mtech-ai-local-runner 0.1.73 → 0.1.74

package/dist/src/verification/p1-execution-host.js

@@ -1,3 +1,4 @@
+import { CONTINUATION_POLICY, hasContinuationHints, validateAttemptContext, attemptContextFingerprint, assertContinuationHost, assertMeasuredContinuationManifest, assertClaimedExecutionAttempt, registeredContinuationSubmodules } from './continuation-runner-contract.js';
 import { RunnerObservedVerifier, assertGatewayVerificationScope } from './runner-observed-verifier.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 import { protocolHash } from '../publication/candidate.js';
@@ -6,24 +7,40 @@ export class RunnerObservedExecutionHost {
     privateRoot;
     supportedVerificationSchemas;
     registration;
+    get registeredSubmodules() { return registeredContinuationSubmodules(this.registration); }
     constructor(privateRoot, registration) {
         this.privateRoot = privateRoot;
         this.registration = structuredClone(registration);
         this.supportedVerificationSchemas = Object.freeze([...(registration.supportedVerificationSchemas ?? ['local-runner-verification-v1'])]);
     }
     options(input) {
-        const p = input.job.taskPackage, r = p.repository;
-        return { root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: resolveRunnerVerification(p.verification).runnerBinding,
-            fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: r.base_commit_sha, working_branch: r.working_branch },
+        const p = input.job.taskPackage, r = p.repository, resolved = resolveRunnerVerification(p.verification);
+        const attempt = resolved.version === 3 ? validateAttemptContext(input.executionAttempt) : undefined;
+        if (attempt && attemptContextFingerprint(attempt) !== input.job.executionAttemptFingerprint)
+            throw Error('P1_CONTRACT_REJECTED');
+        if (attempt) {
+            assertContinuationHost(attempt, this.registration);
+            if (attempt.job_id !== input.job.id || attempt.generation !== input.job.generation || attempt.contract_fingerprint !== p.contract_fingerprint || attempt.contract_base_commit_sha !== r.base_commit_sha || attempt.repository_key !== r.key)
+                throw Error('P1_CONTRACT_REJECTED');
+        }
+        return { ...(attempt ? { attemptContext: attempt, attemptContextFingerprint: attemptContextFingerprint(attempt) } : {}), root: input.checkoutPath, privateRoot: this.privateRoot, registration: this.registration, verification: resolved.runnerBinding,
+            fence: { binding_id: input.bindingId, job_id: input.job.id, generation: input.job.generation, contract_fingerprint: p.contract_fingerprint, base_commit_sha: attempt?.attempt_base_commit_sha ?? r.base_commit_sha, working_branch: attempt?.attempt_working_branch ?? r.working_branch },
             allowedPaths: p.allowed_paths, blockedPaths: r.blocked_paths, candidateLimits: p.candidate_limits,
             current: input.current, freezeOwnedModel: input.freezeOwnedModel, assertModelFrozen: input.assertModelFrozen, signal: input.signal, exportCandidate: input.exportCandidate };
     }
     assertEligible(job) {
+        const attempt = resolveRunnerVerification(job.taskPackage.verification).version === 3 ? assertClaimedExecutionAttempt(job) : undefined;
         assertVerificationHostVersion(job.taskPackage.verification, this.supportedVerificationSchemas);
         const r = this.registration;
         if (r.manifest.schema !== 'local-project-verification-v1' || !r.review.receiptId?.trim() || !r.review.reviewer?.trim() || r.review.manifestFingerprint !== protocolHash(r.manifest))
             throw Error('P1_REGISTRATION_REJECTED');
-        new RunnerObservedVerifier(this.options({ job, checkoutPath: '', bindingId: 'preflight', signal: new AbortController().signal, current: async () => false, freezeOwnedModel: async () => { throw Error('P1_NOT_FROZEN'); }, assertModelFrozen: async () => { throw Error('P1_NOT_FROZEN'); } })).assertContract();
+        new RunnerObservedVerifier(this.options({ ...(attempt ? { executionAttempt: attempt } : {}), job, checkoutPath: '', bindingId: 'preflight', signal: new AbortController().signal, current: async () => false, freezeOwnedModel: async () => { throw Error('P1_NOT_FROZEN'); }, assertModelFrozen: async () => { throw Error('P1_NOT_FROZEN'); } })).assertContract();
+    }
+    async assertCurrent(job) {
+        this.assertEligible(job);
+        const attempt = assertClaimedExecutionAttempt(job);
+        if (attempt)
+            await assertMeasuredContinuationManifest(attempt, this.registration);
     }
     verify(input) { assertVerificationHostVersion(input.job.taskPackage.verification, this.supportedVerificationSchemas); return new RunnerObservedVerifier(this.options(input)).verify(); }
 }
@@ -37,7 +54,9 @@ export const hasP1 = (p) => {
 /** Compare host launch claims to authoritative WEC/bundle fields before start. */
 export function assertP1Bindings(p, canonical, bundle = false) {
     const envelope = record(p.verification), resolved = resolveRunnerVerification(envelope), v = resolved.runnerBinding, r = record(p.repository), limits = record(p.candidate_limits);
-    if (resolved.version === 2) {
+    if (resolved.version !== 3 && hasContinuationHints(p))
+        throw Error('P1_CONTRACT_REJECTED');
+    if (resolved.version === 2 || resolved.version === 3) {
