mtech-ai-local-runner 0.1.33 → 0.1.34

package/README.md

@@ -1,3 +1,25 @@
+## 0.1.34: pinned writable Fix HEAD preparation
+
+Accept a linked worktree's symbolic HEAD only for the exact approved writable
+Fix branch and commit. Detached read-only checkouts retain their existing policy.
+Bounded, no-follow metadata reads reject ref chains, traversal, symlinks and
+post-preparation path changes. Preparation errors retain a safe substage code.
+This patch does not grant another execution: package/runtime pins, installation
+review and exact Gateway contract/launch approval remain required. Model work
+limits, personal login/settings and the Claude execution path are unchanged.
+
+## Unreleased: P1 runner-observed evidence (disabled)
+
+P1 adds candidate-bound command receipts and changed-path evidence for explicitly
+reviewed Codex Node/file-only profiles. It verifies a private exact-base candidate
+after the owned model stops; model test claims cannot satisfy the Loop criteria.
+P1 defaults off, the Gateway profile registry is empty, and the runtime P1 host
+is absent by default. Source package `0.1.33` is inherited from upstream; this is
+not a P1 package release or live acceptance. See the [P1 implementation and
+delivery record](../../docs/superpowers/plans/2026-10-17-local-runner-p1-runner-observed-evidence.md)
+for local verification results and separate deployment, runner-update and
+activation gates.
+
 ## Unreleased: P0 terminal safety baseline (local verification only)
 
 The upstream source package is `0.1.31`; P0 does not bump or publish a version.

package/dist/src/adapters/claude-code/adapter.js

@@ -3,6 +3,7 @@ import { requireSecurityRequirements } from '../../safety/security-requirements.
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
+import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 import { compilePrompt } from "./prompt-compiler.js";
 import { completionEvent } from "./completion-report.js";
 import { requireJobSecurity } from "../../safety/job-security-policy.js";
@@ -44,6 +45,7 @@ export class ClaudeCodeAdapter {
     tools;
     cancelled = false;
     started = false;
+    p1 = false;
     startupAcquisition;
     revokedTools;
     revokeFailed = false;
@@ -71,6 +73,7 @@ export class ClaudeCodeAdapter {
         if (this.started)
             throw new Error("adapter has already been started");
         this.started = true;
+        this.p1 = ctx.approvedTaskPackage?.verification?.mode === 'runner_observed_v1';
         const generation = ctx.generation;
         if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
             throw new Error("JOB_SECURITY_REJECTED");
@@ -207,11 +210,14 @@ export class ClaudeCodeAdapter {
                 // A nested agent message is not evidence that the executor has finished.
                 if (message.parent_tool_use_id != null)
                     continue;
-                let parsed = parseClaudeLine(line, this.options.worktreeRoot);
+                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1 });
                 if (!parsed)
                     continue;
                 if (parsed.eventType === "completed") {
+                    const observedUsage = parsed.payload?.usage;
                     parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                    if (this.p1)
+                        parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }
                 if (isTerminalEventType(parsed.eventType))
                     sawTerminal = true;

package/dist/src/adapters/claude-code/stream-parser.js

@@ -1,5 +1,6 @@
 import { isAbsolute, relative, resolve } from "node:path";
 import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
+import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 const EDIT_TOOL_NAMES = new Set(["Edit", "Write", "MultiEdit"]);
 function bounded(summary) {
     return summary.length > MAX_EVENT_SUMMARY_CHARS ? summary.slice(0, MAX_EVENT_SUMMARY_CHARS) : summary;
@@ -105,7 +106,7 @@ function parseResultMessage(message) {
     const summary = subtype === "error_max_budget_exceeded" ? "execution failed: budget exceeded" : "execution failed";
     return { eventType: "failed", summary, payload: costUsd !== undefined ? { cost_usd: costUsd } : undefined };
 }
-export function parseClaudeLine(line, worktreeRoot) {
+export function parseClaudeLine(line, worktreeRoot, options = {}) {
     let message;
     try {
         message = JSON.parse(line);
@@ -113,16 +114,25 @@ export function parseClaudeLine(line, worktreeRoot) {
     catch {
         return null;
     }
-    switch (message.type) {
-        case "system":
-            return parseSystemMessage(message);
-        case "assistant":
-            return parseAssistantMessage(message.message ?? {}, worktreeRoot);
-        case "user":
-            return parseUserMessage(message.message ?? {});
-        case "result":
-            return parseResultMessage(message);
-        default:
-            return null;
+    const parsed = (() => {
+        switch (message.type) {
+            case "system":
+                return parseSystemMessage(message);
+            case "assistant":
+                return parseAssistantMessage(message.message ?? {}, worktreeRoot);
+            case "user":
+                return parseUserMessage(message.message ?? {});
+            case "result":
+                return parseResultMessage(message);
+            default:
+                return null;
+        }
+    })();
+    if (!options.p1 || !parsed)
+        return parsed;
+    if (message.type === 'result') {
+        const usage = message.usage && typeof message.usage === 'object' ? message.usage : {};
+        parsed.payload = { ...parsed.payload, usage: { provider: 'anthropic', source: 'claude_code_cli.result', input_tokens: usage.input_tokens, cached_input_tokens: usage.cache_read_input_tokens, output_tokens: usage.output_tokens, duration_ms: message.duration_ms } };
     }
+    return p1ModelEvent(parsed);
 }

