mtech-ai-local-runner 0.1.72 → 0.1.74

package/README.md

@@ -1,3 +1,31 @@
+## 0.1.74: exact-parent reviewed correction attempts (P3D)
+
+This local source supports newly approved executable V3 launches behind the
+Gateway's default-off `correction_execution_enabled` switch. It does not activate
+an installed runner or upgrade older V1/V2/unavailable-V3 approvals.
+
+Authenticated claim context arrives before checkout. The approved task package,
+canonical repository lease and binding retain ROOT identity; each attempt checks
+out its exact Gateway-reviewed parent P and emits fresh context-bound receipts,
+snapshot and handoff. The original approval fingerprint differs from a successor
+job's reservation fingerprint and remains preserved through at most three attempts.
+Native launch seals the exact context and binding in the host-owned immutable
+plan, measures P immediately before dispatch, and keeps existing ROOT security
+receipt semantics. A replayed binding or uncertain model outcome pauses.
+
+A measured trusted host registration supplies registered submodule providers.
+The runner fetches exact P gitlinks through owned mirrors and refuses unknown
+providers, metadata redirects and nested P-child gitlinks. No profile is installed
+by these source changes. Correction findings are bounded untrusted data scoped to
+the canonical bundle paths; they cannot expand authority or become commands.
+
+Local fake transport/provider/process tests are distinct from real CI or model
+acceptance. A final release commit/version, package manifest/hash and compatible
+reviewed host registration remain pending delivery approval. See the
+[P3D-4 review](../../docs/superpowers/reviews/2026-10-30-local-runner-p3d4-implementation-review.md)
+for verification and compatibility limitations. No setup/update/restart is needed
+to inspect this source tree.
+
 ## 0.1.60: answers go back to the session that asked
 
 An answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,3 +1,4 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
@@ -16,5 +17,6 @@ const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
     "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
     "failed for another reason, such as a file that does not exist.";
 export function compilePrompt(taskPackage, options) {
-    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}${correction}`;
 }

package/dist/src/adapters/codex/exec-invocation.js

@@ -1,3 +1,4 @@
+import { validateAttemptContext, attemptContextFingerprint } from '../../verification/continuation-runner-contract.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import path from 'node:path';
 import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './global-instructions.js';
@@ -10,10 +11,18 @@ export const EXEC_MODE = 'supported_cli_exec_policy_v1';
 export const isReleaseExecMode = (mode) => mode === EXEC_RELEASE_MODE || mode === UNMANAGED_EXEC_MODE;
 const plans = new WeakMap();
 const consumed = new WeakSet();
+const executionAttempts = new WeakMap();
 const fail = () => new Error('CODEX_EXEC_PLAN_REJECTED');
 export function buildOfficialExecPlan(input) {
     try {
         const i = structuredClone(input.identity), inv = structuredClone(input.invocation);
+        const attempt = input.executionAttempt === undefined ? undefined : validateAttemptContext(input.executionAttempt);
+        if ((attempt === undefined) !== (input.executionAttemptFingerprint === undefined) || (attempt === undefined) !== (input.executionBindingId === undefined))
+            throw fail();
+        if (attempt && (typeof input.executionBindingId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(input.executionBindingId)))
+            throw fail();
+        if (attempt && (attemptContextFingerprint(attempt) !== input.executionAttemptFingerprint || attempt.job_id !== i.jobId || attempt.generation !== i.generation || attempt.contract_base_commit_sha !== i.sourceSha || attempt.contract_fingerprint !== i.contractFingerprint || (attempt.attempt_number === 1 && attempt.launch_approval_fingerprint !== i.launchFingerprint)))
+            throw fail();
         if (input.policyMode !== undefined && !isReleaseExecMode(input.policyMode))
             throw fail();
         const keys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
@@ -36,6 +45,8 @@ export function buildOfficialExecPlan(input) {
         const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };
         const executionNonce = randomBytes(32).toString('hex');
         const plan = Object.freeze({ transport: EXEC_TRANSPORT, mode: input.policyMode ?? EXEC_MODE, executionNonce, identity: Object.freeze(i), modelId: inv.modelId, home: inv.env.HOME, accountRoot, credentialBackend: input.credentialBackend, binary: input.binary, cwd, endpoint: inv.endpoint.url, invocationFingerprint: hash({ ...actual }) });
+        if (attempt)
+            executionAttempts.set(plan, { fingerprint: input.executionAttemptFingerprint, bindingId: input.executionBindingId, sourceRoot: source });
         plans.set(plan, structuredClone(actual));
         return plan;
     }
@@ -60,3 +71,16 @@ export function assertOfficialExecPlanAvailable(plan) {
     if (consumed.has(plan))
         throw fail();
 }
+/** Private plan seal is execution identity, separate from legacy ROOT approval
+ * and security receipt identity. Native host still verifies Gateway authority. */
+export function assertOfficialExecAttempt(plan, context, fingerprint, bindingId, sourceRoot) {
+    requireOfficialExecPlan(plan);
+    const expected = executionAttempts.get(plan);
+    if (expected === undefined) {
+        if (context !== undefined || fingerprint !== undefined)
+            throw fail();
+        return;
+    }
+    if (context === undefined || fingerprint !== expected.fingerprint || attemptContextFingerprint(context) !== expected.fingerprint || bindingId !== expected.bindingId || sourceRoot !== undefined && path.resolve(sourceRoot) !== expected.sourceRoot)
+        throw fail();
+}

