mtech-ai-local-runner 0.1.73 → 0.1.74

package/README.md

@@ -1,3 +1,31 @@
+## 0.1.74: exact-parent reviewed correction attempts (P3D)
+
+This local source supports newly approved executable V3 launches behind the
+Gateway's default-off `correction_execution_enabled` switch. It does not activate
+an installed runner or upgrade older V1/V2/unavailable-V3 approvals.
+
+Authenticated claim context arrives before checkout. The approved task package,
+canonical repository lease and binding retain ROOT identity; each attempt checks
+out its exact Gateway-reviewed parent P and emits fresh context-bound receipts,
+snapshot and handoff. The original approval fingerprint differs from a successor
+job's reservation fingerprint and remains preserved through at most three attempts.
+Native launch seals the exact context and binding in the host-owned immutable
+plan, measures P immediately before dispatch, and keeps existing ROOT security
+receipt semantics. A replayed binding or uncertain model outcome pauses.
+
+A measured trusted host registration supplies registered submodule providers.
+The runner fetches exact P gitlinks through owned mirrors and refuses unknown
+providers, metadata redirects and nested P-child gitlinks. No profile is installed
+by these source changes. Correction findings are bounded untrusted data scoped to
+the canonical bundle paths; they cannot expand authority or become commands.
+
+Local fake transport/provider/process tests are distinct from real CI or model
+acceptance. A final release commit/version, package manifest/hash and compatible
+reviewed host registration remain pending delivery approval. See the
+[P3D-4 review](../../docs/superpowers/reviews/2026-10-30-local-runner-p3d4-implementation-review.md)
+for verification and compatibility limitations. No setup/update/restart is needed
+to inspect this source tree.
+
 ## 0.1.60: answers go back to the session that asked
 
 An answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,3 +1,4 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
@@ -16,5 +17,6 @@ const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
     "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
     "failed for another reason, such as a file that does not exist.";
 export function compilePrompt(taskPackage, options) {
-    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}${correction}`;
 }

package/dist/src/adapters/codex/exec-invocation.js

@@ -1,3 +1,4 @@
+import { validateAttemptContext, attemptContextFingerprint } from '../../verification/continuation-runner-contract.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import path from 'node:path';
 import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './global-instructions.js';
@@ -10,10 +11,18 @@ export const EXEC_MODE = 'supported_cli_exec_policy_v1';
 export const isReleaseExecMode = (mode) => mode === EXEC_RELEASE_MODE || mode === UNMANAGED_EXEC_MODE;
 const plans = new WeakMap();
 const consumed = new WeakSet();
+const executionAttempts = new WeakMap();
 const fail = () => new Error('CODEX_EXEC_PLAN_REJECTED');
 export function buildOfficialExecPlan(input) {
     try {
         const i = structuredClone(input.identity), inv = structuredClone(input.invocation);
+        const attempt = input.executionAttempt === undefined ? undefined : validateAttemptContext(input.executionAttempt);
+        if ((attempt === undefined) !== (input.executionAttemptFingerprint === undefined) || (attempt === undefined) !== (input.executionBindingId === undefined))
+            throw fail();
+        if (attempt && (typeof input.executionBindingId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(input.executionBindingId)))
+            throw fail();
+        if (attempt && (attemptContextFingerprint(attempt) !== input.executionAttemptFingerprint || attempt.job_id !== i.jobId || attempt.generation !== i.generation || attempt.contract_base_commit_sha !== i.sourceSha || attempt.contract_fingerprint !== i.contractFingerprint || (attempt.attempt_number === 1 && attempt.launch_approval_fingerprint !== i.launchFingerprint)))
+            throw fail();
         if (input.policyMode !== undefined && !isReleaseExecMode(input.policyMode))
             throw fail();
         const keys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
@@ -36,6 +45,8 @@ export function buildOfficialExecPlan(input) {
         const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };
         const executionNonce = randomBytes(32).toString('hex');
         const plan = Object.freeze({ transport: EXEC_TRANSPORT, mode: input.policyMode ?? EXEC_MODE, executionNonce, identity: Object.freeze(i), modelId: inv.modelId, home: inv.env.HOME, accountRoot, credentialBackend: input.credentialBackend, binary: input.binary, cwd, endpoint: inv.endpoint.url, invocationFingerprint: hash({ ...actual }) });
+        if (attempt)
+            executionAttempts.set(plan, { fingerprint: input.executionAttemptFingerprint, bindingId: input.executionBindingId, sourceRoot: source });
         plans.set(plan, structuredClone(actual));
         return plan;
     }
@@ -60,3 +71,16 @@ export function assertOfficialExecPlanAvailable(plan) {
     if (consumed.has(plan))
         throw fail();
 }
+/** Private plan seal is execution identity, separate from legacy ROOT approval
+ * and security receipt identity. Native host still verifies Gateway authority. */
+export function assertOfficialExecAttempt(plan, context, fingerprint, bindingId, sourceRoot) {
+    requireOfficialExecPlan(plan);
+    const expected = executionAttempts.get(plan);
+    if (expected === undefined) {
+        if (context !== undefined || fingerprint !== undefined)
+            throw fail();
+        return;
+    }
+    if (context === undefined || fingerprint !== expected.fingerprint || attemptContextFingerprint(context) !== expected.fingerprint || bindingId !== expected.bindingId || sourceRoot !== undefined && path.resolve(sourceRoot) !== expected.sourceRoot)
+        throw fail();
+}

