mtech-ai-local-runner 0.1.68 → 0.1.70

package/README.md

@@ -186,6 +186,19 @@ and at most 6 times an hour. With no such session the ask becomes one macOS noti
 seconds and logs only an error code, and the ask waits for the next session start or prompt. Hook text is fixed and
 carries validated ids only; the AI reads the ask itself with the Gateway show tools, which mark its text as untrusted.
 
+An ask or answer the runner puts into a session on its own, by a wake or at a turn end, also gets one macOS
+notification naming that app ("It is in your Claude session."), since the person may be looking elsewhere (Work Item
+643dc395). It is sent within two minutes of the show and never for a delivery that already had a notification; one
+shown because the person typed gets none. The Gateway's `shown_via` stays `rewake` or `stop`.
+
+While the Gateway's sync says `ask_alert: true` for the person (their actor id is in
+`AI_OPS_GATEWAY_WORK_ASK_AI_FIRST_ALERT_ACTOR_IDS`, empty by default), every ask notification is the banner and also an
+alert: a `display alert` with Later and Open Claude or Open Codex that stays until it is closed and gives up after 10
+minutes. The banner stays in Notification Center if the alert is closed unread. Open runs `open -b` with that app's
+bundle id. One alert is on screen at a time; while one is, the next notification is the banner only. The runner never waits for an alert, kills one still
+open after 610 seconds, and closes it at shutdown. A sync without `ask_alert` turns alerts off; the session-open wait
+leaves the last value.
+
 The Gateway sends the ask keys on the wait only while asks are on for this runner. When a wait result comes without
 them, every stored delivery ends: it is dropped from `asks.json` with no report, and the Gateway's Slack fallback
 covers it. A stored delivery is forgotten an hour after it arrived, by which time the fallback (at most 15 minutes) has

