mtech-ai-local-runner 0.1.74 → 0.1.76

package/README.md

@@ -1,3 +1,34 @@
+## Unreleased: Gateway-managed verification budget (P3E)
+
+D6 owner revision `fbc30fbe-cac9-45d1-9eff-bccec6ee6a54` selects a separate
+Gateway-initiated P2 verification budget: at most 1,500 weighted minutes per UTC
+calendar month and one active verification per workspace. This does not cap or
+certify the entire Bitbucket bill or unrelated jobs.
+
+New `gateway-verification-scope-v2` contracts freeze the managed accounting
+policy, reviewed weight and D6 identity. Legacy scope-v1 contracts retain their
+strict provider-billed usage condition and are never upgraded by a flag. The
+Runner validates the explicit new scope through both reviewed and continuation
+envelopes before execution. Existing provider validation limits (including its
+reviewed cloud-1x pipeline restriction) are unchanged; this feature does not
+approve another CI location or an unreviewed isolation profile.
+
+The Gateway's `AI_OPS_GATEWAY_WORK_VERIFICATION_MANAGED_BUDGET_ENABLED` switch
+is false by default. New launch/admission and stage/start writes need it; already
+admitted CI may still be polled and settled when that switch is off. Ambiguous
+POST results retain their reservation and never automatically retry a paid run.
+Scoped monthly rows preserve the legacy ledger and share its workspace guard;
+known settlement releases ownership without refunding conservative debits.
+
+This is unreleased source support. No profile, reviewer or host is
+registered by the change. A coordinated additive ledger migration and compatible
+readers are required before activation. The earlier source-version0.1.73 review
+archive predates this implementation and cannot authorize these new bytes; an
+unused final version, committed source and fresh package/runtime manifest must
+be reviewed together. No package is published or installed. See the
+[P3E design](../../docs/superpowers/specs/2026-10-30-p3e-managed-ci-budget-design.md)
+and [implementation plan](../../docs/superpowers/plans/2026-10-30-p3e-managed-ci-budget-implementation.md).
+
 ## 0.1.74: exact-parent reviewed correction attempts (P3D)
 
 This local source supports newly approved executable V3 launches behind the
@@ -525,6 +556,13 @@ publication authority through a late response. Once publication may have taken
 effect, retain `publication_pending` recovery instead of falsely completing,
 failing or restarting the attempt. Canonical publication approval remains required.
 
+Since 0.1.75 (Work Decision `b3d7eb22`) a failed Gateway stage, advance or fence read
+after stage started is repeated with the same arguments for up to 15 minutes, 5 s
+doubling to 130 s, while the heartbeat keeps the lease. A suspended runner names its
+held publication job in `suspended_job` on sync. Once the Gateway answers that the job
+is closed, it clears its state and restarts. The Gateway closes only that runner's own
+job, only when its lease is long expired and no pull request can exist.
+
 Component, shadow admission, installed-package and live-provider evidence are
 separate. Historical 0.1.10 hook behavior below is not current Claude admission;
 Claude parity requires the actual current isolation/admission gate to pass.
@@ -863,10 +901,19 @@ The relay binds only to loopback. Local capabilities are stored in private mode-
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner setup
-npx mtech-ai-local-runner doctor
+npx mtech-ai-local-runner@<version> setup
+npx mtech-ai-local-runner@<version> doctor
 ```
 
+Since 0.1.76, setup copies the install that ran it into
+`<state root>/releases/<version>` and points the LaunchAgent at that copy, so
+the daemon never runs from the npx cache. The copy is byte-identical: it keeps
+the measured Fix receipt. A newer dependency from a fresh install could change
+that receipt. An existing release directory with other bytes is refused, and the
+LaunchAgent is left as it was. Before 0.1.76, setup pinned whatever CLI ran it.
+Under npx that was the cache (seen with 0.1.75 on 2026-10-30). Run 0.1.75 setup
+from an installed copy instead.
+
 ### Cancellation and preparation failures
 
 Cancelling a Work Loop also cancels its non-terminal local jobs. Repeating the

package/dist/src/cli.js

@@ -24,6 +24,7 @@ import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore, runnerMode } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
+import { installStableRelease } from "./platform/macos/stable-release.js";
 import { buildDaemon, runnerDisplayName } from "./daemon/runtime.js";
 import { createHash } from "node:crypto";
 import { discoverEmployeeAdapters, hasUsableAdapter, adapterDiagnosticsWithRemedies } from "./adapters/discovery.js";
@@ -258,10 +259,12 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
-                await launchd.install(process.argv[1], config.stateRoot);
+                // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.
