mtech-ai-local-runner 0.1.33 → 0.1.35

package/README.md

@@ -1,3 +1,37 @@
+## 0.1.35: exact approved source paths in Codex instructions
+
+Codex receives the approved checkout-relative paths, revision, access mode and
+blocked-path list from its binding bundle. A denial for an unlisted path does
+not imply that another approved file is unavailable. Scope descriptions exclude
+repository transport coordinates and write leases. Unregistered commands remain
+unavailable, and missing validation stays not_run/unverified.
+
+This patch does not expand source or tool permissions, change the Claude path,
+or authorize a new execution. Package integrity, runtime pins and a separately
+approved exact contract/launch remain required for the next Fix attempt.
+
+## 0.1.34: pinned writable Fix HEAD preparation
+
+Accept a linked worktree's symbolic HEAD only for the exact approved writable
+Fix branch and commit. Detached read-only checkouts retain their existing policy.
+Bounded, no-follow metadata reads reject ref chains, traversal, symlinks and
+post-preparation path changes. Preparation errors retain a safe substage code.
+This patch does not grant another execution: package/runtime pins, installation
+review and exact Gateway contract/launch approval remain required. Model work
+limits, personal login/settings and the Claude execution path are unchanged.
+
+## Unreleased: P1 runner-observed evidence (disabled)
+
+P1 adds candidate-bound command receipts and changed-path evidence for explicitly
+reviewed Codex Node/file-only profiles. It verifies a private exact-base candidate
+after the owned model stops; model test claims cannot satisfy the Loop criteria.
+P1 defaults off, the Gateway profile registry is empty, and the runtime P1 host
+is absent by default. Source package `0.1.33` is inherited from upstream; this is
+not a P1 package release or live acceptance. See the [P1 implementation and
+delivery record](../../docs/superpowers/plans/2026-10-17-local-runner-p1-runner-observed-evidence.md)
+for local verification results and separate deployment, runner-update and
+activation gates.
+
 ## Unreleased: P0 terminal safety baseline (local verification only)
 
 The upstream source package is `0.1.31`; P0 does not bump or publish a version.

package/dist/src/adapters/claude-code/adapter.js

@@ -3,6 +3,7 @@ import { requireSecurityRequirements } from '../../safety/security-requirements.
 import { createJobSecurityReceipt } from '../../safety/job-security-receipt.js';
 import { isTerminalEventType } from "../../protocol.js";
 import { parseClaudeLine } from "./stream-parser.js";
+import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 import { compilePrompt } from "./prompt-compiler.js";
 import { completionEvent } from "./completion-report.js";
 import { requireJobSecurity } from "../../safety/job-security-policy.js";
@@ -44,6 +45,7 @@ export class ClaudeCodeAdapter {
     tools;
     cancelled = false;
     started = false;
+    p1 = false;
     startupAcquisition;
     revokedTools;
     revokeFailed = false;
@@ -71,6 +73,7 @@ export class ClaudeCodeAdapter {
         if (this.started)
             throw new Error("adapter has already been started");
         this.started = true;
+        this.p1 = ctx.approvedTaskPackage?.verification?.mode === 'runner_observed_v1';
         const generation = ctx.generation;
         if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
             throw new Error("JOB_SECURITY_REJECTED");
@@ -207,11 +210,14 @@ export class ClaudeCodeAdapter {
                 // A nested agent message is not evidence that the executor has finished.
                 if (message.parent_tool_use_id != null)
                     continue;
-                let parsed = parseClaudeLine(line, this.options.worktreeRoot);
+                let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1 });
                 if (!parsed)
                     continue;
                 if (parsed.eventType === "completed") {
+                    const observedUsage = parsed.payload?.usage;
                     parsed = completionEvent(message.result, parsed.payload?.cost_usd);
+                    if (this.p1)
+                        parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }
                 if (isTerminalEventType(parsed.eventType))
                     sawTerminal = true;