package/dist/src/asks/alerter.js

@@ -0,0 +1,127 @@
+import { execFile, spawn as nodeSpawn } from "node:child_process";
+import { promisify } from "node:util";
+import { OSASCRIPT, notificationText } from "./notifier.js";
+/*
+ * Ask notifications as an alert that stays until it is closed (Work Item 643dc395, spec 2026-10-29, C), shown beside
+ * the banner while the Gateway's sync says alerts are on for this person (ask_alert). One alert at a time, and the runner never
+ * waits for it to close, so it holds no delivery handling and no shutdown. The text and the Open label reach
+ * AppleScript as arguments, never as script source, and nothing runs through a shell.
+ */
+export const OPEN = "/usr/bin/open";
+/** An alert that has not failed after this long counts as shown, the same promise a banner makes. */
+export const ALERT_SETTLE_MS = 1_000;
+/** AppleScript gives up after 600 s; an alert still open 10 s later is killed. */
+export const ALERT_KILL_MS = 610_000;
+export const BUNDLE_IDS = { claude: "com.anthropic.claudefordesktop", codex: "com.openai.codex" };
+const OPEN_LABEL = { claude: "Open Claude", codex: "Open Codex" };
+/** `activate` brings osascript itself to the front, so the alert is not hidden behind other windows; it sends no Apple event to another app. */
+const SCRIPT = [
+    "on run argv",
+    "activate",
+    "display alert \"AI Gateway\" message (item 1 of argv) buttons {\"Later\", item 2 of argv} default button 2 giving up after 600",
+    "end run",
+];
+/** `open -b` gives up after this, like the session opener's `open`. */
+const OPEN_TIMEOUT_MS = 10_000;
+/** The arguments osascript gets: the fixed script, then the text and the Open label. */
+export function alertArguments(text, app) {
+    return [...SCRIPT.flatMap(line => ["-e", line]), text, OPEN_LABEL[app]];
+}
+const execFileAsync = promisify(execFile);
+function errorCode(error) {
+    const code = error?.code;
+    return typeof code === "string" && /^[A-Z0-9_]{1,64}$/.test(code) ? code : "UNKNOWN";
+}
+export function createAlerter(deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const settleMs = deps.settleMs ?? ALERT_SETTLE_MS;
+    const killMs = deps.killMs ?? ALERT_KILL_MS;
+    const spawn = deps.spawn ?? ((file, args) => nodeSpawn(file, args, { stdio: ["ignore", "pipe", "ignore"] }));
+    const run = deps.run ?? ((file, args) => execFileAsync(file, args, { timeout: OPEN_TIMEOUT_MS, killSignal: "SIGKILL" }));
+    const fail = (code) => {
+        try {
+            deps.log?.({ event: "ask_alert_failed", code });
+        }
+        catch { /* Logging never stops delivery. */ }
+    };
+    let open = null;
+    return {
+        get busy() { return open !== null; },
+        show(text, app) {
+            if (platform !== "darwin" || open !== null)
+                return Promise.resolve(false);
+            return new Promise(resolve => {
+                let child;
+                try {
+                    child = spawn(OSASCRIPT, alertArguments(text, app));
+                }
+                catch {
+                    fail("SPAWN_FAILED");
+                    resolve(false);
+                    return;
+                }
+                open = child;
+                let output = "";
+                let settled = false;
+                let ended = false;
+                const settle = (shown) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    resolve(shown);
+                };
+                const settleTimer = setTimeout(() => settle(true), settleMs);
+                const killTimer = setTimeout(() => child.kill("SIGKILL"), killMs);
+                const end = () => {
+                    ended = true;
+                    clearTimeout(settleTimer);
+                    clearTimeout(killTimer);
+                    if (open === child)
+                        open = null;
+                };
+                child.stdout?.on("data", chunk => { output += chunk.toString("utf8"); });
+                child.on("error", () => {
+                    if (ended)
+                        return;
+                    end();
+                    if (!settled)
+                        fail("SPAWN_FAILED");
+                    settle(false);
+                });
+                child.on("close", code => {
+                    if (ended)
+                        return;
+                    end();
+                    // A failure before the alert counted as shown leaves the delivery to the banner.
+                    if (code !== 0 && !settled)
+                        fail(code === null ? "KILLED" : `EXIT_${code}`);
+                    settle(code === 0);
+                    if (code === 0 && output.includes(`button returned:${OPEN_LABEL[app]}`)) {
+                        run(OPEN, ["-b", BUNDLE_IDS[app]]).catch(error => fail(errorCode(error)));
+                    }
+                });
+            });
+        },
+        stop() {
+            const child = open;
+            open = null;
+            child?.kill("SIGKILL");
+        },
+    };
+}
+/**
+ * The runner's notifier: always the banner, and also the alert while alerts are on and none is open. The owner chose
+ * both on 2026-10-29: the alert stays until it is closed, and the banner stays in Notification Center if it is closed
+ * unread. The alert's app is the one the delivery is in, else the app of the most recent session with a typed prompt.
+ * The delivery counts as shown when either was.
+ */
+export function withAlerts(banner, alerter, deps) {
+    return async (item, options = {}) => {
+        const bannerShown = await banner(item, options);
+        if (!deps.alertsOn() || alerter.busy)
+            return bannerShown;
+        const app = options.shownIn ?? options.heldIn ?? options.openedApp ?? deps.fallbackApp();
+        const alertShown = await alerter.show(notificationText(item, options), app);
+        return bannerShown || alertShown;
+    };
+}

package/dist/src/asks/inbox.js

@@ -1,5 +1,5 @@
 import { emptyAskState, pruneAskState, sessionKey } from "./store.js";
-import { addDeliveries, claimOpen, closeDeliveries, confirmNotified, confirmOpened, confirmWake, isLive, openApp, planRoutes, promptSubmitted, releaseOpen, sessionEnded, sessionStarted, turnEnded, } from "./routing.js";
+import { addDeliveries, claimOpen, claimShownNotifications, closeDeliveries, confirmNotified, confirmOpened, confirmWake, isLive, openApp, planRoutes, preferredApp, promptSubmitted, releaseOpen, sessionEnded, sessionStarted, turnEnded, } from "./routing.js";
 import { droppableDeliveryId, parseAskDelivery } from "./types.js";
 import { renderOutput } from "./templates.js";
 import { PRESENCE_RECHECK_MS } from "./presence.js";
@@ -71,6 +71,10 @@ export class AskInbox {
             watchers: this.watchers.size,
         };
     }
+    /** The app of the session with the most recent typed prompt, for an alert's Open button (Work Item 643dc395). */
+    preferredApp() {
+        return preferredApp(this.state);
+    }
     /**
      * The answer resolves as soon as the change is made, before the save; the queue is held until the save is done. A
      * client that is gone gets nothing and changes nothing: marking an ask shown for a hook that cannot print it would
@@ -289,6 +293,8 @@ export class AskInbox {
             this.watchers.delete(key);
             confirmWake(this.state, key, output, now);
         }
+        // What a wake or a turn end just showed gets its one notification: the person may not be looking at that session.
+        const shown = claimShownNotifications(this.state, now);
         // Claimed before anything runs, so a delivery is never opened or notified twice.
         const opening = new Set(plan.open.map(item => item.deliveryId));
         claimOpen(this.state, [...opening], now);
@@ -302,6 +308,7 @@ export class AskInbox {
         return {
             notify: notify.filter(id => !opening.has(id)),
             held,
+            shown,
             // The notification of a delivery in the open waits for its outcome, which decides the text.
             open: opening.size === 0 ? null : { deliveryIds: [...opening], notifyAfter: notify.filter(id => opening.has(id)) },
         };
@@ -313,6 +320,8 @@ export class AskInbox {
             this.startNotifying(work.notify);
         for (const { deliveryId, app } of work.held)
             this.startNotifying([deliveryId], { heldIn: app });
+        for (const { deliveryId, app } of work.shown)
+            this.startNotifying([deliveryId], { shownIn: app });
         if (work.open !== null)
             this.startOpening(work.open);
         try {

