mtech-ai-local-runner 0.1.43 → 0.1.45

package/README.md

@@ -1,3 +1,38 @@
+## 0.1.45: pin official Codex alpha.11 outside the app
+
+Manual and daemon Codex registration now require the reviewed official standalone
+`codex-cli 0.163.0-alpha.11` (SHA256
+`80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466`) at
+`<employee-home>/.local/share/mtec-ai-local-runner/codex/0.163.0-alpha.11/<sha256>/codex`.
+There is no ChatGPT app, PATH or environment fallback. A missing, changed,
+symlinked, foreign-owned or group/world-writable installation blocks Codex.
+Existing login/settings, the Claude path, policy observer and execution limits
+are unchanged. This package does not install the standalone automatically;
+provisioning, exact Gateway runtime pins and daemon transition need their own
+reviewed delivery plan. A package update alone is not a successful transition.
+
+Executable integrity checks still hash every byte on every call, with a bounded
+1 MiB read buffer to reduce repeated filesystem dispatch. Tests separate
+independent scenarios and distinguish completion output from actual target exit.
+No timeout was expanded. The historical MCP startup timeout is not declared fixed.
+
+### Interactive LaunchAgent
+
+`setup` writes the runner LaunchAgent with `ProcessType` `Interactive`. The `Background` class kept the daemon, Codex and
+every verification command at priority 4 on the efficiency cores, so P1 verification took 12.5 minutes on a busy Mac;
+`Standard` was barely faster. An installed agent changes class only when its plist is rewritten and reloaded;
+`launchctl print gui/$(id -u)/com.mtec.ai-local-runner` should then show `spawn type = interactive (4)`.
+
+## 0.1.44: stop repeating whole-checkout checks in P1 verification
+
+The P1 verifier rereads the whole model checkout for every source check and every candidate check. On the AI
+Gateway repository (3,781 files) the live pilot spent about 12.5 minutes in `p1_verify`, and part of that was the same
+check run twice with nothing in between. Each command is now bracketed by one fresh source check and one fresh
+candidate check: before the first command, between commands and after the last. A source re-check compares the Git
+listings and every file's mode and sha256 with the values recorded at the seal instead of rereading every base blob,
+and an object already present in the private checkout is verified without being compressed again. Every file is
+still read and hashed at each check, so the same changes are rejected as before.
+
 ## 0.1.43: give whole-checkout snapshots whole-checkout bounds
 
 The P1 verifier snapshots the whole model checkout before it runs the reviewed commands. It passed the candidate limits

package/dist/src/platform/macos/launchd.js

@@ -26,6 +26,9 @@ export class LaunchdService {
         this.deps = deps;
         this.plistPath = join(deps.home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     }
+    // Interactive, because the employee waits on every job and its verification. Background kept
+    // the daemon on the efficiency cores at priority 4, and Standard (priority 20) was barely faster
+    // on a busy Mac: P1 verification took 553-698 s there against 60-165 s at priority 31.
     render(executablePath, stateRoot) {
         return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -34,7 +37,7 @@ export class LaunchdService {
 <key>ProgramArguments</key><array><string>${xml(process.execPath)}</string><string>${xml(executablePath)}</string><string>run</string><string>--state-root=${xml(stateRoot)}</string></array>
 <key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(this.deps.path ?? process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin")}</string></dict>
 <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
-<key>ProcessType</key><string>Background</string>
+<key>ProcessType</key><string>Interactive</string>
 </dict></plist>
 `;
     }