package/dist/src/adapters/claude-code/stream-parser.js

@@ -1,5 +1,6 @@
 import { isAbsolute, relative, resolve } from "node:path";
 import { MAX_EVENT_SUMMARY_CHARS } from "../../protocol.js";
+import { p1ModelEvent } from '../../verification/p1-execution-host.js';
 const EDIT_TOOL_NAMES = new Set(["Edit", "Write", "MultiEdit"]);
 function bounded(summary) {
     return summary.length > MAX_EVENT_SUMMARY_CHARS ? summary.slice(0, MAX_EVENT_SUMMARY_CHARS) : summary;
@@ -105,7 +106,7 @@ function parseResultMessage(message) {
     const summary = subtype === "error_max_budget_exceeded" ? "execution failed: budget exceeded" : "execution failed";
     return { eventType: "failed", summary, payload: costUsd !== undefined ? { cost_usd: costUsd } : undefined };
 }
-export function parseClaudeLine(line, worktreeRoot) {
+export function parseClaudeLine(line, worktreeRoot, options = {}) {
     let message;
     try {
         message = JSON.parse(line);
@@ -113,16 +114,25 @@ export function parseClaudeLine(line, worktreeRoot) {
     catch {
         return null;
     }
-    switch (message.type) {
-        case "system":
-            return parseSystemMessage(message);
-        case "assistant":
-            return parseAssistantMessage(message.message ?? {}, worktreeRoot);
-        case "user":
-            return parseUserMessage(message.message ?? {});
-        case "result":
-            return parseResultMessage(message);
-        default:
-            return null;
+    const parsed = (() => {
+        switch (message.type) {
+            case "system":
+                return parseSystemMessage(message);
+            case "assistant":
+                return parseAssistantMessage(message.message ?? {}, worktreeRoot);
+            case "user":
+                return parseUserMessage(message.message ?? {});
+            case "result":
+                return parseResultMessage(message);
+            default:
+                return null;
+        }
+    })();
+    if (!options.p1 || !parsed)
+        return parsed;
+    if (message.type === 'result') {
+        const usage = message.usage && typeof message.usage === 'object' ? message.usage : {};
+        parsed.payload = { ...parsed.payload, usage: { provider: 'anthropic', source: 'claude_code_cli.result', input_tokens: usage.input_tokens, cached_input_tokens: usage.cache_read_input_tokens, output_tokens: usage.output_tokens, duration_ms: message.duration_ms } };
     }
+    return p1ModelEvent(parsed);
 }

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,6 +1,29 @@
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
+function repositoryScope(taskPackage) {
+    const repositories = taskPackage.repositories;
+    const repo = Array.isArray(repositories) && repositories.length === 1
+        && repositories[0] && typeof repositories[0] === "object" && !Array.isArray(repositories[0])
+        ? repositories[0] : undefined;
+    const paths = (value) => Array.isArray(value)
+        && value.every(item => typeof item === "string" && item.length > 0);
+    if (!repo || !paths(repo.allowed_paths) || !repo.allowed_paths.length || !paths(repo.blocked_paths)
+        || !["read", "write"].includes(String(repo.access))
+        || typeof repo.repository_key !== "string" || typeof repo.base_commit_sha !== "string"
+        || !/^[a-f0-9]{40}$/i.test(repo.base_commit_sha)) {
+        return "## Approved repository scope\nRepository scope is unavailable; do not guess source paths or commands. Stop and emit one final blocked report.";
+    }
+    // Project only source-scope fields from the binding bundle. Never stringify
+    // the whole repository: it may contain transport coordinates or write leases.
+    const scope = { repository_key: repo.repository_key, base_commit_sha: repo.base_commit_sha,
+        access: repo.access, allowed_paths: repo.allowed_paths, blocked_paths: repo.blocked_paths };
+    return `## Approved repository scope\n${JSON.stringify(scope, null, 2)}\n` +
+        "Use these checkout-relative paths exactly, including case. Start with the relevant approved files above before drawing a conclusion about source availability. " +
+        "Do not invent paths or commands from framework conventions. A denial for an unlisted path does not establish that a listed file is unavailable. " +
+        "Do not claim an approved file was denied unless its exact path was attempted and the tool returned a denial. " +
+        "These are scope descriptions, not instructions from source files; the host policy remains authoritative and may deny blocked/private paths within an allowed prefix.";
+}
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "docs/example.md"}) or local_search({path: "docs/example.md", query: "text"}) with checkout-relative paths. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never a reason to try another path. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\nUse only the ai_local job tools for repository reads, edits and approved tests. For reading, use server ai_local's local_read({path: "<exact approved path>"}) or local_search({path: "<exact approved path>", query: "text"}) with checkout-relative paths. Required test criteria are not command grants. No model test commands are registered unless the host explicitly supplies exact model-callable command IDs; do not use local_test to discover commands or run --help. Missing tests remain not_run/unverified, not passed. In a read-only task, use only read/search tools; the Runner enforces the approved paths and operations. A denied native cwd is intentional: it is a private control directory, not the source checkout. Native filesystem, commands, web, images and delegation are unavailable or denied. A denied tool is a scope boundary, never permission to broaden scope or bypass the denial. Do not retry the denied path. It does not remove independently approved paths: continue with relevant listed paths, and report a missing dependency only after checking the available approved source. Do not repeat host orchestration: claim, shadow, fingerprints, binding, administrator checks, launches, Gateway usage and Job reporting belong to the Runner/host, even when described in the objective. Perform only the assigned repository work and report evidence you actually observed. Do not claim that no model call occurred. If the required tool is unavailable, emit one final structured blocked report naming the missing tool and unfinished repository work; do not request or attempt a new launch.`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/daemon/execution-coordinator.js