package/dist/src/asks/notifier.js

@@ -4,16 +4,17 @@ import { execFile as nodeExecFile } from "node:child_process";
  * One per delivery, a fixed text per subject type and direction, no buttons. /usr/bin/osascript runs through
  * execFile, never a shell, and the text reaches AppleScript as an argument, never as script source.
  */
-const ASK_TEXT = {
-    decision: "AI Gateway: a colleague asked you for a decision. Open Claude or ChatGPT to see it.",
-    review: "AI Gateway: a colleague asked you for a review. Open Claude or ChatGPT to see it.",
-    request: "AI Gateway: a colleague asked you for an answer. Open Claude or ChatGPT to see it.",
+const ASK_LEAD = {
+    decision: "AI Gateway: a colleague asked you for a decision.",
+    review: "AI Gateway: a colleague asked you for a review.",
+    request: "AI Gateway: a colleague asked you for an answer.",
 };
-const ANSWER_TEXT = {
-    decision: "AI Gateway: your decision request has been answered. Open Claude or ChatGPT to continue.",
-    review: "AI Gateway: your review request has been answered. Open Claude or ChatGPT to continue.",
-    request: "AI Gateway: your work request has been answered. Open Claude or ChatGPT to continue.",
+const ANSWER_LEAD = {
+    decision: "AI Gateway: your decision request has been answered.",
+    review: "AI Gateway: your review request has been answered.",
+    request: "AI Gateway: your work request has been answered.",
 };
+const APP_NAME = { claude: "Claude", codex: "Codex" };
 /** Sent together with an open (open-session design section 5): the session is already there, in this app. */
 const OPENED_TEXT = {
     ask: {
@@ -43,7 +44,10 @@ export function notificationText(item, options = {}) {
         return HELD_TEXT[options.heldIn];
     if (options.openedApp !== undefined)
         return OPENED_TEXT[item.direction][options.openedApp];
-    return (item.direction === "ask" ? ASK_TEXT : ANSWER_TEXT)[item.subjectType];
+    const lead = (item.direction === "ask" ? ASK_LEAD : ANSWER_LEAD)[item.subjectType];
+    if (options.shownIn !== undefined)
+        return `${lead} It is in your ${APP_NAME[options.shownIn]} session.`;
+    return `${lead} ${item.direction === "ask" ? "Open Claude or ChatGPT to see it." : "Open Claude or ChatGPT to continue."}`;
 }
 /** The arguments osascript gets: the fixed script, then the text as its only argument. */
 export function notificationArguments(text) {

package/dist/src/asks/routing.js

@@ -357,6 +357,26 @@ export function confirmNotified(state, deliveryId, now, shown) {
         item.outbox.push({ event: "shown", via: "notification" });
     }
 }
+/** A delivery shown this long ago or longer gets no notification for it, so a just-upgraded runner does not announce old ones. */
+export const SHOWN_NOTIFY_WINDOW_MS = 2 * 60 * 1000;
+/**
+ * Deliveries the runner put into a session on its own, by rewake or stop, that have had no notification yet (Work Item
+ * 643dc395, B). Each is claimed (notifiedAt), so it is never notified twice, and returned with its session's app. A
+ * delivery shown because the person typed, or whose session is gone, is left alone.
+ */
+export function claimShownNotifications(state, now) {
+    const claimed = [];
+    for (const item of itemsWhere(state, item => item.phase === "shown" && (item.shownVia === "rewake" || item.shownVia === "stop") && item.notifiedAt === null)) {
+        if (item.shownAt === null || now - item.shownAt > SHOWN_NOTIFY_WINDOW_MS)
+            continue;
+        const session = item.sessionKey === null ? undefined : state.sessions[item.sessionKey];
+        if (session === undefined)
+            continue;
+        item.notifiedAt = now;
+        claimed.push({ deliveryId: item.deliveryId, app: session.app });
+    }
+    return claimed;
+}
 /** Claims one open for these deliveries before it runs, so none is opened twice. */
 export function claimOpen(state, deliveryIds, now) {
     for (const id of deliveryIds) {

