mtech-ai-local-runner 0.1.70 → 0.1.71

package/README.md

@@ -187,8 +187,10 @@ seconds and logs only an error code, and the ask waits for the next session star
 carries validated ids only; the AI reads the ask itself with the Gateway show tools, which mark its text as untrusted.
 
 An ask or answer the runner puts into a session on its own, by a wake or at a turn end, also gets one macOS
-notification naming that app ("It is in your Claude session."), since the person may be looking elsewhere (Work Item
-643dc395). It is sent within two minutes of the show and never for a delivery that already had a notification; one
+notification naming that app and session ("It is in your Claude session in api-cloud-service-ai-gateway (last typed
+17:39)."), since the person may be looking elsewhere (Work Item 643dc395). Hooks carry no session title, so the
+session is named by the last segment of its cwd and the local time of the last prompt a person typed there; an answer
+held in its asking session is named the same way. No prompt text is shown. It is sent within two minutes of the show and never for a delivery that already had a notification; one
 shown because the person typed gets none. The Gateway's `shown_via` stays `rewake` or `stop`.
 
 While the Gateway's sync says `ask_alert: true` for the person (their actor id is in

package/dist/src/adapters/discovery.js

@@ -55,8 +55,15 @@ export async function discoverAdapters(env, command = run, adapterIds = ['claude
         }
     }));
 }
+/**
+ * Whether setup can make this Mac a full runner. Codex needs its probe to admit it. Claude needs only a verified login:
+ * the host probe reports Claude unsupported on every Mac, and the daemon runs Claude only from its own verified copy of
+ * the reviewed release the Gateway lists, so the probe must not decide it. Without this a Mac with only Claude always
+ * became a messenger (Work Item 1c8026f1).
+ */
 export function hasUsableAdapter(adapters) {
-    return adapters.some(adapter => adapter.available !== false && adapter.authenticated);
+    return adapters.some(adapter => adapter.authenticated
+        && (adapter.available !== false || adapter.id === 'claude_code_cli' && adapter.loginStatus === 'authenticated'));
 }
 /** Stable local remedies, never a CLI stderr or account-output echo. */
 export function adapterDiagnosticsWithRemedies(adapters) {
@@ -75,7 +82,7 @@ export function adapterDiagnosticsWithRemedies(adapters) {
         else if (adapter.loginStatus === 'unknown')
             action = 'Claude login status is unknown; inspect the local status diagnostic before changing credentials. Execution remains blocked.';
         else if (!adapter.available && adapter.executableVersion && adapter.authenticated)
-            action = 'Claude CLI security isolation is unverified; wait for a reviewed release. Login alone does not grant execution.';
+            action = 'Claude is logged in. The runner runs it only from its own verified copy of the reviewed release the AI Gateway lists; that security check happens in the running service, not here.';
         else if (!adapter.available)
             action = 'Install Claude Code CLI and sign in, then rerun doctor; security admission is also required.';
         else if (!adapter.authenticated)