package/dist/src/publication/git-snapshot.js

@@ -3,11 +3,10 @@ import { promisify } from 'node:util';
 import { constants } from 'node:fs';
 import { lstat, mkdir, mkdtemp, open, realpath, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
-import { deflateSync } from 'node:zlib';
 import path from 'node:path';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash } from './candidate.js';
-import { RawGitObjects } from './raw-git-objects.js';
+import { deflateObject, RawGitObjects } from './raw-git-objects.js';
 const execute = promisify(execFile), denied = () => Error('SNAPSHOT_REJECTED');
 const digest = (data) => createHash('sha256').update(data).digest('hex');
 const safe = (p) => p.length > 0 && !path.isAbsolute(p) && !p.includes('\\') && !p.includes('\0') && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.ssh|\.aws|\.codex|\.claude|\.env|\.netrc|\.npmrc|credentials(?:\..*)?)$/i.test(s));
@@ -21,6 +20,7 @@ export const isP1WorkingBranch = (branch) => typeof branch === 'string' && branc
 export class GitSnapshotHost {
     options;
     seals = new WeakSet();
+    listings = new WeakMap();
     ownedRoots = new Set();
     constructor(options) { this.options = structuredClone(options); }
     async git(args) {
@@ -135,15 +135,21 @@ export class GitSnapshotHost {
             await fd.close();
         }
     }
-    async capture() {
+    /** Checks the options every read relies on, then that HEAD is the base commit on the working branch. */
+    async head() {
         const o = this.options, branchAllowed = o.p1WorkingBranch === undefined ? /^ai-work\/local\/[A-Za-z0-9-]+$/.test(o.workingBranch) : o.p1WorkingBranch === o.workingBranch && isP1WorkingBranch(o.workingBranch);
         if (!/^[a-f0-9]{40}$/.test(o.baseCommitSha) || !branchAllowed || await realpath(o.root) !== o.root || !Number.isSafeInteger(o.maxFileBytes) || o.maxFileBytes < 1 || !Number.isSafeInteger(o.maxTotalBytes) || o.maxTotalBytes < o.maxFileBytes)
             throw denied();
         const head = (await this.git(['rev-parse', '--verify', 'HEAD'])).toString().trim(), branch = (await this.git(['symbolic-ref', '--short', 'HEAD'])).toString().trim();
         if (head !== o.baseCommitSha || branch !== o.workingBranch)
             throw denied();
-        const base = new Map(), gitlinks = new Map();
-        for (const line of (await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha])).toString().split('\0').filter(Boolean)) {
+    }
+    async capture() {
+        const o = this.options;
+        await this.head();
+        const head = o.baseCommitSha, branch = o.workingBranch;
+        const base = new Map(), gitlinks = new Map(), baseListing = await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha]);
+        for (const line of baseListing.toString().split('\0').filter(Boolean)) {
             const link = /^160000 commit ([a-f0-9]{40})\t(.+)$/s.exec(line);
             if (link) {
                 if (!safe(link[2]))
@@ -158,8 +164,8 @@ export class GitSnapshotHost {
         }
         // Gitlinks remain exact base-tree references. Never traverse or copy their source.
         // Staged replacement/deletion is refused rather than publishing hidden changes.
-        const staged = new Map();
-        for (const line of (await this.git(['ls-files', '--stage', '-z'])).toString().split('\0').filter(Boolean)) {
+        const staged = new Map(), stagedListing = await this.git(['ls-files', '--stage', '-z']);
+        for (const line of stagedListing.toString().split('\0').filter(Boolean)) {
             const entry = /^(100644|100755|160000) ([a-f0-9]{40}) 0\t(.+)$/s.exec(line);
             if (!entry || !safe(entry[3]))
                 throw denied();
@@ -170,11 +176,12 @@ export class GitSnapshotHost {
             expected.set(name, '160000 ' + oid);
         if (protocolHash([...expected].sort()) !== protocolHash([...staged].sort()))
             throw denied();
-        const names = new Set([...base.keys(), ...(await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--'])).toString().split('\0').filter(Boolean)]);
+        const untrackedListing = await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--']);
+        const names = [...new Set([...base.keys(), ...untrackedListing.toString().split('\0').filter(Boolean)])].sort();
         const blobs = await this.batchObjects([...base.values()].map(v => v.blob));
         const files = [], changes = [];
         let total = 0;
-        for (const name of [...names].sort()) {
+        for (const name of names) {
             if ([...gitlinks.keys()].some(p => name === p || name.startsWith(p + '/') || p.startsWith(name + '/')))
                 throw denied();
             const current = await this.currentFile(name), prior = base.get(name);
@@ -196,7 +203,30 @@ export class GitSnapshotHost {