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,4 @@
+import { assertOfficialExecAttempt } from './exec-invocation.js';
 import { performance } from 'node:perf_hooks';
 import { PreparationClock, CODEX_PREPARATION_BUDGET_MS } from '../../safety/preparation-timing.js';
 import { localEndpointObservations, localEndpointReadObservations } from '../../safety/local-tool-server.js';
@@ -42,6 +43,7 @@ export class CodexExecLaunchHost {
         throw fail();
     } }
     assertContext(ctx, jobId) {
+        assertOfficialExecAttempt(this.plan, ctx.executionAttempt, ctx.executionAttemptFingerprint, ctx.bindingId);
         const a = ctx.approvedTaskPackage, r = a?.security_requirements, b = ctx.taskPackage, execution = b?.execution;
         if (isReleaseExecMode(this.plan.mode)) {
             if (!r)
@@ -63,6 +65,7 @@ export class CodexExecLaunchHost {
     async start(ctx, jobId, prompt, signal) {
         if (this.used || this.stopped)
             throw fail();
+        ctx = structuredClone(ctx);
         this.assertAvailableContext(ctx, jobId);
         claimOfficialExecPlan(this.plan);
         this.ownsAttempt = true;
@@ -114,6 +117,8 @@ export class CodexExecLaunchHost {
                 this.inspection.beforeSpawn?.();
                 timing.mark('before_spawn_complete');
                 assertPreparationBudget();
+                this.current();
+                this.assertContext(ctx, jobId);
                 stage = 'codex_spawn';
                 timing.mark('spawn_requested');
                 const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -99,7 +99,7 @@ export function buildCodexExecJobOptions(input) {
                 if (closed || signal.aborted)
                     throw reject();
                 stage = 'codex_invocation';
-                const plan = buildOfficialExecPlan({ policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                const plan = buildOfficialExecPlan({ executionAttempt: ctx.executionAttempt, executionAttemptFingerprint: ctx.executionAttemptFingerprint, ...(ctx.executionAttempt ? { executionBindingId: ctx.bindingId } : {}), policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
                 gate = new ExecToolGate(plan);
                 const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
                 launchHost = host;

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,7 +1,9 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${correction}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/asks/runtime.js