package/dist/src/daemon/execution-coordinator.js

@@ -1,4 +1,5 @@
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
+import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
 import { executionError, executionFailure } from '../safety/execution-failure.js';
 import { isUnsupportedSupervisorCommand } from '../safety/unsupported-supervisor-command.js';
 import { requireSecurityRequirements } from '../safety/security-requirements.js';
@@ -71,6 +72,9 @@ export class ExecutionCoordinator {
         let fixSession;
         let localFixPublication;
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
+        const isP1 = hasP1(job.taskPackage);
+        let p1Result;
+        const p1ReceiptIds = [];
         const lifecycle = { frozen: false, current: true };
         const deadline = Date.now() + (this.deps.preparationTimeoutMs ?? 900_000);
         let leaseExpiresAt = job.leaseExpiresAt;
@@ -80,6 +84,12 @@ export class ExecutionCoordinator {
         try {
             await preparation.start();
             const pkg = job.taskPackage;
+            if (isP1) {
+                assertP1Bindings(pkg);
+                if (!this.deps.p1Host)
+                    throw Error('P1_HOST_REQUIRED');
+                this.deps.p1Host.assertEligible(job);
+            }
             if (isLocalFix && (!this.deps.localFixHost || pkg.repository?.access !== "write"))
                 throw new LocalFixHostRequired();
             const repository = pkg.repository;
@@ -96,7 +106,8 @@ export class ExecutionCoordinator {
                 repositoryKey: text(repository?.key, "repository key"),
                 providerUrl: text(repository?.provider_url, "repository provider URL"),
                 baseCommitSha: text(repository?.base_commit_sha, "repository SHA"),
-                ...(isLocalFix ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {})
+                ...(isLocalFix || isP1 ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {}),
+                ...(isP1 ? { p1WorkingBranch: text(repository?.working_branch, 'approved P1 branch') } : {})
             }));
             stage = "adapter";
             adapter = await preparation.step(() => this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id }), late => late.cancel());
@@ -107,11 +118,17 @@ export class ExecutionCoordinator {
             if (contractFingerprint(gatewayShadow.contractPayload) !== expectedContractFingerprint || gatewayShadow.contractFingerprint !== expectedContractFingerprint || gatewayShadow.taskPackageFingerprint !== fingerprint(pkg)) {
                 throw new GatewayToolError("contract or task-package fingerprint mismatch before binding", 'work_execution_contract_show', 'JOB_SHADOW_FENCE_INVALID');
             }
+            if (isP1)
+                assertP1Bindings(pkg, gatewayShadow.contractPayload);
+            else if (hasP1(gatewayShadow.contractPayload))
+                throw Error('P1_CONTRACT_REJECTED');
             stage = "binding";
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "binding" }));
             preparation.beginBinding();
             bindingAttempted = true;
             binding = await step(() => this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path }, preparation.signal));
+            if (isP1)
+                assertP1Bindings(pkg, binding.taskPackage, true);
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest }));
             await preparation.stop();
             preparation.assert();
@@ -164,6 +181,7 @@ export class ExecutionCoordinator {
         const executor = adapter;
         let heartbeatFailure;
         const evidenceAbort = new AbortController();
+        const verificationAbort = new AbortController();
         const controlAbort = new AbortController();
         let leaseBoundary;
         let rejectFence;
@@ -202,6 +220,7 @@ export class ExecutionCoordinator {
             heartbeatFailure = executionError(error, 'heartbeat', 'EXECUTION_FAILED');
             controlAbort.abort();
             evidenceAbort.abort();
+            verificationAbort.abort();
             rejectFence(heartbeatFailure);
             // Cancellation cannot queue behind transport or generator cleanup.
             void stopExecutor().catch(() => { });
@@ -239,6 +258,8 @@ export class ExecutionCoordinator {
                     let commandTerminal;
                     if (["cancel", "pause", "request_replan"].includes(command.command)) {
                         lifecycle.current = false;
+                        if (isP1)
+                            verificationAbort.abort();
                         commandTerminal = { eventType: "cancelled", summary: `supervisor ${command.command} acknowledged`,
                             payload: { reason: command.command === 'pause' ? 'paused' : command.command === 'request_replan' ? 'replan_requested' : 'cancelled' } };
                         await stopExecutor();
@@ -253,6 +274,8 @@ export class ExecutionCoordinator {
                             if (!isUnsupportedSupervisorCommand(error))
                                 throw error;
                             lifecycle.current = false;
+                            if (isP1)
+                                verificationAbort.abort();
                             await stopExecutor();
                             requireControlFence();
                             commandTerminal = { eventType: 'failed', summary: 'supervisor command is unsupported for the approved launch',
@@ -329,7 +352,9 @@ export class ExecutionCoordinator {
             if (!ignoreControlFailure && (controlFailure || heartbeatFailure))
                 throw controlFailure || heartbeatFailure;
