mtech-ai-local-runner 0.1.73 → 0.1.75

package/README.md

@@ -1,3 +1,31 @@
+## 0.1.74: exact-parent reviewed correction attempts (P3D)
+
+This local source supports newly approved executable V3 launches behind the
+Gateway's default-off `correction_execution_enabled` switch. It does not activate
+an installed runner or upgrade older V1/V2/unavailable-V3 approvals.
+
+Authenticated claim context arrives before checkout. The approved task package,
+canonical repository lease and binding retain ROOT identity; each attempt checks
+out its exact Gateway-reviewed parent P and emits fresh context-bound receipts,
+snapshot and handoff. The original approval fingerprint differs from a successor
+job's reservation fingerprint and remains preserved through at most three attempts.
+Native launch seals the exact context and binding in the host-owned immutable
+plan, measures P immediately before dispatch, and keeps existing ROOT security
+receipt semantics. A replayed binding or uncertain model outcome pauses.
+
+A measured trusted host registration supplies registered submodule providers.
+The runner fetches exact P gitlinks through owned mirrors and refuses unknown
+providers, metadata redirects and nested P-child gitlinks. No profile is installed
+by these source changes. Correction findings are bounded untrusted data scoped to
+the canonical bundle paths; they cannot expand authority or become commands.
+
+Local fake transport/provider/process tests are distinct from real CI or model
+acceptance. A final release commit/version, package manifest/hash and compatible
+reviewed host registration remain pending delivery approval. See the
+[P3D-4 review](../../docs/superpowers/reviews/2026-10-30-local-runner-p3d4-implementation-review.md)
+for verification and compatibility limitations. No setup/update/restart is needed
+to inspect this source tree.
+
 ## 0.1.60: answers go back to the session that asked
 
 An answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client
@@ -497,6 +525,13 @@ publication authority through a late response. Once publication may have taken
 effect, retain `publication_pending` recovery instead of falsely completing,
 failing or restarting the attempt. Canonical publication approval remains required.
 
+Since 0.1.75 (Work Decision `b3d7eb22`) a failed Gateway stage, advance or fence read
+after stage started is repeated with the same arguments for up to 15 minutes, 5 s
+doubling to 130 s, while the heartbeat keeps the lease. A suspended runner names its
+held publication job in `suspended_job` on sync. Once the Gateway answers that the job
+is closed, it clears its state and restarts. The Gateway closes only that runner's own
+job, only when its lease is long expired and no pull request can exist.
+
 Component, shadow admission, installed-package and live-provider evidence are
 separate. Historical 0.1.10 hook behavior below is not current Claude admission;
 Claude parity requires the actual current isolation/admission gate to pass.

package/dist/src/adapters/claude-code/prompt-compiler.js

@@ -1,3 +1,4 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 // Claude's working directory is the job's private control directory, so without these rules it sends that directory's
@@ -16,5 +17,6 @@ const CLAUDE_PATH_RULES = "## Local tool path rules\n" +
     "command: send a corrected call instead of concluding that source is unavailable. LOCAL_TOOL_FAILED means the call " +
     "failed for another reason, such as a file that does not exist.";
 export function compilePrompt(taskPackage, options) {
-    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, options)}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}\n\n${CLAUDE_PATH_RULES}${correction}`;
 }