@@ -21,6 +21,25 @@ const SHUTDOWN_WAIT_MS = 5000;
  * would end. Bounded, so a heartbeat, and the job claim behind it, is never held up longer than this.
  */
 export const ADVERTISEMENT_START_WAIT_MS = 2000;
+/** Room notices use only a human prompt already arriving at the Ask hub; they never wake a model. */
+export function withRoomNotice(handler, claim) {
+    return {
+        status: () => handler.status(),
+        watch: (request, watcher) => handler.watch(request, watcher),
+        event: async (request, client) => {
+            const text = await handler.event(request, client);
+            if (request.event !== 'prompt' || request.human !== true || client.gone)
+                return text;
+            try {
+                const notice = await claim();
+                return notice === null ? text : text === null ? notice : `${text}\n${notice}`;
+            }
+            catch {
+                return text;
+            }
+        },
+    };
+}
 function errorCode(error) {
     const code = error?.code;
     if (typeof code === "string" && /^[A-Z0-9_]{1,64}$/.test(code))
@@ -51,7 +70,9 @@ export class AskRuntime {
             openSession: deps.openSession ?? createSessionOpener({ home: deps.env.HOME ?? "" }),
             presenceRecheckMs: deps.presenceRecheckMs,
             onChange: () => this.flushSoon(), log: event => this.log(event) });
-        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot), handler: this.inbox, log: event => this.log(event) });
+        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot),
+            handler: deps.claimRoomNotice ? withRoomNotice(this.inbox, deps.claimRoomNotice) : this.inbox,
+            log: event => this.log(event) });
     }
     /** True while the hub listens; only then are deliveries taken and ask_inbox advertised. */
     get ready() {