package/dist/src/asks/runtime.js

@@ -4,6 +4,7 @@ import { AskStore } from "./store.js";
 import { refreshShim } from "./shim.js";
 import { installedApps } from "./integrations.js";
 import { createNotifier } from "./notifier.js";
+import { createAlerter, withAlerts } from "./alerter.js";
 import { createPresenceReader } from "./presence.js";
 import { createSessionOpener } from "./opener.js";
 import { ASK_INBOX_VERSION } from "./types.js";
@@ -31,6 +32,9 @@ export class AskRuntime {
     deps;
     controller = new AbortController();
     inbox;
+    alerter;
+    /** The last sync's ask_alert (Work Item 643dc395); off until a sync says otherwise. */
+    alertsOn = false;
     hub;
     started = false;
     /** The one start of this run, kept so advertisement() can wait for it; null until start() is called. */
@@ -39,8 +43,10 @@ export class AskRuntime {
     flushAgain = false;
     constructor(deps) {
         this.deps = deps;
+        this.alerter = deps.alerter ?? createAlerter({ log: event => this.log(event) });
+        const banner = deps.notify ?? createNotifier({ log: event => this.log(event) });
         this.inbox = new AskInbox({ store: new AskStore(deps.stateRoot), now: deps.now,
-            notify: deps.notify ?? createNotifier({ log: event => this.log(event) }),
+            notify: withAlerts(banner, this.alerter, { alertsOn: () => this.alertsOn, fallbackApp: () => this.inbox.preferredApp() ?? "claude" }),
             presence: deps.presence ?? createPresenceReader({ log: event => this.log(event) }),
             openSession: deps.openSession ?? createSessionOpener({ home: deps.env.HOME ?? "" }),
             presenceRecheckMs: deps.presenceRecheckMs,
@@ -86,6 +92,7 @@ export class AskRuntime {
         this.controller.abort();
         this.inbox.stopTimers();
         this.inbox.releaseAll("shutdown");
+        this.alerter.stop();
         try {
             await this.hub.stop();
         }
@@ -111,12 +118,19 @@ export class AskRuntime {
      * therefore means asks are off, and every stored delivery ends here with no report: the Gateway's fallback owns them.
      * A result with the key present but empty changes nothing.
      *
+     * A sync result also carries askAlert (Work Item 643dc395): whether notifications are alerts until the next sync. The
+     * session-open wait result has no askAlert and leaves the last value. Asks off means alerts off.
+     *
      * Resolves false when the result's closures could not be handled (the hub is down, or closing failed), so the push
      * transport does not acknowledge them and the Gateway lists them again (Work Item 25d8ea74).
      */
     async handleWait(result) {
         if (!this.started)
             return false;
+        if (result.askAlert !== undefined)
+            this.alertsOn = result.askAlert;
+        if (result.askDeliveries === undefined)
+            this.alertsOn = false;
         let closuresHandled = true;
         try {
             if (result.askDeliveries === undefined) {