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,4 @@
+import { assertOfficialExecAttempt } from './exec-invocation.js';
 import { performance } from 'node:perf_hooks';
 import { PreparationClock, CODEX_PREPARATION_BUDGET_MS } from '../../safety/preparation-timing.js';
 import { localEndpointObservations, localEndpointReadObservations } from '../../safety/local-tool-server.js';
@@ -42,6 +43,7 @@ export class CodexExecLaunchHost {
         throw fail();
     } }
     assertContext(ctx, jobId) {
+        assertOfficialExecAttempt(this.plan, ctx.executionAttempt, ctx.executionAttemptFingerprint, ctx.bindingId);
         const a = ctx.approvedTaskPackage, r = a?.security_requirements, b = ctx.taskPackage, execution = b?.execution;
         if (isReleaseExecMode(this.plan.mode)) {
             if (!r)
@@ -63,6 +65,7 @@ export class CodexExecLaunchHost {
     async start(ctx, jobId, prompt, signal) {
         if (this.used || this.stopped)
             throw fail();
+        ctx = structuredClone(ctx);
         this.assertAvailableContext(ctx, jobId);
         claimOfficialExecPlan(this.plan);
         this.ownsAttempt = true;
@@ -114,6 +117,8 @@ export class CodexExecLaunchHost {
                 this.inspection.beforeSpawn?.();
                 timing.mark('before_spawn_complete');
                 assertPreparationBudget();
+                this.current();
+                this.assertContext(ctx, jobId);
                 stage = 'codex_spawn';
                 timing.mark('spawn_requested');
                 const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -99,7 +99,7 @@ export function buildCodexExecJobOptions(input) {
                 if (closed || signal.aborted)
                     throw reject();
                 stage = 'codex_invocation';
-                const plan = buildOfficialExecPlan({ policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                const plan = buildOfficialExecPlan({ executionAttempt: ctx.executionAttempt, executionAttemptFingerprint: ctx.executionAttemptFingerprint, ...(ctx.executionAttempt ? { executionBindingId: ctx.bindingId } : {}), policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
                 gate = new ExecToolGate(plan);
                 const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
                 launchHost = host;

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,7 +1,9 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${correction}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/asks/runtime.js

