owlrunkit 0.25.0 → 0.25.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.25.2
+
+- Supports managed Linux worker recovery with system Bubblewrap when Landlock
+  is unavailable. RunKit verifies the writable attempt, read-only sandbox
+  root, hidden host files, and seccomp process and network restrictions before
+  selecting the backend.
+- Keeps Landlock as the first Linux backend. If neither backend passes its
+  runtime probe, managed peer commands refuse to start.
+
+## 0.25.1
+
+- Adds enforced Linux peer isolation for x86-64 and ARM64 with Landlock and
+  seccomp. The helper verifies kernel support before managed tasks start.
+- A cooperating agent can attach its worker command to `peer recover`.
+  A confirmed wake preserves the current owner. After takeover, exactly one
+  invocation starts the successor from the last accepted checkpoint.
+- On Linux, control transactions use an OS lock that is released on process
+  exit. The next transaction verifies interrupted state before proceeding.
+  Partial multi-file changes and ownerless directory locks still require
+  reconciliation. Legacy shared-directory worker leases remain explicit.
+
 ## 0.25.0
 
 - Adds opt-in same-host peer recovery for macOS-contained workers. A cooperating

package/NOTICE.md

@@ -1,137 +1,22 @@
-# NOTICE
+# OwlRunKit Notice
 
-## OwlCoda Positioning
+OwlRunKit is an independent package in the OwlCoda product family. It is not
+affiliated with any model vendor, coding-agent vendor, or hosted agent service.
 
-OwlCoda is an independent local AI coding platform. It is not affiliated with
-any external coding assistant vendor.
+The OwlRunKit CLI, Core, contracts, and attestation package are distributed
+under `GPL-3.0-or-later`; see [`LICENSE`](LICENSE). The published package uses
+Node.js built-in modules and currently declares no runtime npm dependencies.
+Files carrying their own license or provenance notice retain those terms.
 
-Third-party product names may appear where they are needed for protocol
-interoperability, optional user-provided provider integrations, migration
-history, or competitive analysis. The default npm release package contains the
-OwlCoda runtime, bundled skill resources, branding assets, configuration
-examples, and public release documents. Bundled skills and third-party-derived
-resources keep their own license files and provenance records where applicable.
+Product and provider names may appear only where needed for interoperability,
+portable integration guidance, compatibility history, or evidence captured by
+the user. Such references do not imply endorsement, sponsorship, or
+affiliation.
 
-Starting with the `0.15.0` license boundary, the OwlCoda core package is
-released under `GPL-3.0-or-later`. Third-party dependencies and in-tree
-attributions keep their own licenses as listed below; this notice records
-those dependencies and does not override the OwlCoda project license.
+OwlRunKit records delivery continuity and verification evidence. It does not
+grant Git, release, deployment, production, automation, money, or business
+authority, and it does not become the Business Truth of a domain product.
 