         };
-        const append = async (event) => {
+        const append = async (event, hostProof = false) => {
+            if (isP1 && !hostProof)
+                event = p1ModelEvent(event);
             const previousStage = executionStage;
             let payload = event.payload;
             if (isTerminalEventType(event.eventType)) {
@@ -338,6 +363,8 @@ export class ExecutionCoordinator {
                 const evidence = localFixPublication && typeof localFixPublication.diff_hash === 'string' && typeof localFixPublication.changed_file_manifest_hash === 'string' ? { diffHash: localFixPublication.diff_hash, changedFileManifestHash: localFixPublication.changed_file_manifest_hash } : await fenced(this.deps.terminalEvidenceCollector.collect({ checkoutPath: workspace.path, baseSha: workspace.baseCommitSha, signal: evidenceAbort.signal }));
                 requireControlFence();
                 payload = { ...payload, diff_hash: evidence.diffHash, changed_file_manifest_hash: evidence.changedFileManifestHash };
+                if (isP1 && event.eventType === 'completed' && p1Result)
+                    payload = { ...payload, candidate_commit_sha: p1Result.candidate_commit_sha, snapshot_fingerprint: p1Result.snapshot_fingerprint, changed_paths: p1Result.changed_paths, verification_receipt_ids: [...p1ReceiptIds] };
             }
             // A vendor report cannot supply host observations, even when its shape looks valid.
             if (payload) {
@@ -373,8 +400,11 @@ export class ExecutionCoordinator {
             }
             requireControlFence();
             eventUncertain = true;
-            await fenced(this.deps.gateway.appendEvent(binding.bindingId, normalized));
+            const receipt = await fenced(this.deps.gateway.appendEvent(binding.bindingId, normalized));
             requireControlFence();
+            const eventId = receipt?.id;
+            if (isP1 && hostProof && (typeof eventId !== 'string' || !eventId.trim() || p1ReceiptIds.includes(eventId)))
+                throw Error('P1_EVENT_ID_UNCONFIRMED');
             sequence = normalized.sequence;
             executionStage = 'state_save';
             if (event.eventType === "checkpoint_ready")
@@ -382,6 +412,7 @@ export class ExecutionCoordinator {
             await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, eventCursor: sequence, ...(isTerminalEventType(event.eventType) ? { terminalEventType: event.eventType } : {}), workspaceManifest: workspace.manifest });
             eventUncertain = false;
             executionStage = previousStage;
+            return typeof eventId === 'string' ? eventId : undefined;
         };
         const publicationStep = async (operation) => {
             requireControlFence();
@@ -434,6 +465,33 @@ export class ExecutionCoordinator {
                         if (requestedTerminal)
                             break;
                         if (isTerminalEventType(event.eventType)) {
+                            if (event.eventType === 'completed' && isP1) {
+                                if (!adapter.freezeForPublication)
+                                    throw Error('P1_OWNED_FREEZE_UNAVAILABLE');
+                                const current = async () => { requireControlFence(); return lifecycle.current && !requestedTerminal && !verificationAbort.signal.aborted; };
+                                const assertModelFrozen = async () => { if (!await current() || !lifecycle.frozen)
+                                    throw Error('P1_MODEL_NOT_FROZEN'); };
+                                const freezeOwnedModel = async () => { if (!await current())
+                                    throw Error('P1_FENCE_LOST'); if (!lifecycle.frozen) {
+                                    await publicationStep(() => adapter.freezeForPublication());
+                                    lifecycle.frozen = true;
+                                } await assertModelFrozen(); };
+                                await freezeOwnedModel();
+                                await readControls();
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen }));
+                                await readControls();
+                                await assertModelFrozen();
+                                const seen = new Set();
+                                for (const receipt of p1Result.receipts) {
+                                    if (seen.has(receipt.receipt_id))
+                                        throw Error('P1_DUPLICATE_RECEIPT');
+                                    seen.add(receipt.receipt_id);
+                                    await readControls();
+                                    await assertModelFrozen();
+                                    const id = await publicationStep(() => append({ eventType: 'test_result', summary: 'runner command observed', payload: { observer: 'runner', runner_receipt: receipt } }, true));
+                                    p1ReceiptIds.push(id);
+                                }
+                            }
                             if (event.eventType === "completed" && fixSession) {
                                 // Stop only this owned model before running verified host publication.
                                 // Controls/heartbeat remain active throughout the publication phase.
@@ -547,6 +605,7 @@ export class ExecutionCoordinator {
             if (heartbeatTimer)
                 clearInterval(heartbeatTimer);
             lifecycle.current = false;
+            verificationAbort.abort();
             if (leaseBoundary)
                 clearTimeout(leaseBoundary);
             await fixSession?.close();