                 changes.push({ path: name, status: !prior ? 'added' : !current ? 'deleted' : 'modified', before: before?.toString('base64') ?? null, after: current?.bytes.toString('base64') ?? null, before_mode: prior?.mode ?? null, after_mode: current?.mode ?? null });
         }
         const observation = { base_commit_sha: o.baseCommitSha, head_commit_sha: head, working_branch: branch, diff: JSON.stringify({ format: 'local-candidate-binary-diff-v1', changes }), changed_files: changes.map(({ path, status }) => ({ path, status })) };
-        return { observation, files, fingerprint: protocolHash({ observation, files: files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) })) }) };
+        const listing = { base: digest(baseListing), staged: digest(stagedListing), untracked: digest(untrackedListing), names };
+        return { observation, files, listing, fingerprint: protocolHash({ observation, files: files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) })) }) };
+    }
+    /** The checkout still equals a capture when HEAD, the branch, the three Git listings and every
+     * file's mode and sha256 are unchanged. The capture's observation follows from those alone: the
+     * base blobs that an unchanged listing names are immutable objects, so they are not read again. */
+    async matches(listing, treeFingerprint) {
+        const o = this.options;
+        await this.head();
+        if (digest(await this.git(['ls-tree', '-r', '-z', '--full-tree', o.baseCommitSha])) !== listing.base || digest(await this.git(['ls-files', '--stage', '-z'])) !== listing.staged || digest(await this.git(['ls-files', '--others', '--exclude-standard', '-z', '--'])) !== listing.untracked)
+            throw denied();
+        const files = [];
+        let total = 0;
+        for (const name of listing.names) {
+            const current = await this.currentFile(name);
+            if (!current)
+                continue;
+            total += current.bytes.length;
+            if (total > o.maxTotalBytes)
+                throw denied();
+            files.push({ path: current.path, mode: current.mode, sha256: digest(current.bytes) });
+        }
+        if (protocolHash(files) !== treeFingerprint)
+            throw denied();
     }
     /** Creates a separate local-only Git checkout with exact base parent objects.
      * Raw object copying and raw file writes invoke no filters, templates or hooks;
@@ -241,7 +271,7 @@ export class GitSnapshotHost {
                     throw denied();
                 const dir = path.join(gitdir, 'objects', oid.slice(0, 2));
                 await mkdir(dir, { recursive: true, mode: 0o700 });
-                await writeFile(path.join(dir, oid.slice(2)), deflateSync(raw), { flag: 'wx', mode: 0o400 });
+                await writeFile(path.join(dir, oid.slice(2)), deflateObject(raw), { flag: 'wx', mode: 0o400 });
             }
             const copy = async (from, to) => { for (const name of await readdir(from)) {
                 const source = path.join(from, name), target = path.join(to, name), stat = await lstat(source);
@@ -272,11 +302,10 @@ export class GitSnapshotHost {
     async publicationCheckout(sealed) { return this.privateCheckout(sealed); }
     async assertSourceUnchanged(sealed) {
         try {
-            if (!this.seals.has(sealed))
-                throw denied();
-            const capture = await this.capture();
-            if (protocolHash(capture.observation) !== protocolHash(sealed.observation) || protocolHash(capture.files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) }))) !== sealed.treeFingerprint)
+            const listing = this.listings.get(sealed);
+            if (!this.seals.has(sealed) || !listing)
                 throw denied();
+            await this.matches(listing, sealed.treeFingerprint);
         }
         catch {
             throw denied();
@@ -371,9 +400,9 @@ export class GitSnapshotHost {
                 await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
                 await writeFile(file, f.bytes, { flag: 'wx', mode: (f.mode & 0o111) ? 0o500 : 0o400 });
             }
-            if ((await this.capture()).fingerprint !== capture.fingerprint)
-                throw denied();
+            // The source must not have changed while it was copied.
             const expected = protocolHash(capture.files.map(f => ({ path: f.path, mode: f.mode, sha256: digest(f.bytes) })));
+            await this.matches(capture.listing, expected);
             const assertUnchanged = async () => {
                 const entries = [];
                 const walk = async (dir, prefix = '') => { for (const item of (await readdir(dir)).sort()) {
@@ -396,6 +425,7 @@ export class GitSnapshotHost {
             await assertUnchanged();
             const seal = { root, observation: structuredClone(capture.observation), treeFingerprint: expected, assertUnchanged };
             this.seals.add(seal);
+            this.listings.set(seal, capture.listing);
             return Object.freeze(seal);
         }
         catch {