-### What OwlCoda Provides
-
-OwlCoda provides:
-- Protocol translation layer (messages API ↔ OpenAI Chat Completions)
-- Local model platform integration (Ollama, LM Studio, vLLM)
-- Native REPL, tool orchestration, and session workflows
-- Production infrastructure (health monitoring, rate limiting, circuit breakers)
-- Extended REPL commands and observability
-
-### What OwlCoda Does NOT Provide
-
-OwlCoda does not claim to be any third-party coding assistant, does not ship a
-third-party branded UI, and does not rely on an external vendor CLI as its
-primary product surface.
-
-### Protocol Interoperability vs Affiliation
-
-OwlCoda implements two widely-deployed wire formats so that users can
-plug their existing local runtime into it without rewriting the
-runtime:
-
-1. The Messages-shaped API (originated by Anthropic and now implemented
-   by many independent open-source servers) — incoming `/v1/messages`
-   requests are accepted in this shape and translated as needed.
-2. The OpenAI Chat Completions wire format — outgoing requests to
-   user-configured backends use this shape because most local
-   inference runtimes (Ollama, LM Studio, vLLM, etc.) expose it.
-
-Implementing these wire formats is a technical interoperability
-choice, not a brand affiliation. Where the codebase contains the
-literal strings `Anthropic`, `Anthropic-compatible`,
-`anthropic-version`, `/v1/messages`, or imports the public
-`@anthropic-ai/sdk` package, those references are protocol-level,
-exist solely to maintain over-the-wire compatibility, and do not
-constitute or imply:
-
-- endorsement by, or sponsorship from, Anthropic, OpenAI, or any
-  other third party;
-- any affiliation, partnership, or contractual relationship with
-  those parties; or
-- a claim that OwlCoda is a substitute for, or a derivative of,
-  any third-party product.
-
-The `@anthropic-ai/sdk` package is listed as a `devDependency` only
-and is used by `tests/sdk-verify.ts` as an interoperability sanity
-check against OwlCoda's own server implementation. It is not loaded
-by the OwlCoda runtime.
-
-## Third-Party Source Attributions
-
-OwlCoda incorporates source code derived from the following third-party
-projects. Their original copyright notices and MIT permission text are
-reproduced below as required by their licenses.
-
-### Ink (https://github.com/vadimdemedes/ink)
-
-The `src/ink/` directory contains a fork of the Ink terminal-UI library
-originally authored by Vadim Demedes. OwlCoda's fork extends Ink with
-ScrollBox / viewport-culling / sticky-scroll primitives needed by the
-native REPL, but the underlying reconciler, layout, renderer, DOM, event,
-and component code remain derivative of upstream Ink.
-
-```
-MIT License
-
-Copyright (c) Vadim Demedes <vadimdemedes@hey.com> (vadimdemedes.com)
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the "Software"),
-to deal in the Software without restriction, including without limitation
-the rights to use, copy, modify, merge, publish, distribute, sublicense,
-and/or sell copies of the Software, and to permit persons to whom the
-Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included
-in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
-```
-
-A copy of this attribution also lives at `src/ink/ATTRIBUTION.md` so it
-travels with the fork in any redistribution.
-
-### Direct Runtime Dependencies
-
-OwlCoda's published tarball ships only `dist/`; runtime dependencies are
-resolved by `npm install` and their full license texts are available
-under `node_modules/<pkg>/LICENSE` after install. The list below is
-provided for transparency; it does not replace the per-package license
-files that npm fetches automatically.
-
-For GPL-covered npm packages, corresponding source availability is documented
-in `SOURCE.md`. Dependency-license review for GPLv3 compatibility is a release
-gate distinct from the older "does this project depend on GPL code?" check.
-
-| Package | License |
-|---|---|
-| `@anthropic-ai/sdk` (devDependency, type-only import + verify script) | MIT |
-| `@commander-js/extra-typings` | MIT |
-| `@growthbook/growthbook` | MIT |
-| `@modelcontextprotocol/sdk` | MIT |
-| `@opentelemetry/*` (api, core, sdk-logs, sdk-metrics, sdk-trace-base, resources, api-logs, semantic-conventions) | Apache-2.0 |
-| `axios`, `chalk`, `chokidar`, `marked`, `react`, `react-reconciler`, `ws`, `zod`, `undici`, `execa`, `turndown`, `xss`, `yaml`, others | MIT |
-| `cacache`, `cli-highlight`, `semver`, `signal-exit`, `yaml` | ISC |
-| `diff` | BSD-3-Clause |
-| `lru-cache` | BlueOak-1.0.0 |
-| `ink` (npm — co-installed alongside the in-tree fork in `src/ink/`) | MIT (Vadim Demedes) |
-
-No GPL / AGPL / SSPL / Business Source / Commons Clause / Elastic License
-dependencies are present in the current transitive graph (verified via
-`npm ls --all`). That is a dependency fact, not a statement about OwlCoda's own
-project license.
+The Linux helper binaries statically link musl. See
+[`peer-linux.MUSL-COPYRIGHT`](scripts/runkit-contract/peer-linux.MUSL-COPYRIGHT)
+for its copyright and license notices.

package/README.md

@@ -136,7 +136,7 @@ separate authority boundaries.
 
