patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/recipes/yamlRunner.js

@@ -31,8 +31,10 @@ import { fileURLToPath } from "node:url";
 import { parse as parseYaml } from "yaml";
 import { captureFixture } from "../connectors/fixtureRecorder.js";
 import { sanitizeEnv } from "../drivers/claude/envSanitizer.js";
+import { isLoopbackOrPrivateEndpoint } from "../localEndpointGuard.js";
 import { loadConfig as loadPatchworkConfigSync } from "../patchworkConfig.js";
 import { findYamlRecipePath } from "../recipesHttp.js";
+import { classifyTool } from "../riskTier.js";
 /**
  * Local alias for `sanitizeParsedJson` from `src/sanitizeParsedJson.ts`.
  * Kept under the old name so the existing callsites in this file don't
@@ -42,14 +44,18 @@ import { findYamlRecipePath } from "../recipesHttp.js";
  */
 import { sanitizeParsedJson as sanitizeParsed } from "../sanitizeParsedJson.js";
 import { ensureCmdShim } from "../winShim.js";
+import { mergeAgentDisallowedTools } from "../workers/workerGate.js";
 import { executeAgent as _executeAgent, } from "./agentExecutor.js";
 import { categoriseHaltReason } from "./haltCategory.js";
 import { assertValidManualRunId, deriveScopeKey, WriteEffectLedger, } from "./idempotencyKey.js";
 import { buildJudgeArtefactBlock, JUDGE_PROMPT_SUFFIX, parseJudgeVerdict, } from "./judgeVerdict.js";
 import { defaultDeprecationWarn, normalizeRecipeForRuntime, } from "./migrations/index.js";
+import { costRouter } from "./pricing/costRouter.js";
+import { loadPriceTable, costUsd as priceCostUsd, } from "./pricing/priceTable.js";
 import { resolveRecipePath } from "./resolveRecipePath.js";
 import { RunBudget } from "./runBudget.js";
-import { detectSilentFail } from "./stepObservation.js";
+import { registerRun, unregisterRun } from "./runRegistry.js";
+import { detectSilentFail, redactSecretsForPrompt } from "./stepObservation.js";
 // Import tool registry and trigger tool self-registration
 import { applyToolOutputContext, executeTool, getTool, hasTool, registerPluginTools, } from "./toolRegistry.js";
 import { resolveWorkspaceRoot } from "./workspaceRoot.js";
@@ -134,6 +140,13 @@ export function evaluateExpect(result, expect) {
  * without schema assertions don't pay the import/compile cost.
  */
 let _stepExpectAjv;
+// Process-scoped probe cache for `claude --version`. Avoids spawning the .cmd
+// shim (300–700 ms on Windows) on every recipe step when no claudeFn is
+// configured. Exported for tests that need to reset between cases.
+let _claudeCliProbeCache;
+export function resetProbeCliCache() {
+    _claudeCliProbeCache = undefined;
+}
 async function getStepExpectAjv() {
     if (!_stepExpectAjv) {
         const { createAjv2020 } = await import("../ajv2020.js");
@@ -314,6 +327,14 @@ export async function loadRecipeServers(specs) {
         debug: (_msg) => { },
     };
     for (const spec of toLoad) {
+        // Mark the spec as loaded OPTIMISTICALLY before the async load so two
+        // concurrent recipe runs sharing a `servers:` spec don't both pass the
+        // `filter` dedup above and double-register the same plugin tools (the
+        // registry does not guard re-registration). On failure we remove it so a
+        // later run can retry.
+        if (loadedPluginSpecs.has(spec))
+            continue;
+        loadedPluginSpecs.add(spec);
         try {
             const loaded = await loadPluginsFull([spec], minimalConfig, minimalLogger);
             let toolCount = 0;
@@ -325,39 +346,172 @@ export async function loadRecipeServers(specs) {
                 }));
                 toolCount += registerPluginTools(pluginTools);
             }
-            loadedPluginSpecs.add(spec);
             if (toolCount > 0) {
                 console.info(`[recipe servers] loaded "${spec}" — ${toolCount} tool(s) registered`);
             }
         }
         catch (err) {
+            loadedPluginSpecs.delete(spec);
             console.warn(`[recipe servers] failed to load "${spec}": ${err instanceof Error ? err.message : String(err)}`);
         }
     }
 }
+/**
+ * P1 cost/token corpus — drivers that incur real, metered, per-token API
+ * billing (the only ones whose spend is real money and thus priceable here).