package/dist/src/adapters/codex/exec-invocation.js

@@ -1,3 +1,4 @@
+import { validateAttemptContext, attemptContextFingerprint } from '../../verification/continuation-runner-contract.js';
 import { UNMANAGED_EXEC_MODE } from './unmanaged-scope.js';
 import path from 'node:path';
 import { CODEX_GLOBAL_INSTRUCTION_WRAPPER, globalInstructionProfile } from './global-instructions.js';
@@ -10,10 +11,18 @@ export const EXEC_MODE = 'supported_cli_exec_policy_v1';
 export const isReleaseExecMode = (mode) => mode === EXEC_RELEASE_MODE || mode === UNMANAGED_EXEC_MODE;
 const plans = new WeakMap();
 const consumed = new WeakSet();
+const executionAttempts = new WeakMap();
 const fail = () => new Error('CODEX_EXEC_PLAN_REJECTED');
 export function buildOfficialExecPlan(input) {
     try {
         const i = structuredClone(input.identity), inv = structuredClone(input.invocation);
+        const attempt = input.executionAttempt === undefined ? undefined : validateAttemptContext(input.executionAttempt);
+        if ((attempt === undefined) !== (input.executionAttemptFingerprint === undefined) || (attempt === undefined) !== (input.executionBindingId === undefined))
+            throw fail();
+        if (attempt && (typeof input.executionBindingId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(input.executionBindingId)))
+            throw fail();
+        if (attempt && (attemptContextFingerprint(attempt) !== input.executionAttemptFingerprint || attempt.job_id !== i.jobId || attempt.generation !== i.generation || attempt.contract_base_commit_sha !== i.sourceSha || attempt.contract_fingerprint !== i.contractFingerprint || (attempt.attempt_number === 1 && attempt.launch_approval_fingerprint !== i.launchFingerprint)))
+            throw fail();
         if (input.policyMode !== undefined && !isReleaseExecMode(input.policyMode))
             throw fail();
         const keys = ['jobId', 'generation', 'actorId', 'runnerId', 'sourceSha', 'binarySha256', 'releaseManifestFingerprint', 'requirementsFingerprint', 'contractFingerprint', 'taskPackageFingerprint', 'launchFingerprint', 'commandsFingerprint', 'toolSchemaFingerprint', 'barrierFingerprint'];
@@ -36,6 +45,8 @@ export function buildOfficialExecPlan(input) {
         const actual = isReleaseExecMode(input.policyMode) ? { binary: CODEX_GLOBAL_INSTRUCTION_WRAPPER, args: ['-p', globalInstructionProfile(accountRoot), input.binary, ...generated.args], env: generated.env } : { binary: input.binary, ...generated };
         const executionNonce = randomBytes(32).toString('hex');
         const plan = Object.freeze({ transport: EXEC_TRANSPORT, mode: input.policyMode ?? EXEC_MODE, executionNonce, identity: Object.freeze(i), modelId: inv.modelId, home: inv.env.HOME, accountRoot, credentialBackend: input.credentialBackend, binary: input.binary, cwd, endpoint: inv.endpoint.url, invocationFingerprint: hash({ ...actual }) });
+        if (attempt)
+            executionAttempts.set(plan, { fingerprint: input.executionAttemptFingerprint, bindingId: input.executionBindingId, sourceRoot: source });
         plans.set(plan, structuredClone(actual));
         return plan;
     }
@@ -60,3 +71,16 @@ export function assertOfficialExecPlanAvailable(plan) {
     if (consumed.has(plan))
         throw fail();
 }
+/** Private plan seal is execution identity, separate from legacy ROOT approval
+ * and security receipt identity. Native host still verifies Gateway authority. */
+export function assertOfficialExecAttempt(plan, context, fingerprint, bindingId, sourceRoot) {
+    requireOfficialExecPlan(plan);
+    const expected = executionAttempts.get(plan);
+    if (expected === undefined) {
+        if (context !== undefined || fingerprint !== undefined)
+            throw fail();
+        return;
+    }
+    if (context === undefined || fingerprint !== expected.fingerprint || attemptContextFingerprint(context) !== expected.fingerprint || bindingId !== expected.bindingId || sourceRoot !== undefined && path.resolve(sourceRoot) !== expected.sourceRoot)
+        throw fail();
+}