 ## Install
 
-This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.0`
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.25.2`
 artifact. Registry adoption remains fail-closed until its exact official npm
 version, shasum, integrity, and tarball URL are independently verified. Local
 tarballs remain candidate-test inputs and are never adoption provenance. Until
@@ -144,7 +144,7 @@ that registry evidence exists, use the package only for isolated candidate
 verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.25.0
+npm install --save-exact owlrunkit@0.25.2
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -160,9 +160,9 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.0 --dry-run
+  --exact owlrunkit@0.25.2 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.25.0 --apply
+  --exact owlrunkit@0.25.2 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
 npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
@@ -997,9 +997,9 @@ continuation; fully idle Desktop wake requires a separate supported ingress.
 
 ## Managed local peer recovery
 
-On macOS, opt a new task into peer recovery before starting its writer. The
-project controller names the current agent, successor, and exact checkpoint
-paths in `peer.json`, for example:
+Opt a new task into peer recovery before starting its writer. The project
+controller names the current agent, successor, and exact checkpoint paths in
+`peer.json`, for example:
 
 ```json
 {"owner":"alpha","successor":"bravo","paths":["result.txt"]}
@@ -1009,18 +1009,21 @@ paths in `peer.json`, for example:
 npx --no-install owlrunkit peer create --workspace . --task repair --request peer.json
 npx --no-install owlrunkit peer run --workspace . --task repair --agent alpha --generation 1 -- /absolute/worker
 npx --no-install owlrunkit peer inspect --workspace . --task repair
-npx --no-install owlrunkit peer recover --workspace . --task repair --agent bravo --generation 1 --revision 2
+npx --no-install owlrunkit peer recover --workspace . --task repair --agent bravo --generation 1 --revision 2 -- /absolute/successor-worker
 ```
 
-Run the last two commands from the cooperating agent while it is investigating
-an interruption. Use the actual generation and revision returned by `inspect`.
+The cooperating agent uses the last two commands when it observes an
+interruption and has authority to run the successor worker. Use the generation
+and revision returned by `inspect`.
 Recovery requests a wake from the current worker. A matching, changed checkpoint
 keeps that worker in charge. If wake remains unconfirmed after the bounded wait,
 recovery can move ownership to the designated successor because the current
 attempt already runs in an isolated directory. One durable revision binds the
-successor generation to the last accepted checkpoint. The successor explicitly
-runs its own worker using that generation. An ACK or timeout is not a proof of
-worker death. Retry the same observed revision to read back a race or recovery.
+successor generation to the last accepted checkpoint. With a worker command
+after `--`, recovery starts that worker after takeover and reports its result.
+A concurrent retry may report the already-started attempt. Without a command,
+the successor starts its own worker with `peer run`. An ACK or timeout does
+not prove worker death. Retry the observed revision to read back the handoff.
 
 Use a local worker that speaks newline-delimited JSON. RunKit seeds the attempt
 directory from the previous checkpoint and sets `OWLRUNKIT_PEER_PATHS` to the
@@ -1035,14 +1038,25 @@ go to stderr. `inspect` returns the checkpoint path and hash for handoff and
 review. Only accepted checkpoints seed the next attempt, and the previous
 scratch directory is reported for inspection while it remains on disk.
 
-The macOS backend confines each worker's writes to its own attempt and denies
-network and additional processes. The host caller explicitly authorizes the
-worker command, and supplies the peer identity. This is a supported boundary
-for contained workers and their checkpoints. An unmanaged file lease, a raw
-shared-directory writer, or an existing Desktop session needs its own recovery
-procedure. Legacy lease records and `control.lock` are untouched. The result
-is task evidence for the existing acceptance process. Canonical source
-integration remains a separate authorized step.
+The macOS and Linux backends confine writes to the attempt and deny network
+connections and new worker processes. Linux supports x86-64 and ARM64 with
+seccomp filtering and `close_range`. RunKit tries Landlock ABI 3 or later
+first. If Landlock is unavailable, it can use a trusted system Bubblewrap
+executable with user and mount namespaces. The Bubblewrap probe verifies
+that the attempt is writable, host files are hidden, and new processes and
+network sockets are denied. If the probe fails, the task stays blocked.
+On Linux, the worker is terminated if its supervisor is killed. The host
+caller supplies the worker command and peer identity. Existing Desktop sessions and writers using
+legacy shared-directory leases follow their own recovery procedure. An
+existing managed task remains pinned to the core that created it.
+
+Linux control transactions use a kernel lock and a marker in the runtime
+directory. If the process exits during an atomic lease operation, the next
+transaction reads the lease state from the committed artifact. For other
+transactions, automatic recovery requires unchanged control state. A partial
+transaction returns `runkit_control_reconciliation_required` and preserves its
+state. An older `control.lock` directory has no kernel ownership record and
+requires the existing explicit recovery procedure.
 