+ * Mirrors `BILLABLE_DRIVERS` in runBudget.ts (kept local — that set is private
+ * and runBudget.ts is enforcement-critical / must not be modified for P1).
+ * `local` reports usage but costs no real money, so it is NOT billable.
+ */
+const COST_BILLABLE_DRIVERS = new Set([
+    "anthropic",
+    "openai",
+    "grok",
+    "gemini",
+    "gemini-api",
+]);
+function newStepUsageAccumulator() {
+    return { inputTokens: 0, outputTokens: 0, measured: false };
+}
+/**
+ * Fold one agent call's usage into a per-step accumulator. Adds tokens when
+ * `usage` is present; adds USD only when the served model is billable AND
+ * present in the price table (NEVER a `0` placeholder for the unpriced case).
+ */
+function accumulateAgentUsage(acc, usage, servedBy, priceTable) {
+    if (!usage)
+        return;
+    acc.measured = true;
+    acc.inputTokens += usage.inputTokens;
+    acc.outputTokens += usage.outputTokens;
+    const driver = servedBy?.driver;
+    const model = servedBy?.model;
+    if (driver && model && COST_BILLABLE_DRIVERS.has(driver)) {
+        const cost = priceCostUsd(model, usage, priceTable);
+        if (typeof cost === "number") {
+            acc.costUsd = (acc.costUsd ?? 0) + cost;
+        }
+    }
+}
+/**
+ * Build the optional token fields for a step result from its accumulator.
+ * Returns an empty object (no fields) when the step reported no usage, so a
+ * tool step or unmeasured-driver step round-trips with the fields ABSENT.
+ */
+function stepUsageFields(acc) {
+    if (!acc.measured)
+        return {};
+    return {
+        inputTokens: acc.inputTokens,
+        outputTokens: acc.outputTokens,
+        ...(typeof acc.costUsd === "number" ? { costUsd: acc.costUsd } : {}),
+    };
+}
+/**
+ * P1 — single-call usage → persisted-step usage fields. Exported for the
+ * chained runner, whose agent steps make exactly one agent call (no
+ * judge→refine loop), so a per-call computation suffices. Returns undefined
+ * when the driver reported no usage (fields stay ABSENT). `costUsd` set only
+ * for a billable driver + priced model; never a `0` placeholder.
+ */
+export function computeAgentCallUsage(usage, servedBy, priceTable = loadPriceTable()) {
+    if (!usage)
+        return undefined;
+    const driver = servedBy?.driver;
+    const model = servedBy?.model;
+    let cost;
+    if (driver && model && COST_BILLABLE_DRIVERS.has(driver)) {
+        const c = priceCostUsd(model, usage, priceTable);
+        if (typeof c === "number")
+            cost = c;
+    }
+    return {
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+        ...(typeof cost === "number" ? { costUsd: cost } : {}),
+    };
+}
+function newRunUsageAccumulator() {
+    return { inputTokens: 0, outputTokens: 0, measured: false };
+}
+function foldStepIntoRun(run, step) {
+    if (!step.measured)
+        return;
+    run.measured = true;
+    run.inputTokens += step.inputTokens;
+    run.outputTokens += step.outputTokens;
+    if (typeof step.costUsd === "number") {
+        run.costUsd = (run.costUsd ?? 0) + step.costUsd;
+    }
+}
+/** Build the optional `tokenTotals` for a run, or undefined when none measured. */
+function runTokenTotals(run) {
+    if (!run.measured)
+        return undefined;
+    return {
+        inputTokens: run.inputTokens,
+        outputTokens: run.outputTokens,
+        ...(typeof run.costUsd === "number" ? { costUsd: run.costUsd } : {}),
+    };
+}
+/**
+ * Extract ONLY the env vars a recipe explicitly declares via a
+ * `context: [{ type: "env", keys: [...] }]` block. Both the flat runner AND the
+ * chained/replay paths MUST use this so undeclared process-level secrets never
+ * reach `{{env.X}}` template expressions.