@@ -1,4 +1,5 @@
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
+import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
 import { executionError, executionFailure } from '../safety/execution-failure.js';
 import { isUnsupportedSupervisorCommand } from '../safety/unsupported-supervisor-command.js';
 import { requireSecurityRequirements } from '../safety/security-requirements.js';
@@ -71,6 +72,9 @@ export class ExecutionCoordinator {
         let fixSession;
         let localFixPublication;
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
+        const isP1 = hasP1(job.taskPackage);
+        let p1Result;
+        const p1ReceiptIds = [];
         const lifecycle = { frozen: false, current: true };
         const deadline = Date.now() + (this.deps.preparationTimeoutMs ?? 900_000);
         let leaseExpiresAt = job.leaseExpiresAt;
@@ -80,6 +84,12 @@ export class ExecutionCoordinator {
         try {
             await preparation.start();
             const pkg = job.taskPackage;
+            if (isP1) {
+                assertP1Bindings(pkg);
+                if (!this.deps.p1Host)
+                    throw Error('P1_HOST_REQUIRED');
+                this.deps.p1Host.assertEligible(job);
+            }
             if (isLocalFix && (!this.deps.localFixHost || pkg.repository?.access !== "write"))
                 throw new LocalFixHostRequired();
             const repository = pkg.repository;
@@ -96,7 +106,8 @@ export class ExecutionCoordinator {
                 repositoryKey: text(repository?.key, "repository key"),
                 providerUrl: text(repository?.provider_url, "repository provider URL"),
                 baseCommitSha: text(repository?.base_commit_sha, "repository SHA"),
-                ...(isLocalFix ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {})
+                ...(isLocalFix || isP1 ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {}),
+                ...(isP1 ? { p1WorkingBranch: text(repository?.working_branch, 'approved P1 branch') } : {})
             }));
             stage = "adapter";
             adapter = await preparation.step(() => this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id }), late => late.cancel());
@@ -107,11 +118,17 @@ export class ExecutionCoordinator {
             if (contractFingerprint(gatewayShadow.contractPayload) !== expectedContractFingerprint || gatewayShadow.contractFingerprint !== expectedContractFingerprint || gatewayShadow.taskPackageFingerprint !== fingerprint(pkg)) {
                 throw new GatewayToolError("contract or task-package fingerprint mismatch before binding", 'work_execution_contract_show', 'JOB_SHADOW_FENCE_INVALID');
             }
+            if (isP1)
+                assertP1Bindings(pkg, gatewayShadow.contractPayload);
+            else if (hasP1(gatewayShadow.contractPayload))
+                throw Error('P1_CONTRACT_REJECTED');
             stage = "binding";
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "binding" }));
             preparation.beginBinding();
             bindingAttempted = true;
             binding = await step(() => this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path }, preparation.signal));
+            if (isP1)
+                assertP1Bindings(pkg, binding.taskPackage, true);
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest }));
             await preparation.stop();
             preparation.assert();
@@ -164,6 +181,7 @@ export class ExecutionCoordinator {
         const executor = adapter;
         let heartbeatFailure;
         const evidenceAbort = new AbortController();
+        const verificationAbort = new AbortController();
         const controlAbort = new AbortController();
         let leaseBoundary;
         let rejectFence;
@@ -202,6 +220,7 @@ export class ExecutionCoordinator {
             heartbeatFailure = executionError(error, 'heartbeat', 'EXECUTION_FAILED');
             controlAbort.abort();
             evidenceAbort.abort();
+            verificationAbort.abort();
             rejectFence(heartbeatFailure);
             // Cancellation cannot queue behind transport or generator cleanup.
             void stopExecutor().catch(() => { });
@@ -239,6 +258,8 @@ export class ExecutionCoordinator {
                     let commandTerminal;
                     if (["cancel", "pause", "request_replan"].includes(command.command)) {
                         lifecycle.current = false;
+                        if (isP1)
+                            verificationAbort.abort();
                         commandTerminal = { eventType: "cancelled", summary: `supervisor ${command.command} acknowledged`,
                             payload: { reason: command.command === 'pause' ? 'paused' : command.command === 'request_replan' ? 'replan_requested' : 'cancelled' } };
                         await stopExecutor();
@@ -253,6 +274,8 @@ export class ExecutionCoordinator {
                             if (!isUnsupportedSupervisorCommand(error))
                                 throw error;
                             lifecycle.current = false;
+                            if (isP1)
+                                verificationAbort.abort();
                             await stopExecutor();
                             requireControlFence();
                             commandTerminal = { eventType: 'failed', summary: 'supervisor command is unsupported for the approved launch',
@@ -329,7 +352,9 @@ export class ExecutionCoordinator {
             if (!ignoreControlFailure && (controlFailure || heartbeatFailure))
                 throw controlFailure || heartbeatFailure;
         };