package/dist/src/daemon/runtime.js

@@ -58,6 +58,7 @@ export async function buildDaemon(input) {
     const state = new FileDaemonStateStore(input.stateRoot);
     const coordinator = new ExecutionCoordinator({
         localFixHost,
+        p1Host: input.p1Host,
         reportExecutionFailure: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "execution_failed", ...diagnostic })}\n`); },
         reportPreparationFailure: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "preparation_failed", ...diagnostic })}\n`); },
         terminalEvidenceCollector: buildTerminalEvidenceCollector(),

package/dist/src/gateway-client.js

@@ -32,15 +32,17 @@ function epochToIso(value) {
 function compactRecord(value) {
     return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined && item !== null && (!Array.isArray(item) || item.length > 0)));
 }
-function shadowTaskPackage(contract) {
+export function shadowTaskPackage(contract) {
     const payload = contract.contract_payload;
     const execution = nested(payload, "agent_execution");
     const brief = nested(execution, "implementation_brief");
+    const verification = nested(payload, 'verification.mode') === 'runner_observed_v1' ? payload.verification : undefined;
     const repositories = (payload.repositories ?? []).map((repository) => ({
         repository_key: requiredString(repository.repository_key, "repository key"),
         access: repository.access === "write" ? "write" : "read",
         responsibility: repository.responsibility === "primary" ? "primary" : "supporting",
         base_commit_sha: requiredString(repository.base_commit_sha, "base commit SHA"),
+        ...(verification ? { allowed_paths: repository.allowed_paths ?? [], blocked_paths: repository.blocked_paths ?? [], working_branch: repository.working_branch ?? null } : {}),
     }));
     const implementationBrief = compactRecord({
         design_artifact_id: brief.design_artifact_id,
@@ -55,6 +57,7 @@ function shadowTaskPackage(contract) {
     });
     return {
         bundle_version: "agent-execution-v1",
+        ...(verification ? { verification, candidate_limits: nested(payload, 'policy.candidate_limits') ?? {} } : {}),
         contract: compactRecord({
             id: requiredString(contract.id, "execution contract ID"),
             status: requiredString(contract.status, "execution contract status"),
@@ -354,6 +357,7 @@ export class McpGatewayClient {
         const fingerprint = requiredString(nested(context.bundle, "contract.content_fingerprint"), "contract fingerprint");
         const result = await this.callTool("agent_runtime_event_append", {
             binding_id: bindingId,
+            ...(nested(context.bundle, 'contract.verification.mode') === 'runner_observed_v1' || nested(context.bundle, 'verification.mode') === 'runner_observed_v1' ? { job_fence: context.jobFence } : {}),
             ...(isTerminalEventType(event.eventType) ? { lease_token: context.leaseToken } : {}),
             event: {
                 protocol_version: event.protocolVersion,
@@ -368,7 +372,7 @@ export class McpGatewayClient {
                 contract_fingerprint: fingerprint,
             },
         });
-        return { sequence: result.event.sequence };
+        return { sequence: result.event.sequence, ...(typeof result.event.id === 'string' ? { id: result.event.id } : {}) };
     }
     async readBindingEvents(bindingId, afterSequence) {
         const page = await this.callTool("agent_runtime_events_read", {
@@ -481,6 +485,7 @@ export class McpGatewayClient {
         const iterationId = requiredString(result.binding.iteration_id, "iteration ID");
         signal?.throwIfAborted();
         this.context = {
+            jobFence: { job_id: input.jobId, generation: input.generation, lease_token: input.jobLeaseToken },
             workLoopId: requiredString(result.work_loop_id, "Work Loop ID"),
             leaseToken: requiredString(result.lease_token, "Work Loop lease token"),
             leaseExpiresAt: epochToIso(result.binding.lease_expires_at),