package/dist/src/adapters/codex/exec-launch-host.js

@@ -1,3 +1,4 @@
+import { assertOfficialExecAttempt } from './exec-invocation.js';
 import { performance } from 'node:perf_hooks';
 import { PreparationClock, CODEX_PREPARATION_BUDGET_MS } from '../../safety/preparation-timing.js';
 import { localEndpointObservations, localEndpointReadObservations } from '../../safety/local-tool-server.js';
@@ -42,6 +43,7 @@ export class CodexExecLaunchHost {
         throw fail();
     } }
     assertContext(ctx, jobId) {
+        assertOfficialExecAttempt(this.plan, ctx.executionAttempt, ctx.executionAttemptFingerprint, ctx.bindingId);
         const a = ctx.approvedTaskPackage, r = a?.security_requirements, b = ctx.taskPackage, execution = b?.execution;
         if (isReleaseExecMode(this.plan.mode)) {
             if (!r)
@@ -63,6 +65,7 @@ export class CodexExecLaunchHost {
     async start(ctx, jobId, prompt, signal) {
         if (this.used || this.stopped)
             throw fail();
+        ctx = structuredClone(ctx);
         this.assertAvailableContext(ctx, jobId);
         claimOfficialExecPlan(this.plan);
         this.ownsAttempt = true;
@@ -114,6 +117,8 @@ export class CodexExecLaunchHost {
                 this.inspection.beforeSpawn?.();
                 timing.mark('before_spawn_complete');
                 assertPreparationBudget();
+                this.current();
+                this.assertContext(ctx, jobId);
                 stage = 'codex_spawn';
                 timing.mark('spawn_requested');
                 const h = this.deps.processHost.spawn(invocation.binary, invocation.args, { cwd: this.plan.cwd, env: invocation.env });

package/dist/src/adapters/codex/exec-runtime-options.js

@@ -99,7 +99,7 @@ export function buildCodexExecJobOptions(input) {
                 if (closed || signal.aborted)
                     throw reject();
                 stage = 'codex_invocation';
-                const plan = buildOfficialExecPlan({ policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
+                const plan = buildOfficialExecPlan({ executionAttempt: ctx.executionAttempt, executionAttemptFingerprint: ctx.executionAttemptFingerprint, ...(ctx.executionAttempt ? { executionBindingId: ctx.bindingId } : {}), policyMode: admitted.release.securityMode, binary: admitted.binary, credentialBackend: admitted.release.credentialBackend, identity: { jobId: input.jobId, generation: ctx.generation, actorId: admitted.actorId, runnerId: admitted.runnerId, sourceSha: String(approved.repository.base_commit_sha), binarySha256: admitted.release.binarySha256, releaseManifestFingerprint: String(requirements.release_manifest_sha256), requirementsFingerprint: String(requirements.fingerprint), contractFingerprint: ctx.securityBinding.contractFingerprint, taskPackageFingerprint: ctx.securityBinding.taskPackageFingerprint, launchFingerprint: ctx.securityBinding.launchFingerprint, commandsFingerprint: commandRegistryFingerprint(admitted.release.commands), toolSchemaFingerprint: fingerprint({ tools: localToolInventory() }), barrierFingerprint: admitted.release.fixturesFingerprint }, invocation: { modelId: ctx.resolvedModelId, worktreeRoot: cwd, sourceRoot: source, schemaPath: schema, endpoint, env, scratch } });
                 gate = new ExecToolGate(plan);
                 const host = new CodexExecLaunchHost(plan, { processHost, inspectRelease: p => job.inspect(p), execTools: gate, revokeTools: () => { gate?.revoke(); server?.revoke(); policy?.revoke(); job?.revoke(); }, closeTools: dispose });
                 launchHost = host;