@@ -21,6 +21,25 @@ const SHUTDOWN_WAIT_MS = 5000;
  * would end. Bounded, so a heartbeat, and the job claim behind it, is never held up longer than this.
  */
 export const ADVERTISEMENT_START_WAIT_MS = 2000;
+/** Room notices use only a human prompt already arriving at the Ask hub; they never wake a model. */
+export function withRoomNotice(handler, claim) {
+    return {
+        status: () => handler.status(),
+        watch: (request, watcher) => handler.watch(request, watcher),
+        event: async (request, client) => {
+            const text = await handler.event(request, client);
+            if (request.event !== 'prompt' || request.human !== true || client.gone)
+                return text;
+            try {
+                const notice = await claim();
+                return notice === null ? text : text === null ? notice : `${text}\n${notice}`;
+            }
+            catch {
+                return text;
+            }
+        },
+    };
+}
 function errorCode(error) {
     const code = error?.code;
     if (typeof code === "string" && /^[A-Z0-9_]{1,64}$/.test(code))
@@ -51,7 +70,9 @@ export class AskRuntime {
             openSession: deps.openSession ?? createSessionOpener({ home: deps.env.HOME ?? "" }),
             presenceRecheckMs: deps.presenceRecheckMs,
             onChange: () => this.flushSoon(), log: event => this.log(event) });
-        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot), handler: this.inbox, log: event => this.log(event) });
+        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot),
+            handler: deps.claimRoomNotice ? withRoomNotice(this.inbox, deps.claimRoomNotice) : this.inbox,
+            log: event => this.log(event) });
     }
     /** True while the hub listens; only then are deliveries taken and ask_inbox advertised. */
     get ready() {

package/dist/src/cli.js

@@ -518,5 +518,9 @@ export function isDirectCliInvocation(moduleUrl, argvPath) {
 if (isDirectCliInvocation(import.meta.url, process.argv[1])) {
     main(process.argv.slice(2), process.env).then((code) => {
         process.exitCode = code;
+        // A daemon that stopped (to apply Fix consent, decision baf0cd89) must leave so launchd starts a fresh one.
+        // The unref'd timer only fires if a socket or timer still holds the event loop five seconds later.
+        if (process.argv[2] === "run")
+            setTimeout(() => process.exit(code), 5000).unref();
     });
 }