package/dist/src/asks/inbox.js

@@ -3,6 +3,7 @@ import { addDeliveries, claimOpen, claimShownNotifications, closeDeliveries, con
 import { droppableDeliveryId, parseAskDelivery } from "./types.js";
 import { renderOutput } from "./templates.js";
 import { PRESENCE_RECHECK_MS } from "./presence.js";
+import { sessionPlace } from "./notifier.js";
 /** The most reports one flush sends, so a misbehaving Gateway can never keep it busy. */
 const MAX_REPORTS_PER_FLUSH = 200;
 /** How many ended delivery ids are remembered, so one offered again is never stored or shown again. */
@@ -71,6 +72,11 @@ export class AskInbox {
             watchers: this.watchers.size,
         };
     }
+    /** Which session a notification points at: its folder and last typed time (Work Item 643dc395). */
+    placeOf(key) {
+        const session = key === null ? undefined : this.state.sessions[key];
+        return session === undefined ? undefined : sessionPlace(session.cwd, session.lastPromptAt);
+    }
     /** The app of the session with the most recent typed prompt, for an alert's Open button (Work Item 643dc395). */
     preferredApp() {
         return preferredApp(this.state);
@@ -294,7 +300,7 @@ export class AskInbox {
             confirmWake(this.state, key, output, now);
         }
         // What a wake or a turn end just showed gets its one notification: the person may not be looking at that session.
-        const shown = claimShownNotifications(this.state, now);
+        const shown = claimShownNotifications(this.state, now).map(claim => ({ ...claim, place: this.placeOf(this.state.items[claim.deliveryId]?.sessionKey ?? null) }));
         // Claimed before anything runs, so a delivery is never opened or notified twice.
         const opening = new Set(plan.open.map(item => item.deliveryId));
         claimOpen(this.state, [...opening], now);
@@ -303,7 +309,7 @@ export class AskInbox {
         const notify = plan.notify.map(item => item.deliveryId);
         const held = plan.held.flatMap(item => {
             const session = item.sessionKey === null ? undefined : this.state.sessions[item.sessionKey];
-            return session === undefined ? [] : [{ deliveryId: item.deliveryId, app: session.app }];
+            return session === undefined ? [] : [{ deliveryId: item.deliveryId, app: session.app, place: this.placeOf(item.sessionKey) }];
         });
         return {
             notify: notify.filter(id => !opening.has(id)),
@@ -318,10 +324,10 @@ export class AskInbox {
         await this.persist();
         if (work.notify.length > 0)
             this.startNotifying(work.notify);
-        for (const { deliveryId, app } of work.held)
-            this.startNotifying([deliveryId], { heldIn: app });
-        for (const { deliveryId, app } of work.shown)
-            this.startNotifying([deliveryId], { shownIn: app });
+        for (const { deliveryId, app, place } of work.held)
+            this.startNotifying([deliveryId], { heldIn: app, ...(place === undefined ? {} : { place }) });
+        for (const { deliveryId, app, place } of work.shown)
+            this.startNotifying([deliveryId], { shownIn: app, ...(place === undefined ? {} : { place }) });
         if (work.open !== null)
             this.startOpening(work.open);
         try {

package/dist/src/asks/notifier.js

@@ -27,10 +27,23 @@ const OPENED_TEXT = {
     },
 };
 /** An answer held in its live asking session (Work Decision 8562d191): no session is opened, the person goes back to it. */
-const HELD_TEXT = {
-    claude: "AI Gateway: your ask has an answer. It is waiting in the Claude session that asked. Type there to see it.",
-    codex: "AI Gateway: your ask has an answer. It is waiting in the Codex session that asked. Type there to see it.",
-};
+function heldText(app, place) {
+    const where = place === undefined ? "" : `${place.folder === null ? "" : `, in ${place.folder}`}${typedText(place)}`;
+    return `AI Gateway: your ask has an answer. It is waiting in the ${APP_NAME[app]} session that asked${where}. Type there to see it.`;
+}
+const MAX_FOLDER_CHARS = 48;
+/** The place of a session from its cwd and lastPromptAt; undefined when neither is known. */
+export function sessionPlace(cwd, lastPromptAt, timeZone) {
+    const segment = cwd.split("/").filter(part => part !== "").at(-1) ?? "";
+    const clean = segment.replace(/[\u0000-\u001f\u007f]/g, "");
+    const folder = clean === "" ? null : clean.length > MAX_FOLDER_CHARS ? `${clean.slice(0, MAX_FOLDER_CHARS - 1)}…` : clean;
+    const lastTyped = lastPromptAt === null ? null
+        : new Intl.DateTimeFormat("en-GB", { hour: "2-digit", minute: "2-digit", hour12: false, ...(timeZone === undefined ? {} : { timeZone }) }).format(new Date(lastPromptAt));
+    return folder === null && lastTyped === null ? undefined : { folder, lastTyped };
+}
+function typedText(place) {
+    return place.lastTyped !== null && /^\d{2}:\d{2}$/.test(place.lastTyped) ? ` (last typed ${place.lastTyped})` : "";
+}
 export const OSASCRIPT = "/usr/bin/osascript";
 const SCRIPT = ["on run argv", "display notification (item 1 of argv) with title \"AI Gateway\"", "end run"];
 /**
@@ -41,12 +54,15 @@ const SCRIPT = ["on run argv", "display notification (item 1 of argv) with title
 export const NOTIFY_TIMEOUT_MS = 3_000;
 export function notificationText(item, options = {}) {
     if (options.heldIn !== undefined)
-        return HELD_TEXT[options.heldIn];
+        return heldText(options.heldIn, options.place);
     if (options.openedApp !== undefined)
         return OPENED_TEXT[item.direction][options.openedApp];
     const lead = (item.direction === "ask" ? ASK_LEAD : ANSWER_LEAD)[item.subjectType];
-    if (options.shownIn !== undefined)
-        return `${lead} It is in your ${APP_NAME[options.shownIn]} session.`;
+    if (options.shownIn !== undefined) {
+        const place = options.place;
+        const where = place === undefined ? "" : `${place.folder === null ? "" : ` in ${place.folder}`}${typedText(place)}`;
+        return `${lead} It is in your ${APP_NAME[options.shownIn]} session${where}.`;
+    }
     return `${lead} ${item.direction === "ask" ? "Open Claude or ChatGPT to see it." : "Open Claude or ChatGPT to continue."}`;
 }
 /** The arguments osascript gets: the fixed script, then the text as its only argument. */