         const review = record(resolved.completionBinding.review_requirement), profiles = review.permitted_profiles;
         if (typeof p.model_profile !== 'string' || !p.model_profile || !profiles.some(profile => profile.runtime_adapter !== p.runtime_adapter && profile.model_profile !== p.model_profile))
             throw Error('P1_CONTRACT_REJECTED');
@@ -55,7 +74,7 @@ export function assertP1Bindings(p, canonical, bundle = false) {
         throw Error('P1_CONTRACT_REJECTED');
     if (!bundle) {
         const policy = record(canonical.policy);
-        if (policy.policy_key !== (resolved.version === 2 ? REVIEWED_POLICY : 'local-runner-verified-v1') || policy.loop_type !== (resolved.version === 2 ? REVIEWED_LOOP_TYPE : 'agent_runtime_implementation'))
+        if (policy.policy_key !== (resolved.version === 3 ? CONTINUATION_POLICY : resolved.version === 2 ? REVIEWED_POLICY : 'local-runner-verified-v1') || policy.loop_type !== (resolved.version === 1 ? 'agent_runtime_implementation' : REVIEWED_LOOP_TYPE))
             throw Error('P1_CONTRACT_REJECTED');
     }
     const repos = canonical.repositories;

package/dist/src/verification/p1-host-composition.js

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { registeredContinuationSubmodules } from './continuation-runner-contract.js';
 import { chmod, mkdir, realpath } from 'node:fs/promises';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash } from '../publication/candidate.js';
@@ -15,6 +16,7 @@ export async function composeReviewedP1Host(input) {
         return { status: 'mismatch' };
     const registration = structuredClone(registrations[0]), profileId = registration.profileId, mismatch = { status: 'mismatch', profileId };
     try {
+        registeredContinuationSubmodules(registration);
         const node = await realpath(input.execPath ?? process.execPath), commands = registration.manifest.commands;
         if (!commands.length || commands.some(command => command.executable !== node) || await realpath(registration.git.executable) !== registration.git.executable
             || registration.review.manifestFingerprint !== protocolHash(registration.manifest))

package/dist/src/verification/reviewed-runner-contract.js

@@ -1,3 +1,4 @@
+import { CONTINUATION_SCHEMA, CONTINUATION_HINT_KEYS, resolveContinuationVerification } from './continuation-runner-contract.js';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
 import { assertGatewayVerificationScope } from './runner-observed-verifier.js';
 export const REVIEWED_VERIFICATION_SCHEMA = 'local-runner-verification-v2';
@@ -26,7 +27,11 @@ export const REVIEWED_CRITERIA = {
 /** Only unwraps the versioned envelope. The existing P1 host still validates every inner byte. */
 export function resolveRunnerVerification(value) {
     const envelope = object(value);
+    if (envelope.schema_version === CONTINUATION_SCHEMA)
+        return resolveContinuationVerification(envelope);
     if (envelope.schema_version === 'local-runner-verification-v1') {
+        if (CONTINUATION_HINT_KEYS.some(key => Object.hasOwn(envelope, key)))
+            throw rejected();
         if (envelope.mode !== 'runner_observed_v1' || envelope.policy_key !== 'local-runner-verified-v1')
             throw rejected();
         return { version: 1, runnerBinding: envelope, completionBinding: null };
@@ -72,6 +77,8 @@ export function resolveRunnerVerification(value) {
 /** Future reviewed host implementations must explicitly advertise V2 support. */
 export function assertVerificationHostVersion(value, supportedSchemas) {
     const resolved = resolveRunnerVerification(value);
+    if (resolved.version === 3 && !supportedSchemas?.includes(CONTINUATION_SCHEMA))
+        throw Error('CORRECTION_HOST_INCOMPATIBLE');
     if (resolved.version === 2 && !supportedSchemas?.includes(REVIEWED_VERIFICATION_SCHEMA))
         throw Error('REVIEWED_VERIFICATION_HOST_REQUIRED');
 }

package/dist/src/verification/runner-observed-verifier.js

@@ -1,3 +1,5 @@
+import { validateAttemptEvidence, validateAttemptHandoff } from '../protocol.js';
+import { validateAttemptContext, attemptContextFingerprint, assertContinuationHost, assertMeasuredContinuationManifest } from './continuation-runner-contract.js';
 import { createHash } from 'node:crypto';
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
@@ -61,6 +63,14 @@ export class RunnerObservedVerifier {
     } }
     validate() {
         const o = this.options, v = o.verification, p = v.profile_definition, r = o.registration, f = o.fence;
+        if ((o.attemptContext === undefined) !== (o.attemptContextFingerprint === undefined))
+            throw denied();
+        if (o.attemptContext) {
+            const c = validateAttemptContext(o.attemptContext);
+            assertContinuationHost(c, r);
+            if (o.attemptContextFingerprint !== attemptContextFingerprint(c) || f.job_id !== c.job_id || f.generation !== c.generation || f.contract_fingerprint !== c.contract_fingerprint || f.base_commit_sha !== c.attempt_base_commit_sha || f.working_branch !== c.attempt_working_branch)
+                throw denied();
+        }
         keys(v, ['schema_version', 'mode', 'policy_key', 'profile_id', 'profile_fingerprint', 'project_id', 'runtime_adapter', 'runtime_transport', 'profile_definition', 'frozen_criteria_fingerprint', 'frozen_loop_contract', 'commands', 'command_manifest', 'bounds', 'allowed_paths', 'required_commands', 'qa_scenario_ids', 'required_criteria', 'independent_review_required', 'gateway_verification']);