package/dist/src/publication/raw-git-objects.js

@@ -2,6 +2,8 @@ import { createHash } from 'node:crypto';
 import { deflateSync, inflateSync } from 'node:zlib';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
+/** Git reads any zlib level, and these objects live only as long as one private checkout. */
+export const deflateObject = (raw) => deflateSync(raw, { level: 1 });
 /** Local raw objects only: no filters, hooks, Git identity/config or transport. */
 export class RawGitObjects {
     checkout;
@@ -13,13 +15,21 @@ export class RawGitObjects {
         if (write) {
             const dir = path.join(this.checkout, '.git', 'objects', oid.slice(0, 2)), file = path.join(dir, oid.slice(2));
             await mkdir(dir, { recursive: true, mode: 0o700 });
-            try {
-                await writeFile(file, deflateSync(raw), { flag: 'wx', mode: 0o400 });
-            }
-            catch (e) {
-                if (e.code !== 'EEXIST' || !inflateSync(await readFile(file)).equals(raw))
-                    throw Error('GIT_OBJECT_REJECTED');
-            }
+            // An object already present is verified, not compressed again only to be discarded.
+            let existing = await readFile(file).catch((e) => { if (e.code !== 'ENOENT')
+                throw Error('GIT_OBJECT_REJECTED'); return undefined; });
+            if (existing === undefined)
+                try {
+                    await writeFile(file, deflateObject(raw), { flag: 'wx', mode: 0o400 });
+                    return oid;
+                }
+                catch (e) {
+                    if (e.code !== 'EEXIST')
+                        throw Error('GIT_OBJECT_REJECTED');
+                    existing = await readFile(file);
+                }
+            if (!inflateSync(existing).equals(raw))
+                throw Error('GIT_OBJECT_REJECTED');
         }
         return oid;
     }

package/dist/src/safety/codex-daemon-host.js

@@ -1,5 +1,5 @@
 import { CODEX_DAEMON_EXEC_RELEASES } from './codex-daemon-releases.js';
-import { registeredPrelaunchDependencies, CODEX_MANUAL_BINARY } from './codex-manual-registered.js';
+import { registeredPrelaunchDependencies } from './codex-manual-registered.js';
 import { createPrivilegedDaemonController } from './codex-manual-controller.js';
 import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
 import { PRIVILEGED_MDM_MODE } from '../adapters/codex/prelaunch-policy.js';
@@ -52,7 +52,7 @@ export function createCodexDaemonHost(input, deps) {
                         throw Error('CODEX_DAEMON_PREPARATION_REUSED');
                     const pin = releases[0].policyObserver;
                     const client = createPolicyInventoryClient(pin);
-                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary ?? CODEX_MANUAL_BINARY, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
+                    const controller = createPrivilegedDaemonController({ runnerId: input.runnerId, binary: native.binary, home: input.home, codexHome: input.codexHome, claim }, { releases, observer: pin, readLocal: native.readLocal, readNativeAuth: native.readNativeAuth, collectInventory: native.collectInventory ?? client.collectOnce });
                     controllers.set(jobId, controller);
                     const host = await controller.prepare();
                     if (closed) {