+ *
+ * Audit 2026-06-08 (recipe-support-3): the chained dispatch and replay paths
+ * previously spread the entire `process.env` into the template context, silently
+ * diverging from the flat runner's allowlist and exposing every process secret
+ * (API keys, OAuth/connector tokens, TLS material) to any chained recipe author.
+ */
+export function declaredRecipeEnv(recipe, processEnv = process.env) {
+    const out = {};
+    const blocks = recipe?.context;
+    if (!Array.isArray(blocks))
+        return out;
+    for (const block of blocks) {
+        const b = block;
+        if (b.type === "env" && Array.isArray(b.keys)) {
+            for (const key of b.keys) {
+                if (typeof key !== "string")
+                    continue;
+                const v = processEnv[key];
+                if (v !== undefined)
+                    out[key] = v;
+            }
+        }
+    }
+    return out;
+}
 export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
     if (recipe.servers?.length) {
         await loadRecipeServers(recipe.servers);
     }
     const now = deps.now ? deps.now() : new Date();
-    // Resolve recipe-level context blocks (type: env) into seed context
-    const envCtx = {};
-    if (Array.isArray(recipe.context)) {
-        for (const block of recipe
-            .context ?? []) {
-            const b = block;
-            if (b.type === "env" && Array.isArray(b.keys)) {
-                for (const key of b.keys) {
-                    const v = process.env[key];
-                    if (v !== undefined)
-                        envCtx[key] = v;
-                }
-            }
-        }
-    }
+    // Resolve recipe-level context blocks (type: env) into seed context via the
+    // shared declared-keys allowlist (also used by the chained/replay paths).
+    const envCtx = declaredRecipeEnv(recipe);
+    // SECRETS-IN-VARS: track which ctx keys came from a `type: env` block so the
+    // agent (LLM-facing) prompt can redact them. Their raw values still flow to
+    // TOOL steps (an http header / DB password legitimately needs the secret),
+    // but they must never reach the model verbatim — the secure default is
+    // redaction. See PR body / docs/recipe-feature-investigation-2026-06-05.md.
+    const secretKeys = new Set(Object.keys(envCtx));
+    const iso = now.toISOString();
     const ctx = {
-        date: now.toISOString().slice(0, 10),
+        date: iso.slice(0, 10),
         time: now.toTimeString().slice(0, 5),
+        // Built-in date/time tokens, injected (not phantom) so {{YYYY-MM-DD}} etc.
+        // render real values at run time AND pass template-ref lint. Keep in sync
+        // with builtinKeys in validation.ts. (audit 2026-06-10 recipe-validation-1)
+        YYYY: iso.slice(0, 4),
+        "YYYY-MM": iso.slice(0, 7),
+        "YYYY-MM-DD": iso.slice(0, 10),
+        ISO_NOW: iso,
+        HH: iso.slice(11, 13),
+        MM: iso.slice(14, 16),
+        SS: iso.slice(17, 19),
         ...envCtx,
         ...seedContext,
     };
@@ -470,10 +624,38 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
             // Non-fatal — run-log failures must never break recipe execution.
         }
     }
+    // Register this run so POST /runs/:seq/cancel can abort it (H11).
+    // Mirrors chainedRunner.ts:1277 — only the top-level run registers.
+    const runController = runSeq !== undefined ? registerRun(runSeq) : undefined;
+    // L1 (review #1028): the LIVE cancel handle is runController.signal (aborted
+    // by POST /runs/:seq/cancel); deps.signal is the external caller signal
+    // (absent on the production flat path). Combine both so a cancelled run aborts
+    // a pending approval wait instead of hanging the full TTL — forwarding only
+    // deps.signal left the flat path's L1 goal unmet. Mirrors the dual-signal
+    // next-step check below.