         if (v.gateway_verification !== undefined)
             assertGatewayVerificationScope(v.gateway_verification);
@@ -104,6 +114,8 @@ export class RunnerObservedVerifier {
         if (this.options.signal?.aborted || !await this.options.current() || this.options.signal?.aborted)
             throw denied();
         await this.options.assertModelFrozen();
+        if (this.options.attemptContext)
+            await assertMeasuredContinuationManifest(this.options.attemptContext, this.options.registration);
         if (this.options.signal?.aborted)
             throw denied();
     }
@@ -126,8 +138,15 @@ export class RunnerObservedVerifier {
             const candidate = await host.verificationCandidate(sealed);
             if (!hex(candidate.commitSha, 40))
                 throw denied();
-            const changed_paths = buildP1ChangedPaths({ candidate_commit_sha: candidate.commitSha, base_commit_sha: f.base_commit_sha, entries: observation.changed_files }, v.bounds);
-            const snapshot_fingerprint = protocolHash({ digest_domain: 'p1-snapshot-v1', fence: f, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff_sha256: createHash('sha256').update(observation.diff).digest('hex'), changed_paths });
+            let changed_paths = buildP1ChangedPaths({ candidate_commit_sha: candidate.commitSha, base_commit_sha: f.base_commit_sha, entries: observation.changed_files }, v.bounds);
+            if (o.attemptContext) {
+                const { manifest_sha256: _old, ...unsigned } = changed_paths;
+                const next = { ...unsigned, schema_version: 'runner-changed-paths-v2', digest_domain: 'p1-changed-paths-v2', attempt_context_fingerprint: o.attemptContextFingerprint };
+                changed_paths = { ...next, manifest_sha256: protocolHash(next) };
+                if (Buffer.byteLength(protocolJson(changed_paths)) > v.bounds.max_manifest_bytes)
+                    throw denied();
+            }
+            const snapshot_fingerprint = protocolHash({ digest_domain: o.attemptContext ? 'p1-snapshot-v2' : 'p1-snapshot-v1', fence: f, ...(o.attemptContext ? { attempt_context_fingerprint: o.attemptContextFingerprint } : {}), profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff_sha256: createHash('sha256').update(observation.diff).digest('hex'), changed_paths });
             const registered = await buildReviewedProjectRegistration({ root: candidate.root, manifest: o.registration.manifest, review: o.registration.review, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths });
             const policy = await createIsolatedCommandPolicy({ root: candidate.root, commands: registered.commands, allowedPaths: o.allowedPaths, blockedPaths: o.blockedPaths }, true);
             const receipts = [];
@@ -140,8 +159,8 @@ export class RunnerObservedVerifier {
                     const measurement = await policy.measureTest(command.id, { timeoutMs: v.bounds.max_command_runtime_ms, maxOutputBytes: v.bounds.max_output_bytes }, o.signal);
                     if (index < registered.commands.length - 1)
                         await check();
-                    const identity = { binding_id: f.binding_id, job_id: f.job_id, generation: f.generation, contract_fingerprint: f.contract_fingerprint, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, command_id: command.id, command_fingerprint: protocolHash(command) };
-                    receipts.push({ schema_version: 'runner-command-receipt-v1', receipt_id: protocolHash({ digest_domain: 'p1-command-receipt-id-v1', ...identity }), ...identity, observed_at: Math.floor(Date.now() / 1000), ...measurement });
+                    const identity = { ...(o.attemptContext ? { attempt_context_fingerprint: o.attemptContextFingerprint } : {}), binding_id: f.binding_id, job_id: f.job_id, generation: f.generation, contract_fingerprint: f.contract_fingerprint, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, command_id: command.id, command_fingerprint: protocolHash(command) };
+                    receipts.push({ schema_version: o.attemptContext ? 'runner-command-receipt-v2' : 'runner-command-receipt-v1', receipt_id: protocolHash({ digest_domain: o.attemptContext ? 'p1-command-receipt-id-v2' : 'p1-command-receipt-id-v1', ...identity }), ...identity, observed_at: Math.floor(Date.now() / 1000), ...measurement });
                 }
             }
             finally {
@@ -149,8 +168,13 @@ export class RunnerObservedVerifier {
             }
             await check();
             const result = { candidate_commit_sha: candidate.commitSha, snapshot_fingerprint, changed_paths, receipts };
+            if (o.attemptContext)
+                validateAttemptEvidence(result, o.attemptContext);
             if (o.exportCandidate && receipts.length > 0 && receipts.every(r => r.status === 'passed' && r.exit_code === 0)) {
-                await o.exportCandidate(structuredClone({ schema_version: 'gateway-candidate-handoff-v1', ...result, fence: f, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff: observation.diff }));
+                const handoff = { schema_version: o.attemptContext ? 'gateway-candidate-handoff-v2' : 'gateway-candidate-handoff-v1', ...(o.attemptContext ? { attempt_context: structuredClone(o.attemptContext), attempt_context_fingerprint: o.attemptContextFingerprint } : {}), ...result, fence: f, profile_fingerprint: v.profile_fingerprint, frozen_criteria_fingerprint: v.frozen_criteria_fingerprint, tree_fingerprint: sealed.treeFingerprint, diff: observation.diff };