package/dist/src/adapters/codex/prompt-compiler.js

@@ -1,7 +1,9 @@
+import { renderBundleCorrectionBrief } from '../../verification/continuation-runner-contract.js';
 import { compilePrompt as compileBrief } from "../prompt-compiler.js";
 import { LOCAL_TOOL_GUIDANCE, repositoryScope } from "../local-tool-prompt.js";
 export function compileCodexPrompt(taskPackage, label) {
-    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}`;
+    const correction = renderBundleCorrectionBrief(taskPackage);
+    return `${compileBrief(taskPackage, { workItemLabel: label, progressReporting: "native_messages" })}\n\n${repositoryScope(taskPackage)}\n\n${LOCAL_TOOL_GUIDANCE}${correction}`;
 }
 export const CODEX_REPORT_SCHEMA = {
     type: "object", additionalProperties: false, required: ["status", "report", "evidence", "pending_work"],

package/dist/src/asks/runtime.js

@@ -21,6 +21,25 @@ const SHUTDOWN_WAIT_MS = 5000;
  * would end. Bounded, so a heartbeat, and the job claim behind it, is never held up longer than this.
  */
 export const ADVERTISEMENT_START_WAIT_MS = 2000;
+/** Room notices use only a human prompt already arriving at the Ask hub; they never wake a model. */
+export function withRoomNotice(handler, claim) {
+    return {
+        status: () => handler.status(),
+        watch: (request, watcher) => handler.watch(request, watcher),
+        event: async (request, client) => {
+            const text = await handler.event(request, client);
+            if (request.event !== 'prompt' || request.human !== true || client.gone)
+                return text;
+            try {
+                const notice = await claim();
+                return notice === null ? text : text === null ? notice : `${text}\n${notice}`;
+            }
+            catch {
+                return text;
+            }
+        },
+    };
+}
 function errorCode(error) {
     const code = error?.code;
     if (typeof code === "string" && /^[A-Z0-9_]{1,64}$/.test(code))
@@ -51,7 +70,9 @@ export class AskRuntime {
             openSession: deps.openSession ?? createSessionOpener({ home: deps.env.HOME ?? "" }),
             presenceRecheckMs: deps.presenceRecheckMs,
             onChange: () => this.flushSoon(), log: event => this.log(event) });
-        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot), handler: this.inbox, log: event => this.log(event) });
+        this.hub = new AskHub({ socketPath: hubSocketPath(deps.stateRoot),
+            handler: deps.claimRoomNotice ? withRoomNotice(this.inbox, deps.claimRoomNotice) : this.inbox,
+            log: event => this.log(event) });
     }
     /** True while the hub listens; only then are deliveries taken and ask_inbox advertised. */
     get ready() {