+                const daemonExecutable = await (io.installRelease ?? installStableRelease)({ entry: process.argv[1], stateRoot: config.stateRoot });
+                await launchd.install(daemonExecutable, config.stateRoot);
                 stdout(JSON.stringify(mode === "full"
-                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}) }
-                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}),
+                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), daemonExecutable }
+                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), daemonExecutable,
                         action: "No executor is admitted on this Mac, so the runner is set up as a messenger: it delivers AI Gateway asks and opens sessions, and runs no jobs. Resolve the adapter diagnostics, then rerun setup to run jobs." }));
                 return 0;
             }

package/dist/src/daemon/runtime.js

@@ -35,6 +35,7 @@ import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 import { AskRuntime, withAsks } from '../asks/runtime.js';
 import { GuideRuntime, withGuide } from '../guide/runtime.js';
 import { FixConsentRuntime } from './fix-consent.js';
+import { SuspendedPublication } from './suspended-publication.js';
 import { RoomActivityRuntime } from '../rooms/activity.js';
 import { notifyRoomActivity } from '../rooms/notifier.js';
 export async function buildDaemon(input) {
@@ -267,6 +268,9 @@ export async function buildDaemon(input) {
         report: () => localFixHost?.report, jobRunning: () => poller.running,
         restart: () => { daemon.stop(); },
         log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
+    // A suspended publication clears itself once the Gateway closed its job (Work Decision b3d7eb22), then restarts like a consent change.
+    const suspendedPublication = new SuspendedPublication({ state, restart: () => { daemon.stop(); },
+        log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     const opener = new SessionOpener({ home: input.env.HOME ?? "" });
     const dispatch = createSyncDispatcher({
         open: request => opener.open(request),
@@ -289,9 +293,10 @@ export async function buildDaemon(input) {
     const pushTransport = new RunnerTransport({
         sync: async (reason, signal) => {
             const acknowledged = closureAcks.take();
+            const suspendedJob = await suspendedPublication.named();
             // A runner that takes no jobs right now (reconciling, or suspended for recovery) names no adapter.
             try {
-                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion(), roomActivityV1: true }, signal);
+                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion(), roomActivityV1: true, ...(suspendedJob ? { suspendedJob } : {}) }, signal);
             }
             catch (error) {
                 closureAcks.restore(acknowledged);
@@ -307,7 +312,12 @@ export async function buildDaemon(input) {
                 await dispatch(result);
             }
             finally {
-                await fixConsent.afterSync(result);
+                try {
+                    await fixConsent.afterSync(result);
+                }
+                finally {
+                    await suspendedPublication.afterSync(result);
+                }
             }
         },
         openSocket: (target, events) => new ReverbSocket(target, events, { packageVersion: packageVersion() }),
@@ -328,7 +338,7 @@ export async function buildDaemon(input) {
             throw new Error('Runner state requires authoritative reconciliation');
         },
         poller, sessionOpens: withGuide(guide, withAsks(asks, sessionOpens)),
-        reportRecoveryRequired: reason => { process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
+        reportRecoveryRequired: reason => { suspendedPublication.markSuspended(); process.stderr.write(`${JSON.stringify({ event: 'runner_recovery_required', reason })}\n`); },
     });
     // Model tools have no Gateway relay. Each adapter owns and closes its job endpoint.
     // The Claude host always closes; a failing Claude close never masks a Codex close failure.