+                if (o.attemptContext)
+                    validateAttemptHandoff(handoff, o.attemptContext);
+                await o.exportCandidate(structuredClone(handoff));
                 await check();
             }
             return result;

package/dist/src/workspace/registered-submodules.js

@@ -0,0 +1,204 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, realpath, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+const CONFIG = '[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = true\n';
+const LIMIT = 16;
+function validPath(path) { return path.length <= 200 && path.split('/').length <= 8 && path.split('/').every(part => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(part) && !['private', 'env'].includes(part.toLowerCase())); }
+function fail() { throw Error('Registered submodule ownership or pin mismatch'); }
+async function readPlainMetadata(file, limit) {
+    const named = await lstat(file);
+    if (!named.isFile() || named.isSymbolicLink() || named.nlink !== 1 || named.size > limit || await realpath(file) !== file || (process.getuid && named.uid !== process.getuid()))
+        fail();
+    const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.nlink !== 1 || before.ino !== named.ino || before.dev !== named.dev || before.size !== named.size)
+            fail();
+        const bytes = Buffer.alloc(limit + 1), read = await handle.read(bytes, 0, bytes.length, 0), [after, current] = await Promise.all([handle.stat(), lstat(file)]);
+        if (read.bytesRead !== before.size || read.bytesRead > limit || [after, current].some(stat => !stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.ino !== before.ino || stat.dev !== before.dev || stat.size !== before.size || stat.mtimeMs !== before.mtimeMs || stat.ctimeMs !== before.ctimeMs))
+            fail();
+        return bytes.subarray(0, read.bytesRead).toString('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Eight independent paths at a time; all entries still receive the same ownership checks. */
+async function assertOwnedTree(root, allowObjectHardlinks = false) {
+    const pending = [root];
+    let entries = 1;
+    while (pending.length) {
+        const children = await Promise.all(pending.splice(0, 8).map(async (path) => {
+            const stat = await lstat(path);
+            if (stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid()) || await realpath(path) !== path)
+                fail();
+            if (stat.isDirectory())
+                return (await readdir(path)).map(name => join(path, name));
+            if (!stat.isFile() || (!allowObjectHardlinks && stat.nlink !== 1))
+                fail();
+            return [];
+        }));
+        for (const paths of children) {
+            entries += paths.length;
+            if (entries > 10000)
+                fail();
+            pending.push(...paths);
+        }
+    }
+}
+/** Object lookup must stay inside the owned store for every later consumer too. */
+export async function assertOwnedGitObjectStorage(mirror) {
+    const present = async (path) => { try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    } };
+    for (const path of [mirror, join(mirror, 'objects'), join(mirror, 'objects/info'), join(mirror, 'refs')]) {
+        const stat = await lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid()) || await realpath(path) !== path)
+            fail();
+    }
+    // Local mirror clones can hardlink immutable objects; metadata never may be hardlinked.
+    await assertOwnedTree(join(mirror, 'objects'), true);
+    // A bare mirror has no common-directory redirect; linked worktree records are validated separately.
+    for (const path of [join(mirror, 'commondir'), join(mirror, 'objects/info/alternates'), join(mirror, 'objects/info/http-alternates'), join(mirror, 'refs/replace')])
+        if (await present(path))
+            fail();
+    const packed = join(mirror, 'packed-refs');
+    if (await present(packed)) {
+        if (/(^|\n)[^\n]*[ \t]refs\/replace(?:\/|[\r\n]|$)/.test(await readPlainMetadata(packed, 1024 * 1024)))
+            fail();
+    }
+}
+export class RegisteredSubmoduleMaterializer {
+    client;
+    profiles;
+    constructor(client, profiles) {
+        this.client = client;
+        if (profiles.length > 32)
+            fail();
+        const scopes = new Set();
+        this.profiles = Object.freeze(profiles.map(profile => {
+            const scope = profile.repositoryKey + ':' + profile.contractBaseCommitSha;
+            if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profile.repositoryKey) || !(/^[a-f0-9]{40}$/).test(profile.contractBaseCommitSha) || scopes.has(scope) || profile.submodules.length > LIMIT)
+                fail();
+            scopes.add(scope);
+            const paths = [];
+            const submodules = profile.submodules.map(item => {
+                if (!validPath(item.path) || paths.some(path => path === item.path || path.startsWith(item.path + '/') || item.path.startsWith(path + '/')))
+                    fail();
+                paths.push(item.path);
+                // Exact, trusted provider coordinates only; Git helper/ext protocols are forbidden.