package/dist/src/daemon/execution-coordinator.js

@@ -75,7 +75,9 @@ export class ExecutionCoordinator {
         let localFixPublication;
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
         const isP1 = hasP1(job.taskPackage);
+        const isP2 = isP1 && job.taskPackage.verification?.gateway_verification !== undefined;
         let p1Result;
+        let p2Handoff;
         const p1ReceiptIds = [];
         const lifecycle = { frozen: false, current: true };
         const deadline = Date.now() + (this.deps.preparationTimeoutMs ?? 900_000);
@@ -92,6 +94,8 @@ export class ExecutionCoordinator {
                     throw Error('P1_HOST_REQUIRED');
                 this.deps.p1Host.assertEligible(job);
             }
+            if (isP2 && !this.deps.gateway.stageGatewayVerification)
+                throw Error('P2_HOST_TRANSPORT_REQUIRED');
             if (isLocalFix && (!this.deps.localFixHost || pkg.repository?.access !== "write"))
                 throw new LocalFixHostRequired();
             const repository = pkg.repository;
@@ -500,7 +504,9 @@ export class ExecutionCoordinator {
                                 await freezeOwnedModel();
                                 await readControls();
                                 executionStage = 'p1_verify';
-                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen }));
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
+                                    exportCandidate: isP2 ? async (handoff) => { await readControls(); await assertModelFrozen(); if (p2Handoff)
+                                        throw Error('P2_DUPLICATE_HANDOFF'); p2Handoff = structuredClone(handoff); } : undefined }));
                                 executionStage = 'p1_receipts';
                                 await readControls();
                                 await assertModelFrozen();
@@ -514,6 +520,29 @@ export class ExecutionCoordinator {
                                     const id = await publicationStep(() => append({ eventType: 'test_result', summary: 'runner command observed', payload: { observer: 'runner', runner_receipt: receipt } }, true));
                                     p1ReceiptIds.push(id);
                                 }
+                                if (isP2 && p1Result.receipts.length > 0 && p1Result.receipts.every(r => r.status === 'passed' && r.exit_code === 0)) {
+                                    if (!p2Handoff || p2Handoff.snapshot_fingerprint !== p1Result.snapshot_fingerprint || p2Handoff.candidate_commit_sha !== p1Result.candidate_commit_sha)
+                                        throw Error('P2_SEALED_HANDOFF_REQUIRED');
+                                    await readControls();
+                                    await assertModelFrozen();
+                                    try {
+                                        const result = await publicationStep(() => this.deps.gateway.stageGatewayVerification({ job, bindingId: binding.bindingId, handoff: p2Handoff, receiptEventIds: [...p1ReceiptIds], securityReceipt: adapter.securityReceipt?.() }));
+                                        if (typeof result.publication_id !== 'string' || !result.publication_id || typeof result.status !== 'string' || !/^p2_[a-z_]+$/.test(result.status))
+                                            throw Error('P2_STAGE_UNCONFIRMED');
+                                        await readControls();
+                                        await assertModelFrozen();
+                                        await append({ eventType: 'progress', summary: 'Gateway shadow verification recorded', payload: { gateway_verification: { publication_id: result.publication_id, status: result.status } } });
+                                    }
+                                    catch {
+                                        // An uncertain transport outcome is not a failing P1 command or permission to retry a POST.
+                                        await readControls();
+                                        await assertModelFrozen();
+                                        await append({ eventType: 'progress', summary: 'Gateway shadow stage outcome unconfirmed', payload: { reason: 'P2_STAGE_UNCONFIRMED' } });
+                                    }
+                                    finally {
+                                        p2Handoff = undefined;
+                                    }
+                                }
                                 executionStage = 'event_stream';
                             }
                             if (event.eventType === "completed" && fixSession) {

package/dist/src/daemon/runtime.js

@@ -103,6 +103,7 @@ export async function buildDaemon(input) {
         reportPreparationFailure: (diagnostic) => { process.stderr.write(`${JSON.stringify({ event: "preparation_failed", ...diagnostic })}\n`); },
         terminalEvidenceCollector: buildTerminalEvidenceCollector(),
         gateway: {
+            stageGatewayVerification: async (input) => (await gateway.stageGatewayVerification({ jobId: input.job.id, generation: input.job.generation, leaseToken: input.job.leaseToken, launchGrant: input.job.launchGrant, bindingId: input.bindingId, handoff: input.handoff, receiptEventIds: input.receiptEventIds, securityReceipt: input.securityReceipt })).result,
             renewJob: (job, signal) => gateway.heartbeatLocalJob({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken }, signal),
             confirmJobLease,
             shadow: (job, signal) => gateway.localJobShadow({ workLoopId: job.workLoopId,
@@ -232,7 +233,7 @@ export async function buildDaemon(input) {
             return {
                 deviceFingerprint: createHash("sha256").update(`${process.getuid?.() ?? 0}|${runnerDisplayName()}|${input.gatewayMcpUrl}`).digest("hex"),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationMode), poller.accepting),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode), poller.accepting),
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
@@ -354,15 +355,16 @@ export async function reconcilePreparationState(previous, deps) {
 }
 /** Vendor capability text cannot claim a host-owned publication facility. */
 export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode) {
+    const modes = verificationMode === undefined ? [] : typeof verificationMode === 'string' ? [verificationMode] : verificationMode;
     return probes.map(probe => {
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
         const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1');
         if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
-            if (verificationMode === 'gateway_ci_v1')
+            if (modes.includes('gateway_ci_v1'))
                 capabilities.push('local_fix_gateway_ci_v1');
-            if (verificationMode === 'gateway_publish_v1')
+            if (modes.includes('gateway_publish_v1'))
                 capabilities.push('local_fix_gateway_publish_v1');
         }
         return { adapter: probe.id, version: probe.version, ...status, capabilities };