package/dist/src/safety/codex-daemon-releases.js

@@ -8,11 +8,11 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "policyScope": "unmanaged_personal_only",
         "managedEnforcement": "not_run",
         "executableVersion": "codex-cli 0.163.0-alpha.11",
-        "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+        "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
         "modelIds": [
             "gpt-5.6-sol"
         ],
-        "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+        "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
         "acceptedResidualRisks": [
             "vendor_native_policy_enforcement",
             "managed_policy_not_directly_observed_per_job",
@@ -26,14 +26,14 @@ export const CODEX_DAEMON_EXEC_RELEASES = Object.freeze([{
         "credentialBackend": "auto",
         "mdmVerification": "privileged_prelaunch",
         "fixtureEvidence": {
-            "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-            "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+            "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+            "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
             "managed_scope_exclusion": "a559199e229e153759f7a7cbd682aae423c0e3d33ef2a692fcccb5eed7c57ed3",
-            "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-            "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+            "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+            "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
             "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
         },
-        "fixturesFingerprint": "cc9e1586bbed7c4b0548dad6ffb91453d3cadd084504379178e5820687a2c892",
+        "fixturesFingerprint": "51b0e58037712a01d3f9499bcd6ee65ab727334119d3aaf8d9ed56a5c592e366",
         "commands": [],
         "policyObserver": {
             "protocol": "policy-inventory-v1",

package/dist/src/safety/codex-exec-production-host.js

@@ -7,6 +7,7 @@ import path from 'node:path';
 import { lstat, realpath } from 'node:fs/promises';
 import { parse } from 'smol-toml';
 import { CODEX_REPORT_SCHEMA } from '../adapters/codex/prompt-compiler.js';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary, assertCodexStandaloneBinaryLocation } from './codex-standalone-binary.js';
 import { lstatSync } from 'node:fs';
 import { readStableText, regularFileStamp as stamp } from './stable-file-read.js';
 import { observePinnedGitHead } from './pinned-git-head.js';
@@ -43,6 +44,8 @@ export function createCodexExecProductionHost(original) {
             throw reject();
         const paths = path.isAbsolute(input.binary) ? [input.binary] : input.binary === 'codex' && input.searchPath?.split(path.delimiter).every(p => path.isAbsolute(p)) ? input.searchPath.split(path.delimiter).map(p => path.join(p, 'codex')) : [];
         for (const binary of paths) {
+            if (binary === codexStandaloneBinaryPath(input.home))
+                await verifyCodexStandaloneBinary(input.home);
             let stat;
             try {
                 stat = await lstat(binary);
@@ -109,7 +112,7 @@ export function createCodexExecProductionHost(original) {
             const accountDirStamp = (file) => { const s = lstatSync(file, { bigint: true }); if (!s.isDirectory() || s.isSymbolicLink())
                 throw reject(); return [s.dev, s.ino, s.mode, s.uid].join(':'); };
             const current = () => { try {
-                return !revoked && !!selected && !!ctx && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
+                return !revoked && !!selected && !!ctx && (selected.binary !== codexStandaloneBinaryPath(input.home) || assertCodexStandaloneBinaryLocation(input.home) === selected.binary) && headObservation?.isCurrent() === true && (selected.release.securityMode !== UNMANAGED_EXEC_MODE || selected.policyObservation?.isCurrent() === true) && (lease.get(id)?.expires ?? 0) > Date.now() && [...baseline].every(([file, value]) => stamp(file) === value) && [...directories].every(([file, value]) => dirStamp(file) === value) && [...accountDirectories].every(([file, value]) => accountDirStamp(file) === value);
             }
             catch {
                 return false;