-        const append = async (event) => {
+        const append = async (event, hostProof = false) => {
+            if (isP1 && !hostProof)
+                event = p1ModelEvent(event);
             const previousStage = executionStage;
             let payload = event.payload;
             if (isTerminalEventType(event.eventType)) {
@@ -338,6 +363,8 @@ export class ExecutionCoordinator {
                 const evidence = localFixPublication && typeof localFixPublication.diff_hash === 'string' && typeof localFixPublication.changed_file_manifest_hash === 'string' ? { diffHash: localFixPublication.diff_hash, changedFileManifestHash: localFixPublication.changed_file_manifest_hash } : await fenced(this.deps.terminalEvidenceCollector.collect({ checkoutPath: workspace.path, baseSha: workspace.baseCommitSha, signal: evidenceAbort.signal }));
                 requireControlFence();
                 payload = { ...payload, diff_hash: evidence.diffHash, changed_file_manifest_hash: evidence.changedFileManifestHash };
+                if (isP1 && event.eventType === 'completed' && p1Result)
+                    payload = { ...payload, candidate_commit_sha: p1Result.candidate_commit_sha, snapshot_fingerprint: p1Result.snapshot_fingerprint, changed_paths: p1Result.changed_paths, verification_receipt_ids: [...p1ReceiptIds] };
             }
             // A vendor report cannot supply host observations, even when its shape looks valid.
             if (payload) {
@@ -373,8 +400,11 @@ export class ExecutionCoordinator {
             }
             requireControlFence();
             eventUncertain = true;
-            await fenced(this.deps.gateway.appendEvent(binding.bindingId, normalized));
+            const receipt = await fenced(this.deps.gateway.appendEvent(binding.bindingId, normalized));
             requireControlFence();
+            const eventId = receipt?.id;
+            if (isP1 && hostProof && (typeof eventId !== 'string' || !eventId.trim() || p1ReceiptIds.includes(eventId)))
+                throw Error('P1_EVENT_ID_UNCONFIRMED');
             sequence = normalized.sequence;
             executionStage = 'state_save';
             if (event.eventType === "checkpoint_ready")
@@ -382,6 +412,7 @@ export class ExecutionCoordinator {
             await this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, eventCursor: sequence, ...(isTerminalEventType(event.eventType) ? { terminalEventType: event.eventType } : {}), workspaceManifest: workspace.manifest });
             eventUncertain = false;
             executionStage = previousStage;
+            return typeof eventId === 'string' ? eventId : undefined;
         };
         const publicationStep = async (operation) => {
             requireControlFence();
@@ -434,6 +465,33 @@ export class ExecutionCoordinator {
                         if (requestedTerminal)
                             break;
                         if (isTerminalEventType(event.eventType)) {
+                            if (event.eventType === 'completed' && isP1) {
+                                if (!adapter.freezeForPublication)
+                                    throw Error('P1_OWNED_FREEZE_UNAVAILABLE');
+                                const current = async () => { requireControlFence(); return lifecycle.current && !requestedTerminal && !verificationAbort.signal.aborted; };
+                                const assertModelFrozen = async () => { if (!await current() || !lifecycle.frozen)
+                                    throw Error('P1_MODEL_NOT_FROZEN'); };
+                                const freezeOwnedModel = async () => { if (!await current())
+                                    throw Error('P1_FENCE_LOST'); if (!lifecycle.frozen) {
+                                    await publicationStep(() => adapter.freezeForPublication());
+                                    lifecycle.frozen = true;
+                                } await assertModelFrozen(); };
+                                await freezeOwnedModel();
+                                await readControls();
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen }));
+                                await readControls();
+                                await assertModelFrozen();
+                                const seen = new Set();
+                                for (const receipt of p1Result.receipts) {
+                                    if (seen.has(receipt.receipt_id))
+                                        throw Error('P1_DUPLICATE_RECEIPT');
+                                    seen.add(receipt.receipt_id);
+                                    await readControls();
+                                    await assertModelFrozen();
+                                    const id = await publicationStep(() => append({ eventType: 'test_result', summary: 'runner command observed', payload: { observer: 'runner', runner_receipt: receipt } }, true));
+                                    p1ReceiptIds.push(id);
+                                }
+                            }
                             if (event.eventType === "completed" && fixSession) {
                                 // Stop only this owned model before running verified host publication.
                                 // Controls/heartbeat remain active throughout the publication phase.
@@ -547,6 +605,7 @@ export class ExecutionCoordinator {
             if (heartbeatTimer)
                 clearInterval(heartbeatTimer);
             lifecycle.current = false;
+            verificationAbort.abort();
             if (leaseBoundary)
                 clearTimeout(leaseBoundary);
             await fixSession?.close();