+                if (item.providerUrl.length > 2048 || /[?#]/.test(item.providerUrl) || !(/^(https:\/\/[^\s]+|ssh:\/\/[^\s]+|git@[A-Za-z0-9.-]+:[A-Za-z0-9_./-]+|\/[^\0\r\n]+)$/).test(item.providerUrl) || item.providerUrl.includes('/../'))
+                    fail();
+                if (item.providerUrl.startsWith('https:') || item.providerUrl.startsWith('ssh:')) {
+                    const url = new URL(item.providerUrl);
+                    if (url.username || url.password || !url.hostname)
+                        fail();
+                }
+                return Object.freeze({ ...item });
+            });
+            return Object.freeze({ ...profile, submodules: Object.freeze(submodules) });
+        }));
+    }
+    pins(output) {
+        if (output.length > 1024 * 1024)
+            fail();
+        const result = new Map();
+        let count = 0;
+        for (const entry of output.split('\0').filter(Boolean)) {
+            if (++count > 10000)
+                fail();
+            const match = /^(\d{6}) (blob|tree|commit) ([a-f0-9]{40})\t(.+)$/.exec(entry);
+            if (!match)
+                fail();
+            if (match[1] === '160000') {
+                if (match[2] !== 'commit' || !validPath(match[4]) || result.size >= LIMIT)
+                    fail();
+                if (result.has(match[4]))
+                    fail();
+                result.set(match[4], match[3]);
+            }
+        }
+        return result;
+    }
+    async directory(path) { const stat = await lstat(path); if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(path) !== path || (process.getuid && stat.uid !== process.getuid()))
+        fail(); }
+    async present(path) { try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    } }
+    /** Validate the complete owned mirror tree before Git can follow refs/config/object redirects. */
+    async mirror(path) {
+        await assertOwnedTree(path);
+        await assertOwnedGitObjectStorage(path);
+        if (await readPlainMetadata(join(path, 'config'), Buffer.byteLength(CONFIG)) !== CONFIG)
+            fail();
+    }
+    async materialize(input) {
+        const pins = this.pins((await input.git(['--no-replace-objects', 'ls-tree', '-rz', '--full-tree', input.parent])).stdout);
+        const rootPins = input.contractBase === input.parent ? pins : this.pins((await input.git(['--no-replace-objects', 'ls-tree', '-rz', '--full-tree', input.contractBase])).stdout);
+        const profile = this.profiles.find(p => p.repositoryKey === input.repositoryKey && p.contractBaseCommitSha === input.contractBase);
+        const allowed = profile?.submodules ?? [];
+        if (rootPins.size !== pins.size || pins.size !== allowed.length || allowed.some(item => !rootPins.has(item.path) || !pins.has(item.path)))
+            fail();
+        if (pins.size === 0)
+            return;
+        const namespace = join(input.root, 'submodule-mirrors');
+        if (!await this.present(namespace))
+            await mkdir(namespace, { mode: 0o700 });
+        await this.directory(namespace);
+        for (const item of allowed) {
+            const sha = pins.get(item.path);
+            // Identity includes workspace and context, preventing other generations/jobs from donating metadata.
+            const key = createHash('sha256').update(JSON.stringify([input.repositoryKey, input.contractBase, input.workspace, input.contextFingerprint, item.path, item.providerUrl])).digest('hex');
+            const mirror = join(namespace, key + '.git'), checkout = join(input.workspace, item.path);
+            const config = ['--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-c', 'submodule.recurse=false', '-c', 'protocol.allow=never', '-c', `protocol.${item.providerUrl.startsWith('/') ? 'file' : item.providerUrl.startsWith('https:') ? 'https' : 'ssh'}.allow=always`];
+            const run = async (args) => { await this.mirror(mirror); return this.client.run([...config, '--git-dir', mirror, ...args]); };
+            // Refuse every existing path component redirect before accessing the checkout.