package/dist/src/daemon/suspended-publication.js

@@ -0,0 +1,52 @@
+const PUBLICATION_PHASES = ["publication_pending", "publication_terminal_pending"];
+/** The job fence of a stored publication phase, or undefined for any other state. */
+function heldPublication(state) {
+    if (!state || typeof state !== "object" || Array.isArray(state))
+        return undefined;
+    const { phase, jobId, generation } = state;
+    if (typeof phase !== "string" || !PUBLICATION_PHASES.includes(phase))
+        return undefined;
+    if (typeof jobId !== "string" || !jobId.trim() || !Number.isSafeInteger(generation) || generation < 1)
+        return undefined;
+    return { jobId, generation: generation };
+}
+export class SuspendedPublication {
+    deps;
+    suspended = false;
+    cleared = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The daemon suspended for recovery; from now on its held publication is named. */
+    markSuspended() { this.suspended = true; }
+    /** The job to name on the next sync. A state that cannot be read names nothing. */
+    async named() {
+        if (!this.suspended || this.cleared)
+            return undefined;
+        try {
+            return heldPublication(await this.deps.state.load());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** After every sync: clears and restarts only when the answer closes the job the state still holds. */
+    async afterSync(result) {
+        const answer = result.suspendedJob;
+        if (!answer?.closed)
+            return;
+        const held = await this.named();
+        if (!held || held.jobId !== answer.jobId || held.generation !== answer.generation)
+            return;
+        try {
+            await this.deps.state.clear();
+        }
+        catch {
+            this.deps.log({ event: "runner_recovery_clear_failed", job_id: held.jobId, generation: held.generation });
+            return;
+        }
+        this.cleared = true;
+        this.deps.log({ event: "runner_recovery_cleared", job_id: held.jobId, generation: held.generation, gateway_status: answer.status });
+        this.deps.restart();
+    }
+}

package/dist/src/gateway-client.js

@@ -19,6 +19,17 @@ export class GatewayToolError extends Error {
     }
 }
 const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SUSPENDED_JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A malformed answer is dropped, never a reason to refuse the sync: the runner then stays suspended. */
+function parseSuspendedJob(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const { job_id: jobId, generation, status, closed } = value;
+    if (typeof jobId !== "string" || !SUSPENDED_JOB_ID.test(jobId) || !Number.isSafeInteger(generation) || generation < 1
+        || typeof status !== "string" || !/^[a-z_]{1,32}$/.test(status) || typeof closed !== "boolean")
+        return undefined;
+    return { jobId, generation: generation, status, closed };
+}
 const FIX_CONSENT_GRANT_ID = /^[a-zA-Z0-9-]{1,64}$/;
 const FIX_CONSENT_REPOSITORY_KEY = /^[a-z0-9][a-z0-9._-]{0,99}$/;
 const FIX_CONSENT_GRANTS_MAX = 20;
@@ -54,6 +65,7 @@ export function parseRunnerSync(result, runnerId) {
     if (body === undefined || !Array.isArray(body.opens) || malformed("ask_deliveries") || malformed("closed_delivery_ids")) {
         throw new GatewayToolError("Gateway returned an invalid runner sync result", "local_agent_runner_sync", "GATEWAY_INVALID_TOOL_RESULT");
     }
+    const suspendedJob = parseSuspendedJob(body.suspended_job);
     return {
         opens: body.opens,
         ...(Array.isArray(body.ask_deliveries) ? { askDeliveries: body.ask_deliveries } : {}),
@@ -64,6 +76,7 @@ export function parseRunnerSync(result, runnerId) {
         ...(body.ask_alert === true ? { askAlert: true } : {}),
         ...(body.room_activity_enabled === true ? { roomActivityEnabled: true } : {}),
         ...(Array.isArray(body.fix_consent_grants) ? { fixConsentGrants: parseFixConsentGrants(body.fix_consent_grants) } : {}),
+        ...(suspendedJob ? { suspendedJob } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),
         syncSeconds: clampSeconds(body.sync_seconds, 15, 120, 30),
@@ -608,6 +621,7 @@ export class McpGatewayClient {
             ...(acknowledged.length > 0 ? { acknowledged_closure_ids: acknowledged } : {}),
             ...(input.guidancePolicyVersion ? { guidance_policy_version: input.guidancePolicyVersion } : {}),
             ...(input.roomActivityV1 ? { room_activity_v1: true } : {}),
+            ...(input.suspendedJob ? { suspended_job: { job_id: input.suspendedJob.jobId, generation: input.suspendedJob.generation } } : {}),
         }, signal);
         return parseRunnerSync(result, this.runnerId);
     }

package/dist/src/platform/macos/stable-release.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm } from "node:fs/promises";
+import { basename, dirname, join, relative, sep } from "node:path";
+/*
+ * The LaunchAgent runs the CLI that ran setup. Under npx that is the npx cache (2026-10-30, 0.1.75), which npm may
+ * prune or reuse, so the next daemon start would fail or run other bytes. Setup therefore copies the running install
+ * (the node_modules holding this package and its dependencies) into <state root>/releases/<version> and the
+ * LaunchAgent runs that copy. The copy is the same bytes that ran setup, so the measured Fix receipt does not change;
+ * a fresh npm install could resolve newer dependencies and change it.