package/dist/src/daemon/runtime.js

@@ -58,6 +58,7 @@ export async function buildDaemon(input) {
     const state = new FileDaemonStateStore(input.stateRoot);
     const coordinator = new ExecutionCoordinator({
         localFixHost,
+        p1Host: input.p1Host,
         reportExecutionFailure: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "execution_failed", ...diagnostic })}\n`); },
         reportPreparationFailure: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "preparation_failed", ...diagnostic })}\n`); },
         terminalEvidenceCollector: buildTerminalEvidenceCollector(),

package/dist/src/gateway-client.js

@@ -32,15 +32,17 @@ function epochToIso(value) {
 function compactRecord(value) {
     return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined && item !== null && (!Array.isArray(item) || item.length > 0)));
 }
-function shadowTaskPackage(contract) {
+export function shadowTaskPackage(contract) {
     const payload = contract.contract_payload;
     const execution = nested(payload, "agent_execution");
     const brief = nested(execution, "implementation_brief");
+    const verification = nested(payload, 'verification.mode') === 'runner_observed_v1' ? payload.verification : undefined;
     const repositories = (payload.repositories ?? []).map((repository) => ({
         repository_key: requiredString(repository.repository_key, "repository key"),
         access: repository.access === "write" ? "write" : "read",
         responsibility: repository.responsibility === "primary" ? "primary" : "supporting",
         base_commit_sha: requiredString(repository.base_commit_sha, "base commit SHA"),
+        ...(verification ? { allowed_paths: repository.allowed_paths ?? [], blocked_paths: repository.blocked_paths ?? [], working_branch: repository.working_branch ?? null } : {}),
     }));
     const implementationBrief = compactRecord({
         design_artifact_id: brief.design_artifact_id,
@@ -55,6 +57,7 @@ function shadowTaskPackage(contract) {
     });
     return {
         bundle_version: "agent-execution-v1",
+        ...(verification ? { verification, candidate_limits: nested(payload, 'policy.candidate_limits') ?? {} } : {}),
         contract: compactRecord({
             id: requiredString(contract.id, "execution contract ID"),
             status: requiredString(contract.status, "execution contract status"),
@@ -354,6 +357,7 @@ export class McpGatewayClient {
         const fingerprint = requiredString(nested(context.bundle, "contract.content_fingerprint"), "contract fingerprint");
         const result = await this.callTool("agent_runtime_event_append", {
             binding_id: bindingId,
+            ...(nested(context.bundle, 'contract.verification.mode') === 'runner_observed_v1' || nested(context.bundle, 'verification.mode') === 'runner_observed_v1' ? { job_fence: context.jobFence } : {}),
             ...(isTerminalEventType(event.eventType) ? { lease_token: context.leaseToken } : {}),
             event: {
                 protocol_version: event.protocolVersion,
@@ -368,7 +372,7 @@ export class McpGatewayClient {
                 contract_fingerprint: fingerprint,
             },
         });
-        return { sequence: result.event.sequence };
+        return { sequence: result.event.sequence, ...(typeof result.event.id === 'string' ? { id: result.event.id } : {}) };
     }
     async readBindingEvents(bindingId, afterSequence) {
         const page = await this.callTool("agent_runtime_events_read", {
@@ -481,6 +485,7 @@ export class McpGatewayClient {
         const iterationId = requiredString(result.binding.iteration_id, "iteration ID");
         signal?.throwIfAborted();
         this.context = {
+            jobFence: { job_id: input.jobId, generation: input.generation, lease_token: input.jobLeaseToken },
             workLoopId: requiredString(result.work_loop_id, "Work Loop ID"),
             leaseToken: requiredString(result.lease_token, "Work Loop lease token"),
             leaseExpiresAt: epochToIso(result.binding.lease_expires_at),

