mtech-ai-local-runner 0.1.75 → 0.1.76

package/README.md

@@ -1,3 +1,34 @@
+## Unreleased: Gateway-managed verification budget (P3E)
+
+D6 owner revision `fbc30fbe-cac9-45d1-9eff-bccec6ee6a54` selects a separate
+Gateway-initiated P2 verification budget: at most 1,500 weighted minutes per UTC
+calendar month and one active verification per workspace. This does not cap or
+certify the entire Bitbucket bill or unrelated jobs.
+
+New `gateway-verification-scope-v2` contracts freeze the managed accounting
+policy, reviewed weight and D6 identity. Legacy scope-v1 contracts retain their
+strict provider-billed usage condition and are never upgraded by a flag. The
+Runner validates the explicit new scope through both reviewed and continuation
+envelopes before execution. Existing provider validation limits (including its
+reviewed cloud-1x pipeline restriction) are unchanged; this feature does not
+approve another CI location or an unreviewed isolation profile.
+
+The Gateway's `AI_OPS_GATEWAY_WORK_VERIFICATION_MANAGED_BUDGET_ENABLED` switch
+is false by default. New launch/admission and stage/start writes need it; already
+admitted CI may still be polled and settled when that switch is off. Ambiguous
+POST results retain their reservation and never automatically retry a paid run.
+Scoped monthly rows preserve the legacy ledger and share its workspace guard;
+known settlement releases ownership without refunding conservative debits.
+
+This is unreleased source support. No profile, reviewer or host is
+registered by the change. A coordinated additive ledger migration and compatible
+readers are required before activation. The earlier source-version0.1.73 review
+archive predates this implementation and cannot authorize these new bytes; an
+unused final version, committed source and fresh package/runtime manifest must
+be reviewed together. No package is published or installed. See the
+[P3E design](../../docs/superpowers/specs/2026-10-30-p3e-managed-ci-budget-design.md)
+and [implementation plan](../../docs/superpowers/plans/2026-10-30-p3e-managed-ci-budget-implementation.md).
+
 ## 0.1.74: exact-parent reviewed correction attempts (P3D)
 
 This local source supports newly approved executable V3 launches behind the
@@ -870,10 +901,19 @@ The relay binds only to loopback. Local capabilities are stored in private mode-
 Existing employees can upgrade their installed daemon with:
 
 ```bash
-npx mtech-ai-local-runner setup
-npx mtech-ai-local-runner doctor
+npx mtech-ai-local-runner@<version> setup
+npx mtech-ai-local-runner@<version> doctor
 ```
 
+Since 0.1.76, setup copies the install that ran it into
+`<state root>/releases/<version>` and points the LaunchAgent at that copy, so
+the daemon never runs from the npx cache. The copy is byte-identical: it keeps
+the measured Fix receipt. A newer dependency from a fresh install could change
+that receipt. An existing release directory with other bytes is refused, and the
+LaunchAgent is left as it was. Before 0.1.76, setup pinned whatever CLI ran it.
+Under npx that was the cache (seen with 0.1.75 on 2026-10-30). Run 0.1.75 setup
+from an installed copy instead.
+
 ### Cancellation and preparation failures
 