package/dist/src/gateway-client.js

@@ -35,6 +35,7 @@ export function parseRunnerSync(result, runnerId) {
         ...("guidance_policy" in body ? { guidancePolicy: body.guidance_policy } : {}),
         ...(typeof body.guidance_policy_version === "string" ? { guidancePolicyVersion: body.guidance_policy_version } : {}),
         ...("claude_release" in body ? { claudeRelease: parseClaudeSyncRelease(body.claude_release) } : {}),
+        ...(body.ask_alert === true ? { askAlert: true } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),
         syncSeconds: clampSeconds(body.sync_seconds, 15, 120, 30),
@@ -731,6 +732,14 @@ export class McpGatewayClient {
     async localPublicationContext(input) {
         return this.callTool('local_agent_publication_context', this.localPublicationFence(input));
     }
+    async stageGatewayVerification(input) {
+        const security = { ...input.securityReceipt };
+        if (security.transport === 'official_exec_v1' && ['cli-exec-job-security-receipt-v2', 'cli-exec-job-security-receipt-v3'].includes(String(security.receipt_version))) {
+            delete security.preparation_timing;
+            delete security.launch_process;
+        }
+        return this.callTool('local_agent_server_publication', { ...this.localPublicationFence(input), operation: 'verification_stage', handoff: input.handoff, receipt_event_ids: input.receiptEventIds, security_receipt: security });
+    }
     async executeServerCiPublication(input) {
         const body = { ...this.localPublicationFence(input), operation: input.operation };
         if (input.operation === 'stage') {

package/dist/src/publication/installed-host.js

@@ -29,6 +29,18 @@ async function readPrivateJson(file) {
         await f.close();
     }
 }
+/** Serves each job with the registration of the mode frozen in its own Fix scope. */
+function multiModeHost(hosts) {
+    const verificationModes = hosts.map(h => { if (h.verificationMode === undefined)
+        throw denied(); return h.verificationMode; });
+    return { requiresOwnedFreeze: true, verificationModes, prepare: async (input) => {
+            const mode = input.job.taskPackage?.local_fix_scope?.verification_mode;
+            const host = hosts.find(h => h.verificationMode === mode);
+            if (!host)
+                throw denied();
+            return host.prepare(input);
+        } };
+}
 /** No installation file is created here. A missing file preserves investigation
  * behavior. Explicit approved installation is owner-only; credentials are read
  * only for an exact post-freeze Git operation, never during daemon discovery. */
@@ -49,19 +61,40 @@ export async function loadInstalledLocalFixHost(input) {
         const raw = await readPrivateJson(file);
         if (raw.schema === 'local-fix-host-installation-v2') {
             const config = raw;
-            if (config.enabled !== true || !['gateway_ci_v1', 'gateway_publish_v1'].includes(config.verification_mode) || config.runnerId !== input.runnerId)
-                throw denied();
-            assertServerCiRegistration(config.registration);
-            if (config.verification_mode !== (config.registration.verification_mode ?? 'gateway_ci_v1'))
+            if (config.enabled !== true || config.runnerId !== input.runnerId)
                 throw denied();
+            let registrations;
+            if (config.registrations !== undefined) {
+                // One registration per mode, for one project and one runtime release; never mixed with the single form.
+                if (config.registration !== undefined || config.verification_mode !== undefined || !Array.isArray(config.registrations) || config.registrations.length < 1 || config.registrations.length > 2)
+                    throw denied();
+                for (const r of config.registrations) {
+                    assertServerCiRegistration(r);
+                    if (!['gateway_ci_v1', 'gateway_publish_v1'].includes(r.verification_mode))
+                        throw denied();
+                }
+                const [first] = config.registrations;
+                if (new Set(config.registrations.map(r => r.verification_mode)).size !== config.registrations.length
+                    || config.registrations.some(r => r.project !== first.project || protocolHash(r.receipt) !== protocolHash(first.receipt)))
+                    throw denied();
+                registrations = config.registrations;
+            }
+            else {
+                if (!config.registration || !['gateway_ci_v1', 'gateway_publish_v1'].includes(config.verification_mode))
+                    throw denied();
+                assertServerCiRegistration(config.registration);
+                if (config.verification_mode !== (config.registration.verification_mode ?? 'gateway_ci_v1'))
+                    throw denied();
+                registrations = [config.registration];
+            }
             const packageRoot = await realpath(fileURLToPath(new URL('../../../', import.meta.url)));
-            const assertReleaseCurrent = () => verifyLocalFixRuntime(packageRoot, config.runtimeFiles, config.registration.receipt);
+            const assertReleaseCurrent = () => verifyLocalFixRuntime(packageRoot, config.runtimeFiles, registrations[0].receipt);
             await assertReleaseCurrent();
             await assertPinnedGit(config.git);
             const privateRoot = path.join(input.stateRoot, 'local-fix-publication'), s = await lstat(privateRoot);
             if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0 || (process.getuid && s.uid !== process.getuid()) || await realpath(privateRoot) !== privateRoot)
                 throw denied();
-            return createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration: config.registration, gateway: input.gateway, assertReleaseCurrent, canonicalApprovalId: async (publicationId) => {
+            const hosts = registrations.map(registration => createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration, gateway: input.gateway, assertReleaseCurrent, canonicalApprovalId: async (publicationId) => {
                     let approvals;
                     try {
                         approvals = await readPrivateJson(path.join(input.stateRoot, 'local-fix-pr-approvals.json'));
@@ -75,7 +108,8 @@ export async function loadInstalledLocalFixHost(input) {
                     if (id !== undefined && (typeof id !== 'string' || !/^[a-zA-Z0-9-]{1,191}$/.test(id)))
                         throw denied();
                     return id;
-                } });
+                } }));
+            return config.registrations === undefined ? hosts[0] : multiModeHost(hosts);
         }
         const config = raw;
         if (config.schema !== 'local-fix-host-installation-v1' || config.enabled !== true || config.runnerId !== input.runnerId || !config.registration || config.registration.review.manifestFingerprint !== protocolHash(config.registration.manifest))