 ## Shared Skill upgrades
 

package/SOURCE.md

@@ -1,8 +1,12 @@
 # Source
 
 OwlRunKit is maintained in the private OwlCoda source repository. The npm
-tarball contains the complete JavaScript source for the published runtime and
-read-only verifier; it does not contain generated minified binaries.
+tarball contains the JavaScript runtime, the read-only verifier and the C
+source for the two Linux helper binaries. The distributed binaries link musl
+statically and include its copyright notice. Build the helper on each supported
+Linux architecture with `sh packages/runkit/build-linux-helper.sh <output>`
+in Alpine Linux with `build-base` and `linux-headers`, then pass their output directory to
+`packages/runkit/build-package.mjs --linux-helpers`.
 
 The authoritative release is identified by the npm registry version, shasum,
 integrity, and tarball URL. Local directories, `file:` dependencies, local

package/docs/architecture/OWLCODA_RUNKIT_USAGE_MODE_SELECTION_PRODUCT_DECISION_20260811.md

@@ -6,7 +6,7 @@
 ## 已验证现场事实
 
 以下结论来自对
-`/Users/yeemio/AI/project/sieracMes-AI/.owlcoda/runkit/` 的只读检查，
+一个真实 MES 项目的 `.owlcoda/runkit/` 只读检查，
 不是体验推测：
 
 - W1.6 留下四份 Quick Receipt V1。按回执生成时的 `exitResult` 与

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,14 +7,14 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled registry-gated artifact: standalone `owlrunkit@0.25.0`, bundling Contract
-`0.2` and Core `0.25.0` with manifest
-`sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e`.
+Bundled registry-gated artifact: standalone `owlrunkit@0.25.2`, bundling Contract
+`0.2` and Core `0.25.2` with manifest
+`sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc`.
 Registry adoption remains fail-closed until exact official npm registry
-provenance for `owlrunkit@0.25.0` is independently verified. The
-published rollback baseline for this artifact is `owlrunkit@0.24.1`, with SHA-1
-`b70b857c128f67d19d401acaa096a6cf9f1f348e` and canonical npm tarball URL
-`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.24.1.tgz`.
+provenance for `owlrunkit@0.25.2` is independently verified. The
+published rollback baseline for this artifact is `owlrunkit@0.25.1`, with SHA-1
+`755bdcef5f6df55977ee64d2d4391d1098c00168` and canonical npm tarball URL
+`https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
@@ -25,10 +25,12 @@ For a task already enrolled in `owlrunkit peer` with an isolated worker, inspect
 the task when your cooperating agent stops progressing. As the designated
 successor, run `peer recover` with the observed generation and revision. A
 new checkpoint tied to the wake challenge keeps the original agent active.
-When recovery grants a successor generation, explicitly run the authorized
-worker in that generation and resume from its seeded checkpoint. Treat an ACK
-without progress as unconfirmed. Keep legacy shared-workspace leases on the
-manual recovery path. Use the package README and `peer --help` for setup.
+Append `-- /absolute/worker` when you already have authority to run the
+successor worker. The command only launches it if ownership transfers and
+seeds it from the last accepted checkpoint. Read the returned attempt status
+before treating the work as finished. Treat an ACK without progress as
+unconfirmed. Keep legacy shared-workspace leases on the manual recovery path.
+Use the package README and `peer --help` for setup.
 