package/dist/src/safety/codex-manual-registered.js

@@ -9,18 +9,18 @@ import { measureCommandFile } from './registered-command-integrity.js';
 import { readStableText } from './stable-file-read.js';
 import { eligiblePersonalAccount } from '../adapters/codex/unmanaged-scope.js';
 import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
-/** Compiled reviewed identity; never selected by task, environment or receipts. */
-export const CODEX_MANUAL_BINARY = '/Applications/ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex';
+import { codexStandaloneBinaryPath, verifyCodexStandaloneBinary } from './codex-standalone-binary.js';
 export const CODEX_MANUAL_NATIVE_READER = Object.freeze({ "binary": "/Library/PrivilegedHelperTools/com.mtec.ai-gateway.codex-observe.681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986", "sha256": "681fb12e0b83ff8fbb612dc71f9a5f5c9be5334bcfead29314ca5b979b1dd986" });
 export function registeredManualDependencies(home, codexHome) { return registeredPrelaunchDependencies(home, codexHome, 'manual_prelaunch', CODEX_EXEC_RELEASES); }
 /** Trusted compiled registration shared by manual and daemon host composition. */
 export function registeredPrelaunchDependencies(home, codexHome, mode, releases) {
-    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER;
+    const account = path.resolve(codexHome ?? path.join(home, '.codex')), pin = CODEX_MANUAL_NATIVE_READER, binary = codexStandaloneBinaryPath(home);
     if (!path.isAbsolute(home) || !pin)
         throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');
     const reader = createNativeObservationReader({ accountRoot: account, backend: 'auto', keyringKind: 'direct', process: nativeMetadataProcess(pin.binary, pin.sha256), systemSource: systemPolicySource, mdmInventory: () => { throw Error('MANUAL_INVENTORY_ONLY'); } });
-    return Object.freeze({ binary: CODEX_MANUAL_BINARY, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
-            const digest = await measureCommandFile(CODEX_MANUAL_BINARY), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
+    return Object.freeze({ binary, readLocal: reader.readLocal, readNativeAuth: () => reader.readAuth(), async probe() {
+            await verifyCodexStandaloneBinary(home);
+            const digest = await measureCommandFile(binary), matches = releases.filter(r => reviewedCodexExecRelease(r) && r.binarySha256 === digest && r.mdmVerification === mode && r.credentialBackend === 'auto');
             const config = parse((await readStableText(path.join(account, 'config.toml'))).text);
             if (matches.length !== 1 || (config.cli_auth_credentials_store ?? 'auto') !== 'auto' || config.features?.secret_auth_storage === true)
                 throw Error('CODEX_MANUAL_REGISTRATION_UNAVAILABLE');

package/dist/src/safety/codex-reviewed-manual-release.js

@@ -7,11 +7,11 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "policyScope": "unmanaged_personal_only",
     "managedEnforcement": "not_run",
     "executableVersion": "codex-cli 0.163.0-alpha.11",
-    "binarySha256": "8a6dc3938a2f5d30cc19c50b9ccad83a5aa2ca4a2e3411665430bb78a917220a",
+    "binarySha256": "80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466",
     "modelIds": [
         "gpt-5.6-sol"
     ],
-    "decisionId": "16d7057c-b613-45c0-92e0-05262af96d89",
+    "decisionId": "21d710f0-d8f2-4a5f-b8c5-f7412e2a2100",
     "acceptedResidualRisks": [
         "vendor_native_policy_enforcement",
         "managed_policy_not_directly_observed_per_job",
@@ -25,13 +25,13 @@ export const REVIEWED_MANUAL_CODEX_RELEASE = {
     "credentialBackend": "auto",
     "mdmVerification": "manual_prelaunch",
     "fixtureEvidence": {
-        "binary_release": "e392e2e1a577a5fb91f8cbb508ec3ebf287073a3c92389586531d81d4751b14f",
-        "official_permissions": "3c12b20dda72cc638a4109b2f25f5066f64e302a4b465e941a3188f8f51d21c1",
+        "binary_release": "00bfa3a8438d10787c6b18f6d56fde9dc37b1f4ae64c13ac723a5e472e54498a",
+        "official_permissions": "ae0906f5302344f41ae06aee053764ba98511fbd5072af81b5ec857a2d6c42c0",
         "managed_scope_exclusion": "3bb8b2ad50a44cdea5a2a3f388f8009b51d8c60d46230fb3d0b7fed0b9f7452d",
-        "required_mcp_startup": "94f51ddb832948eaeeb51040b4d5eace56f245328c356d3b9042e09080b4173c",
-        "source_exclusion": "36f4e02fee13fe4c1535f26b539cb2f15218e257ebc857c79c6b9e5676218c2b",
+        "required_mcp_startup": "d2f482b5dd5e74684d7c77652b803314b1555354970d67b795dbefcdddcf7bc2",
+        "source_exclusion": "c44cf5ca899e42349c17ea37524984eb8aa6ffe505494ff6a253b159a0cada64",
         "auth_backend_compatibility": "7c42b882a52698fef3e14b4b956ede91ed1e3b29511fbff3176387063b8d74f0"
     },
-    "fixturesFingerprint": "b0f0778c69ffade85ad0694ae39018312dfd93a7c2c1ebfd948d2d15e6d57e2d",
+    "fixturesFingerprint": "4b226b26432f92720f4b5e67156bcffab324cdd5c765d44bccef568db5e14bcc",
     "commands": []
 };