+ */
+const PACKAGE = "mtech-ai-local-runner";
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?$/;
+/** Every name, link target, file mode and content hash under a directory, in sorted order. */
+async function treeDigest(root) {
+    const hash = createHash("sha256");
+    const walk = async (dir) => {
+        for (const name of (await readdir(dir)).sort()) {
+            const path = join(dir, name), rel = relative(root, path), st = await lstat(path);
+            if (st.isSymbolicLink())
+                hash.update(`L ${rel} ${await readlink(path)}\n`);
+            else if (st.isDirectory()) {
+                hash.update(`D ${rel}\n`);
+                await walk(path);
+            }
+            else if (st.isFile())
+                hash.update(`F ${rel} ${(st.mode & 0o777).toString(8)} ${createHash("sha256").update(await readFile(path)).digest("hex")}\n`);
+            else
+                throw new Error("RUNNER_RELEASE_FILE_UNSUPPORTED");
+        }
+    };
+    await walk(root);
+    return hash.digest("hex");
+}
+/** The installed package that holds the entry, or undefined when the entry is not inside an installed package. */
+async function installedPackage(entry) {
+    let dir = dirname(entry);
+    for (let depth = 0; depth < 6; depth++) {
+        try {
+            const manifest = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+            if (manifest.name === PACKAGE) {
+                if (typeof manifest.version !== "string" || !VERSION.test(manifest.version))
+                    throw new Error("RUNNER_RELEASE_VERSION_INVALID");
+                return basename(dirname(dir)) === "node_modules" ? { root: dir, version: manifest.version } : undefined;
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === "RUNNER_RELEASE_VERSION_INVALID")
+                throw error;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return undefined;
+}
+/** The path the LaunchAgent should run: the entry's copy under <state root>/releases/<version>. */
+export async function installStableRelease(input) {
+    const entry = await realpath(input.entry);
+    const pkg = await installedPackage(entry);
+    if (!pkg)
+        return input.entry;
+    const releases = join(input.stateRoot, "releases");
+    await mkdir(releases, { recursive: true, mode: 0o700 });
+    if (entry.startsWith((await realpath(releases)) + sep))
+        return entry;
+    const modules = dirname(pkg.root), target = join(releases, pkg.version);
+    const targetEntry = join(target, "node_modules", PACKAGE, relative(pkg.root, entry));
+    const expected = await treeDigest(modules);
+    const existing = await lstat(target).catch(() => undefined);
+    if (existing) {
+        if (!existing.isDirectory() || await treeDigest(join(target, "node_modules")).catch(() => "") !== expected) {
+            throw new Error("RUNNER_RELEASE_DIRECTORY_DIFFERS");
+        }
+        return targetEntry;
+    }
+    const partial = `${target}.partial-${process.pid}`;
+    await rm(partial, { recursive: true, force: true });
+    try {
+        await mkdir(partial, { mode: 0o700 });
+        await cp(modules, join(partial, "node_modules"), { recursive: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+        if (await treeDigest(join(partial, "node_modules")) !== expected)
+            throw new Error("RUNNER_RELEASE_COPY_MISMATCH");
+        await rename(partial, target);
+    }
+    finally {
+        await rm(partial, { recursive: true, force: true });
+    }
+    return targetEntry;
+}

package/dist/src/publication/installed-host.js

@@ -42,6 +42,8 @@ export function assertLocalFixConsent(value) {
     if (!Array.isArray(modes) || !modes.length || new Set(modes).size !== modes.length || modes.some(m => m !== 'gateway_ci_v1' && m !== 'gateway_publish_v1'))
         throw denied();
 }
+/** One fixed JSON line per repeated publication call; no payload, path or token. */
+const reportRetry = (event) => { process.stderr.write(`${JSON.stringify(event)}\n`); };
 /** Serves each job with the registration of the mode frozen in its own Fix scope. */
 function multiModeHost(hosts) {
     const verificationModes = hosts.map(h => { if (h.verificationMode === undefined)
@@ -94,7 +96,7 @@ export async function loadInstalledLocalFixHost(input) {
                     // The scope's own reviewed policy and this measured release make the registration the server CI host checks the job against.