 ## Optional file-event continuation
 
@@ -368,9 +370,9 @@ below has no CLI entry.
 
 ```bash
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.0 --dry-run
+  --exact owlrunkit@0.25.2 --dry-run
 npx --no-install owlrunkit bootstrap --workspace "$PROJECT_ROOT" \
-  --exact owlrunkit@0.25.0 --apply
+  --exact owlrunkit@0.25.2 --apply
 npx --no-install owlrunkit init --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --workspace "$PROJECT_ROOT"
 npx --no-install owlrunkit inspect --json --compact --workspace "$PROJECT_ROOT"

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.25.0",
-    "coreManifestSha256": "sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e",
-    "coreSourceRef": "artifact:sha256:20e75c386f1408f11e908a6d3ee1a39316d9728d5719fa06f8d6a5aa45abd83e"
+    "coreVersion": "0.25.2",
+    "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+    "coreSourceRef": "artifact:sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -42,6 +42,16 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.2",
+      "coreManifestSha256": "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.25.1",
+      "coreManifestSha256": "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.25.0",

package/packages/attest/src/quick.mjs

@@ -23,6 +23,16 @@ import {
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.2",
+    coreManifestSha256: "sha256:da816d343597b91c30e4f96c0a3d765bf5c00d6013d6bee430f58bc701399acc",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.25.1",
+    coreManifestSha256: "sha256:0934a076b147847a4623bc89263b677c88088b493495fc74f11485985b7903b5",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.25.0",

package/registry-release-policy-v2.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV2",
   "status": "release_artifact_registry_gated",
   "packageName": "owlrunkit",
-  "artifactVersion": "0.25.0",
+  "artifactVersion": "0.25.2",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "rollbackRelease": {
     "packageName": "owlrunkit",
-    "version": "0.24.1",
-    "shasum": "b70b857c128f67d19d401acaa096a6cf9f1f348e",
-    "integrity": "sha512-8Fr5XTAbtRlxyYboDSB8C257sxSWWiAFqGU6yexF99NXgilJ3pbxtMwq4FcbrlHN5V6yJLME04vTceI2s9F4bA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.24.1.tgz"
+    "version": "0.25.1",
+    "shasum": "755bdcef5f6df55977ee64d2d4391d1098c00168",
+    "integrity": "sha512-+s+PHZXemJIgBo8ScT65+OngqniojRFMxpoUOTjp/Xkq/szB8FqEUOH1BFlokMz6dx64FSOKb30rDPZWC2lS4w==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.25.1.tgz"
   },
   "registryEvidenceMustBeExternal": true,
   "registryEvidenceSchemaVersion": "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.25.0",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.0",
+  "name": "owlrunkit-0.25.2",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.25.2",
   "creationInfo": {
     "created": "2026-11-11T00:00:00Z",
     "creators": [
@@ -14,7 +14,7 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.25.0",
+      "versionInfo": "0.25.2",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.25.0"
+          "referenceLocator": "pkg:npm/owlrunkit@0.25.2"
         }
       ]
     }

package/scripts/runkit-contract/control-transaction-lock.mjs

@@ -0,0 +1,108 @@
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync,
+  readFileSync, readdirSync, rmdirSync, unlinkSync, writeFileSync,
+} from "node:fs";
+import path from "node:path";
+
+import { linuxRuntimeHelper } from "./linux-runtime.mjs";
+
+const LOCK = "control.lock";
+const GUARD = "control.lock.guard";
+const TEMP_PREFIX = ".control-lock-";
+const SCHEMA = "OwlRunKitControlLockV1";
+const ACTIVE = "Another RunKit control transaction is already active.";
+
+function fileIdentity(stat) {
+  return `${stat.dev}:${stat.ino}`;
+}
+
+function controlStateDigest(root) {
+  const hash = createHash("sha256");
+  function visit(directory, prefix) {
+    for (const name of readdirSync(directory).sort()) {
+      if (!prefix && (name === LOCK || name === GUARD || name === "peer-recovery"
+        || name.startsWith(TEMP_PREFIX))) continue;
+      const absolute = path.join(directory, name);
+      const relative = `${prefix}${name}`;
+      const stat = lstatSync(absolute, { bigint: true });
+      hash.update(JSON.stringify([