package/dist/src/daemon/execution-coordinator.js

@@ -2,6 +2,7 @@ import { completionRejectionDiagnostic } from '../adapters/completion-report.js'
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
 import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
+import { assertVerificationHostVersion } from '../verification/reviewed-runner-contract.js';
 import { executionError, executionFailure, jobHeartbeatError } from '../safety/execution-failure.js';
 import { isUnsupportedSupervisorCommand } from '../safety/unsupported-supervisor-command.js';
 import { requireSecurityRequirements } from '../safety/security-requirements.js';
@@ -75,7 +76,9 @@ export class ExecutionCoordinator {
         let localFixPublication;
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
         const isP1 = hasP1(job.taskPackage);
-        const isP2 = isP1 && job.taskPackage.verification?.gateway_verification !== undefined;
+        const envelope = job.taskPackage.verification;
+        const runnerBinding = envelope?.schema_version === 'local-runner-verification-v2' ? envelope.runner_binding : envelope;
+        const isP2 = isP1 && runnerBinding?.gateway_verification !== undefined;
         let p1Result;
         let p2Handoff;
         const p1ReceiptIds = [];
@@ -92,6 +95,7 @@ export class ExecutionCoordinator {
                 assertP1Bindings(pkg);
                 if (!this.deps.p1Host)
                     throw Error('P1_HOST_REQUIRED');
+                assertVerificationHostVersion(pkg.verification, this.deps.p1Host.supportedVerificationSchemas);
                 this.deps.p1Host.assertEligible(job);
             }
             if (isP2 && !this.deps.gateway.stageGatewayVerification)

package/dist/src/gateway-client.js

@@ -1,5 +1,7 @@
 import { publicationError } from './publication/failure.js';
 import { issueTransportDiagnostic } from './safety/transport-diagnostic.js';
+import { hasP1 } from './verification/p1-execution-host.js';
+import { resolveRunnerVerification, REVIEWED_POLICY, REVIEWED_LOOP_TYPE } from './verification/reviewed-runner-contract.js';
 import { parseClaudeSyncRelease } from "./safety/claude-release.js";
 import { createHash } from "node:crypto";
 import { v5 as uuidv5 } from "uuid";
@@ -88,7 +90,12 @@ export function shadowTaskPackage(contract) {
     const payload = contract.contract_payload;
     const execution = nested(payload, "agent_execution");
     const brief = nested(execution, "implementation_brief");
-    const verification = nested(payload, 'verification.mode') === 'runner_observed_v1' ? payload.verification : undefined;
+    const verification = hasP1(payload) ? payload.verification : undefined;
+    if (hasP1(payload)) {
+        const resolved = resolveRunnerVerification(verification);
+        if (resolved.version === 2 && (nested(payload, 'policy.policy_key') !== REVIEWED_POLICY || nested(payload, 'policy.loop_type') !== REVIEWED_LOOP_TYPE))
+            throw Error('P1_CONTRACT_REJECTED');
+    }
     const repositories = (payload.repositories ?? []).map((repository) => ({
         repository_key: requiredString(repository.repository_key, "repository key"),
         access: repository.access === "write" ? "write" : "read",
@@ -414,7 +421,7 @@ export class McpGatewayClient {
         const fingerprint = requiredString(nested(context.bundle, "contract.content_fingerprint"), "contract fingerprint");
         const result = await this.callTool("agent_runtime_event_append", {
             binding_id: bindingId,
-            ...(nested(context.bundle, 'contract.verification.mode') === 'runner_observed_v1' || nested(context.bundle, 'verification.mode') === 'runner_observed_v1' ? { job_fence: context.jobFence } : {}),
+            ...(['runner_observed_v1', 'runner_observed_reviewed_v1'].includes(String(nested(context.bundle, 'contract.verification.mode'))) || ['runner_observed_v1', 'runner_observed_reviewed_v1'].includes(String(nested(context.bundle, 'verification.mode'))) ? { job_fence: context.jobFence } : {}),
             ...(isTerminalEventType(event.eventType) ? { lease_token: context.leaseToken } : {}),
             event: {
                 protocol_version: event.protocolVersion,