                     const manifest = { verification_mode: mode, project: key, ci_profile: scope.ci_profile, ci_profile_fingerprint: protocolHash(scope.ci_profile), receipt: { ...measured.receipt } };
                     const registration = { ...manifest, review: { status: 'reviewed', fingerprint: protocolHash(manifest) } };
-                    return createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration, gateway: input.gateway, assertReleaseCurrent, canonicalApprovalId: async (publicationId) => {
+                    return createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration, gateway: input.gateway, assertReleaseCurrent, report: reportRetry, canonicalApprovalId: async (publicationId) => {
                             let approvals;
                             try {
                                 approvals = await readPrivateJson(path.join(input.stateRoot, 'local-fix-pr-approvals.json'));
@@ -146,7 +148,7 @@ export async function loadInstalledLocalFixHost(input) {
             const privateRoot = path.join(input.stateRoot, 'local-fix-publication'), s = await lstat(privateRoot);
             if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 0o077) !== 0 || (process.getuid && s.uid !== process.getuid()) || await realpath(privateRoot) !== privateRoot)
                 throw denied();
-            const hosts = registrations.map(registration => createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration, gateway: input.gateway, assertReleaseCurrent, canonicalApprovalId: async (publicationId) => {
+            const hosts = registrations.map(registration => createServerCiLocalFixHost({ runnerId: input.runnerId, privateRoot, git: config.git, registration, gateway: input.gateway, assertReleaseCurrent, report: reportRetry, canonicalApprovalId: async (publicationId) => {
                     let approvals;
                     try {
                         approvals = await readPrivateJson(path.join(input.stateRoot, 'local-fix-pr-approvals.json'));

package/dist/src/publication/server-ci-host.js

@@ -14,6 +14,13 @@ import { GitSnapshotHost, SNAPSHOT_TREE_MAX_BYTES } from './git-snapshot.js';
 import { PublicationOutcomeUnknownError } from './publisher.js';
 import { isLocalFixAdapter } from './local-fix-adapters.js';
 const denied = () => Error('LOCAL_FIX_SERVER_CI_REJECTED');
+/** Work Decision b3d7eb22: a failed Gateway publication call is repeated for at most this long; the coordinator heartbeat keeps the lease. */
+export const PUBLICATION_RETRY_WINDOW_MS = 900_000;
+/** 5 s doubling to 130 s, longer than the Gateway's 120-s quiet window, so an absent working branch can be staged again (decision 1bddc563). */
+export const publicationRetryDelay = (failures) => Math.min(5000 * 2 ** (failures - 1), 130_000);
+/** Only the Gateway read of the fence failed; every local check passed, so the call may be repeated. */
+class FenceUnreadable extends Error {
+}
 const safePath = (p) => typeof p === 'string' && p.length > 0 && !p.includes('\\') && !p.includes('\0') && !path.isAbsolute(p) && p.split('/').every(s => s !== '' && s !== '.' && s !== '..' && !/^(?:\.git|\.mcp(?:\..*)?|\.npmrc|\.netrc|id_rsa|id_ed25519|\.local-runner|\.runner|\.env(?:\..*)?|\.codex|\.claude|\.ssh|\.aws|\.config|auth\.(?:json|toml|ya?ml)(?:\..*)?|credentials(?:\..*)?|AGENTS\.md|CLAUDE\.md|mcp\.(?:json|toml|ya?ml)(?:\..*)?)$/i.test(s));
 /** Gateway decision 8e7fff53: under any directory scope, test infrastructure, boot and dependency files stay as the base has them. */
 const testInfrastructure = (p) => /(^|\/)(phpunit\.xml(\.dist)?|bitbucket-pipelines\.yml|composer\.[^/]+|package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml)$|^(scripts|app\/common)(\/|$)|(^|\/)(vendor|node_modules)(\/|$)/.test(p);
@@ -82,8 +89,22 @@ export function createServerCiLocalFixHost(options) {
                 throw denied();
             let closed = false, settled = false, stageStarted = false, host, phase = 'validation_report', primary, disposing, finalization, seal;
             const current = async () => { if (closed || !lifecycle.isCurrent() || !lifecycle.isFrozen())
-                throw denied(); await options.assertReleaseCurrent?.(); if (protocolHash(bindingProof((await options.gateway.localPublicationContext(fence)).context)) !== protocolHash(binding) || closed || !lifecycle.isCurrent() || !lifecycle.isFrozen())