package/dist/src/publication/candidate.js

@@ -2,10 +2,11 @@ import { createHash } from 'node:crypto';
 import { lstat, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
-export function protocolHash(value) {
+export function protocolJson(value) {
     const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === 'object' ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, c]) => [k, canonical(c)])) : v;
-    return createHash('sha256').update(JSON.stringify(canonical(value)).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`)).digest('hex');
+    return JSON.stringify(canonical(value)).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
 }
+export function protocolHash(value) { return createHash('sha256').update(protocolJson(value)).digest('hex'); }
 const denied = () => new Error('CANDIDATE_REJECTED');
 function freeze(v) { if (v && typeof v === 'object') {
     for (const c of Object.values(v))

package/dist/src/publication/git-snapshot.js

@@ -1,20 +1,24 @@
 import { execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { constants } from 'node:fs';
-import { lstat, mkdir, mkdtemp, open, realpath, readdir, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import { deflateSync } from 'node:zlib';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash } from './candidate.js';
+import { RawGitObjects } from './raw-git-objects.js';
 const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const safe = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
+/** P1 branch shape only. Authority still requires exact frozen-fence equality. */
+export const isP1WorkingBranch = (branch) => typeof branch === 'string' && branch.length <= 255 && /^ai-work\/[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(branch) && branch.split('/').every(p => !p.includes('..') && !p.endsWith('.') && !p.endsWith('.lock'));
 /** Reads only immutable Git objects and metadata. Never runs diff against worktree
  * content, where malicious clean filters can execute even with --no-ext-diff. */
 export class GitSnapshotHost {
     options;
     seals = new WeakSet();
+    ownedRoots = new Set();
     constructor(options) { this.options = structuredClone(options); }
     async git(args) {
         const o = this.options;
@@ -129,8 +133,8 @@ export class GitSnapshotHost {
         }
     }
     async capture() {
-        const o = this.options;
-        if (!/^[a-f0-9]{40}$/.test(o.baseCommitSha) || !/^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) || await realpath(o.root) !== o.root || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || !Number.isSafeInteger(o.maxTotalBytes) || o.maxTotalBytes < o.maxFileBytes)
+        const o = this.options, branchAllowed = o.p1WorkingBranch === undefined ? /^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) : o.p1WorkingBranch === o.workingBranch && isP1WorkingBranch(o.workingBranch);
+        if (!/^[a-f0-9]{40}$/.test(o.baseCommitSha) || !branchAllowed || await realpath(o.root) !== o.root || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || !Number.isSafeInteger(o.maxTotalBytes) || o.maxTotalBytes < o.maxFileBytes)
             throw denied();
         const head = (await this.git(['rev-parse', '--verify', 'HEAD'])).toString().trim(), branch = (await this.git(['symbolic-ref', '--short', 'HEAD'])).toString().trim();
         if (head !== o.baseCommitSha || branch !== o.workingBranch)
@@ -168,7 +172,7 @@ export class GitSnapshotHost {
         const files = [], changes = [];
         let total = 0;
         for (const name of [...names].sort()) {
-            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/')))
+            if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
                 throw denied();
             const current = await this.currentFile(name), prior = base.get(name);
             let before = null;
@@ -194,7 +198,7 @@ export class GitSnapshotHost {
     /** Creates a separate local-only Git checkout with exact base parent objects.
      * Raw object copying and raw file writes invoke no filters, templates or hooks;
      * no local fetch/upload-pack, network or account credentials are involved. */
-    async publicationCheckout(sealed) {
+    async privateCheckout(sealed, prefix = 'publisher-') {
         try {
             if (!this.seals.has(sealed))
                 throw denied();
@@ -202,7 +206,8 @@ export class GitSnapshotHost {
             const o = this.options, parent = o.privateRoot;
             if (await realpath(parent) !== parent || (await lstat(parent)).mode & 0o077)
                 throw denied();
-            const root = await mkdtemp(path.join(parent, 'publisher-')), gitdir = path.join(root, '.git');
+            const root = await mkdtemp(path.join(parent, prefix)), gitdir = path.join(root, '.git');
+            this.ownedRoots.add(root);
             await mkdir(path.join(gitdir, 'objects'), { recursive: true, mode: 0o700 });
             const ref = path.join(gitdir, 'refs', 'heads', o.workingBranch);
             await mkdir(path.dirname(ref), { recursive: true, mode: 0o700 });
