen_criteria_fingerprint)
+            throw denied();
+        for (const key of Object.keys(ceilings))
+            if (!Number.isSafeInteger(v.bounds[key]) || v.bounds[key] < 1 || v.bounds[key] > ceilings[key])
+                throw denied();
+        if (!same(v.bounds, p.bounds) || Buffer.byteLength(protocolJson(v)) > v.bounds.max_contract_bytes || !same(o.allowedPaths, v.allowed_paths) || !same(v.allowed_paths, p.allowed_paths) || !Array.isArray(v.allowed_paths) || !v.allowed_paths.length || v.allowed_paths.length > v.bounds.max_manifest_entries || new Set(v.allowed_paths).size !== v.allowed_paths.length || v.allowed_paths.some(n => !exactPath(n) || isBlocked(n, o.blockedPaths)))
+            throw denied();
+        for (const list of [p.project_ids, p.runtime_adapters, p.runtime_transports])
+            if (!Array.isArray(list) || !list.length || list.some(s => typeof s !== 'string' || !s))
+                throw denied();
+        if (!p.project_ids.includes(v.project_id) || v.runtime_adapter !== 'codex_cli' || !p.runtime_adapters.includes(v.runtime_adapter) || v.runtime_transport !== 'official_exec_v1' || !p.runtime_transports.includes(v.runtime_transport) || r.manifest.project !== v.project_id || !same(v.command_manifest, p.commands) || !same(v.command_manifest, r.manifest.commands) || !Array.isArray(p.commands) || !p.commands.length || p.commands.length > v.bounds.max_commands || new Set(p.commands.map(c => c.id)).size !== p.commands.length)
+            throw denied();
+        for (const command of p.commands) {
+            keys(command, ['id', 'executable', 'argv', 'integrity', 'candidateReadPaths']);
+            keys(command.integrity, ['executableSha256', 'readFiles']);
+            if (!/^[a-z0-9][a-z0-9_-]{0,95}$/.test(command.id) || !path.isAbsolute(command.executable) || path.basename(command.executable) !== 'node' || !hex(command.integrity.executableSha256, 64) || !Array.isArray(command.argv) || !command.argv.length || command.argv.length > 32 || command.argv.some(a => !exactPath(a)))
+                throw denied();
+        }
+        if (!Array.isArray(p.bindings) || new Set(p.bindings.map(b => b.criterion_id)).size !== p.bindings.length || !['targeted_tests', 'required_suite'].every(c => p.bindings.some(b => b.criterion_id === c)))
+            throw denied();
+        const expected = p.bindings.map(b => { keys(b, ['criterion_id', 'command_id']); const command = p.commands.find(c => c.id === b.command_id); if (!command || !['targeted_tests', 'required_suite', 'reproduction'].includes(b.criterion_id))
+            throw denied(); return { ...b, command_fingerprint: protocolHash(command) }; });
+        if (!same(v.commands, expected))
+            throw denied();
+        const frozen = v.frozen_loop_contract, criteria = frozen.criteria;
+        if (frozen.loop_type !== 'agent_runtime_implementation' || frozen.policy_key !== v.policy_key || !same(frozen.mandatory_criteria, ['targeted_tests', 'required_suite', 'diff_scope']) || !criteria || !['targeted_tests', 'required_suite', 'diff_scope'].every(id => Object.hasOwn(criteria, id)))
+            throw denied();
+        for (const [id, c] of Object.entries(criteria))
+            if (!['targeted_tests', 'required_suite', 'diff_scope', 'reproduction'].includes(id) || c.minimum_trust !== 'client_reported' || !same(c.producers, ['runtime_event']) || !same(c.verifiers, [id === 'diff_scope' ? 'runner_changed_paths' : 'runner_command_receipt']))
+                throw denied();
+        for (const limit of Object.values(o.candidateLimits))
+            if (!Number.isSafeInteger(limit) || limit < 1)
+                throw denied();
+    }
+    async active() {
+        if (this.options.signal?.aborted || !await this.options.current() || this.options.signal?.aborted)
+            throw denied();
+        await this.options.assertModelFrozen();
+        if (this.options.signal?.aborted)
+            throw denied();
+    }
+    async verify() {
+        let host;
+        try {
+            this.validate();
+            const o = this.options, v = o.verification, f = o.fence;
+            if (o.signal?.aborted || !await o.current())
+                throw denied();
+            await o.freezeOwnedModel();
+            await this.active();
+            if (!path.isAbsolute(o.root) || await realpath(o.root) !== o.root || !path.isAbsolute(o.privateRoot) || await realpath(o.privateRoot) !== o.privateRoot || o.privateRoot === o.root || o.privateRoot.startsWith(o.root + '/'))
+                throw denied();