+                throw denied(); await options.assertReleaseCurrent?.(); let context; try {
+                context = (await options.gateway.localPublicationContext(fence)).context;
+            }
+            catch {
+                throw new FenceUnreadable();
+            } if (protocolHash(bindingProof(context)) !== protocolHash(binding) || closed || !lifecycle.isCurrent() || !lifecycle.isFrozen())
                 throw denied(); await seal?.assertUnchanged(); };
+            const readable = async () => { try {
+                await current();
+                return true;
+            }
+            catch (error) {
+                if (error instanceof FenceUnreadable)
+                    return false;
+                throw error;
+            } };
             const dispose = () => disposing ??= (host?.dispose() ?? Promise.resolve());
             return { close: async () => { closed = true; if (!finalization || settled) {
                     try {
@@ -198,21 +219,51 @@ export function createServerCiLocalFixHost(options) {
                             if (!security)
                                 throw denied();
                             let result;
+                            const sleep = options.sleep ?? delay, now = options.now ?? Date.now;
+                            // Work Decision b3d7eb22: a string answer names a failed Gateway call, repeated with the same arguments while the
+                            // fence holds. The streak ends at the first accepted answer; a delay that would outlast the window gives up as before.
+                            const retrying = async (attempt) => {
+                                let started;
+                                for (let failures = 1;; failures++) {
+                                    const answer = await attempt();
+                                    if (typeof answer !== 'string')
+                                        return answer;
+                                    started ??= now();
+                                    const wait = publicationRetryDelay(failures);
+                                    if (now() - started + wait > PUBLICATION_RETRY_WINDOW_MS)
+                                        throw new PublicationOutcomeUnknownError();
+                                    try {
+                                        options.report?.({ event: 'local_fix_publication_retry', operation: answer, failures, delay_ms: wait });
+                                    }
+                                    catch { /* diagnostics only */ }
+                                    await sleep(wait);
+                                }
+                            };
                             phase = 'stage';
                             stageStarted = true;
-                            try {
-                                result = (await options.gateway.executeServerCiPublication({ ...fence, operation: 'stage', files, ...(report ? { validationReport: report } : {}), securityReceipt: { ...security }, hostReceipt: { ...registration.receipt } })).result;
-                            }
-                            catch {
-                                throw new PublicationOutcomeUnknownError();
-                            }
-                            const publicationId = result.publication_id;
-                            if (typeof publicationId !== 'string' || !publicationId)
-                                throw new PublicationOutcomeUnknownError();
-                            if (record.publication_id && record.publication_id !== publicationId)
-                                throw new PublicationOutcomeUnknownError();
-                            record.publication_id = publicationId;
-                            await journal.save(key, record);
+                            let stages = 0;
+                            const stageInput = { ...fence, operation: 'stage', files, ...(report ? { validationReport: report } : {}), securityReceipt: { ...security }, hostReceipt: { ...registration.receipt } };
+                            // The same frozen files again: the Gateway reconciles a present branch or stages an absent one again (1bddc563).