@@ -261,6 +266,81 @@ export class GitSnapshotHost {
             throw denied();
         }
     }
+    async publicationCheckout(sealed) { return this.privateCheckout(sealed); }
+    async assertSourceUnchanged(sealed) {
+        try {
+            if (!this.seals.has(sealed))
+                throw denied();
+            const capture = await this.capture();
+            if (protocolHash(capture.observation) !== protocolHash(sealed.observation) || protocolHash(capture.files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) }))) !== sealed.treeFingerprint)
+                throw denied();
+        }
+        catch {
+            throw denied();
+        }
+    }
+    /** Verification only; creates no publication capability or remote operation. */
+    async verificationCandidate(sealed) {
+        try {
+            if (this.options.p1WorkingBranch === undefined)
+                throw denied();
+            const root = await this.privateCheckout(sealed, 'verification-'), entries = [];
+            const walk = async (dir, prefix = '') => { for (const name of (await readdir(dir)).sort()) {
+                if (!prefix && name === '.git')
+                    continue;
+                const rel = prefix ? prefix + '/' + name : name, file = path.join(dir, name), s = await lstat(file);
+                if (s.isSymbolicLink() || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)))
+                    throw denied();
+                if (s.isDirectory())
+                    await walk(file, rel);
+                else
+                    entries.push({ path: rel, mode: s.mode & 0o111 ? 0o100755 : 0o100644, bytes: await readFile(file) });
+            } };
+            await walk(root);
+            entries.sort((a, b) => a.path < b.path ? -1 : 1);
+            if (protocolHash(entries.map(e => ({ path: e.path, mode: e.mode, sha256: digest(e.bytes) }))) !== sealed.treeFingerprint)
+                throw denied();
+            for (const line of (await this.git(['ls-tree', '-r', '-z', this.options.baseCommitSha])).toString().split('\0')) {
+                const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
+                if (link)
+                    entries.push({ path: link[2], mode: 0o160000, bytes: Buffer.alloc(0), gitlink: link[1] });
+            }
+            const objects = new RawGitObjects(root), tree = await objects.tree(entries, true), commitSha = await objects.object('commit', Buffer.from(`tree ${tree}\nparent ${this.options.baseCommitSha}\nauthor Local Runner Verification <runner-verification@invalid> 1 +0000\ncommitter Local Runner Verification <runner-verification@invalid> 1 +0000\n\nLocal runner verification candidate v1\n`), true);
+            await writeFile(path.join(root, '.git', 'HEAD'), commitSha + '\n', { mode: 0o600 });
+            // Bind every private checkout byte, including raw Git metadata, before tests.
+            const fingerprint = async () => { const values = []; const visit = async (dir, prefix = '') => { for (const name of (await readdir(dir)).sort()) {
+                const relative = prefix ? prefix + '/' + name : name, file = path.join(dir, name), s = await lstat(file);
+                if (s.isSymbolicLink() || (!s.isDirectory() && (!s.isFile() || s.nlink !== 1)))
+                    throw denied();
+                if (s.isDirectory())
+                    await visit(file, relative);
+                else
+                    values.push({ path: relative, mode: s.mode & 0o111 ? 0o100755 : 0o100644, sha256: await measureCommandFile(file) });
+            } }; await visit(root); return protocolHash(values); };
+            const expected = await fingerprint();
+            await sealed.assertUnchanged();
+            return Object.freeze({ root, commitSha, assertUnchanged: async () => { await sealed.assertUnchanged(); if (await fingerprint() !== expected)
+                    throw denied(); } });
+        }
+        catch {
+            throw denied();
+        }
+    }
+    /** Caller owns this lifecycle. Never returns success if private cleanup fails. */
+    async dispose() {
+        let failed = false;
+        for (const root of this.ownedRoots) {
+            try {
+                await rm(root, { recursive: true, force: true });
+                this.ownedRoots.delete(root);
+            }
+            catch {
+                failed = true;
+            }
+        }
+        if (failed)
+            throw denied();
+    }
     async observe() { try {
         const a = await this.capture(), b = await this.capture();
         if (a.fingerprint !== b.fingerprint)
@@ -282,6 +362,7 @@ export class GitSnapshotHost {
             if (!stat.isDirectory() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
                 throw denied();
             const capture = await this.capture(), root = await mkdtemp(path.join(parent, 'candidate-'));
+            this.ownedRoots.add(root);
             for (const f of capture.files) {
                 const file = path.join(root, f.path);
                 await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });

package/dist/src/publication/git-transport.js

@@ -1,10 +1,10 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
-import { deflateSync, inflateSync } from 'node:zlib';
-import { lstat, readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { lstat, readdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { protocolHash } from './candidate.js';
+import { RawGitObjects } from './raw-git-objects.js';
 import { assertPinnedGit, assertPrivateCheckout, publicationGitEnvironment, publicationGitArgs, strictPublicationOrigin } from './git-credential-broker.js';
 const execute = promisify(execFile), denied = () => Error('GIT_PUBLICATION_REJECTED');
 /** Only DeterministicPublisher may dispatch validated signed requests. This
@@ -79,34 +79,8 @@ export class GitPublicationTransport {
             throw denied();
         return entries;
     }
-    async object(type, bytes, write) { const raw = Buffer.concat([Buffer.from(`${type} ${bytes.length}\0`), bytes]), oid = createHash('sha1').update(raw).digest('hex'); if (write) {
-        const dir = path.join(this.options.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
-        await mkdir(dir, { recursive: true, mode: 0o700 });
-        try {
-            await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
-        }
-        catch (e) {
-            if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
-                throw denied();
-        }
-    } return oid; }
-    async tree(entries, write, prefix = '') {
-        const names = new Map();
-        const children = new Set();
-        for (const entry of entries) {
-            if (!entry.path.startsWith(prefix))
-                continue;
-            const rest = entry.path.slice(prefix.length), slash = rest.indexOf('/');
-            if (slash >= 0)
-                children.add(rest.slice(0, slash));
-            else
-                names.set(rest, { mode: entry.mode.toString(8), oid: entry.gitlink ?? await this.object('blob', entry.bytes, write) });
-        }
-        for (const child of children)
-            names.set(child, { mode: '40000', oid: await this.tree(entries, write, prefix + child + '/') });
-        const chunks = [...names].sort(([a, av], [b, bv]) => Buffer.compare(Buffer.from(a + (av.mode === '40000' ? '/' : '')), Buffer.from(b + (bv.mode === '40000' ? '/' : '')))).map(([name, v]) => Buffer.concat([Buffer.from(`${v.mode} ${name}\0`), Buffer.from(v.oid, 'hex')]));
-        return this.object('tree', Buffer.concat(chunks), write);
-    }
+    async object(type, bytes, write) { return new RawGitObjects(this.options.checkout).object(type, bytes, write); }
+    async tree(entries, write) { return new RawGitObjects(this.options.checkout).tree(entries, write); }
     marker(r) { return `Local Fix ${r.attempt_id}\n\nLocal-Fix-Publication: ${r.publication_id}\nLocal-Fix-Candidate: ${r.candidate_fingerprint}\n`; }
     async commit(r, entries, write) { const tree = await this.tree(entries, write); return this.object('commit', Buffer.from(`tree ${tree}\nparent ${r.base_commit_sha}\nauthor Local Fix <local-fix@invalid> 1 +0000\ncommitter Local Fix <local-fix@invalid> 1 +0000\n\n${this.marker(r)}Local-Fix-Request: ${r.request_fingerprint}\n`), write); }
     scope(r) { return { origin: this.options.origin, checkout: this.options.checkout, ref: `refs/heads/${r.working_branch}`, sha: r.accepted_results.committed_sha }; }