 Cancelling a Work Loop also cancels its non-terminal local jobs. Repeating the

package/dist/src/cli.js

@@ -24,6 +24,7 @@ import { OAuthTokenProvider, LoginRequiredError } from "./auth/token-provider.js
 import { createBrowserOpener } from "./auth/browser-opener.js";
 import { FileLocalConfigStore, runnerMode } from "./registration/local-config.js";
 import { LaunchdService } from "./platform/macos/launchd.js";
+import { installStableRelease } from "./platform/macos/stable-release.js";
 import { buildDaemon, runnerDisplayName } from "./daemon/runtime.js";
 import { createHash } from "node:crypto";
 import { discoverEmployeeAdapters, hasUsableAdapter, adapterDiagnosticsWithRemedies } from "./adapters/discovery.js";
@@ -258,10 +259,12 @@ export async function main(argv, env, io = {}) {
                 const features = requestedFeatures ?? ["asks"];
                 const integrations = features.includes("asks") ? await installIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : [];
                 const guide = features.includes("guide") ? await installGuideIntegrations(requestedIntegrations ?? [], env, config.stateRoot) : undefined;
-                await launchd.install(process.argv[1], config.stateRoot);
+                // The LaunchAgent runs a copy under releases/<version>, never the npx cache that may have run setup.
+                const daemonExecutable = await (io.installRelease ?? installStableRelease)({ entry: process.argv[1], stateRoot: config.stateRoot });
+                await launchd.install(daemonExecutable, config.stateRoot);
                 stdout(JSON.stringify(mode === "full"
-                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}) }
-                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}),
+                    ? { configured: true, mode, runnerId: registered.runner.id, adapters, integrations, ...(guide ? { guide } : {}), daemonExecutable }
+                    : { configured: true, mode, runnerId: registered.runner.id, adapters: adapterDiagnosticsWithRemedies(detected), integrations, ...(guide ? { guide } : {}), daemonExecutable,
                         action: "No executor is admitted on this Mac, so the runner is set up as a messenger: it delivers AI Gateway asks and opens sessions, and runs no jobs. Resolve the adapter diagnostics, then rerun setup to run jobs." }));
                 return 0;
             }

package/dist/src/platform/macos/stable-release.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm } from "node:fs/promises";
+import { basename, dirname, join, relative, sep } from "node:path";
+/*
+ * The LaunchAgent runs the CLI that ran setup. Under npx that is the npx cache (2026-10-30, 0.1.75), which npm may
+ * prune or reuse, so the next daemon start would fail or run other bytes. Setup therefore copies the running install
+ * (the node_modules holding this package and its dependencies) into <state root>/releases/<version> and the
+ * LaunchAgent runs that copy. The copy is the same bytes that ran setup, so the measured Fix receipt does not change;
+ * a fresh npm install could resolve newer dependencies and change it.
+ */
+const PACKAGE = "mtech-ai-local-runner";
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?$/;
+/** Every name, link target, file mode and content hash under a directory, in sorted order. */
+async function treeDigest(root) {
+    const hash = createHash("sha256");
+    const walk = async (dir) => {
+        for (const name of (await readdir(dir)).sort()) {
+            const path = join(dir, name), rel = relative(root, path), st = await lstat(path);
+            if (st.isSymbolicLink())
+                hash.update(`L ${rel} ${await readlink(path)}\n`);
+            else if (st.isDirectory()) {
+                hash.update(`D ${rel}\n`);
+                await walk(path);
+            }
+            else if (st.isFile())
+                hash.update(`F ${rel} ${(st.mode & 0o777).toString(8)} ${createHash("sha256").update(await readFile(path)).digest("hex")}\n`);
+            else
+                throw new Error("RUNNER_RELEASE_FILE_UNSUPPORTED");
+        }
+    };
+    await walk(root);
+    return hash.digest("hex");
+}
+/** The installed package that holds the entry, or undefined when the entry is not inside an installed package. */
+async function installedPackage(entry) {
+    let dir = dirname(entry);
+    for (let depth = 0; depth < 6; depth++) {
+        try {
+            const manifest = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+            if (manifest.name === PACKAGE) {
+                if (typeof manifest.version !== "string" || !VERSION.test(manifest.version))
+                    throw new Error("RUNNER_RELEASE_VERSION_INVALID");
+                return basename(dirname(dir)) === "node_modules" ? { root: dir, version: manifest.version } : undefined;
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === "RUNNER_RELEASE_VERSION_INVALID")
+                throw error;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return undefined;
+}
+/** The path the LaunchAgent should run: the entry's copy under <state root>/releases/<version>. */
+export async function installStableRelease(input) {
+    const entry = await realpath(input.entry);
+    const pkg = await installedPackage(entry);
+    if (!pkg)
+        return input.entry;
+    const releases = join(input.stateRoot, "releases");
+    await mkdir(releases, { recursive: true, mode: 0o700 });
+    if (entry.startsWith((await realpath(releases)) + sep))
+        return entry;
+    const modules = dirname(pkg.root), target = join(releases, pkg.version);
+    const targetEntry = join(target, "node_modules", PACKAGE, relative(pkg.root, entry));
+    const expected = await treeDigest(modules);
+    const existing = await lstat(target).catch(() => undefined);
+    if (existing) {
+        if (!existing.isDirectory() || await treeDigest(join(target, "node_modules")).catch(() => "") !== expected) {
+            throw new Error("RUNNER_RELEASE_DIRECTORY_DIFFERS");
+        }
+        return targetEntry;
+    }
+    const partial = `${target}.partial-${process.pid}`;
+    await rm(partial, { recursive: true, force: true });
+    try {
+        await mkdir(partial, { mode: 0o700 });
+        await cp(modules, join(partial, "node_modules"), { recursive: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+        if (await treeDigest(join(partial, "node_modules")) !== expected)
+            throw new Error("RUNNER_RELEASE_COPY_MISMATCH");
+        await rename(partial, target);
+    }
+    finally {
+        await rm(partial, { recursive: true, force: true });
+    }
+    return targetEntry;
+}