package/dist/src/safety/job-tool-policy.js

@@ -1,5 +1,7 @@
 import path from 'node:path';
 import { protocolHash } from '../publication/candidate.js';
+import { resolveRunnerVerification, REVIEWED_VERIFICATION_SCHEMA } from '../verification/reviewed-runner-contract.js';
+import { assertP1Bindings } from '../verification/p1-execution-host.js';
 function object(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new Error('Invalid Job policy');
@@ -48,15 +50,23 @@ export function jobToolPolicyOptions(worktreeRoot, pkg, approved, registry, runt
         }
     if (allowedPaths.length === 0)
         throw new Error('Job approved source scope has no intersection');
-    const commands = strings(object(object(pkg.contract).verification).required_commands);
+    const frozenVerification = object(object(pkg.contract).verification);
+    const reviewed = frozenVerification.schema_version === REVIEWED_VERIFICATION_SCHEMA;
+    if (reviewed && approved.verification === undefined)
+        throw new Error('Reviewed Job verification approval is missing');
+    const commandBinding = reviewed ? resolveRunnerVerification(frozenVerification).runnerBinding : frozenVerification;
+    const commands = strings(reviewed ? (commandBinding.required_commands ?? []) : commandBinding.required_commands);
     const approvedCommands = strings(approved.required_commands);
     if (commands.length !== approvedCommands.length || JSON.stringify([...commands].sort()) !== JSON.stringify([...approvedCommands].sort()))
         throw new Error('Job required commands differ from approval');
     if (approved.verification !== undefined) {
-        const verification = object(approved.verification);
+        const envelope = object(approved.verification);
+        if (reviewed || envelope.schema_version === REVIEWED_VERIFICATION_SCHEMA)
+            assertP1Bindings(approved, pkg, true);
+        const verification = envelope.schema_version === REVIEWED_VERIFICATION_SCHEMA ? resolveRunnerVerification(envelope).runnerBinding : envelope;
         if (runtime.runtimeAdapter !== 'codex_cli' || runtime.runtimeAdapterVersion !== '1' || approved.runtime_transport !== 'official_exec_v1' || verification.runtime_adapter !== runtime.runtimeAdapter || verification.runtime_transport !== approved.runtime_transport || verification.policy_key !== 'local-runner-verified-v1' || protocolHash(repo.blocked_paths) !== protocolHash(source.blocked_paths))
             throw new Error('P1 Job runtime or scope differs from approval');
-        if (approved.local_fix_scope !== undefined || verification.mode !== 'runner_observed_v1' || verification.schema_version !== 'local-runner-verification-v1' || pkg.verification !== undefined && protocolHash(verification) !== protocolHash(pkg.verification) || protocolHash(verification) !== protocolHash(object(pkg.contract).verification) || protocolHash(repo.allowed_paths) !== protocolHash(approved.allowed_paths) || protocolHash(verification.allowed_paths) !== protocolHash(approved.allowed_paths))
+        if (approved.local_fix_scope !== undefined || verification.mode !== 'runner_observed_v1' || verification.schema_version !== 'local-runner-verification-v1' || pkg.verification !== undefined && protocolHash(envelope) !== protocolHash(pkg.verification) || protocolHash(envelope) !== protocolHash(frozenVerification) || protocolHash(repo.allowed_paths) !== protocolHash(approved.allowed_paths) || protocolHash(verification.allowed_paths) !== protocolHash(approved.allowed_paths))
             throw new Error('P1 Job verification differs from approval');
         return { worktreeRoot, access: repo.access === 'write' && source.access === 'write' ? 'write' : 'read', allowedPaths: strings(approved.allowed_paths), blockedPaths: strings(repo.blocked_paths), requiredCommands: [] };
     }