package/dist/src/publication/candidate.js

@@ -2,10 +2,11 @@ import { createHash } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
-export function protocolHash(value) {
+export function protocolJson(value) {
     const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object' ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, c]) => [k, canonical(c)])) : v;
-    return createHash('sha256').update(JSON.stringify(canonical(value)).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`)).digest('hex');
+    return JSON.stringify(canonical(value)).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
 }
+export function protocolHash(value) { return createHash('sha256').update(protocolJson(value)).digest('hex'); }
 const denied = () => new Error('CANDIDATE_REJECTED');
 function freeze(v) { if (v && typeof v === 'object') {
     for (const c of Object.values(v))

package/dist/src/publication/git-snapshot.js

@@ -1,20 +1,24 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { constants } from 'node:fs';
-import { lstat, mkdir, mkdtemp, open, realpath, readdir, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import { deflateSync } from 'node:zlib';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash } from './candidate.js';
+import { RawGitObjects } from './raw-git-objects.js';
 const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const safe = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
+/** P1 branch shape only. Authority still requires exact frozen-fence equality. */
+export const isP1WorkingBranch = (branch) => typeof branch === 'string' && branch.length <= 255 && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(branch) && branch.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
 /** Reads only immutable Git objects and metadata. Never runs diff against worktree
  * content, where malicious clean filters can execute even with --no-ext-diff. */
 export class GitSnapshotHost {
     options;
     seals = new WeakSet();
+    ownedRoots = new Set();
     constructor(options) { this.options = structuredClone(options); }
     async git(args) {
         const o = this.options;
@@ -129,8 +133,8 @@ export class GitSnapshotHost {
         }
     }
     async capture() {
-        const o = this.options;
-        if (!/^[a-f0-9]{40}$/.test(o.baseCommitSha) || !/^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) || await realpath(o.root) !== o.root || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || !Number.isSafeInteger(o.maxTotalBytes) || o.maxTotalBytes < o.maxFileBytes)
+        const o = this.options, branchAllowed = o.p1WorkingBranch === undefined ? /^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) : o.p1WorkingBranch === o.workingBranch && isP1WorkingBranch(o.workingBranch);
+        if (!/^[a-f0-9]{40}$/.test(o.baseCommitSha) || !branchAllowed || await realpath(o.root) !== o.root || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || !Number.isSafeInteger(o.maxTotalBytes) || o.maxTotalBytes < o.maxFileBytes)
             throw denied();
         const head = (await this.git(['rev-parse', '--verify', 'HEAD'])).toString().trim(), branch = (await this.git(['symbolic-ref', '--short', 'HEAD'])).toString().trim();
         if (head !== o.baseCommitSha || branch !== o.workingBranch)
@@ -168,7 +172,7 @@ export class GitSnapshotHost {
         const files = [], changes = [];
         let total = 0;
         for (const name of [...names].sort()) {
-            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/')))
+            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
                 throw denied();
             const current = await this.currentFile(name), prior = base.get(name);
             let before = null;
@@ -194,7 +198,7 @@ export class GitSnapshotHost {
     /** Creates a separate local-only Git checkout with exact base parent objects.
      * Raw object copying and raw file writes invoke no filters, templates or hooks;
      * no local fetch/upload-pack, network or account credentials are involved. */
-    async publicationCheckout(sealed) {
+    async privateCheckout(sealed, prefix = 'publisher-') {
         try {
             if (!this.seals.has(sealed))
                 throw denied();
@@ -202,7 +206,8 @@ export class GitSnapshotHost {
             const o = this.options, parent = o.privateRoot;
             if (await realpath(parent) !== parent || (await lstat(parent)).mode & 0o077)
                 throw denied();
-            const root = await mkdtemp(path.join(parent, 'publisher-')), gitdir = path.join(root, '.git');
+            const root = await mkdtemp(path.join(parent, prefix)), gitdir = path.join(root, '.git');
+            this.ownedRoots.add(root);
             await mkdir(path.join(gitdir, 'objects'), { recursive: true, mode: 0o700 });
             const ref = path.join(gitdir, 'refs', 'heads', o.workingBranch);
             await mkdir(path.dirname(ref), { recursive: true, mode: 0o700 });
@@ -261,6 +266,81 @@ export class GitSnapshotHost {
             throw denied();