package/dist/src/commands/fix.js

@@ -25,19 +25,108 @@ function flags(argv) {
     return values;
 }
 /** A job owns the host until it ends: never replace or restart under it. */
-async function idle(io) {
+export async function fixHostBusy(stateRoot) {
     for (const file of BUSY)
-        if (await exists(path.join(io.stateRoot, file))) {
-            io.stderr('FIX_HOST_JOB_ACTIVE: wait until the current job ends, then run this again.');
-            return false;
-        }
+        if (await exists(path.join(stateRoot, file)))
+            return true;
+    return false;
+}
+const JOB_ACTIVE = 'FIX_HOST_JOB_ACTIVE: wait until the current job ends, then run this again.';
+async function idle(io) {
+    if (await fixHostBusy(io.stateRoot)) {
+        io.stderr(JOB_ACTIVE);
+        return false;
+    }
     return true;
 }
-async function backup(io, file) {
-    const dir = path.join(io.stateRoot, 'backups');
+async function backup(stateRoot, file) {
+    const dir = path.join(stateRoot, 'backups');
     await mkdir(dir, { recursive: true, mode: 0o700 });
     await copyFile(file, path.join(dir, `local-fix-host-${new Date().toISOString().replace(/[:.]/g, '-')}.json`));
 }
+/** The existing host, when it is a v3 host this runner would load; anything else is replaced whole. */
+async function currentConsentHost(file, runnerId) {
+    let raw;
+    try {
+        const s = await lstat(file);
+        if (!s.isFile() || s.isSymbolicLink() || s.size > 128 * 1024)
+            return undefined;
+        raw = JSON.parse(await readFile(file, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || Object.keys(raw).sort().join() !== 'consent,enabled,git,runnerId,schema')
+        return undefined;
+    if (raw.schema !== 'local-fix-host-installation-v3' || raw.enabled !== true || raw.runnerId !== runnerId)
+        return undefined;
+    const git = raw.git;
+    if (!git || typeof git !== 'object' || Array.isArray(git) || Object.keys(git).sort().join() !== 'executable,sha256' || typeof git.executable !== 'string' || typeof git.sha256 !== 'string')
+        return undefined;
+    try {
+        assertLocalFixConsent(raw.consent);
+    }
+    catch {
+        return undefined;
+    }
+    return raw;
+}
+const union = (first, second) => [...first, ...second.filter(value => !first.includes(value))];
+/**
+ * The one writer of local-fix-host.json consent, shared by `fix enable` (replace) and the daemon applying a Slack
+ * grant (extend; Work Item 6f9e64ae, decision baf0cd89). Refuses while a job or recovery is pending. Extend merges
+ * into a v3 host this runner would load and keeps its pinned Git; any other file is backed up and replaced by a
+ * fresh v3 host with newly pinned Git, as `fix enable` writes. Writes are owner-only and atomic; a replaced file is
+ * kept under backups/. Restarting the runner is the caller's job.
+ */
+export async function applyFixConsent(input) {
+    const requested = { repository_keys: [...input.repositoryKeys], verification_modes: [...input.verificationModes] };
+    try {
+        assertLocalFixConsent(requested);
+    }
+    catch {
+        return { ok: false, code: 'FIX_CONSENT_INVALID' };
+    }
+    if (await fixHostBusy(input.stateRoot))
+        return { ok: false, code: 'FIX_HOST_JOB_ACTIVE' };
+    const file = path.join(input.stateRoot, HOST_FILE);
+    const existing = input.mode === 'extend' ? await currentConsentHost(file, input.runnerId) : undefined;
+    let host;
+    if (existing) {
+        const consent = { repository_keys: union(existing.consent.repository_keys, requested.repository_keys), verification_modes: union(existing.consent.verification_modes, requested.verification_modes) };
+        try {
+            assertLocalFixConsent(consent);
+        }
+        catch {
+            return { ok: false, code: 'FIX_CONSENT_INVALID' };
+        }
+        if (consent.repository_keys.length === existing.consent.repository_keys.length && consent.verification_modes.length === existing.consent.verification_modes.length)
+            return { ok: true, changed: false, consent: existing.consent };