+                            result = await retrying(async () => {
+                                if (stages++ > 0 && !await readable())
+                                    return 'fence';
+                                let answer;
+                                try {
+                                    answer = (await options.gateway.executeServerCiPublication(stageInput)).result;
+                                }
+                                catch {
+                                    return 'stage';
+                                }
+                                const id = answer.publication_id;
+                                if (typeof id !== 'string' || !id)
+                                    throw new PublicationOutcomeUnknownError();
+                                if (record.publication_id && record.publication_id !== id)
+                                    throw new PublicationOutcomeUnknownError();
+                                record.publication_id = id;
+                                await journal.save(key, record);
+                                return answer.status === 'publication_unknown' ? 'stage' : answer;
+                            });
+                            const publicationId = String(result.publication_id);
                             const pending = new Set(['staged', 'validating', 'authorized', 'committing', 'committed', 'pushing', 'pushed', 'opening_pr']);
                             for (;;) {
                                 phase = 'result';
@@ -221,7 +272,7 @@ export function createServerCiLocalFixHost(options) {
                                 if (result.status === 'ci_failed')
                                     throw new ServerCiPublicationError(result.ci?.error_code ?? result.failure?.code);
                                 if (result.status === 'completed') {
-                                    await current();
+                                    await retrying(async () => await readable() ? {} : 'fence');
                                     const ci = result.ci;
                                     if (result.verification_mode !== mode || (mode === 'gateway_ci_v1' ? ci?.status !== 'passed' || ci.commit_sha !== result.commit_sha : ci?.status !== 'not_run' || result.verification?.status !== 'unverified') || typeof result.commit_sha !== 'string' || !/^[a-f0-9]{40}$/.test(result.commit_sha) || result.working_branch !== binding.working_branch)
                                         throw new PublicationOutcomeUnknownError();
@@ -230,16 +281,20 @@ export function createServerCiLocalFixHost(options) {
                                 if (result.waiting || !pending.has(String(result.status)))
                                     throw new PublicationOutcomeUnknownError();
                                 phase = 'advance';
-                                await (options.sleep ?? delay)(5000);
-                                await current();
-                                const approval = await options.canonicalApprovalId?.(publicationId);
-                                await current();
-                                try {
-                                    result = (await options.gateway.executeServerCiPublication({ ...fence, operation: 'advance', publicationId, canonicalApprovalId: approval })).result;
-                                }
-                                catch {
-                                    throw new PublicationOutcomeUnknownError();
-                                }
+                                await sleep(5000);
+                                result = await retrying(async () => {
+                                    if (!await readable())
+                                        return 'fence';
+                                    const approval = await options.canonicalApprovalId?.(publicationId);
+                                    if (!await readable())
+                                        return 'fence';
+                                    try {
+                                        return (await options.gateway.executeServerCiPublication({ ...fence, operation: 'advance', publicationId, canonicalApprovalId: approval })).result;
+                                    }
+                                    catch {
+                                        return 'advance';
+                                    }
+                                });
                             }
                         });
                     })().catch(error => {

package/dist/src/verification/continuation-runner-contract.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { realpath } from 'node:fs/promises';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
+import { assertGatewayVerificationScope } from './runner-observed-verifier.js';
 export const CONTINUATION_SCHEMA = 'local-runner-verification-v3';
 export const CONTINUATION_POLICY = 'local-runner-reviewed-corrections-v1';
 export const ATTEMPT_CONTEXT_SCHEMA = 'local-runner-attempt-context-v1';
@@ -57,10 +58,12 @@ export function resolveContinuationVerification(value) {
     const inner = object(e.runner_binding), c = object(e.completion_binding);
     if (inner.schema_version !== 'local-runner-verification-v1' || inner.mode !== 'runner_observed_v1' || inner.policy_key !== 'local-runner-verified-v1')
         reject();
-    const gateway = object(inner.gateway_verification), definition = object(gateway.profile_definition);
-    exact(gateway, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (gateway.schema_version !== 'gateway-verification-scope-v1' || gateway.intent !== 'verification_only' || gateway.mode !== 'shadow' || !same(gateway.profile_fingerprint, protocolHash(definition)) || definition.reviewed !== true || definition.ref_prefix !== 'ai-verify/' || definition.max_concurrent_runs !== 1 || typeof gateway.profile_id !== 'string' || !gateway.profile_id || typeof gateway.repository_key !== 'string' || !Array.isArray(definition.repository_keys) || !definition.repository_keys.includes(gateway.repository_key))
+    try {
+        assertGatewayVerificationScope(inner.gateway_verification);
+    }
+    catch {
         reject();
+    }
     exact(c, ['schema_version', 'frozen_loop_contract', 'completion_criteria_fingerprint', 'runner_criteria_fingerprint', 'review_subject_schema', 'review_requirement', 'execute_attempt_limit', 'max_correction_rounds', 'd3_reference']);
     if (!integer(c.max_correction_rounds, 0, 2) || c.execute_attempt_limit !== Math.min(3, 1 + Number(c.max_correction_rounds)))
         reject();

package/dist/src/verification/runner-observed-verifier.js

@@ -30,13 +30,57 @@ export function assertGatewayVerificationScope(value, repositoryKey) {
         throw denied();
     const g = value;
     keys(g, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (g.schema_version !== 'gateway-verification-scope-v1' || g.intent !== 'verification_only' || g.mode !== 'shadow'
+    if (!['gateway-verification-scope-v1', 'gateway-verification-scope-v2'].includes(g.schema_version) || g.intent !== 'verification_only' || g.mode !== 'shadow'
         || typeof g.profile_id !== 'string' || !g.profile_id || typeof g.repository_key !== 'string' || !g.repository_key
         || repositoryKey !== undefined && g.repository_key !== repositoryKey || !g.profile_definition || typeof g.profile_definition !== 'object'
         || protocolHash(g.profile_definition) !== g.profile_fingerprint || g.profile_definition.reviewed !== true
         || g.profile_definition.ref_prefix !== 'ai-verify/' || g.profile_definition.max_concurrent_runs !== 1
         || !Array.isArray(g.profile_definition.repository_keys) || !g.profile_definition.repository_keys.includes(g.repository_key))
         throw denied();
+    const p = g.profile_definition, managed = g.schema_version === 'gateway-verification-scope-v2';
+    const fields = ['reviewed', 'repository_keys', 'ref_prefix', 'ci', 'protected_paths', 'monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'max_concurrent_runs', 'grant_ttl_seconds'];
+    // Legacy bytes remain legacy; accounting can only arrive in an explicit V2 scope.