+    const effectiveRunSignal = runController?.signal && deps.signal
+        ? AbortSignal.any([runController.signal, deps.signal])
+        : (runController?.signal ?? deps.signal);
     const outputs = [];
     const stepResults = [];
+    // P1 cost/token corpus. The price table is loaded once per run (fail-open).
+    // `currentStepUsage` accumulates usage across all agent calls of the CURRENT
+    // agent step (including judge→refine re-runs via `runAgentText`); `runUsage`
+    // sums measured steps into the run-level total.
+    const priceTable = loadPriceTable();
+    const runUsage = newRunUsageAccumulator();
+    let currentStepUsage = newStepUsageAccumulator();
     let stepsRun = 0;
     let runError;
+    // Bug (2): the flat runner historically recorded the first non-optional
+    // failure in `runError` but kept executing later steps — diverging from
+    // chainedRunner, which aborts on a fatal failure. This flag is set ONLY
+    // when a failure is fatal (non-optional AND fail-open semantics do not
+    // apply via step.optional / on_error.fallback=log_only|deliver_original).
+    // The loop checks it at the top and breaks, matching chainedRunner's
+    // abort-on-failure contract. Fail-open failures never set it, so
+    // log_only/deliver_original/optional steps still let the run continue.
+    let haltAfterFailure = false;
     // Live-tail SSE broadcaster. Wrapped in a try/catch on every call so a
     // misbehaving listener can never break the run (mirrors chainedRunner).
     // No-ops when `activityLog` isn't wired (CLI runs, tests, mocks).
@@ -543,6 +725,245 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
             ts: Date.now(),
         });
     };
+    // ── OPT-IN judge → refine loop (helper closure) ──────────────────────────
+    //
+    // ⚠️ INVARIANT DEPARTURE — this drives a bounded revise→re-judge loop and
+    // MAY gate the run on exhaustion. It departs the augment-only invariant in
+    // judgeVerdict.ts, but is reachable ONLY when the judge step opts in via
+    // `agent.max_revisions > 0`. The augment-only PR3a path is untouched.
+    //
+    // `runAgentText` mirrors the main agent path's text processing exactly
+    // (strip leading narration, then JSON-fence parse + sanitize, else use the
+    // raw string) so a revised draft commits to ctx the same way a first-pass
+    // agent step would. It returns `{ value, ok }`; `ok: false` signals a
+    // failed / silent-fail / empty agent response — the caller stops the loop
+    // and treats it as exhausted (we don't re-judge a non-result).
+    const runAgentText = async (prompt, driver, model, mcpAccess, downshift, providerOptions, 
+    // P0-5: carry the reviewed/judge step's opt-in tool sandbox into refine-loop
+    // re-runs so a sandboxed step STAYS sandboxed across revisions/re-judges.
+    sandboxOpts) => {
+        // Phase 4: route revisions too, so a downshift on the reviewed step also
+        // applies to its refine-loop re-runs (no-op when downshift is absent).
+        const routed = resolveRouting({ driver, model }, downshift, prompt, runBudget);
+        const agentReturn = await _executeAgent({
+            prompt,
+            driver: routed.driver === "api" ? "anthropic" : routed.driver,
+            model: routed.model,
+            ...(mcpAccess !== undefined && { mcpAccess }),
+            ...(sandboxOpts?.sandbox !== undefined && {
+                sandbox: sandboxOpts.sandbox,
+            }),
+            ...(sandboxOpts?.tools !== undefined && {
+                allowedTools: sandboxOpts.tools,
+            }),
+            // Worker.autonomy: a sandboxed step STAYS sandboxed across re-runs AND
+            // inherits the worker's agent-step deny list (same merge as the primary
+            // agent branch), so refine-loop re-runs can't bypass the gate either.