package/dist/src/daemon/execution-coordinator.js

@@ -1,3 +1,4 @@
+import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
@@ -9,7 +10,7 @@ import { requireSecurityRequirements } from '../safety/security-requirements.js'
 import { GatewayToolError } from "../gateway-client.js";
 import { createHash } from "node:crypto";
 import { completionReportDiagnostic } from "../adapters/completion-report.js";
-import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
+import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, validateAttemptEvidence, validateAttemptHandoff, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 import { DAEMON_BLOCKED_REASONS, DAEMON_CANCELLED_REASONS } from "../state-store.js";
 import { PreparationDeadlineError, PreparationLease, validateJobLease } from './preparation-lease.js';
 function canonical(value) {
@@ -66,8 +67,24 @@ export class ExecutionCoordinator {
     constructor(deps) {
         this.deps = deps;
     }
-    async execute(job) {
-        job = { ...job, taskPackage: immutable(structuredClone(job.taskPackage)) };
+    active;
+    execute(job) {
+        job = immutable(structuredClone(job));
+        const key = `${job.id}:${job.generation}`;
+        if (this.active) {
+            if (this.active.key !== key)
+                return Promise.reject(Error('EXECUTION_ALREADY_ACTIVE'));
+            if (this.active.identity !== fingerprint(job))
+                return Promise.reject(Error('EXECUTION_CLAIM_MISMATCH'));
+            return this.active.promise;
+        }
+        const promise = Promise.resolve().then(() => this.executeOwned(job));
+        this.active = { key, identity: fingerprint(job), promise };
+        void promise.finally(() => { if (this.active?.promise === promise)
+            this.active = undefined; }).catch(() => { });
+        return promise;
+    }
+    async executeOwned(job) {
         let stage = "package";
         let workspace;
         let adapter;
@@ -77,8 +94,9 @@ export class ExecutionCoordinator {
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
         const isP1 = hasP1(job.taskPackage);
         const envelope = job.taskPackage.verification;
-        const runnerBinding = envelope?.schema_version === 'local-runner-verification-v2' ? envelope.runner_binding : envelope;
+        const runnerBinding = ['local-runner-verification-v2', 'local-runner-verification-v3'].includes(String(envelope?.schema_version)) ? envelope?.runner_binding : envelope;
         const isP2 = isP1 && runnerBinding?.gateway_verification !== undefined;
+        let executionAttempt;
         let p1Result;
         let p2Handoff;
         const p1ReceiptIds = [];
@@ -89,6 +107,19 @@ export class ExecutionCoordinator {
         const step = (operation) => preparation.step(operation);
         let bindingAttempted = false;
         try {
+            try {
+                executionAttempt = assertClaimedExecutionAttempt(job);
+            }
+            catch {
+                throw new GatewayToolError('Continuation execution is unavailable', 'local_agent_jobs_wait', 'CORRECTION_EXECUTION_UNAVAILABLE');
+            }
+            // Trusted host admission and measurement precede checkout. Package/schema/hash alone is never authority.
+            if (executionAttempt) {
+                if (!this.deps.p1Host?.assertCurrent || !this.deps.gateway.readCommands || !this.deps.gateway.heartbeat)
+                    throw Error('CORRECTION_HOST_INCOMPATIBLE');
+                this.deps.p1Host.assertEligible(job);
+                await step(() => this.deps.p1Host.assertCurrent(job));
+            }
             await preparation.start();
             const pkg = job.taskPackage;
             if (isP1) {
@@ -116,8 +147,9 @@ export class ExecutionCoordinator {
                 repositoryKey: text(repository?.key, "repository key"),
                 providerUrl: text(repository?.provider_url, "repository provider URL"),
                 baseCommitSha: text(repository?.base_commit_sha, "repository SHA"),
-                ...(isLocalFix || isP1 ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {}),
-                ...(isP1 ? { p1WorkingBranch: text(repository?.working_branch, 'approved P1 branch') } : {})
+                ...(isLocalFix || isP1 ? { workingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, "approved fix branch") } : {}),
+                ...(isP1 ? { p1WorkingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, 'approved P1 branch') } : {}),
+                ...(executionAttempt ? { attemptContext: executionAttempt, attemptContextFingerprint: job.executionAttemptFingerprint } : {})
             }));
             stage = "adapter";
             adapter = await preparation.step(() => this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id }), late => late.cancel());
@@ -137,6 +169,10 @@ export class ExecutionCoordinator {
             preparation.beginBinding();
             bindingAttempted = true;
             binding = await step(() => this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path }, preparation.signal));
+            assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
+            if (executionAttempt && binding.bindingReplayed !== false)
+                throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+            binding = immutable(structuredClone(binding));
             if (isP1)
                 assertP1Bindings(pkg, binding.taskPackage, true);
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest }));
@@ -474,8 +510,25 @@ export class ExecutionCoordinator {
                         return session;
                     }));
             }
+            if (executionAttempt) {
+                await readControls();
+                requireControlFence();
+                if (!requestedTerminal) {
+                    const renewed = await fenced(this.deps.gateway.heartbeat(binding.bindingId, job, controlAbort.signal));
+                    requireControlFence();
+                    const expiry = validateJobLease(renewed, job, true);
+                    if (!['running', 'review_pending'].includes(renewed.job.status))
+                        throw Error('JOB_LEASE_FENCE_INVALID');
+                    this.deps.gateway.confirmJobLease?.(job, expiry);
+                    leaseExpiresAt = expiry;
+                    armLeaseBoundary();
+                    await fenced(this.deps.p1Host.assertCurrent(job));
+                    await readControls();
+                    requireControlFence();
+                }
+            }
             if (!requestedTerminal) {
-                await fenced(Promise.race([adapter.start({ securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
+                await fenced(Promise.race([adapter.start({ ...(executionAttempt ? { executionAttempt, executionAttemptFingerprint: job.executionAttemptFingerprint } : {}), securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
             }
             executionStage = 'commands';
             await readControls();
@@ -508,9 +561,12 @@ export class ExecutionCoordinator {
                                 await freezeOwnedModel();
                                 await readControls();
                                 executionStage = 'p1_verify';
-                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ ...(executionAttempt ? { executionAttempt } : {}), job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
                                     exportCandidate: isP2 ? async (handoff) => { await readControls(); await assertModelFrozen(); if (p2Handoff)
-                                        throw Error('P2_DUPLICATE_HANDOFF'); p2Handoff = structuredClone(handoff); } : undefined }));
+                                        throw Error('P2_DUPLICATE_HANDOFF'); if (executionAttempt)
+                                        validateAttemptHandoff(handoff, executionAttempt); p2Handoff = structuredClone(handoff); } : undefined }));
+                                if (executionAttempt)
+                                    validateAttemptEvidence(p1Result, executionAttempt);
                                 executionStage = 'p1_receipts';
                                 await readControls();
                                 await assertModelFrozen();