package/dist/src/daemon/execution-coordinator.js

@@ -1,3 +1,4 @@
+import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
@@ -9,7 +10,7 @@ import { requireSecurityRequirements } from '../safety/security-requirements.js'
 import { GatewayToolError } from "../gateway-client.js";
 import { createHash } from "node:crypto";
 import { completionReportDiagnostic } from "../adapters/completion-report.js";
-import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
+import { PROTOCOL_VERSION, isTerminalEventType, validateEvent, validateAttemptEvidence, validateAttemptHandoff, MAX_EVENT_SUMMARY_CHARS } from "../protocol.js";
 import { DAEMON_BLOCKED_REASONS, DAEMON_CANCELLED_REASONS } from "../state-store.js";
 import { PreparationDeadlineError, PreparationLease, validateJobLease } from './preparation-lease.js';
 function canonical(value) {
@@ -66,8 +67,24 @@ export class ExecutionCoordinator {
     constructor(deps) {
         this.deps = deps;
     }
-    async execute(job) {
-        job = { ...job, taskPackage: immutable(structuredClone(job.taskPackage)) };
+    active;
+    execute(job) {
+        job = immutable(structuredClone(job));
+        const key = `${job.id}:${job.generation}`;
+        if (this.active) {
+            if (this.active.key !== key)
+                return Promise.reject(Error('EXECUTION_ALREADY_ACTIVE'));
+            if (this.active.identity !== fingerprint(job))
+                return Promise.reject(Error('EXECUTION_CLAIM_MISMATCH'));
+            return this.active.promise;
+        }
+        const promise = Promise.resolve().then(() => this.executeOwned(job));
+        this.active = { key, identity: fingerprint(job), promise };
+        void promise.finally(() => { if (this.active?.promise === promise)
+            this.active = undefined; }).catch(() => { });
+        return promise;
+    }
+    async executeOwned(job) {
         let stage = "package";
         let workspace;
         let adapter;
@@ -77,8 +94,9 @@ export class ExecutionCoordinator {
         const isLocalFix = job.taskPackage.local_fix_scope !== undefined;
         const isP1 = hasP1(job.taskPackage);
         const envelope = job.taskPackage.verification;
-        const runnerBinding = envelope?.schema_version === 'local-runner-verification-v2' ? envelope.runner_binding : envelope;
+        const runnerBinding = ['local-runner-verification-v2', 'local-runner-verification-v3'].includes(String(envelope?.schema_version)) ? envelope?.runner_binding : envelope;
         const isP2 = isP1 && runnerBinding?.gateway_verification !== undefined;
+        let executionAttempt;
         let p1Result;
         let p2Handoff;
         const p1ReceiptIds = [];
@@ -89,6 +107,19 @@ export class ExecutionCoordinator {
         const step = (operation) => preparation.step(operation);
         let bindingAttempted = false;
         try {
+            try {
+                executionAttempt = assertClaimedExecutionAttempt(job);
+            }
+            catch {
+                throw new GatewayToolError('Continuation execution is unavailable', 'local_agent_jobs_wait', 'CORRECTION_EXECUTION_UNAVAILABLE');
+            }
+            // Trusted host admission and measurement precede checkout. Package/schema/hash alone is never authority.
+            if (executionAttempt) {
+                if (!this.deps.p1Host?.assertCurrent || !this.deps.gateway.readCommands || !this.deps.gateway.heartbeat)
+                    throw Error('CORRECTION_HOST_INCOMPATIBLE');
+                this.deps.p1Host.assertEligible(job);
+                await step(() => this.deps.p1Host.assertCurrent(job));
+            }
             await preparation.start();
             const pkg = job.taskPackage;
             if (isP1) {
@@ -116,8 +147,9 @@ export class ExecutionCoordinator {
                 repositoryKey: text(repository?.key, "repository key"),
                 providerUrl: text(repository?.provider_url, "repository provider URL"),
                 baseCommitSha: text(repository?.base_commit_sha, "repository SHA"),
-                ...(isLocalFix || isP1 ? { workingBranch: text(repository?.working_branch, "approved fix branch") } : {}),
-                ...(isP1 ? { p1WorkingBranch: text(repository?.working_branch, 'approved P1 branch') } : {})
+                ...(isLocalFix || isP1 ? { workingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, "approved fix branch") } : {}),
+                ...(isP1 ? { p1WorkingBranch: executionAttempt?.attempt_working_branch ?? text(repository?.working_branch, 'approved P1 branch') } : {}),