+    keys(p, managed ? [...fields, 'accounting'] : fields);
+    if (!managed)
+        return;
+    const exact = (value, fields) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw denied();
+        keys(value, fields);
+        if (fields.some(k => !Object.hasOwn(value, k)))
+            throw denied();
+        return value;
+    };
+    exact(p, [...fields, 'accounting']);
+    const a = exact(p.accounting, ['mode', 'budget_scope', 'period_kind', 'decision_revision_id', 'weight_multiplier']);
+    if (a.mode !== 'gateway_managed_reservations_v1' || a.budget_scope !== 'p2_gateway_verification' || a.period_kind !== 'utc_calendar_month'
+        || a.decision_revision_id !== 'fbc30fbe-cac9-45d1-9eff-bccec6ee6a54' || !Number.isSafeInteger(a.weight_multiplier) || Number(a.weight_multiplier) < 1)
+        throw denied();
+    for (const key of ['monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'grant_ttl_seconds'])
+        if (!Number.isSafeInteger(p[key]) || Number(p[key]) < 1)
+            throw denied();
+    if (Number(p.monthly_minutes_budget) > 1500 || Number(p.max_pipeline_minutes) > 60 || Number(p.grant_ttl_seconds) > 86400
+        || Number(p.grant_ttl_seconds) < Number(p.max_pipeline_minutes) * 60 + 600
+        || p.weighted_minutes_reservation !== Number(p.max_pipeline_minutes) * Number(a.weight_multiplier)
+        || Number(p.weighted_minutes_reservation) > Number(p.monthly_minutes_budget))
+        throw denied();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/.test(g.profile_id) || !Array.isArray(p.protected_paths) || p.protected_paths.length > 100 || p.protected_paths.some(n => typeof n !== 'string' || !n || n.length > 400))
+        throw denied();
+    const ci = exact(p.ci, ['validation_only', 'secret_isolation', 'automatic_deployment', 'selector', 'required_steps', 'trusted_files']);
+    if (ci.validation_only !== true || ci.secret_isolation !== true || ci.automatic_deployment !== false || typeof ci.selector !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/.test(ci.selector)
+        || !Array.isArray(ci.required_steps) || !ci.required_steps.length || ci.required_steps.length > 50 || new Set(ci.required_steps).size !== ci.required_steps.length
+        || ci.required_steps.some(n => typeof n !== 'string' || !n || n.trim() !== n || n.length > 255)
+        || !Array.isArray(ci.trusted_files) || !ci.trusted_files.length || ci.trusted_files.length > 100)
+        throw denied();
+    const paths = new Set();
+    for (const file of ci.trusted_files) {
+        const f = exact(file, ['path', 'sha256']);
+        if (typeof f.path !== 'string' || !/^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(f.path) || f.path.split('/').includes('..') || paths.has(f.path) || !hex(f.sha256, 64))
+            throw denied();
+        paths.add(f.path);
+    }
+    if (!paths.has('bitbucket-pipelines.yml'))
+        throw denied();
 }
 /** Canonical P1 domain. Never uses legacy terminal T/U bytes or diff hashing. */
 export function buildP1ChangedPaths(input, bounds) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "private": false,
   "license": "UNLICENSED",
   "bin": {