package/dist/src/daemon/manual-codex.js

@@ -36,7 +36,7 @@ export async function runManualCodexJob(input, deps) {
         let leaseExpires = claim.job.lease_expires_at;
         if (!Number.isSafeInteger(leaseExpires))
             throw Error('MANUAL_PILOT_LEASE_MISSING');
-        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint };
+        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint, executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint };
         await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: 'claimed' });
         let result = { jobId: job.id, status: 'unacknowledged' };
         const confirmJobLease = (j, expires) => { host?.heartbeat(j.id, j.generation, expires); leaseExpires = expires; claim.job.lease_expires_at = expires; };
@@ -65,7 +65,7 @@ export async function runManualCodexJob(input, deps) {
             gateway: {
                 renewJob: (j, signal) => input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal), confirmJobLease,
                 shadow: (j, signal) => input.gateway.localJobShadow({ workLoopId: j.workLoopId, contractFingerprint: j.gatewayContractFingerprint, taskPackageFingerprint: j.gatewayTaskPackageFingerprint }, signal),
-                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath }, signal),
+                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath, claimedJob: j }, signal),
                 appendEvent: (id, event) => input.gateway.appendEvent(id, event), readCommands: (id, cursor, signal) => input.gateway.readCommands(id, cursor, signal), acknowledgeCommand: (id, sequence, signal) => input.gateway.acknowledgeCommand(id, sequence, signal),
                 async heartbeat(id, j, signal) { await input.gateway.heartbeat(id, signal); signal.throwIfAborted(); return input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal); },
                 async complete(value) { await input.gateway.completeLocalJob(value); result = { jobId: value.jobId, status: value.status }; }

package/dist/src/daemon/runtime.js

@@ -35,6 +35,8 @@ import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 import { AskRuntime, withAsks } from '../asks/runtime.js';
 import { GuideRuntime, withGuide } from '../guide/runtime.js';
 import { FixConsentRuntime } from './fix-consent.js';
+import { RoomActivityRuntime } from '../rooms/activity.js';
+import { notifyRoomActivity } from '../rooms/notifier.js';
 export async function buildDaemon(input) {
     const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
     if (claudeParts !== 0 && claudeParts !== 3)
@@ -63,8 +65,11 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    const roomActivity = new RoomActivityRuntime({ stateRoot: input.stateRoot,
+        read: (cursor, limit) => gateway.readRoomActivity(cursor, limit), notify: notifyRoomActivity });
     // AI-first ask delivery (Work Item e1c08b33) rides on the session-open loop below; it starts no executor.
     const asks = new AskRuntime({ stateRoot: input.stateRoot, env: input.env,
+        claimRoomNotice: () => roomActivity.claimNotice(),
         report: (deliveryId, report, signal) => gateway.reportAskDelivery({ deliveryId, ...report }, signal),
         log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     // Guide hooks (Work Item d38d60f9) ride on the same sync and heartbeat; they start no executor.
@@ -121,7 +126,7 @@ export async function buildDaemon(input) {
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
             createBinding: async (job, signal) => gateway.createLocalJobBinding({
                 jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath,
+                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
             }, signal),
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
@@ -145,7 +150,7 @@ export async function buildDaemon(input) {
                 }
                 return registry.select(id, version, options);
             } },
-        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient() }),
+        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient(), registeredSubmodules: p1Host?.registeredSubmodules }),
         state,
     });
     let transport;
@@ -167,6 +172,7 @@ export async function buildDaemon(input) {
                 launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint,
                 gatewayTaskPackageFingerprint: claim.task_package_fingerprint,
                 leaseExpiresAt: claim.job.lease_expires_at,
+                executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint,
             };
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
@@ -285,7 +291,7 @@ export async function buildDaemon(input) {
             const acknowledged = closureAcks.take();
             // A runner that takes no jobs right now (reconciling, or suspended for recovery) names no adapter.
             try {
-                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion() }, signal);
+                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion(), roomActivityV1: true }, signal);
             }
             catch (error) {
                 closureAcks.restore(acknowledged);
@@ -293,12 +299,17 @@ export async function buildDaemon(input) {
             }
         },
         authorize: (socketId, signal) => gateway.authorizeRunnerChannel(socketId, signal),
-        dispatch: async (result) => { try {
-            await dispatch(result);
-        }
-        finally {
-            await fixConsent.afterSync(result);
-        } },
+        dispatch: async (result) => {
+            void roomActivity.handleSync(result.roomActivityEnabled === true).catch(() => {
+                process.stderr.write(`${JSON.stringify({ event: 'room_activity_scan_failed' })}\n`);
+            });
+            try {
+                await dispatch(result);
+            }
+            finally {
+                await fixConsent.afterSync(result);
+            }
+        },
         openSocket: (target, events) => new ReverbSocket(target, events, { packageVersion: packageVersion() }),
         report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); },
     });