package/dist/src/verification/p1-execution-host.js

@@ -1,38 +1,47 @@
 import { RunnerObservedVerifier, assertGatewayVerificationScope } from './runner-observed-verifier.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 import { protocolHash } from '../publication/candidate.js';
+import { resolveRunnerVerification, assertVerificationHostVersion, REVIEWED_POLICY, REVIEWED_LOOP_TYPE } from './reviewed-runner-contract.js';
 export class RunnerObservedExecutionHost {
     privateRoot;
+    supportedVerificationSchemas;
     registration;
     constructor(privateRoot, registration) {
         this.privateRoot = privateRoot;
         this.registration = structuredClone(registration);
+        this.supportedVerificationSchemas = Object.freeze([...(registration.supportedVerificationSchemas ?? ['local-runner-verification-v1'])]);
     }
     options(input) {
         const p = input.job.taskPackage, r = p.repository;
-        return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: p.verification,
+        return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: resolveRunnerVerification(p.verification).runnerBinding,
             fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: r.base_commit_sha, working_branch: r.working_branch },
             allowedPaths: p.allowed_paths, blockedPaths: r.blocked_paths, candidateLimits: p.candidate_limits,
             current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal, exportCandidate: input.exportCandidate };
     }
     assertEligible(job) {
+        assertVerificationHostVersion(job.taskPackage.verification, this.supportedVerificationSchemas);
         const r = this.registration;
         if (r.manifest.schema !== 'local-project-verification-v1' || !r.review.receiptId?.trim() || !r.review.reviewer?.trim() || r.review.manifestFingerprint !== protocolHash(r.manifest))
             throw Error('P1_REGISTRATION_REJECTED');
         new RunnerObservedVerifier(this.options({ job, checkoutPath: '', bindingId: 'preflight', signal: new AbortController().signal, current: async () => false, freezeOwnedModel: async () => { throw Error('P1_NOT_FROZEN'); }, assertModelFrozen: async () => { throw Error('P1_NOT_FROZEN'); } })).assertContract();
     }
-    verify(input) { return new RunnerObservedVerifier(this.options(input)).verify(); }
+    verify(input) { assertVerificationHostVersion(input.job.taskPackage.verification, this.supportedVerificationSchemas); return new RunnerObservedVerifier(this.options(input)).verify(); }
 }
 const record = (v) => { if (!v || typeof v !== 'object' || Array.isArray(v))
     throw Error('P1_CONTRACT_REJECTED'); return v; };
 const equal = (a, b) => a !== undefined && b !== undefined && protocolHash(a) === protocolHash(b);
 export const hasP1 = (p) => {
     const v = p.verification, policy = p.policy;
-    return policy?.policy_key === 'local-runner-verified-v1' || !!v && (v.schema_version !== undefined || v.mode !== undefined);
+    return ['local-runner-verified-v1', REVIEWED_POLICY].includes(String(policy?.policy_key)) || !!v && (v.schema_version !== undefined || v.mode !== undefined);
 };
 /** Compare host launch claims to authoritative WEC/bundle fields before start. */
 export function assertP1Bindings(p, canonical, bundle = false) {
-    const v = record(p.verification), r = record(p.repository), limits = record(p.candidate_limits);