+                ...(executionAttempt ? { attemptContext: executionAttempt, attemptContextFingerprint: job.executionAttemptFingerprint } : {})
             }));
             stage = "adapter";
             adapter = await preparation.step(() => this.deps.registry.select(adapterId, adapterVersion, { worktreePath: workspace.path, jobId: job.id }), late => late.cancel());
@@ -137,6 +169,10 @@ export class ExecutionCoordinator {
             preparation.beginBinding();
             bindingAttempted = true;
             binding = await step(() => this.deps.gateway.createBinding({ ...job, checkoutPath: workspace.path }, preparation.signal));
+            assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
+            if (executionAttempt && binding.bindingReplayed !== false)
+                throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+            binding = immutable(structuredClone(binding));
             if (isP1)
                 assertP1Bindings(pkg, binding.taskPackage, true);
             await step(() => this.deps.state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "running", bindingId: binding.bindingId, workspaceManifest: workspace.manifest }));
@@ -474,8 +510,25 @@ export class ExecutionCoordinator {
                         return session;
                     }));
             }
+            if (executionAttempt) {
+                await readControls();
+                requireControlFence();
+                if (!requestedTerminal) {
+                    const renewed = await fenced(this.deps.gateway.heartbeat(binding.bindingId, job, controlAbort.signal));
+                    requireControlFence();
+                    const expiry = validateJobLease(renewed, job, true);
+                    if (!['running', 'review_pending'].includes(renewed.job.status))
+                        throw Error('JOB_LEASE_FENCE_INVALID');
+                    this.deps.gateway.confirmJobLease?.(job, expiry);
+                    leaseExpiresAt = expiry;
+                    armLeaseBoundary();
+                    await fenced(this.deps.p1Host.assertCurrent(job));
+                    await readControls();
+                    requireControlFence();
+                }
+            }
             if (!requestedTerminal) {
-                await fenced(Promise.race([adapter.start({ securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
+                await fenced(Promise.race([adapter.start({ ...(executionAttempt ? { executionAttempt, executionAttemptFingerprint: job.executionAttemptFingerprint } : {}), securityBinding: { launchFingerprint: job.launchFingerprint, contractFingerprint: job.gatewayContractFingerprint, taskPackageFingerprint: job.gatewayTaskPackageFingerprint }, generation: job.generation, approvedTaskPackage: job.taskPackage, bindingId: binding.bindingId, sessionId: binding.bindingId, taskPackage: binding.taskPackage, resolvedModelId: binding.resolvedModelId }), unconfirmedStop]));
             }
             executionStage = 'commands';
             await readControls();
@@ -508,9 +561,12 @@ export class ExecutionCoordinator {
                                 await freezeOwnedModel();
                                 await readControls();
                                 executionStage = 'p1_verify';
-                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
+                                p1Result = await publicationStep(() => this.deps.p1Host.verify({ ...(executionAttempt ? { executionAttempt } : {}), job, checkoutPath: workspace.path, bindingId: binding.bindingId, signal: verificationAbort.signal, current, freezeOwnedModel, assertModelFrozen,
                                     exportCandidate: isP2 ? async (handoff) => { await readControls(); await assertModelFrozen(); if (p2Handoff)
-                                        throw Error('P2_DUPLICATE_HANDOFF'); p2Handoff = structuredClone(handoff); } : undefined }));
+                                        throw Error('P2_DUPLICATE_HANDOFF'); if (executionAttempt)
+                                        validateAttemptHandoff(handoff, executionAttempt); p2Handoff = structuredClone(handoff); } : undefined }));
+                                if (executionAttempt)
+                                    validateAttemptEvidence(p1Result, executionAttempt);
                                 executionStage = 'p1_receipts';
                                 await readControls();
                                 await assertModelFrozen();