package/dist/src/gateway-client.js

@@ -1,3 +1,4 @@
+import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt, CONTINUATION_SCHEMA, CONTINUATION_POLICY } from './verification/continuation-runner-contract.js';
 import { publicationError } from './publication/failure.js';
 import { issueTransportDiagnostic } from './safety/transport-diagnostic.js';
 import { hasP1 } from './verification/p1-execution-host.js';
@@ -17,6 +18,7 @@ export class GatewayToolError extends Error {
         this.code = code;
     }
 }
+const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const FIX_CONSENT_GRANT_ID = /^[a-zA-Z0-9-]{1,64}$/;
 const FIX_CONSENT_REPOSITORY_KEY = /^[a-z0-9][a-z0-9._-]{0,99}$/;
 const FIX_CONSENT_GRANTS_MAX = 20;
@@ -60,6 +62,7 @@ export function parseRunnerSync(result, runnerId) {
         ...(typeof body.guidance_policy_version === "string" ? { guidancePolicyVersion: body.guidance_policy_version } : {}),
         ...("claude_release" in body ? { claudeRelease: parseClaudeSyncRelease(body.claude_release) } : {}),
         ...(body.ask_alert === true ? { askAlert: true } : {}),
+        ...(body.room_activity_enabled === true ? { roomActivityEnabled: true } : {}),
         ...(Array.isArray(body.fix_consent_grants) ? { fixConsentGrants: parseFixConsentGrants(body.fix_consent_grants) } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),
@@ -116,7 +119,7 @@ export function shadowTaskPackage(contract) {
     const verification = hasP1(payload) ? payload.verification : undefined;
     if (hasP1(payload)) {
         const resolved = resolveRunnerVerification(verification);
-        if (resolved.version === 2 && (nested(payload, 'policy.policy_key') !== REVIEWED_POLICY || nested(payload, 'policy.loop_type') !== REVIEWED_LOOP_TYPE))
+        if (resolved.version !== 1 && (nested(payload, 'policy.policy_key') !== (resolved.version === 3 ? CONTINUATION_POLICY : REVIEWED_POLICY) || nested(payload, 'policy.loop_type') !== REVIEWED_LOOP_TYPE))
             throw Error('P1_CONTRACT_REJECTED');
     }
     const repositories = (payload.repositories ?? []).map((repository) => ({
@@ -315,10 +318,14 @@ export class McpGatewayClient {
         if (!this.checkoutPath) {
             throw new Error("local checkout path is required before creating an execution binding");
         }
-        const useProvidedLease = Boolean(this.initialLeaseToken) && !input.claimNext;
+        const qualified = input.expectedJobId !== undefined || input.expectedAttemptNumber !== undefined;
+        if (qualified && (typeof input.expectedJobId !== 'string' || !input.expectedJobId.trim() || !Number.isSafeInteger(input.expectedAttemptNumber) || input.expectedAttemptNumber < 1 || input.expectedAttemptNumber > 3))
+            throw new GatewayToolError('Qualified next identity is invalid', 'work_loop_next', 'CORRECTION_LINEAGE_MISMATCH');
+        const nextArguments = { work_loop_id: input.workLoopId, ...(qualified ? { expected_job_id: input.expectedJobId, expected_attempt_number: input.expectedAttemptNumber } : {}) };
+        const useProvidedLease = Boolean(this.initialLeaseToken) && !input.claimNext && !qualified;
         const claim = useProvidedLease
             ? await this.callTool("work_loop_show", { work_loop_id: input.workLoopId })
-            : await this.callTool("work_loop_next", { work_loop_id: input.workLoopId });
+            : await this.callTool("work_loop_next", nextArguments);
         const leaseToken = useProvidedLease
             ? this.initialLeaseToken
             : requiredString(claim.lease_token, "lease token");
@@ -505,12 +512,25 @@ export class McpGatewayClient {
         return { leaseExpiresAt: context.leaseExpiresAt };
     }
     async waitForLocalJob(adapterVersions, waitSeconds = 25, jobId) {
-        return this.callTool("local_agent_jobs_wait", {
+        const claim = await this.callTool("local_agent_jobs_wait", {
             runner_id: this.runnerId,
             adapter_versions: adapterVersions,
             ...(jobId ? { job_id: jobId } : {}),
             wait_seconds: Math.max(0, Math.min(30, waitSeconds)),
         });
+        if (['continuation', 'execution_attempt', 'execution_attempt_fingerprint'].some(key => Object.hasOwn(claim, key)))
+            throw new GatewayToolError('Unexpected claimed attempt identity', 'local_agent_jobs_wait', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (claim.status === 'claimed' && claim.task_package && claim.job) {
+            try {
+                assertClaimedExecutionAttempt({ id: claim.job.id, generation: claim.job.generation, workLoopId: claim.job.work_loop_id, launchFingerprint: claim.job.launch_fingerprint, launchGrant: claim.launch_grant ?? '', leaseToken: claim.lease_token ?? '', taskPackage: claim.task_package, executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint });
+            }
+            catch {
+                throw new GatewayToolError('Claimed attempt identity is invalid', 'local_agent_jobs_wait', 'CORRECTION_EXECUTION_UNAVAILABLE');
+            }
+        }