+    const envelope = record(p.verification), resolved = resolveRunnerVerification(envelope), v = resolved.runnerBinding, r = record(p.repository), limits = record(p.candidate_limits);
+    if (resolved.version === 2) {
+        const review = record(resolved.completionBinding.review_requirement), profiles = review.permitted_profiles;
+        if (typeof p.model_profile !== 'string' || !p.model_profile || !profiles.some(profile => profile.runtime_adapter !== p.runtime_adapter && profile.model_profile !== p.model_profile))
+            throw Error('P1_CONTRACT_REJECTED');
+    }
     if (v.gateway_verification !== undefined)
         assertGatewayVerificationScope(v.gateway_verification, r.key);
     if (p.local_fix_scope !== undefined || p.verification_mode === 'gateway_ci_v1' || p.runtime_adapter !== 'codex_cli' || p.runtime_adapter_version !== '1' || p.runtime_transport !== 'official_exec_v1' || v.schema_version !== 'local-runner-verification-v1' || v.policy_key !== 'local-runner-verified-v1' || v.mode !== 'runner_observed_v1' || v.runtime_adapter !== p.runtime_adapter || v.runtime_transport !== p.runtime_transport || r.access !== 'write' || !isP1WorkingBranch(r.working_branch) || !equal(p.allowed_paths, v.allowed_paths) || !equal(r.allowed_paths, v.allowed_paths) || !Array.isArray(r.blocked_paths))
@@ -46,7 +55,7 @@ export function assertP1Bindings(p, canonical, bundle = false) {
         throw Error('P1_CONTRACT_REJECTED');
     if (!bundle) {
         const policy = record(canonical.policy);
-        if (policy.policy_key !== 'local-runner-verified-v1' || policy.loop_type !== 'agent_runtime_implementation')
+        if (policy.policy_key !== (resolved.version === 2 ? REVIEWED_POLICY : 'local-runner-verified-v1') || policy.loop_type !== (resolved.version === 2 ? REVIEWED_LOOP_TYPE : 'agent_runtime_implementation'))
             throw Error('P1_CONTRACT_REJECTED');
     }
     const repos = canonical.repositories;
@@ -54,9 +63,9 @@ export function assertP1Bindings(p, canonical, bundle = false) {
         throw Error('P1_CONTRACT_REJECTED');
     const repo = record(repos[0]);
     const bound = bundle ? record(canonical.contract) : canonical;
-    if (!equal(v, bound.verification) || !equal(limits, record(bound.policy).candidate_limits) || repo.repository_key !== r.key || repo.access !== r.access || repo.base_commit_sha !== r.base_commit_sha || repo.working_branch !== r.working_branch || !equal(repo.allowed_paths, r.allowed_paths) || !equal(repo.blocked_paths, r.blocked_paths))
+    if (!equal(envelope, bound.verification) || !equal(limits, record(bound.policy).candidate_limits) || repo.repository_key !== r.key || repo.access !== r.access || repo.base_commit_sha !== r.base_commit_sha || repo.working_branch !== r.working_branch || !equal(repo.allowed_paths, r.allowed_paths) || !equal(repo.blocked_paths, r.blocked_paths))
         throw Error('P1_CONTRACT_REJECTED');
-    if (bundle && (bound.content_fingerprint !== p.contract_fingerprint || canonical.verification !== undefined && !equal(v, canonical.verification) || canonical.candidate_limits !== undefined && !equal(limits, canonical.candidate_limits)))
+    if (bundle && (bound.content_fingerprint !== p.contract_fingerprint || canonical.verification !== undefined && !equal(envelope, canonical.verification) || canonical.candidate_limits !== undefined && !equal(limits, canonical.candidate_limits)))
         throw Error('P1_CONTRACT_REJECTED');
 }
 /** P1 model events carry narrative/progress only. Proof is injected afterwards. */