+            let current = input.workspace;
+            for (const part of item.path.split('/')) {
+                current = join(current, part);
+                if (await this.present(current))
+                    await this.directory(current);
+                else
+                    await mkdir(current, { mode: 0o700 });
+            }
+            if (await this.present(join(checkout, '.git'))) {
+                await this.mirror(mirror);
+                await input.assertMetadata(checkout, mirror);
+            }
+            else {
+                if ((await readdir(checkout)).length)
+                    fail();
+                if (!await this.present(mirror)) {
+                    await this.client.run([...config, 'init', '--bare', '--template=', mirror]);
+                    await writeFile(join(mirror, 'config'), CONFIG, { mode: 0o600 });
+                }
+                await run(['fetch', '--no-tags', '--depth=1', item.providerUrl, sha]);
+                await run(['cat-file', '-e', `${sha}^{commit}`]);
+                // Nested submodules have no registration authority in this profile version.
+                if (this.pins((await run(['ls-tree', '-rz', '--full-tree', sha])).stdout).size)
+                    fail();
+                await run(['worktree', 'add', '--detach', checkout, sha]);
+            }
+            const checkoutGit = async (args) => { await this.mirror(mirror); await input.assertMetadata(checkout, mirror); return this.client.run([...config, '-C', checkout, ...args]); };
+            if ((await checkoutGit(['rev-parse', 'HEAD'])).stdout.trim() !== sha)
+                fail();
+            if (this.pins((await checkoutGit(['ls-tree', '-rz', '--full-tree', sha])).stdout).size)
+                fail();
+            if ((await checkoutGit(['status', '--porcelain', '--untracked-files=all'])).stdout !== '')
+                fail();
+        }
+    }
+}

package/dist/src/workspace/workspace-manager.js

@@ -1,13 +1,39 @@
-import { access, mkdir, realpath, rename, writeFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { resolve, join, sep } from "node:path";
+import { validateAttemptContext, attemptContextFingerprint } from '../verification/continuation-runner-contract.js';
+import { access, lstat, mkdir, open, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { constants } from 'node:fs';
+import { createHash, randomUUID } from "node:crypto";
+import { resolve, join, sep, dirname } from "node:path";
+import { assertOwnedGitObjectStorage, RegisteredSubmoduleMaterializer } from './registered-submodules.js';
 import { isP1WorkingBranch } from '../publication/git-snapshot.js';
 export class WorkspaceManager {
     deps;
+    submodules;
     constructor(deps) {
         this.deps = deps;
+        this.submodules = new RegisteredSubmoduleMaterializer(deps.git, deps.registeredSubmodules ?? []);
     }
     async create(input) {
+        input = { ...input };
+        if (input.attemptContext !== undefined || input.attemptContextFingerprint !== undefined) {
+            try {
+                return await this.createManaged(input);
+            }
+            catch {
+                throw new Error('CORRECTION_PARENT_UNAVAILABLE');
+            }
+        }
+        return this.createManaged(input);
+    }
+    async createManaged(input) {
+        const attempt = input.attemptContext === undefined ? undefined : validateAttemptContext(input.attemptContext);
+        if ((input.attemptContextFingerprint !== undefined) !== (attempt !== undefined))
+            throw Error('Invalid attempt context');
+        if (attempt && (input.attemptContextFingerprint !== attemptContextFingerprint(attempt) || input.jobId !== attempt.job_id || input.repositoryKey !== attempt.repository_key || input.baseCommitSha !== attempt.contract_base_commit_sha || input.workingBranch !== attempt.attempt_working_branch || input.p1WorkingBranch !== attempt.attempt_working_branch))
+            throw Error('Attempt identity mismatch');
+        const approvedBase = input.baseCommitSha;
+        if (attempt)
+            input = { ...input, baseCommitSha: attempt.attempt_base_commit_sha };
+        const workspaceKey = attempt ? `${input.jobId}.g${attempt.generation}` : input.jobId;
         if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,190}$/.test(input.jobId))
             throw new Error("Invalid job ID for managed workspace");
         if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(input.repositoryKey))
@@ -23,48 +49,86 @@ export class WorkspaceManager {
         const mirrorsRoot = join(root, "mirrors");
         const jobsRoot = join(root, "jobs");
         const mirrorPath = join(mirrorsRoot, `${input.repositoryKey}.git`);
-        const workspacePath = join(jobsRoot, input.jobId);
+        const workspacePath = join(jobsRoot, workspaceKey);
         this.assertContained(root, mirrorPath);
         this.assertContained(root, workspacePath);
         await mkdir(mirrorsRoot, { recursive: true, mode: 0o700 });
         await mkdir(jobsRoot, { recursive: true, mode: 0o700 });
+        if (attempt && (await realpath(mirrorsRoot) !== mirrorsRoot || await realpath(jobsRoot) !== jobsRoot))
+            throw Error('Workspace ownership mismatch');
+        if (attempt)
+            for (const owned of [mirrorPath, workspacePath]) {
+                try {
+                    const stat = await lstat(owned);