package/dist/src/daemon/manual-codex.js

@@ -36,7 +36,7 @@ export async function runManualCodexJob(input, deps) {
         let leaseExpires = claim.job.lease_expires_at;
         if (!Number.isSafeInteger(leaseExpires))
             throw Error('MANUAL_PILOT_LEASE_MISSING');
-        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint };
+        const job = { id: claim.job.id, generation: claim.job.generation, leaseExpiresAt: claim.job.lease_expires_at, workLoopId: claim.job.work_loop_id, leaseToken: claim.lease_token, launchGrant: claim.launch_grant, taskPackage: claim.task_package, launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint, gatewayTaskPackageFingerprint: claim.task_package_fingerprint, executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint };
         await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: 'claimed' });
         let result = { jobId: job.id, status: 'unacknowledged' };
         const confirmJobLease = (j, expires) => { host?.heartbeat(j.id, j.generation, expires); leaseExpires = expires; claim.job.lease_expires_at = expires; };
@@ -65,7 +65,7 @@ export async function runManualCodexJob(input, deps) {
             gateway: {
                 renewJob: (j, signal) => input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal), confirmJobLease,
                 shadow: (j, signal) => input.gateway.localJobShadow({ workLoopId: j.workLoopId, contractFingerprint: j.gatewayContractFingerprint, taskPackageFingerprint: j.gatewayTaskPackageFingerprint }, signal),
-                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath }, signal),
+                createBinding: (j, signal) => input.gateway.createLocalJobBinding({ jobId: j.id, generation: j.generation, jobLeaseToken: j.leaseToken, launchGrant: j.launchGrant, workLoopId: j.workLoopId, checkoutPath: j.checkoutPath, claimedJob: j }, signal),
                 appendEvent: (id, event) => input.gateway.appendEvent(id, event), readCommands: (id, cursor, signal) => input.gateway.readCommands(id, cursor, signal), acknowledgeCommand: (id, sequence, signal) => input.gateway.acknowledgeCommand(id, sequence, signal),
                 async heartbeat(id, j, signal) { await input.gateway.heartbeat(id, signal); signal.throwIfAborted(); return input.gateway.heartbeatLocalJob({ jobId: j.id, generation: j.generation, leaseToken: j.leaseToken }, signal); },
                 async complete(value) { await input.gateway.completeLocalJob(value); result = { jobId: value.jobId, status: value.status }; }

package/dist/src/daemon/runtime.js

@@ -35,6 +35,9 @@ import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 import { AskRuntime, withAsks } from '../asks/runtime.js';
 import { GuideRuntime, withGuide } from '../guide/runtime.js';
 import { FixConsentRuntime } from './fix-consent.js';
+import { SuspendedPublication } from './suspended-publication.js';
+import { RoomActivityRuntime } from '../rooms/activity.js';
+import { notifyRoomActivity } from '../rooms/notifier.js';
 export async function buildDaemon(input) {
     const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
     if (claudeParts !== 0 && claudeParts !== 3)
@@ -63,8 +66,11 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    const roomActivity = new RoomActivityRuntime({ stateRoot: input.stateRoot,
+        read: (cursor, limit) => gateway.readRoomActivity(cursor, limit), notify: notifyRoomActivity });
     // AI-first ask delivery (Work Item e1c08b33) rides on the session-open loop below; it starts no executor.
     const asks = new AskRuntime({ stateRoot: input.stateRoot, env: input.env,
+        claimRoomNotice: () => roomActivity.claimNotice(),
         report: (deliveryId, report, signal) => gateway.reportAskDelivery({ deliveryId, ...report }, signal),
         log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     // Guide hooks (Work Item d38d60f9) ride on the same sync and heartbeat; they start no executor.
@@ -121,7 +127,7 @@ export async function buildDaemon(input) {
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
             createBinding: async (job, signal) => gateway.createLocalJobBinding({
                 jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath,
+                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
             }, signal),
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
@@ -145,7 +151,7 @@ export async function buildDaemon(input) {
                 }
                 return registry.select(id, version, options);
             } },
-        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient() }),
+        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient(), registeredSubmodules: p1Host?.registeredSubmodules }),
         state,
     });
     let transport;
@@ -167,6 +173,7 @@ export async function buildDaemon(input) {
                 launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint,
                 gatewayTaskPackageFingerprint: claim.task_package_fingerprint,
                 leaseExpiresAt: claim.job.lease_expires_at,
+                executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint,
             };
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
@@ -261,6 +268,9 @@ export async function buildDaemon(input) {
         report: () => localFixHost?.report, jobRunning: () => poller.running,
         restart: () => { daemon.stop(); },
         log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
+    // A suspended publication clears itself once the Gateway closed its job (Work Decision b3d7eb22), then restarts like a consent change.
+    const suspendedPublication = new SuspendedPublication({ state, restart: () => { daemon.stop(); },
+        log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     const opener = new SessionOpener({ home: input.env.HOME ?? "" });
     const dispatch = createSyncDispatcher({
         open: request => opener.open(request),
@@ -283,9 +293,10 @@ export async function buildDaemon(input) {
     const pushTransport = new RunnerTransport({
         sync: async (reason, signal) => {
             const acknowledged = closureAcks.take();
+            const suspendedJob = await suspendedPublication.named();
             // A runner that takes no jobs right now (reconciling, or suspended for recovery) names no adapter.
             try {
-                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion() }, signal);
+                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion(), roomActivityV1: true, ...(suspendedJob ? { suspendedJob } : {}) }, signal);
             }
             catch (error) {
                 closureAcks.restore(acknowledged);
@@ -293,12 +304,22 @@ export async function buildDaemon(input) {
             }
         },
         authorize: (socketId, signal) => gateway.authorizeRunnerChannel(socketId, signal),
-        dispatch: async (result) => { try {
-            await dispatch(result);
-        }
-        finally {
-            await fixConsent.afterSync(result);
-        } },
+        dispatch: async (result) => {
+            void roomActivity.handleSync(result.roomActivityEnabled === true).catch(() => {
+                process.stderr.write(`${JSON.stringify({ event: 'room_activity_scan_failed' })}\n`);
+            });
+            try {
+                await dispatch(result);
+            }
+            finally {
+                try {
+                    await fixConsent.afterSync(result);
+                }
+                finally {
+                    await suspendedPublication.afterSync(result);
+                }
+            }
+        },
         openSocket: (target, events) => new ReverbSocket(target, events, { packageVersion: packageVersion() }),
         report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); },
     });
@@ -317,7 +338,7 @@ export async function buildDaemon(input) {
             throw new Error('Runner state requires authoritative reconciliation');
         },
         poller, sessionOpens: withGuide(guide, withAsks(asks, sessionOpens)),
-        reportRecoveryRequired: reason => { process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
+        reportRecoveryRequired: reason => { suspendedPublication.markSuspended(); process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
     });
     // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.
     // The Claude host always closes; a failing Claude close never masks a Codex close failure.