         }
     }
+    async publicationCheckout(sealed) { return this.privateCheckout(sealed); }
+    async assertSourceUnchanged(sealed) {
+        try {
+            if (!this.seals.has(sealed))
+                throw denied();
+            const capture = await this.capture();
+            if (protocolHash(capture.observation) !== protocolHash(sealed.observation) || protocolHash(capture.files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) }))) !== sealed.treeFingerprint)
+                throw denied();
+        }
+        catch {
+            throw denied();
+        }
+    }
+    /** Verification only; creates no publication capability or remote operation. */
+    async verificationCandidate(sealed) {
+        try {
+            if (this.options.p1WorkingBranch === undefined)
+                throw denied();
+            const root = await this.privateCheckout(sealed, 'verification-'), entries = [];
+            const walk = async (dir, prefix = '') => { for (const name of (await readdir(dir)).sort()) {
+                if (!prefix && name === '.git')
+                    continue;
+                const rel = prefix ? prefix + '/' + name : name, file = path.join(dir, name), s = await lstat(file);
+                if (s.isSymbolicLink() || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)))
+                    throw denied();
+                if (s.isDirectory())
+                    await walk(file, rel);
+                else
+                    entries.push({ path: rel, mode: s.mode & 0o111 ? 0o100755 : 0o100644, bytes: await readFile(file) });
+            } };
+            await walk(root);
+            entries.sort((a, b) => a.path < b.path ? -1 : 1);
+            if (protocolHash(entries.map(e => ({ path: e.path, mode: e.mode, sha256: digest(e.bytes) }))) !== sealed.treeFingerprint)
+                throw denied();
+            for (const line of (await this.git(['ls-tree', '-r', '-z', this.options.baseCommitSha])).toString().split('\0')) {
+                const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
+                if (link)
+                    entries.push({ path: link[2], mode: 0o160000, bytes: Buffer.alloc(0), gitlink: link[1] });
+            }
+            const objects = new RawGitObjects(root), tree = await objects.tree(entries, true), commitSha = await objects.object('commit', Buffer.from(`tree ${tree}\nparent ${this.options.baseCommitSha}\nauthor Local Runner Verification <runner-verification@invalid> 1 +0000\ncommitter Local Runner Verification <runner-verification@invalid> 1 +0000\n\nLocal runner verification candidate v1\n`), true);
+            await writeFile(path.join(root, '.git', 'HEAD'), commitSha + '\n', { mode: 0o600 });
+            // Bind every private checkout byte, including raw Git metadata, before tests.
+            const fingerprint = async () => { const values = []; const visit = async (dir, prefix = '') => { for (const name of (await readdir(dir)).sort()) {
+                const relative = prefix ? prefix + '/' + name : name, file = path.join(dir, name), s = await lstat(file);
+                if (s.isSymbolicLink() || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)))
+                    throw denied();
+                if (s.isDirectory())
+                    await visit(file, relative);
+                else
+                    values.push({ path: relative, mode: s.mode & 0o111 ? 0o100755 : 0o100644, sha256: await measureCommandFile(file) });
+            } }; await visit(root); return protocolHash(values); };
+            const expected = await fingerprint();
+            await sealed.assertUnchanged();
+            return Object.freeze({ root, commitSha, assertUnchanged: async () => { await sealed.assertUnchanged(); if (await fingerprint() !== expected)
+                    throw denied(); } });
+        }
+        catch {
+            throw denied();
+        }
+    }
+    /** Caller owns this lifecycle. Never returns success if private cleanup fails. */
+    async dispose() {
+        let failed = false;
+        for (const root of this.ownedRoots) {
+            try {
+                await rm(root, { recursive: true, force: true });
+                this.ownedRoots.delete(root);
+            }
+            catch {
+                failed = true;
+            }
+        }
+        if (failed)
+            throw denied();
+    }
     async observe() { try {
         const a = await this.capture(), b = await this.capture();
         if (a.fingerprint !== b.fingerprint)
@@ -282,6 +362,7 @@ export class GitSnapshotHost {
             if (!stat.isDirectory() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
                 throw denied();
             const capture = await this.capture(), root = await mkdtemp(path.join(parent, 'candidate-'));
+            this.ownedRoots.add(root);
             for (const f of capture.files) {
                 const file = path.join(root, f.path);
                 await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });

package/dist/src/publication/git-transport.js

@@ -1,10 +1,10 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
-import { deflateSync, inflateSync } from 'node:zlib';
-import { lstat, readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { lstat, readdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { protocolHash } from './candidate.js';
+import { RawGitObjects } from './raw-git-objects.js';
 import { assertPinnedGit, assertPrivateCheckout, publicationGitEnvironment, publicationGitArgs, strictPublicationOrigin } from './git-credential-broker.js';
 const execute = promisify(execFile), denied = () => Error('GIT_PUBLICATION_REJECTED');
 /** Only DeterministicPublisher may dispatch validated signed requests. This
@@ -79,34 +79,8 @@ export class GitPublicationTransport {
             throw denied();
         return entries;
     }
-    async object(type, bytes, write) { const raw = Buffer.concat([Buffer.from(`${type} ${bytes.length}\0`), bytes]), oid = createHash('sha1').update(raw).digest('hex'); if (write) {
-        const dir = path.join(this.options.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
-        await mkdir(dir, { recursive: true, mode: 0o700 });
-        try {
-            await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
-        }
-        catch (e) {
-            if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
-                throw denied();
-        }
-    } return oid; }
-    async tree(entries, write, prefix = '') {
-        const names = new Map();
-        const children = new Set();
-        for (const entry of entries) {
-            if (!entry.path.startsWith(prefix))
-                continue;
-            const rest = entry.path.slice(prefix.length), slash = rest.indexOf('/');
-            if (slash >= 0)
-                children.add(rest.slice(0, slash));
-            else
-                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
-        }
-        for (const child of children)
-            names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });
-        const chunks = [...names].sort(([a, av], [b, bv]) => Buffer.compare(Buffer.from(a + (av.mode === '40000' ? '/' : '')), Buffer.from(b + (bv.mode === '40000' ? '/' : '')))).map(([name, v]) => Buffer.concat([Buffer.from(`${v.mode} ${name}\0`), Buffer.from(v.oid, 'hex')]));
-        return this.object('tree', Buffer.concat(chunks), write);
-    }
+    async object(type, bytes, write) { return new RawGitObjects(this.options.checkout).object(type, bytes, write); }
+    async tree(entries, write) { return new RawGitObjects(this.options.checkout).tree(entries, write); }
     marker(r) { return `Local Fix ${r.attempt_id}\n\nLocal-Fix-Publication: ${r.publication_id}\nLocal-Fix-Candidate: ${r.candidate_fingerprint}\n`; }
     async commit(r, entries, write) { const tree = await this.tree(entries, write); return this.object('commit', Buffer.from(`tree ${tree}\nparent ${r.base_commit_sha}\nauthor Local Fix <local-fix@invalid> 1 +0000\ncommitter Local Fix <local-fix@invalid> 1 +0000\n\n${this.marker(r)}Local-Fix-Request: ${r.request_fingerprint}\n`), write); }
     scope(r) { return { origin: this.options.origin, checkout: this.options.checkout, ref: `refs/heads/${r.working_branch}`, sha: r.accepted_results.committed_sha }; }