package/dist/src/transport/sync-dispatch.js

@@ -92,6 +92,7 @@ export function createSyncDispatcher(deps) {
                 const handled = await deps.asks.handleWait({
                     ...(result.askDeliveries !== undefined ? { askDeliveries: result.askDeliveries } : {}),
                     ...(result.closedDeliveryIds !== undefined ? { closedDeliveryIds: result.closedDeliveryIds } : {}),
+                    askAlert: result.askAlert === true,
                 });
                 // Acknowledged only once handled: a failed handleWait leaves them for the Gateway to list again.
                 if (handled !== false)

package/dist/src/verification/p1-execution-host.js

@@ -1,4 +1,4 @@
-import { RunnerObservedVerifier } from './runner-observed-verifier.js';
+import { RunnerObservedVerifier, assertGatewayVerificationScope } from './runner-observed-verifier.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 import { protocolHash } from '../publication/candidate.js';
 export class RunnerObservedExecutionHost {
@@ -13,7 +13,7 @@ export class RunnerObservedExecutionHost {
         return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: p.verification,
             fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: r.base_commit_sha, working_branch: r.working_branch },
             allowedPaths: p.allowed_paths, blockedPaths: r.blocked_paths, candidateLimits: p.candidate_limits,
-            current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal };
+            current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal, exportCandidate: input.exportCandidate };
     }
     assertEligible(job) {
         const r = this.registration;
@@ -33,6 +33,8 @@ export const hasP1 = (p) => {
 /** Compare host launch claims to authoritative WEC/bundle fields before start. */
 export function assertP1Bindings(p, canonical, bundle = false) {
     const v = record(p.verification), r = record(p.repository), limits = record(p.candidate_limits);
+    if (v.gateway_verification !== undefined)
+        assertGatewayVerificationScope(v.gateway_verification, r.key);
     if (p.local_fix_scope !== undefined || p.verification_mode === 'gateway_ci_v1' || p.runtime_adapter !== 'codex_cli' || p.runtime_adapter_version !== '1' || p.runtime_transport !== 'official_exec_v1' || v.schema_version !== 'local-runner-verification-v1' || v.policy_key !== 'local-runner-verified-v1' || v.mode !== 'runner_observed_v1' || v.runtime_adapter !== p.runtime_adapter || v.runtime_transport !== p.runtime_transport || r.access !== 'write' || !isP1WorkingBranch(r.working_branch) || !equal(p.allowed_paths, v.allowed_paths) || !equal(r.allowed_paths, v.allowed_paths) || !Array.isArray(r.blocked_paths))
         throw Error('P1_CONTRACT_REJECTED');
     if (Object.keys(limits).sort().join(',') !== 'max_changed_files,max_diff_bytes,max_file_bytes' || Object.values(limits).some(n => !Number.isSafeInteger(n) || Number(n) < 1))