+        host = { schema: 'local-fix-host-installation-v3', enabled: true, runnerId: input.runnerId, git: { executable: existing.git.executable, sha256: existing.git.sha256 }, consent };
+    }
+    else {
+        const executable = await realpath(input.git ?? await (input.findGit ?? defaultGit)());
+        const git = { executable, sha256: await measureCommandFile(executable) };
+        await assertPinnedGit(git);
+        host = { schema: 'local-fix-host-installation-v3', enabled: true, runnerId: input.runnerId, git, consent: requested };
+    }
+    const privateRoot = path.join(input.stateRoot, 'local-fix-publication');
+    if (!await exists(privateRoot))
+        await mkdir(privateRoot, { mode: 0o700 });
+    const s = await lstat(privateRoot);
+    if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0)
+        return { ok: false, code: 'FIX_HOST_PRIVATE_DIRECTORY_INSECURE', privateRoot };
+    const serialized = JSON.stringify(host, null, 1);
+    let previous;
+    if (await exists(file)) {
+        previous = await readFile(file, 'utf8').catch(() => undefined);
+        await backup(input.stateRoot, file);
+    }
+    const temporary = path.join(input.stateRoot, `.${HOST_FILE}.${randomUUID()}`);
+    await writeFile(temporary, serialized, { mode: 0o600, flag: 'wx' });
+    await rename(temporary, file);
+    return { ok: true, changed: previous !== serialized, consent: host.consent };
+}
 async function restart(io, summary) {
     if (await io.serviceLoaded()) {
         await io.restartService();
@@ -77,7 +166,7 @@ export async function runFixCommand(argv, io) {
             io.stdout(JSON.stringify({ ok: true, removed: false }));
             return 0;
         }
-        await backup(io, file);
+        await backup(io.stateRoot, file);
         await rm(file);
         return restart(io, { ok: true, removed: true });
     }
@@ -103,24 +192,15 @@ export async function runFixCommand(argv, io) {
         io.stderr('MESSENGER_MODE_HAS_NO_EXECUTOR: log in to Claude Code or Codex, then rerun npx mtech-ai-local-runner@latest setup before fix enable.');
         return 1;
     }
-    if (!await idle(io))
-        return 1;
-    const executable = await realpath(values.get('git') ?? await (io.findGit ?? defaultGit)());
-    const git = { executable, sha256: await measureCommandFile(executable) };
-    await assertPinnedGit(git);
-    const privateRoot = path.join(io.stateRoot, 'local-fix-publication');
-    if (!await exists(privateRoot))
-        await mkdir(privateRoot, { mode: 0o700 });
-    const s = await lstat(privateRoot);
-    if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) {
-        io.stderr('FIX_HOST_PRIVATE_DIRECTORY_INSECURE: ' + privateRoot + ' must be a 0700 directory owned by this user.');
+    const applied = await applyFixConsent({ stateRoot: io.stateRoot, runnerId: local.runnerId, repositoryKeys: consent.repository_keys, verificationModes: consent.verification_modes, mode: 'replace', git: values.get('git'), findGit: io.findGit });
+    if (!applied.ok) {
+        if (applied.code === 'FIX_HOST_JOB_ACTIVE')
+            io.stderr(JOB_ACTIVE);
+        else if (applied.code === 'FIX_HOST_PRIVATE_DIRECTORY_INSECURE')
+            io.stderr('FIX_HOST_PRIVATE_DIRECTORY_INSECURE: ' + applied.privateRoot + ' must be a 0700 directory owned by this user.');
+        else
+            io.stderr('FIX_CONSENT_INVALID: give registered repository keys (lowercase, comma separated, no repeats) and modes gateway_publish_v1 or gateway_ci_v1.');
         return 1;
     }
-    const host = { schema: 'local-fix-host-installation-v3', enabled: true, runnerId: local.runnerId, git, consent };
-    if (await exists(file))
-        await backup(io, file);
-    const temporary = path.join(io.stateRoot, `.${HOST_FILE}.${randomUUID()}`);
-    await writeFile(temporary, JSON.stringify(host, null, 1), { mode: 0o600, flag: 'wx' });
-    await rename(temporary, file);
-    return restart(io, { ok: true, repository_keys: consent.repository_keys, verification_modes: consent.verification_modes });
+    return restart(io, { ok: true, repository_keys: applied.consent.repository_keys, verification_modes: applied.consent.verification_modes });
 }