+            ...(() => {
+                const merged = mergeAgentDisallowedTools(sandboxOpts?.disallowedTools, deps.agentDisallowedTools);
+                return merged !== undefined ? { disallowedTools: merged } : {};
+            })(),
+            // Fail closed if a worker sandbox can't be enforced on the chosen driver.
+            ...(deps.agentDisallowedTools?.length && { enforceSandbox: true }),
+            ...(providerOptions && { providerOptions }),
+        }, buildAgentExecutorDeps(stepDeps, deps));
+        runBudget.reconcile(
+        // Prefer the driver executeAgent actually resolved+ran; fall back to
+        // the routed value only when servedBy is absent (non-executeAgent
+        // callers). Stops auto-detected runs being mis-attributed to "auto".
+        agentReturn.servedBy?.driver ??
+            (routed.driver === "api" ? "anthropic" : (routed.driver ?? "auto")), agentReturn.usage, 
+        // Resolved model for USD pricing (Phase 3). Absent → unpriced → the USD
+        // cap fails open for this call.
+        agentReturn.servedBy?.model, 
+        // Char counts for the opt-in unmeasured-driver ≈$ estimate (warn-only).
+        { inputChars: prompt.length, outputChars: agentReturn.text.length });
+        // P1: fold this refine-loop agent call into the current step's usage.
+        accumulateAgentUsage(currentStepUsage, agentReturn.usage, agentReturn.servedBy, priceTable);
+        const text = agentReturn.text;
+        // Same failure detection as the main agent branch: explicit failure
+        // marker or silent-fail patterns ⇒ not a usable result.
+        if (text.startsWith("[agent step failed:") || detectSilentFail(text)) {
+            return { value: text, ok: false };
+        }
+        const stripped = stripLeadingNarration(text);
+        if (!stripped.trim()) {
+            return { value: stripped, ok: false };
+        }
+        try {
+            const jsonMatch = /```(?:json)?\s*([\s\S]*?)```/.exec(stripped) ?? [
+                null,
+                stripped,
+            ];
+            const parsed = sanitizeParsed(JSON.parse((jsonMatch[1] ?? "").trim()));
+            return { value: parsed, ok: true };
+        }
+        catch {
+            return { value: stripped, ok: true };
+        }
+    };
+    const runJudgeRefineLoop = async (params) => {
+        const { agentCfg, reviewsKey, maxRevisions, judgeStepId, firstVerdict, judgeStepResult, failOpenAgent, } = params;
+        // Find the agent step whose output the judge reviews. A judge that
+        // reviews a tool step or a seed var (no agent to re-run) cannot be
+        // refined — skip the loop gracefully, leaving the augment-only verdict
+        // already stashed on the judge step result untouched.
+        const reviewedStep = recipe.steps.find((s) => s.agent && (s.agent.into ?? "agent_output") === reviewsKey);
+        if (!reviewedStep?.agent) {
+            return { haltAfterFailure: false };
+        }
+        const reviewedAgent = reviewedStep.agent;
+        let currentVerdict = firstVerdict;
+        let revisions = 0;
+        while (revisions < maxRevisions &&
+            currentVerdict.verdict === "request_changes") {
+            // Budget gate: never exceed the run's token budget. If admission is
+            // refused, stop early (treat as exhausted) — the budget halt is
+            // surfaced by the next top-of-loop admission check for later steps.
+            const admission = runBudget.admit();
+            if (!admission.admitted) {
+                break;
+            }
+            // REVISE: re-run the reviewed agent with the prior draft + fixList.