package/dist/src/daemon/suspended-publication.js

@@ -0,0 +1,52 @@
+const PUBLICATION_PHASES = ["publication_pending", "publication_terminal_pending"];
+/** The job fence of a stored publication phase, or undefined for any other state. */
+function heldPublication(state) {
+    if (!state || typeof state !== "object" || Array.isArray(state))
+        return undefined;
+    const { phase, jobId, generation } = state;
+    if (typeof phase !== "string" || !PUBLICATION_PHASES.includes(phase))
+        return undefined;
+    if (typeof jobId !== "string" || !jobId.trim() || !Number.isSafeInteger(generation) || generation < 1)
+        return undefined;
+    return { jobId, generation: generation };
+}
+export class SuspendedPublication {
+    deps;
+    suspended = false;
+    cleared = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The daemon suspended for recovery; from now on its held publication is named. */
+    markSuspended() { this.suspended = true; }
+    /** The job to name on the next sync. A state that cannot be read names nothing. */
+    async named() {
+        if (!this.suspended || this.cleared)
+            return undefined;
+        try {
+            return heldPublication(await this.deps.state.load());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** After every sync: clears and restarts only when the answer closes the job the state still holds. */
+    async afterSync(result) {
+        const answer = result.suspendedJob;
+        if (!answer?.closed)
+            return;
+        const held = await this.named();
+        if (!held || held.jobId !== answer.jobId || held.generation !== answer.generation)
+            return;
+        try {
+            await this.deps.state.clear();
+        }
+        catch {
+            this.deps.log({ event: "runner_recovery_clear_failed", job_id: held.jobId, generation: held.generation });
+            return;
+        }
+        this.cleared = true;
+        this.deps.log({ event: "runner_recovery_cleared", job_id: held.jobId, generation: held.generation, gateway_status: answer.status });
+        this.deps.restart();
+    }
+}