+            host = o.host ?? new GitSnapshotHost({ root: o.root, privateRoot: o.privateRoot, git: o.registration.git, baseCommitSha: f.base_commit_sha, workingBranch: f.working_branch, p1WorkingBranch: f.working_branch, maxFileBytes: o.candidateLimits.max_file_bytes, maxTotalBytes: Math.max(o.candidateLimits.max_file_bytes, o.candidateLimits.max_diff_bytes) });
+            const sealed = await host.materialize(), observation = structuredClone(sealed.observation);
+            if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)))
+                throw denied();
+            await this.active();
+            await sealed.assertUnchanged();
+            const candidate = await host.verificationCandidate(sealed);
+            await candidate.assertUnchanged();
+            if (!hex(candidate.commitSha, 40))
+                throw denied();
+            const changed_paths = buildP1ChangedPaths({ candidate_commit_sha: candidate.commitSha, base_commit_sha: f.base_commit_sha, entries: observation.changed_files }, v.bounds);
+            const snapshot_fingerprint = protocolHash({ digest_domain: 'p1-snapshot-v1', fence: f, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff_sha256: createHash('sha256').update(observation.diff).digest('hex'), changed_paths });
+            const registered = await buildReviewedProjectRegistration({ root: candidate.root, manifest: o.registration.manifest, review: o.registration.review, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths });
+            const policy = await createIsolatedCommandPolicy({ root: candidate.root, commands: registered.commands, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths }, true);
+            const receipts = [];
+            try {
+                for (const command of registered.commands) {
+                    await this.active();
+                    await host.assertSourceUnchanged(sealed);
+                    await candidate.assertUnchanged();
+                    const measurement = await policy.measureTest(command.id, { timeoutMs: v.bounds.max_command_runtime_ms, maxOutputBytes: v.bounds.max_output_bytes }, o.signal);
+                    await this.active();
+                    await host.assertSourceUnchanged(sealed);
+                    await candidate.assertUnchanged();
+                    const identity = { binding_id: f.binding_id, job_id: f.job_id, generation: f.generation, contract_fingerprint: f.contract_fingerprint, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, command_id: command.id, command_fingerprint: protocolHash(command) };
+                    receipts.push({ schema_version: 'runner-command-receipt-v1', receipt_id: protocolHash({ digest_domain: 'p1-command-receipt-id-v1', ...identity }), ...identity, observed_at: Math.floor(Date.now() / 1000), ...measurement });
+                }
+            }
+            finally {
+                policy.revoke();
+            }
+            await this.active();
+            await host.assertSourceUnchanged(sealed);
+            await candidate.assertUnchanged();
+            return { candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, changed_paths, receipts };
+        }
+        catch {
+            throw denied();
+        }
+        finally {
+            if (host)
+                try {
+                    await host.dispose();
+                    await this.active();
+                }
+                catch {
+                    throw denied();
+                }
+        }
+    }
+}

package/dist/src/workspace/workspace-manager.js

@@ -1,6 +1,7 @@
 import { access, mkdir, realpath, rename, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { resolve, join, sep } from "node:path";
+import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 export class WorkspaceManager {
     deps;
     constructor(deps) {
@@ -13,7 +14,7 @@ export class WorkspaceManager {
             throw new Error("Invalid repository key");
         if (!/^[a-f0-9]{40}$/.test(input.baseCommitSha))
             throw new Error("Repository revision must be an exact SHA");
-        if (input.workingBranch !== undefined && !/^ai-work\/local\/[A-Za-z0-9-]+$/.test(input.workingBranch))
+        if (input.p1WorkingBranch !== undefined ? (input.p1WorkingBranch !== input.workingBranch || !isP1WorkingBranch(input.p1WorkingBranch)) : (input.workingBranch !== undefined && !/^ai-work\/local\/[A-Za-z0-9-]+$/.test(input.workingBranch)))
             throw new Error('Invalid approved fix branch');
         if (!input.providerUrl)
             throw new Error("Repository provider remote is required");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "private": false,
   "license": "UNLICENSED",
   "bin": {