package/dist/src/publication/isolated-verifier.js

@@ -6,25 +6,29 @@ import { protocolHash } from './candidate.js';
 /** Reuses the exact registered-command sandbox: no ambient credentials, network,
  * subprocess permissions, repository writes, or additional dependency grants.
  * Unsupported PHP/Node project commands remain denied by existing confinement. */
-function buildIsolatedVerifier(input, allowCandidateReads = false) {
+export async function createIsolatedCommandPolicy(input, allowCandidateReads = false) {
     const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
-    return async (snapshot) => {
-        const executionCommands = [];
-        for (const command of options.commands) {
-            const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
-            if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+    const executionCommands = [];
+    for (const command of options.commands) {
+        const derived = structuredClone(command), names = command.candidateReadPaths ?? [];
+        if (!Array.isArray(names) || new Set(names).size !== names.length || (!allowCandidateReads && names.length))
+            throw Error('ISOLATED_VERIFICATION_REJECTED');
+        for (const name of names) {
+            if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
                 throw Error('ISOLATED_VERIFICATION_REJECTED');
-            for (const name of names) {
-                if (typeof name !== 'string' || !name || path.isAbsolute(name) || name.includes('\\') || name.split('/').some(p => !p || p === '.' || p === '..' || /^(?:\.git|\.env(?:\..*)?|\.ssh|\.aws|\.codex|\.claude|\.npmrc|\.netrc|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)|AGENTS\.md|CLAUDE\.md)$/i.test(p)) || !options.allowedPaths.includes(name) || Object.hasOwn(command.integrity.readFiles, name) || options.blockedPaths.some(p => name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/')))
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                const file = path.join(options.root, name);
-                if (await realpath(file) !== file)
-                    throw Error('ISOLATED_VERIFICATION_REJECTED');
-                derived.integrity.readFiles[name] = await measureCommandFile(file);
-            }
-            executionCommands.push(derived);
+            const file = path.join(options.root, name);
+            if (await realpath(file) !== file)
+                throw Error('ISOLATED_VERIFICATION_REJECTED');
+            derived.integrity.readFiles[name] = await measureCommandFile(file);
         }
-        const policy = new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+        executionCommands.push(derived);
+    }
+    return new LocalToolPolicy({ worktreeRoot: options.root, access: 'read', allowedPaths: options.allowedPaths, blockedPaths: options.blockedPaths, requiredCommands: executionCommands.map(c => ({ ...c, readPaths: Object.keys(c.integrity.readFiles) })) });
+}
+function buildIsolatedVerifier(input, allowCandidateReads = false) {
+    const options = { ...input, commands: structuredClone(input.commands), allowedPaths: [...input.allowedPaths], blockedPaths: [...input.blockedPaths] };
+    return async (snapshot) => {
+        const policy = await createIsolatedCommandPolicy(options, allowCandidateReads);
         try {
             if (snapshot.commands.length !== options.commands.length)
                 throw Error('ISOLATED_VERIFICATION_REJECTED');

package/dist/src/publication/project-registration.js

@@ -5,7 +5,7 @@ import { evaluateCommand } from '../safety/command-policy.js';
 import { protocolHash } from './candidate.js';
 const denied = () => new Error('PROJECT_REGISTRATION_REJECTED');
 const privateSegment = /^(?:\.git|\.mcp(?:\..*)?|\.env(?:\..*)?|\.ssh|\.aws|\.config|\.codex|\.claude|\.runner|\.local-runner|\.npmrc|\.netrc|id_rsa|id_ed25519|credentials(?:\..*)?|auth\.(?:json|toml|ya?ml)(?:\..*)?|mcp\.(?:json|toml|ya?ml)(?:\..*)?|AGENTS\.md|CLAUDE\.md|vendor|node_modules)$/i;
-function exactName(name) { return typeof name === 'string' && !!name && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
+function exactName(name) { return typeof name === 'string' && !!name && !name.startsWith('-') && !path.isAbsolute(name) && !/[\\\0*?\[\]{}]/.test(name) && name.split('/').every(s => !!s && s !== '.' && s !== '..' && !privateSegment.test(s)); }
 function blocked(name, scopes) { return scopes.some(scope => scope === '.env.*' ? name.startsWith('.env.') : name === scope || name.startsWith(scope.replace(/\/\*\*$/, '') + '/')); }
 /** Validates reviewed exact registrations against the current host and scope.
  * Receipt authenticity/ownership belongs to host release attestation; this API