package/dist/src/verification/runner-observed-verifier.js

@@ -23,6 +23,19 @@ const exactPath = (name) => typeof name === 'string' && /^[A-Za-z0-9_][A-Za-z0-9
 const isBlocked = (name, scopes) => scopes.some(p => p === '.env.*' ? name.startsWith('.env.') : p === '**' || name === p || name.startsWith(p.replace(/\/\*\*$/, '') + '/'));
 function keys(object, allowed) { if (!object || typeof object !== 'object' || Array.isArray(object) || Object.keys(object).some(k => !allowed.includes(k)))
     throw denied(); }
+export function assertGatewayVerificationScope(value, repositoryKey) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw denied();
+    const g = value;
+    keys(g, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
+    if (g.schema_version !== 'gateway-verification-scope-v1' || g.intent !== 'verification_only' || g.mode !== 'shadow'
+        || typeof g.profile_id !== 'string' || !g.profile_id || typeof g.repository_key !== 'string' || !g.repository_key
+        || repositoryKey !== undefined && g.repository_key !== repositoryKey || !g.profile_definition || typeof g.profile_definition !== 'object'
+        || protocolHash(g.profile_definition) !== g.profile_fingerprint || g.profile_definition.reviewed !== true
+        || g.profile_definition.ref_prefix !== 'ai-verify/' || g.profile_definition.max_concurrent_runs !== 1
+        || !Array.isArray(g.profile_definition.repository_keys) || !g.profile_definition.repository_keys.includes(g.repository_key))
+        throw denied();
+}
 /** Canonical P1 domain. Never uses legacy terminal T/U bytes or diff hashing. */
 export function buildP1ChangedPaths(input, bounds) {
     const entries = [...input.entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
@@ -48,7 +61,9 @@ export class RunnerObservedVerifier {
     } }
     validate() {
         const o = this.options, v = o.verification, p = v.profile_definition, r = o.registration, f = o.fence;
-        keys(v, ['schema_version', 'mode', 'policy_key', 'profile_id', 'profile_fingerprint', 'project_id', 'runtime_adapter', 'runtime_transport', 'profile_definition', 'frozen_criteria_fingerprint', 'frozen_loop_contract', 'commands', 'command_manifest', 'bounds', 'allowed_paths', 'required_commands', 'qa_scenario_ids', 'required_criteria', 'independent_review_required']);
+        keys(v, ['schema_version', 'mode', 'policy_key', 'profile_id', 'profile_fingerprint', 'project_id', 'runtime_adapter', 'runtime_transport', 'profile_definition', 'frozen_criteria_fingerprint', 'frozen_loop_contract', 'commands', 'command_manifest', 'bounds', 'allowed_paths', 'required_commands', 'qa_scenario_ids', 'required_criteria', 'independent_review_required', 'gateway_verification']);
+        if (v.gateway_verification !== undefined)
+            assertGatewayVerificationScope(v.gateway_verification);
         keys(p, ['schema_version', 'reviewed', 'project_ids', 'runtime_adapters', 'runtime_transports', 'allowed_paths', 'bounds', 'commands', 'bindings']);
         keys(v.bounds, Object.keys(ceilings));
         if (!r || !r.review || ![f.binding_id, f.job_id].every(id => typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(id)) || !Number.isSafeInteger(f.generation) || f.generation < 1 || !hex(f.contract_fingerprint, 64) || !hex(f.base_commit_sha, 40) || !isP1WorkingBranch(f.working_branch) || v.schema_version !== 'local-runner-verification-v1' || v.mode !== 'runner_observed_v1' || v.policy_key !== 'local-runner-verified-v1' || !v.profile_id || p.schema_version !== 'local-runner-profile-v1' || p.reviewed !== true || r.profileId !== v.profile_id || r.profileFingerprint !== v.profile_fingerprint || protocolHash(p) !== v.profile_fingerprint || protocolHash(v.frozen_loop_contract) !== v.frozen_criteria_fingerprint)
@@ -133,7 +148,12 @@ export class RunnerObservedVerifier {
                 policy.revoke();
             }
             await check();
-            return { candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, changed_paths, receipts };
+            const result = { candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, changed_paths, receipts };
+            if (o.exportCandidate && receipts.length > 0 && receipts.every(r => r.status === 'passed' && r.exit_code === 0)) {
+                await o.exportCandidate(structuredClone({ schema_version: 'gateway-candidate-handoff-v1', ...result, fence: f, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff: observation.diff }));
+                await check();
+            }
+            return result;
         }
         catch {
             throw denied();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "private": false,
   "license": "UNLICENSED",
   "bin": {