package/dist/src/daemon/execution-coordinator.js

@@ -1,3 +1,4 @@
+import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
@@ -9,7 +10,7 @@ import { requireSecurityRequirements } from '../safety/security-requirements.js'
 import { GatewayToolError } from "../gateway-client.js";
 import { createHash } from "node:crypto";
 import { completionReportDiagnostic } from "../adapters/completion-report.js";
-import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
+import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, validateAttemptEvidence, validateAttemptHandoff, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 import { DAEMON_BLOCKED_REASONS, DAEMON_CANCELLED_REASONS } from "../state-store.js";
 import { PreparationDeadlineError, PreparationLease, validateJobLease } from './preparation-lease.js';
 function canonical(value) {
@@ -66,8 +67,24 @@ export class ExecutionCoordinator {
     constructor(deps) {
         this.deps = deps;
     }
-    async execute(job) {
-        job = { ...job, taskPackage: immutable(structuredClone(job.taskPackage)) };
+    active;
+    execute(job) {
+        job = immutable(structuredClone(job));
+        const key = `${job.id}:${job.generation}`;
+        if (this.active) {
+            if (this.active.key !== key)
+                return Promise.reject(Error('EXECUTION_ALREADY_ACTIVE'));
+            if (this.active.identity !== fingerprint(job))
+                return Promise.reject(Error('EXECUTION_CLAIM_MISMATCH'));
+            return this.active.promise;
+        }
+        const promise = Promise.resolve().then(() => this.executeOwned(job));
+        this.active = { key, identity: fingerprint(job), promise };
+        void promise.finally(() => { if (this.active?.promise === promise)
+            this.active = undefined; }).catch(() => { });
+        return promise;
+    }
+    async executeOwned(job) {
         let stage = "package";
         let workspace;
         let adapter;
@@ -77,8 +94,9 @@ export class ExecutionCoordinator {
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
         const isP1 = hasP1(job.taskPackage);
         const envelope = job.taskPackage.verification;
-        const runnerBinding = envelope?.schema_version === 'local-runner-verification-v2' ? envelope.runner_binding : envelope;
+        const runnerBinding = ['local-runner-verification-v2', 'local-runner-verification-v3'].includes(String(envelope?.schema_version)) ? envelope?.runner_binding : envelope;
         const isP2 = isP1 && runnerBinding?.gateway_verification !== undefined;
+        let executionAttempt;
         let p1Result;
         let p2Handoff;
         const p1ReceiptIds = [];
@@ -89,6 +107,19 @@ export class ExecutionCoordinator {
         const step = (operation) => preparation.step(operation);
         let bindingAttempted = false;
         try {
+            try {
+                executionAttempt = assertClaimedExecutionAttempt(job);
+            }
+            catch {
+                throw new GatewayToolError('Continuation execution is unavailable', 'local_agent_jobs_wait', 'CORRECTION_EXECUTION_UNAVAILABLE');
+            }
+            // Trusted host admission and measurement precede checkout. Package/schema/hash alone is never authority.
+            if (executionAttempt) {
+                if (!this.deps.p1Host?.assertCurrent || !this.deps.gateway.readCommands || !this.deps.gateway.heartbeat)
+                    throw Error('CORRECTION_HOST_INCOMPATIBLE');
+                this.deps.p1Host.assertEligible(job);
+                await step(() => this.deps.p1Host.assertCurrent(job));
+            }
             await preparation.start();
             const pkg = job.taskPackage;
             if (isP1) {
@@ -116,8 +147,9 @@ export class ExecutionCoordinator {
                 repositoryKey: text(repository?.key, "repository key"),
                 providerUrl: text(repository?.provider_url, "repository provider URL"),
                 baseCommitSha: text(repository?.base_commit_sha, "repository SHA"),
-                ...(isLocalFix || isP1 ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {}),