package/dist/src/verification/reviewed-runner-contract.js

@@ -0,0 +1,77 @@
+import { protocolHash, protocolJson } from '../publication/candidate.js';
+import { assertGatewayVerificationScope } from './runner-observed-verifier.js';
+export const REVIEWED_VERIFICATION_SCHEMA = 'local-runner-verification-v2';
+export const REVIEWED_POLICY = 'local-runner-reviewed-v1';
+export const REVIEWED_LOOP_TYPE = 'agent_runtime_reviewed_implementation';
+const MAX_CONTRACT_BYTES = 65536;
+const MAX_EVIDENCE_AGE_SECONDS = 86400;
+const MAX_REVIEWER_PROFILES = 100;
+const rejected = () => Error('REVIEWED_RUNNER_VERIFICATION_REJECTED');
+const same = (a, b) => a !== undefined && b !== undefined && protocolHash(a) === protocolHash(b);
+const object = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw rejected();
+    return value;
+};
+function exact(value, keys) {
+    if (Object.keys(value).length !== keys.length || keys.some(key => !Object.hasOwn(value, key)))
+        throw rejected();
+}
+export const REVIEWED_CRITERIA = {
+    targeted_tests: { minimum_trust: 'client_reported', producers: ['runtime_event'], verifiers: ['runner_command_receipt'] },
+    required_suite: { minimum_trust: 'gateway_verified', producers: ['gateway_verification'], verifiers: ['ci_pipeline_result'] },
+    diff_scope: { minimum_trust: 'gateway_verified', producers: ['gateway_verification'], verifiers: ['verification_ref_diffstat'] },
+    independent_review: { minimum_trust: 'client_reported', producers: ['independent_agent_review'], verifiers: ['candidate_bound_review'] },
+};
+/** Only unwraps the versioned envelope. The existing P1 host still validates every inner byte. */
+export function resolveRunnerVerification(value) {
+    const envelope = object(value);
+    if (envelope.schema_version === 'local-runner-verification-v1') {
+        if (envelope.mode !== 'runner_observed_v1' || envelope.policy_key !== 'local-runner-verified-v1')
+            throw rejected();
+        return { version: 1, runnerBinding: envelope, completionBinding: null };
+    }
+    exact(envelope, ['schema_version', 'mode', 'policy_key', 'runner_binding', 'completion_binding']);
+    if (envelope.schema_version !== REVIEWED_VERIFICATION_SCHEMA || envelope.mode !== 'runner_observed_reviewed_v1' || envelope.policy_key !== REVIEWED_POLICY)
+        throw rejected();
+    const inner = object(envelope.runner_binding), completion = object(envelope.completion_binding);
+    if (inner.schema_version !== 'local-runner-verification-v1' || inner.mode !== 'runner_observed_v1' || inner.policy_key !== 'local-runner-verified-v1')
+        throw rejected();
+    assertGatewayVerificationScope(inner.gateway_verification);
+    exact(completion, ['schema_version', 'frozen_loop_contract', 'completion_criteria_fingerprint', 'runner_criteria_fingerprint', 'review_subject_schema', 'review_requirement', 'execute_attempt_limit']);
+    const frozen = object(completion.frozen_loop_contract);
+    exact(frozen, ['loop_type', 'policy_key', 'mandatory_criteria', 'criteria', 'max_evidence_age_seconds']);
+    if (completion.schema_version !== 'loop-reviewed-completion-v1' || completion.review_subject_schema !== 'loop-candidate-review-subject-v2' || completion.execute_attempt_limit !== 1
+        || completion.runner_criteria_fingerprint !== inner.frozen_criteria_fingerprint || completion.completion_criteria_fingerprint !== protocolHash(frozen)
+        || frozen.loop_type !== REVIEWED_LOOP_TYPE || frozen.policy_key !== REVIEWED_POLICY || !same(frozen.mandatory_criteria, Object.keys(REVIEWED_CRITERIA)) || !same(frozen.criteria, REVIEWED_CRITERIA)
+        || !Number.isSafeInteger(frozen.max_evidence_age_seconds) || Number(frozen.max_evidence_age_seconds) < 1 || Number(frozen.max_evidence_age_seconds) > MAX_EVIDENCE_AGE_SECONDS)
+        throw rejected();
+    const review = object(completion.review_requirement);
+    exact(review, ['option_key', 'role', 'capabilities', 'distinct_fields', 'same_actor_allowed', 'minimum_trust', 'permitted_profiles']);
+    if (review.option_key !== 'separated_runtime_review' || review.role !== 'reviewer' || !same(review.capabilities, ['repository_read', 'git_diff'])
+        || !same(review.distinct_fields, ['runtime_adapter', 'model_profile', 'session_reference']) || review.same_actor_allowed !== true || review.minimum_trust !== 'client_reported'
+        || !Array.isArray(review.permitted_profiles) || review.permitted_profiles.length < 1 || review.permitted_profiles.length > MAX_REVIEWER_PROFILES)
+        throw rejected();
+    const seen = new Set();
+    for (const item of review.permitted_profiles) {
+        const profile = object(item);
+        exact(profile, ['runtime_adapter', 'model_profile', 'registration_fingerprint']);
+        for (const field of ['runtime_adapter', 'model_profile'])
+            if (typeof profile[field] !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(profile[field]))
+                throw rejected();
+        const key = profile.runtime_adapter + ':' + profile.model_profile;
+        if (seen.has(key) || typeof profile.registration_fingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(profile.registration_fingerprint))
+            throw rejected();
+        seen.add(key);
+    }
+    const bound = object(inner.bounds).max_contract_bytes;
+    if (!Number.isSafeInteger(bound) || Number(bound) < 1 || Number(bound) > MAX_CONTRACT_BYTES || Buffer.byteLength(protocolJson(envelope)) > Number(bound))
+        throw rejected();
+    return { version: 2, runnerBinding: inner, completionBinding: completion };
+}
+/** Future reviewed host implementations must explicitly advertise V2 support. */
+export function assertVerificationHostVersion(value, supportedSchemas) {
+    const resolved = resolveRunnerVerification(value);
+    if (resolved.version === 2 && !supportedSchemas?.includes(REVIEWED_VERIFICATION_SCHEMA))
+        throw Error('REVIEWED_VERIFICATION_HOST_REQUIRED');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.70",
+  "version": "0.1.71",
   "private": false,
   "license": "UNLICENSED",
   "bin": {