package/dist/src/verification/continuation-runner-contract.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { realpath } from 'node:fs/promises';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { protocolHash, protocolJson } from '../publication/candidate.js';
+import { assertGatewayVerificationScope } from './runner-observed-verifier.js';
 export const CONTINUATION_SCHEMA = 'local-runner-verification-v3';
 export const CONTINUATION_POLICY = 'local-runner-reviewed-corrections-v1';
 export const ATTEMPT_CONTEXT_SCHEMA = 'local-runner-attempt-context-v1';
@@ -57,10 +58,12 @@ export function resolveContinuationVerification(value) {
     const inner = object(e.runner_binding), c = object(e.completion_binding);
     if (inner.schema_version !== 'local-runner-verification-v1' || inner.mode !== 'runner_observed_v1' || inner.policy_key !== 'local-runner-verified-v1')
         reject();
-    const gateway = object(inner.gateway_verification), definition = object(gateway.profile_definition);
-    exact(gateway, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (gateway.schema_version !== 'gateway-verification-scope-v1' || gateway.intent !== 'verification_only' || gateway.mode !== 'shadow' || !same(gateway.profile_fingerprint, protocolHash(definition)) || definition.reviewed !== true || definition.ref_prefix !== 'ai-verify/' || definition.max_concurrent_runs !== 1 || typeof gateway.profile_id !== 'string' || !gateway.profile_id || typeof gateway.repository_key !== 'string' || !Array.isArray(definition.repository_keys) || !definition.repository_keys.includes(gateway.repository_key))
+    try {
+        assertGatewayVerificationScope(inner.gateway_verification);
+    }
+    catch {
         reject();
+    }
     exact(c, ['schema_version', 'frozen_loop_contract', 'completion_criteria_fingerprint', 'runner_criteria_fingerprint', 'review_subject_schema', 'review_requirement', 'execute_attempt_limit', 'max_correction_rounds', 'd3_reference']);
     if (!integer(c.max_correction_rounds, 0, 2) || c.execute_attempt_limit !== Math.min(3, 1 + Number(c.max_correction_rounds)))
         reject();