-                ...(isP1 ? { p1WorkingBranch: text(repository?.working_branch, 'approved P1 branch') } : {})
+                ...(isLocalFix || isP1 ? { workingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, "approved fix branch") } : {}),
+                ...(isP1 ? { p1WorkingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, 'approved P1 branch') } : {}),
+                ...(executionAttempt ? { attemptContext: executionAttempt, attemptContextFingerprint: job.executionAttemptFingerprint } : {})
             }));
             stage = "adapter";
             adapter = await preparation.step(() => this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id }), late => late.cancel());
@@ -137,6 +169,10 @@ export class ExecutionCoordinator {
             preparation.beginBinding();
             bindingAttempted = true;
             binding = await step(() => this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path }, preparation.signal));
+            assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
+            if (executionAttempt && binding.bindingReplayed !== false)
+                throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+            binding = immutable(structuredClone(binding));
             if (isP1)
                 assertP1Bindings(pkg, binding.taskPackage, true);
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest }));
@@ -474,8 +510,25 @@ export class ExecutionCoordinator {
                         return session;
                     }));
             }
+            if (executionAttempt) {
+                await readControls();
+                requireControlFence();
+                if (!requestedTerminal) {
+                    const renewed = await fenced(this.deps.gateway.heartbeat(binding.bindingId, job, controlAbort.signal));
+                    requireControlFence();
+                    const expiry = validateJobLease(renewed, job, true);
+                    if (!['running', 'review_pending'].includes(renewed.job.status))
+                        throw Error('JOB_LEASE_FENCE_INVALID');
+                    this.deps.gateway.confirmJobLease?.(job, expiry);
+                    leaseExpiresAt = expiry;
+                    armLeaseBoundary();
+                    await fenced(this.deps.p1Host.assertCurrent(job));
+                    await readControls();
+                    requireControlFence();
+                }
+            }
             if (!requestedTerminal) {
-                await fenced(Promise.race([adapter.start({ securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
+                await fenced(Promise.race([adapter.start({ ...(executionAttempt ? { executionAttempt, executionAttemptFingerprint: job.executionAttemptFingerprint } : {}), securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
             }
             executionStage = 'commands';
             await readControls();
@@ -508,9 +561,12 @@ export class ExecutionCoordinator {
                                 await freezeOwnedModel();
                                 await readControls();
                                 executionStage = 'p1_verify';
-                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ ...(executionAttempt ? { executionAttempt } : {}), job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
                                     exportCandidate: isP2 ? async (handoff) => { await readControls(); await assertModelFrozen(); if (p2Handoff)
-                                        throw Error('P2_DUPLICATE_HANDOFF'); p2Handoff = structuredClone(handoff); } : undefined }));
+                                        throw Error('P2_DUPLICATE_HANDOFF'); if (executionAttempt)
+                                        validateAttemptHandoff(handoff, executionAttempt); p2Handoff = structuredClone(handoff); } : undefined }));
+                                if (executionAttempt)
+                                    validateAttemptEvidence(p1Result, executionAttempt);
                                 executionStage = 'p1_receipts';
                                 await readControls();
                                 await assertModelFrozen();