+        else if (claim.attempt_context !== undefined || claim.attempt_context_fingerprint !== undefined)
+            throw new GatewayToolError('Unexpected claimed attempt identity', 'local_agent_jobs_wait', 'GATEWAY_INVALID_TOOL_RESULT');
+        return claim;
     }
     async registerLocalRunner(input) {
         return this.callTool("local_agent_runner_register", {
@@ -587,9 +607,40 @@ export class McpGatewayClient {
             reason: input.reason,
             ...(acknowledged.length > 0 ? { acknowledged_closure_ids: acknowledged } : {}),
             ...(input.guidancePolicyVersion ? { guidance_policy_version: input.guidancePolicyVersion } : {}),
+            ...(input.roomActivityV1 ? { room_activity_v1: true } : {}),
         }, signal);
         return parseRunnerSync(result, this.runnerId);
     }
+    async readRoomActivity(afterRoomId = '', limit = 50, signal) {
+        if ((afterRoomId !== '' && !ROOM_ID.test(afterRoomId)) || !Number.isInteger(limit) || limit < 1 || limit > 100) {
+            throw new GatewayToolError('Invalid Room activity query', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        const result = await this.callTool('work_room_read', { operation: 'activity', after_room_id: afterRoomId, limit, share_only: true }, signal);
+        const body = result && typeof result === 'object' && !Array.isArray(result) ? result : undefined;
+        if (!body || !Array.isArray(body.rooms) || body.rooms.length > limit
+            || !(body.next_cursor === null || (typeof body.next_cursor === 'string' && ROOM_ID.test(body.next_cursor)))) {
+            throw new GatewayToolError('Invalid Room activity page', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        const rooms = body.rooms.map(row => {
+            const item = row && typeof row === 'object' && !Array.isArray(row) ? row : {};
+            if (typeof item.room_id !== 'string' || !ROOM_ID.test(item.room_id)
+                || !Number.isSafeInteger(item.unread_count) || item.unread_count < 0
+                || !Number.isSafeInteger(item.latest_message_sequence) || item.latest_message_sequence < 0) {
+                throw new GatewayToolError('Invalid Room activity entry', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+            }
+            return { roomId: item.room_id, unreadCount: item.unread_count, latestMessageSequence: item.latest_message_sequence };
+        });
+        let previous = afterRoomId;
+        for (const room of rooms) {
+            if (room.roomId <= previous)
+                throw new GatewayToolError('Room activity order is invalid', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+            previous = room.roomId;
+        }
+        if (body.next_cursor !== null && (rooms.length === 0 || body.next_cursor !== previous)) {
+            throw new GatewayToolError('Room activity cursor is invalid', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        return { rooms, nextCursor: body.next_cursor };
+    }
     async authorizeRunnerChannel(socketId, signal) {
         const result = await this.callTool("local_agent_runner_channel_auth", {
             runner_id: this.runnerId,
@@ -640,6 +691,15 @@ export class McpGatewayClient {
         const bindingId = requiredString(result.binding.id, "binding ID");
         const iterationId = requiredString(result.binding.iteration_id, "iteration ID");
         signal?.throwIfAborted();
+        if (input.claimedJob) {
+            if (input.claimedJob.id !== input.jobId || input.claimedJob.generation !== input.generation || input.claimedJob.workLoopId !== input.workLoopId || input.claimedJob.leaseToken !== input.jobLeaseToken || input.claimedJob.launchGrant !== input.launchGrant || result.work_loop_id !== input.workLoopId)
+                throw Error('CORRECTION_LINEAGE_MISMATCH');
+            assertBoundExecutionAttempt(input.claimedJob, result.bundle, iterationId);
+            if (input.claimedJob.executionAttempt && typeof result.binding_replayed !== 'boolean')
+                throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+        }
+        else if (Object.hasOwn(result.bundle, 'attempt_context') || Object.hasOwn(result.bundle, 'attempt_context_fingerprint') || nested(result.bundle, 'contract.verification.schema_version') === CONTINUATION_SCHEMA)
+            throw Error('CORRECTION_LINEAGE_MISMATCH');
         this.context = {
             jobFence: { job_id: input.jobId, generation: input.generation, lease_token: input.jobLeaseToken },
             workLoopId: requiredString(result.work_loop_id, "Work Loop ID"),
@@ -653,7 +713,7 @@ export class McpGatewayClient {
             runtimeAdapterVersion: requiredString(result.binding.runtime_adapter_version, "runtime adapter version"),
         };
         return {
-            bindingId,
+            bindingId, iterationId, ...(input.claimedJob?.executionAttempt ? { bindingReplayed: result.binding_replayed } : {}),
             taskPackage: result.bundle,
             resolvedModelId: requiredString(result.binding.resolved_model_id, "resolved model ID"),
         };