package/dist/src/safety/codex-standalone-binary.js

@@ -0,0 +1,71 @@
+import path from 'node:path';
+import { lstat, realpath } from 'node:fs/promises';
+import { lstatSync, realpathSync } from 'node:fs';
+import { measureCommandFile } from './registered-command-integrity.js';
+/** Trusted compiled artifact, not selected by config, PATH, task or receipts. */
+export const CODEX_STANDALONE_ARTIFACT = Object.freeze({
+    version: '0.163.0-alpha.11',
+    binarySha256: '80df47f6ca9d316c732014bc5f6e6514696fafb5593e08e064332a1d3718b466',
+    archiveSha256: '4ceb37d6b7b5929925e4c36aeae912f1d040a43203696129fc6b3ffe09cb452a',
+});
+const reject = () => new Error('CODEX_STANDALONE_BINARY_REJECTED');
+/** The optional identity is for trusted in-process fixture composition only.
+ * Production registration always uses the compiled default. No authority is
+ * created by resolving or measuring a path. */
+export function codexStandaloneBinaryPath(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    if (!path.isAbsolute(home) || path.resolve(home) !== home || home === '/' || home.length > 4096 || /[\r\n\0]/.test(home) || !(/^[a-f0-9]{64}$/).test(sha))
+        throw reject();
+    return path.join(home, '.local', 'share', 'mtec-ai-local-runner', 'codex', CODEX_STANDALONE_ARTIFACT.version, sha, 'codex');
+}
+/** Rechecked by the retained per-execution current-input fence before spawn. */
+export function assertCodexStandaloneBinaryLocation(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || realpathSync(home) !== home || realpathSync(binary) !== binary)
+            throw reject();
+        let current = home;
+        const parts = ['', ...path.relative(home, binary).split(path.sep)];
+        for (let i = 0; i < parts.length; i++) {
+            current = path.join(current, parts[i]);
+            const s = lstatSync(current), last = i === parts.length - 1;
+            if (s.uid !== uid || (s.mode & 0o022) || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1 || !(s.mode & 0o111))))
+                throw reject();
+        }
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}
+/** Owner-only installation chain plus existing stable no-follow file measure.
+ * This is not atomic exec against the employee owner; per-execution digest,
+ * stamp and OS confinement checks remain mandatory in the existing host. */
+export async function verifyCodexStandaloneBinary(home, sha = CODEX_STANDALONE_ARTIFACT.binarySha256) {
+    try {
+        const binary = codexStandaloneBinaryPath(home, sha), uid = process.getuid?.();
+        if (uid === undefined || await realpath(home) !== home)
+            throw reject();
+        const paths = [home];
+        let current = home;
+        for (const part of path.relative(home, binary).split(path.sep)) {
+            current = path.join(current, part);
+            paths.push(current);
+        }
+        const inspect = async () => Promise.all(paths.map(async (file, index) => {
+            const s = await lstat(file, { bigint: true }), last = index === paths.length - 1;
+            if (s.uid !== BigInt(uid) || (s.mode & 18n) !== 0n || s.isSymbolicLink() || (!last && !s.isDirectory()) || (last && (!s.isFile() || s.nlink !== 1n || (s.mode & 73n) === 0n)))
+                throw reject();
+            return { dev: s.dev, ino: s.ino, uid: s.uid, mode: s.mode };
+        }));
+        const before = await inspect();
+        if (await realpath(binary) !== binary || await measureCommandFile(binary) !== sha)
+            throw reject();
+        const after = await inspect();
+        if (after.some((s, i) => s.dev !== before[i].dev || s.ino !== before[i].ino || s.uid !== before[i].uid || s.mode !== before[i].mode) || await realpath(binary) !== binary)
+            throw reject();
+        return binary;
+    }
+    catch {
+        throw reject();
+    }
+}