+                    if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(owned) !== owned)
+                        throw Error('Workspace ownership mismatch');
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+        const manifestPath = join(jobsRoot, `${workspaceKey}.manifest.json`);
+        let priorManifest;
+        if (attempt && (await this.exists(workspacePath) || await this.exists(manifestPath))) {
+            const stat = await lstat(manifestPath);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.isSymbolicLink() || await realpath(manifestPath) !== manifestPath)
+                throw Error('Manifest ownership mismatch');
+            priorManifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+            if (priorManifest.jobId !== input.jobId || priorManifest.generation !== attempt.generation || priorManifest.attemptContextFingerprint !== input.attemptContextFingerprint || priorManifest.contractBaseCommitSha !== approvedBase || priorManifest.baseCommitSha !== input.baseCommitSha || priorManifest.repositoryKey !== input.repositoryKey || priorManifest.remoteFingerprint !== createHash('sha256').update(input.providerUrl).digest('hex') || priorManifest.retentionState !== 'active' || typeof priorManifest.createdAt !== 'string' || !Number.isFinite(Date.parse(priorManifest.createdAt)))
+                throw Error('Manifest identity mismatch');
+        }
+        const managedGit = async (args) => {
+            if (attempt && args[0] === '--git-dir')
+                await assertOwnedGitObjectStorage(mirrorPath);
+            return this.deps.git.run([...(attempt ? ['--no-replace-objects'] : []), ...args]);
+        };
         if (await this.exists(mirrorPath)) {
-            const remote = (await this.deps.git.run(["--git-dir", mirrorPath, "remote", "get-url", "origin"])).stdout.trim();
+            const remote = (await managedGit(["--git-dir", mirrorPath, "remote", "get-url", "origin"])).stdout.trim();
             if (remote !== input.providerUrl)
                 throw new Error("Managed repository remote does not match the registered provider");
         }
         else {
-            await this.deps.git.run(["clone", "--mirror", input.providerUrl, mirrorPath]);
+            await managedGit(["clone", "--mirror", input.providerUrl, mirrorPath]);
         }
         try {
-            await this.deps.git.run(["--git-dir", mirrorPath, "fetch", "--prune", "origin", input.baseCommitSha]);
-            await this.deps.git.run(["--git-dir", mirrorPath, "cat-file", "-e", `${input.baseCommitSha}^{commit}`]);
+            await managedGit(["--git-dir", mirrorPath, "fetch", "--prune", "origin", input.baseCommitSha]);
+            await managedGit(["--git-dir", mirrorPath, "cat-file", "-e", `${input.baseCommitSha}^{commit}`]);
         }
         catch {
             throw new Error(`Repository revision ${input.baseCommitSha} is unavailable`);
         }
         if (!await this.exists(workspacePath)) {
-            await this.deps.git.run(["--git-dir", mirrorPath, "worktree", "add", "--detach", workspacePath, input.baseCommitSha]);
+            await managedGit(["--git-dir", mirrorPath, "worktree", "add", "--detach", workspacePath, input.baseCommitSha]);
         }
         const actualPath = await realpath(workspacePath);
         this.assertContained(root, actualPath);
-        const head = (await this.deps.git.run(["-C", actualPath, "rev-parse", "HEAD"])).stdout.trim();
+        if (attempt && actualPath !== workspacePath)
+            throw Error('Workspace ownership mismatch');
+        const workspaceGit = async (args, noHooks = false) => {
+            if (attempt)
+                await this.assertAttemptGitMetadata(actualPath, mirrorPath);
+            return this.deps.git.run([...(attempt ? ['--no-replace-objects'] : []), ...(noHooks ? ['-c', 'core.hooksPath=/dev/null'] : []), '-C', actualPath, ...args]);
+        };
+        const head = (await workspaceGit(["rev-parse", "HEAD"])).stdout.trim();
         if (head !== input.baseCommitSha)
             throw new Error("Managed workspace HEAD differs from the approved revision");
-        const dirty = (await this.deps.git.run(["-C", actualPath, "status", "--porcelain"])).stdout;
+        if (attempt)
+            await this.submodules.materialize({ workspace: actualPath, root, repositoryKey: input.repositoryKey, contractBase: approvedBase, parent: input.baseCommitSha, contextFingerprint: input.attemptContextFingerprint, git: workspaceGit, assertMetadata: (path, mirror) => this.assertAttemptGitMetadata(path, mirror) });
+        const dirty = (await workspaceGit(["status", "--porcelain"])).stdout;
         if (dirty !== "")
             throw new Error("Managed workspace is dirty before execution");
         if (input.workingBranch) {
             const ref = `refs/heads/${input.workingBranch}`;
-            const current = (await this.deps.git.run(['-C', actualPath, 'rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim();
+            const current = (await workspaceGit(['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim();
             if (current !== 'HEAD' && current !== input.workingBranch)
                 throw new Error('Managed fix branch differs from approval');
-            const existing = (await this.deps.git.run(['-C', actualPath, 'for-each-ref', '--format=%(objectname)', ref])).stdout.trim();