+        relative, fileIdentity(stat), String(stat.mode), String(stat.size),
+        String(stat.mtimeNs), String(stat.ctimeNs),
+      ]) + "\n");
+      if (stat.isDirectory()) visit(absolute, `${relative}/`);
+    }
+  }
+  visit(root, "");
+  return hash.digest("hex");
+}
+
+function recoverInterruptedLock(root, lockPath, guard) {
+  let stat;
+  try { stat = lstatSync(lockPath); }
+  catch (error) { if (error.code === "ENOENT") return; throw error; }
+  // Releases without an ownership record still use a directory at this
+  // path. Its presence alone cannot establish who owns it or if it is stale.
+  if (!stat.isFile() || stat.size > 1024) throw new Error(ACTIVE);
+  const fd = openSync(lockPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  let previous;
+  try { previous = JSON.parse(readFileSync(fd, "utf8")); }
+  finally { closeSync(fd); }
+  if (previous?.schemaVersion !== SCHEMA || previous.guard !== guard
+    || !["atomic-lease", "control-state"].includes(previous.kind)) throw new Error(ACTIVE);
+  if (previous.kind === "control-state" && previous.before !== controlStateDigest(root)) {
+    throw new Error("runkit_control_reconciliation_required: interrupted transaction changed control state.");
+  }
+  unlinkSync(lockPath);
+}
+
+function acquireLinuxLock(root, lockPath, helper, kind) {
+  const guardPath = path.join(root, GUARD);
+  const fd = openSync(guardPath,
+    constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+  try {
+    const guardStat = fstatSync(fd, { bigint: true });
+    if (!guardStat.isFile() || guardStat.nlink !== 1n) throw new Error("Invalid RunKit control lock guard.");
+    const result = spawnSync(helper, ["lock"], {
+      env: {}, timeout: 3000, stdio: ["ignore", "ignore", "pipe", fd], encoding: "utf8",
+    });
+    if (result.status === 73) throw new Error(ACTIVE);
+    if (result.status !== 0) {
+      throw new Error(`RunKit control lock unavailable: ${result.stderr?.trim() || result.error?.code}`);
+    }
+    // The helper locks the open description shared with this process. Keep
+    // the descriptor open until the transaction ends or the kernel reaps it.
+    const guard = fileIdentity(guardStat);
+    if (fileIdentity(lstatSync(guardPath, { bigint: true })) !== guard) {
+      throw new Error("RunKit control lock guard was replaced.");
+    }
+    recoverInterruptedLock(root, lockPath, guard);
+    const record = { schemaVersion: SCHEMA, guard, kind,
+      before: kind === "control-state" ? controlStateDigest(root) : null };
+    const scratch = path.join(root, `${TEMP_PREFIX}${randomUUID()}`);
+    const marker = openSync(scratch, "wx", 0o600);
+    try {
+      writeFileSync(marker, JSON.stringify(record));
+      fsyncSync(marker);
+      try { linkSync(scratch, lockPath); }
+      catch (error) { if (error.code === "EEXIST") throw new Error(ACTIVE); throw error; }
+    } finally { closeSync(marker); unlinkSync(scratch); }
+    return () => {
+      try { unlinkSync(lockPath); }
+      finally { closeSync(fd); }
+    };
+  } catch (error) {
+    closeSync(fd);
+    throw error;
+  }
+}
+
+export function acquireRunKitControlLock(root, { atomicLease = false } = {}) {
+  const lockPath = path.join(root, LOCK);
+  const helper = linuxRuntimeHelper();
+  if (helper) return acquireLinuxLock(root, lockPath, helper, atomicLease ? "atomic-lease" : "control-state");
+  try { mkdirSync(lockPath); }
+  catch (error) { if (error.code === "EEXIST") throw new Error(ACTIVE); throw error; }
+  return () => rmdirSync(lockPath);
+}

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.25.0";
+export const CORE_VERSION = "0.25.2";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -23,6 +23,7 @@ const CORE_FILES = [
   "core-successor.mjs",
   "coverage-adoption.mjs",
   "core-contract.mjs",
+  "control-transaction-lock.mjs",
   "delivery-create.mjs",
   "delivery-selection.mjs",
   "deployment-workflow.mjs",
@@ -40,8 +41,11 @@ const CORE_FILES = [
   "install-codex-skill.mjs",
   "lease-lifecycle.mjs",
   "lifecycle-orchestration.mjs",
+  "linux-runtime.mjs",
   "offline-store.mjs",
   "outcome-presentation.mjs",
+  "peer-linux-bwrap.mjs",
+  "peer-linux.c",
   "peer-recovery.mjs",
   "onboarding-doctor.mjs",
   "onboarding-bootstrap.mjs",