package/dist/src/protocol.js

@@ -1,3 +1,5 @@
+import { validateAttemptContext, attemptContextFingerprint } from './verification/continuation-runner-contract.js';
+import { protocolHash } from './publication/candidate.js';
 export const PROTOCOL_VERSION = "agent-execution-v1";
 export const ROLES = ["planner", "supervisor", "executor", "reviewer"];
 export const EVENT_TYPES = [
@@ -73,3 +75,34 @@ export class TerminalGuard {
         return this.terminalSeen !== null;
     }
 }
+/** Wire-domain/identity check only. Scope, measured command results and grant authority
+ * are verified by their owners; a syntactically valid payload is not completion proof. */
+export function validateAttemptEvidence(value, expected) {
+    const c = validateAttemptContext(expected), fp = attemptContextFingerprint(c);
+    const reject = () => { throw Error('CORRECTION_LINEAGE_MISMATCH'); };
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        reject();
+    const p = value, m = p.changed_paths, receipts = p.receipts;
+    const hex = (v, n) => typeof v === 'string' && new RegExp(`^[a-f0-9]{${n}}$`).test(v);
+    if (!hex(p.candidate_commit_sha, 40) || !hex(p.snapshot_fingerprint, 64) || !m || m.schema_version !== 'runner-changed-paths-v2' || m.digest_domain !== 'p1-changed-paths-v2' || m.attempt_context_fingerprint !== fp || m.base_commit_sha !== c.attempt_base_commit_sha || m.candidate_commit_sha !== p.candidate_commit_sha || !Array.isArray(m.entries) || !m.entries.length || !Array.isArray(receipts) || !receipts.length)
+        reject();
+    const { manifest_sha256, ...unsigned } = m;
+    if (manifest_sha256 !== protocolHash(unsigned))
+        reject();
+    for (const value of receipts) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            reject();
+        const r = value;
+        if (r.schema_version !== 'runner-command-receipt-v2' || r.attempt_context_fingerprint !== fp || r.job_id !== c.job_id || r.generation !== c.generation || r.contract_fingerprint !== c.contract_fingerprint || r.candidate_commit_sha !== p.candidate_commit_sha || r.snapshot_fingerprint !== p.snapshot_fingerprint)
+            reject();
+    }
+}
+/** Versioned host handoff check, distinct from ordinary terminal event transport. */
+export function validateAttemptHandoff(value, expected) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw Error('CORRECTION_LINEAGE_MISMATCH');
+    const h = value, fp = attemptContextFingerprint(expected);
+    if (h.schema_version !== 'gateway-candidate-handoff-v2' || h.attempt_context_fingerprint !== fp || attemptContextFingerprint(h.attempt_context) !== fp)
+        throw Error('CORRECTION_LINEAGE_MISMATCH');
+    validateAttemptEvidence(h, expected);
+}