package/dist/src/safety/registered-command-integrity.js

@@ -12,7 +12,9 @@ export async function measureCommandFile(file) {
             throw denied();
         const hash = createHash('sha256');
         let size = 0n;
-        for await (const chunk of fd.createReadStream({ autoClose: false })) {
+        // Rehash every byte on every call, but avoid one filesystem dispatch per
+        // 64 KiB when snapshot fences repeatedly inspect multi-megabyte executables.
+        for await (const chunk of fd.createReadStream({ autoClose: false, highWaterMark: 1024 * 1024 })) {
             size += BigInt(chunk.length);
             if (size > 512n * 1024n * 1024n)
                 throw denied();

package/dist/src/verification/runner-observed-verifier.js

@@ -108,9 +108,7 @@ export class RunnerObservedVerifier {
             if (observation.base_commit_sha !== f.base_commit_sha || observation.head_commit_sha !== f.base_commit_sha || observation.working_branch !== f.working_branch || !observation.changed_files.length || observation.changed_files.length > o.candidateLimits.max_changed_files || Buffer.byteLength(observation.diff) > o.candidateLimits.max_diff_bytes || observation.changed_files.some(e => !o.allowedPaths.includes(e.path) || !exactPath(e.path) || isBlocked(e.path, o.blockedPaths)) || changedFileBytes(observation.diff).some(n => n > o.candidateLimits.max_file_bytes))
                 throw denied();
             await this.active();
-            await sealed.assertUnchanged();
             const candidate = await host.verificationCandidate(sealed);
-            await candidate.assertUnchanged();
             if (!hex(candidate.commitSha, 40))
                 throw denied();
             const changed_paths = buildP1ChangedPaths({ candidate_commit_sha: candidate.commitSha, base_commit_sha: f.base_commit_sha, entries: observation.changed_files }, v.bounds);
@@ -118,15 +116,15 @@ export class RunnerObservedVerifier {
             const registered = await buildReviewedProjectRegistration({ root: candidate.root, manifest: o.registration.manifest, review: o.registration.review, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths });
             const policy = await createIsolatedCommandPolicy({ root: candidate.root, commands: registered.commands, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths }, true);
             const receipts = [];
+            // One fresh source and candidate check before the first command, between commands and after the
+            // last. Each check rereads the whole checkout, and repeating one with nothing run in between proves nothing.
+            const snapshots = host, check = async () => { await this.active(); await snapshots.assertSourceUnchanged(sealed); await candidate.assertUnchanged(); };
             try {
-                for (const command of registered.commands) {
-                    await this.active();
-                    await host.assertSourceUnchanged(sealed);
-                    await candidate.assertUnchanged();
+                await check();
+                for (const [index, command] of registered.commands.entries()) {
                     const measurement = await policy.measureTest(command.id, { timeoutMs: v.bounds.max_command_runtime_ms, maxOutputBytes: v.bounds.max_output_bytes }, o.signal);
-                    await this.active();
-                    await host.assertSourceUnchanged(sealed);
-                    await candidate.assertUnchanged();
+                    if (index < registered.commands.length - 1)
+                        await check();
                     const identity = { binding_id: f.binding_id, job_id: f.job_id, generation: f.generation, contract_fingerprint: f.contract_fingerprint, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, command_id: command.id, command_fingerprint: protocolHash(command) };
                     receipts.push({ schema_version: 'runner-command-receipt-v1', receipt_id: protocolHash({ digest_domain: 'p1-command-receipt-id-v1', ...identity }), ...identity, observed_at: Math.floor(Date.now() / 1000), ...measurement });
                 }
@@ -134,9 +132,7 @@ export class RunnerObservedVerifier {
             finally {
                 policy.revoke();
             }
-            await this.active();
-            await host.assertSourceUnchanged(sealed);
-            await candidate.assertUnchanged();
+            await check();
             return { candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, changed_paths, receipts };
         }
         catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "private": false,
   "license": "UNLICENSED",
   "bin": {