+            const existing = (await workspaceGit(['for-each-ref', '--format=%(objectname)', ref])).stdout.trim();
             if (existing && existing !== input.baseCommitSha)
                 throw new Error('Managed fix branch revision differs from approval');
             if (!existing)
-                await this.deps.git.run(['-c', 'core.hooksPath=/dev/null', '-C', actualPath, 'update-ref', ref, input.baseCommitSha, '0'.repeat(40)]);
-            await this.deps.git.run(['-c', 'core.hooksPath=/dev/null', '-C', actualPath, 'symbolic-ref', 'HEAD', ref]);
+                await workspaceGit(['update-ref', ref, input.baseCommitSha, '0'.repeat(40)], true);
+            await workspaceGit(['symbolic-ref', 'HEAD', ref], true);
         }
         const manifest = {
             jobId: input.jobId,
@@ -73,13 +137,59 @@ export class WorkspaceManager {
             baseCommitSha: head,
             createdAt: new Date().toISOString(),
             retentionState: "active",
+            ...(attempt ? { generation: attempt.generation, contractBaseCommitSha: approvedBase, attemptContextFingerprint: input.attemptContextFingerprint } : {}),
         };
-        const manifestPath = join(jobsRoot, `${input.jobId}.manifest.json`);
-        const temporaryManifestPath = `${manifestPath}.${process.pid}.tmp`;
-        await writeFile(temporaryManifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+        if (priorManifest)
+            manifest.createdAt = priorManifest.createdAt;
+        const temporaryManifestPath = `${manifestPath}.${attempt ? randomUUID() : process.pid}.tmp`;
+        await writeFile(temporaryManifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600, ...(attempt ? { flag: 'wx' } : {}) });
         await rename(temporaryManifestPath, manifestPath);
         return { path: actualPath, mirrorPath, baseCommitSha: head, manifest };
     }
+    /** Validate linked-worktree ownership using plain metadata before invoking Git in it.
+     * A .git file pointing at a same-SHA foreign repository must never authorize writes. */
+    async assertAttemptGitMetadata(workspacePath, mirrorPath) {
+        await assertOwnedGitObjectStorage(mirrorPath);
+        const dotGit = join(workspacePath, '.git');
+        const pointer = await this.readOwnedMetadata(dotGit);
+        const match = /^gitdir: ([^\r\n\0]+)\r?\n?$/.exec(pointer);
+        if (!match)
+            throw Error('Workspace metadata mismatch');
+        const gitDirectory = resolve(workspacePath, match[1]);
+        const metadataRoot = join(mirrorPath, 'worktrees');
+        // Constrain lexically first: never stat/read metadata in a caller-chosen repository.
+        if (dirname(gitDirectory) !== metadataRoot || gitDirectory === metadataRoot)
+            throw Error('Workspace metadata mismatch');
+        for (const directory of [mirrorPath, metadataRoot, gitDirectory]) {
+            const stat = await lstat(directory);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(directory) !== directory || (process.getuid && stat.uid !== process.getuid()))
+                throw Error('Workspace metadata mismatch');
+        }
+        const [common, backpointer] = await Promise.all([this.readOwnedMetadata(join(gitDirectory, 'commondir')), this.readOwnedMetadata(join(gitDirectory, 'gitdir')), this.readOwnedMetadata(join(gitDirectory, 'HEAD'))]);
+        const oneLine = (value) => { if (!/^[^\r\n\0]+\r?\n?$/.test(value))
+            throw Error('Workspace metadata mismatch'); return value.replace(/\r?\n$/, ''); };
+        if (resolve(gitDirectory, oneLine(common)) !== mirrorPath || resolve(gitDirectory, oneLine(backpointer)) !== dotGit)
+            throw Error('Workspace metadata mismatch');
+        // HEAD was checked alongside both pointers before this workspace may receive a Git command.
+    }
+    async readOwnedMetadata(file) {
+        const named = await lstat(file);
+        if (!named.isFile() || named.isSymbolicLink() || named.nlink !== 1 || named.size < 1 || named.size > 4096 || await realpath(file) !== file || (process.getuid && named.uid !== process.getuid()))
+            throw Error('Workspace metadata mismatch');
+        const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const before = await handle.stat();
+            if (!before.isFile() || before.nlink !== 1 || before.ino !== named.ino || before.dev !== named.dev || before.size !== named.size)
+                throw Error('Workspace metadata mismatch');
+            const bytes = Buffer.alloc(4097), read = await handle.read(bytes, 0, bytes.length, 0), [after, current] = await Promise.all([handle.stat(), lstat(file)]);
+            if (read.bytesRead !== before.size || read.bytesRead > 4096 || [after, current].some(stat => !stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.ino !== before.ino || stat.dev !== before.dev || stat.size !== before.size || stat.mtimeMs !== before.mtimeMs || stat.ctimeMs !== before.ctimeMs))
+                throw Error('Workspace metadata mismatch');
+            return bytes.subarray(0, read.bytesRead).toString('utf8');
+        }
+        finally {
+            await handle.close();
+        }
+    }
     assertContained(root, candidate) {
         const resolved = resolve(candidate);
         if (resolved !== root && !resolved.startsWith(`${root}${sep}`))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.73",
+  "version": "0.1.74",
   "private": false,
   "license": "UNLICENSED",
   "bin": {