package/dist/src/verification/runner-observed-verifier.js

@@ -30,13 +30,57 @@ export function assertGatewayVerificationScope(value, repositoryKey) {
         throw denied();
     const g = value;
     keys(g, ['schema_version', 'intent', 'mode', 'profile_id', 'repository_key', 'profile_definition', 'profile_fingerprint']);
-    if (g.schema_version !== 'gateway-verification-scope-v1' || g.intent !== 'verification_only' || g.mode !== 'shadow'
+    if (!['gateway-verification-scope-v1', 'gateway-verification-scope-v2'].includes(g.schema_version) || g.intent !== 'verification_only' || g.mode !== 'shadow'
         || typeof g.profile_id !== 'string' || !g.profile_id || typeof g.repository_key !== 'string' || !g.repository_key
         || repositoryKey !== undefined && g.repository_key !== repositoryKey || !g.profile_definition || typeof g.profile_definition !== 'object'
         || protocolHash(g.profile_definition) !== g.profile_fingerprint || g.profile_definition.reviewed !== true
         || g.profile_definition.ref_prefix !== 'ai-verify/' || g.profile_definition.max_concurrent_runs !== 1
         || !Array.isArray(g.profile_definition.repository_keys) || !g.profile_definition.repository_keys.includes(g.repository_key))
         throw denied();
+    const p = g.profile_definition, managed = g.schema_version === 'gateway-verification-scope-v2';
+    const fields = ['reviewed', 'repository_keys', 'ref_prefix', 'ci', 'protected_paths', 'monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'max_concurrent_runs', 'grant_ttl_seconds'];
+    // Legacy bytes remain legacy; accounting can only arrive in an explicit V2 scope.
+    keys(p, managed ? [...fields, 'accounting'] : fields);
+    if (!managed)
+        return;
+    const exact = (value, fields) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw denied();
+        keys(value, fields);
+        if (fields.some(k => !Object.hasOwn(value, k)))
+            throw denied();
+        return value;
+    };
+    exact(p, [...fields, 'accounting']);
+    const a = exact(p.accounting, ['mode', 'budget_scope', 'period_kind', 'decision_revision_id', 'weight_multiplier']);
+    if (a.mode !== 'gateway_managed_reservations_v1' || a.budget_scope !== 'p2_gateway_verification' || a.period_kind !== 'utc_calendar_month'
+        || a.decision_revision_id !== 'fbc30fbe-cac9-45d1-9eff-bccec6ee6a54' || !Number.isSafeInteger(a.weight_multiplier) || Number(a.weight_multiplier) < 1)
+        throw denied();
+    for (const key of ['monthly_minutes_budget', 'max_pipeline_minutes', 'weighted_minutes_reservation', 'grant_ttl_seconds'])
+        if (!Number.isSafeInteger(p[key]) || Number(p[key]) < 1)
+            throw denied();
+    if (Number(p.monthly_minutes_budget) > 1500 || Number(p.max_pipeline_minutes) > 60 || Number(p.grant_ttl_seconds) > 86400
+        || Number(p.grant_ttl_seconds) < Number(p.max_pipeline_minutes) * 60 + 600
+        || p.weighted_minutes_reservation !== Number(p.max_pipeline_minutes) * Number(a.weight_multiplier)
+        || Number(p.weighted_minutes_reservation) > Number(p.monthly_minutes_budget))
+        throw denied();
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,95}$/.test(g.profile_id) || !Array.isArray(p.protected_paths) || p.protected_paths.length > 100 || p.protected_paths.some(n => typeof n !== 'string' || !n || n.length > 400))
+        throw denied();
+    const ci = exact(p.ci, ['validation_only', 'secret_isolation', 'automatic_deployment', 'selector', 'required_steps', 'trusted_files']);
+    if (ci.validation_only !== true || ci.secret_isolation !== true || ci.automatic_deployment !== false || typeof ci.selector !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,100}$/.test(ci.selector)
+        || !Array.isArray(ci.required_steps) || !ci.required_steps.length || ci.required_steps.length > 50 || new Set(ci.required_steps).size !== ci.required_steps.length
+        || ci.required_steps.some(n => typeof n !== 'string' || !n || n.trim() !== n || n.length > 255)
+        || !Array.isArray(ci.trusted_files) || !ci.trusted_files.length || ci.trusted_files.length > 100)
+        throw denied();
+    const paths = new Set();
+    for (const file of ci.trusted_files) {
+        const f = exact(file, ['path', 'sha256']);
+        if (typeof f.path !== 'string' || !/^[A-Za-z0-9_][A-Za-z0-9_.-]*(?:\/[A-Za-z0-9_.-]+)*$/.test(f.path) || f.path.split('/').includes('..') || paths.has(f.path) || !hex(f.sha256, 64))
+            throw denied();
+        paths.add(f.path);
+    }
+    if (!paths.has('bitbucket-pipelines.yml'))
+        throw denied();
 }
 /** Canonical P1 domain. Never uses legacy terminal T/U bytes or diff hashing. */
 export function buildP1ChangedPaths(input, bounds) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.75",
+  "version": "0.1.76",
   "private": false,
   "license": "UNLICENSED",
   "bin": {