package/dist/src/daemon/fix-consent.js

@@ -0,0 +1,98 @@
+import { applyFixConsent, fixHostBusy } from "../commands/fix.js";
+const covers = (report, grant) => !!report && report.repository_keys.includes(grant.repositoryKey) && report.verification_modes.includes(grant.verificationMode);
+export class FixConsentRuntime {
+    deps;
+    /** Grants deferred while busy. Each later sync's own list replaces them, so a grant the Gateway dropped is never applied from memory. */
+    deferred = [];
+    due = false;
+    stopping = false;
+    logged = new Set();
+    queue = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** True once a changed host waits for the restart; new claims are held until then. */
+    get restartDue() { return this.due; }
+    /** Applies the grants of one sync when idle. The restart waits for afterSync, so the rest of that sync (its session opens) is still handled. */
+    handleGrants(grants) {
+        return this.serial(async () => { this.deferred = grants.slice(0, 20); await this.apply(); });
+    }
+    /** After every sync: drops deferred grants the sync no longer lists, and restarts once a changed host is due and the runner is idle. */
+    afterSync(result) {
+        return this.serial(async () => {
+            if (!Array.isArray(result.fixConsentGrants) || result.fixConsentGrants.length === 0)
+                this.deferred = [];
+            await this.apply();
+            await this.restartWhenIdle();
+        });
+    }
+    serial(task) {
+        const next = this.queue.then(task, task);
+        this.queue = next.catch(() => undefined);
+        return next;
+    }
+    async busy() {
+        return this.deps.jobRunning() || await fixHostBusy(this.deps.stateRoot);
+    }
+    once(key, event) {
+        if (this.logged.has(key))
+            return;
+        this.logged.add(key);
+        this.deps.log(event);
+    }
+    async apply() {
+        if (this.stopping)
+            return;
+        const pending = this.deferred.filter(grant => !covers(this.deps.report(), grant));
+        if (pending.length > 0 && await this.busy()) {
+            this.deferred = pending;
+            for (const grant of pending)
+                this.once(`deferred:${grant.id}`, { event: "fix_consent_deferred", grant_id: grant.id, repository_key: grant.repositoryKey, reason: "job_active" });
+            return;
+        }
+        this.deferred = [];
+        const applied = [];
+        for (const grant of pending) {
+            let result;
+            try {
+                result = await applyFixConsent({ stateRoot: this.deps.stateRoot, runnerId: this.deps.runnerId,
+                    repositoryKeys: [grant.repositoryKey], verificationModes: [grant.verificationMode], mode: "extend" });
+            }
+            catch {
+                // Git could not be pinned or the file could not be written; the error text may name local paths, so only the code is logged.
+                result = { ok: false, code: "FIX_CONSENT_APPLY_FAILED" };
+            }
+            if (!result.ok && result.code === "FIX_HOST_JOB_ACTIVE") {
+                this.deferred.push(grant);
+                continue;
+            }
+            if (!result.ok) {
+                this.reject(grant, result.code);
+                continue;
+            }
+            if (result.changed) {
+                this.due = true;
+                applied.push(grant);
+                continue;
+            }
+            // Already on disk, yet the host loaded at start does not report it: a restart would load the same file again.
+            if (!this.due)
+                this.reject(grant, "FIX_HOST_NOT_LOADED");
+        }
+        if (applied.length > 0) {
+            this.deps.log({ event: "fix_consent_applied", grant_ids: applied.map(grant => grant.id),
+                repository_keys: [...new Set(applied.map(grant => grant.repositoryKey))], verification_modes: [...new Set(applied.map(grant => grant.verificationMode))] });
+        }
+    }
+    async restartWhenIdle() {
+        if (this.stopping || !this.due || await fixHostBusy(this.deps.stateRoot) || this.deps.jobRunning())
+            return;
+        // No await between the last check and the stop: the daemon stops its job runner first, so no claim starts after it.
+        this.stopping = true;
+        this.deps.log({ event: "runner_restarting", reason: "fix_consent" });
+        this.deps.restart();
+    }
+    reject(grant, code) {
+        this.once(`rejected:${grant.id}:${code}`, { event: "fix_consent_rejected", grant_id: grant.id, repository_key: grant.repositoryKey, code });
+    }
+}

package/dist/src/daemon/manual-codex.js

@@ -36,7 +36,7 @@ export async function runManualCodexJob(input, deps) {
         let leaseExpires = claim.job.lease_expires_at;
         if (!Number.isSafeInteger(leaseExpires))
             throw Error('MANUAL_PILOT_LEASE_MISSING');
-        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint };
+        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint, executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint };
         await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: 'claimed' });
         let result = { jobId: job.id, status: 'unacknowledged' };
         const confirmJobLease = (j, expires) => { host?.heartbeat(j.id, j.generation, expires); leaseExpires = expires; claim.job.lease_expires_at = expires; };
@@ -65,7 +65,7 @@ export async function runManualCodexJob(input, deps) {
             gateway: {
                 renewJob: (j, signal) => input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal), confirmJobLease,
                 shadow: (j, signal) => input.gateway.localJobShadow({ workLoopId: j.workLoopId, contractFingerprint: j.gatewayContractFingerprint, taskPackageFingerprint: j.gatewayTaskPackageFingerprint }, signal),
-                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath }, signal),
+                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath, claimedJob: j }, signal),
                 appendEvent: (id, event) => input.gateway.appendEvent(id, event), readCommands: (id, cursor, signal) => input.gateway.readCommands(id, cursor, signal), acknowledgeCommand: (id, sequence, signal) => input.gateway.acknowledgeCommand(id, sequence, signal),
                 async heartbeat(id, j, signal) { await input.gateway.heartbeat(id, signal); signal.throwIfAborted(); return input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal); },
                 async complete(value) { await input.gateway.completeLocalJob(value); result = { jobId: value.jobId, status: value.status }; }