+            const priorDraft = ctx[reviewsKey];
+            const fixList = currentVerdict.fixList ?? [];
+            const revisionBlock = `\n\n<revision-request>\n` +
+                `A reviewer requested changes to your previous draft. Address every` +
+                ` item, then return the full revised draft only.\n\n` +
+                `<previous-draft>\n${typeof priorDraft === "string" ? priorDraft : JSON.stringify(priorDraft, null, 2)}\n</previous-draft>\n\n` +
+                `<fix-list>\n${fixList.length > 0 ? fixList.map((f) => `- ${f}`).join("\n") : "- (no explicit fix list provided)"}\n</fix-list>\n` +
+                `</revision-request>`;
+            const revisionPrompt = render(reviewedAgent.prompt, redactSecretsForPrompt(ctx, secretKeys)) +
+                revisionBlock;
+            // Quality-aware escalation: on the Nth revision, re-run the reviewed step
+            // with the Nth more-capable candidate (`escalate[revisions]`) instead of
+            // the base model — local/cheap first, escalate to cloud only when the
+            // judge keeps rejecting. `revisions` is 0-based here (incremented after
+            // the re-judge below). When escalating we drop `downshift` for this call:
+            // escalation means "go stronger", so it must not be re-downshifted.
+            const escalateTo = reviewedAgent.escalate?.[revisions];
+            const revised = await runAgentText(revisionPrompt, escalateTo?.driver ?? reviewedAgent.driver, escalateTo?.model ?? reviewedAgent.model, reviewedAgent.mcpAccess, escalateTo ? undefined : reviewedAgent.downshift, undefined, 
+            // P0-5: the revision re-runs the REVIEWED step → keep its sandbox.
+            {
+                ...(reviewedAgent.sandbox !== undefined && {
+                    sandbox: reviewedAgent.sandbox,
+                }),
+                ...(reviewedAgent.tools !== undefined && {
+                    tools: reviewedAgent.tools,
+                }),
+                ...(reviewedAgent.disallowedTools !== undefined && {
+                    disallowedTools: reviewedAgent.disallowedTools,
+                }),
+            });
+            if (!revised.ok) {
+                // A failed / empty revision can't be re-judged — stop and treat the
+                // loop as exhausted with the last good verdict still in place.
+                break;
+            }
+            // R4 #1 (HIGH): stage the revised draft locally — do NOT commit to ctx
+            // yet. Committing before the verdict resolves leaves an UNAPPROVED draft
+            // in ctx on any loop break (unparseable verdict, budget denial, failed
+            // re-judge), so downstream steps treat it as approved. The revised value
+            // is only promoted to ctx once a verdict accepts it (approve, or
+            // exhaustion with on_exhausted: "proceed").
+            const pendingRevised = revised.value;
+            // Budget gate (post-revise, pre-re-judge): the revise call may have
+            // exhausted the token budget. Check again before firing the re-judge so
+            // we don't make one extra LLM call over budget — audit 2026-06-03 LOW #2.
+            const postReviseAdmission = runBudget.admit();
+            if (!postReviseAdmission.admitted) {
+                // Audit 2026-06-08 (recipe-flat-1): the revision was produced but the
+                // budget ran out before we could re-judge it. On on_exhausted:"proceed"
+                // the user opted to accept best-effort output, so promote the revision
+                // instead of silently discarding it and keeping the stale pre-revision
+                // draft. On "halt" the run errors below, so leave ctx untouched.
+                if ((agentCfg.on_exhausted ?? "halt") === "proceed") {
+                    ctx[reviewsKey] = pendingRevised;
+                }
+                break;
+            }
+            // RE-JUDGE: rebuild the judge prompt against the revised artefact. The
+            // judge reviews the STAGED draft, not ctx (which still holds the prior
+            // accepted value).
+            const reJudgePrompt = render(agentCfg.prompt, redactSecretsForPrompt(ctx, secretKeys)) +
+                buildJudgeArtefactBlock(pendingRevised) +
+                JUDGE_PROMPT_SUFFIX;
+            const judged = await runAgentText(reJudgePrompt, agentCfg.driver, agentCfg.model, agentCfg.mcpAccess, 
+            // M32: pass the judge step's downshift so cost-aware routing applies
+            // to re-judge calls in the refine loop, not just the initial judge.
+            agentCfg.downshift, 
+            // Re-judge is a judge call → enforce JSON on supporting drivers.
+            { responseFormat: { type: "json_object" } }, 
+            // P0-5: the re-judge re-runs the JUDGE step → keep its sandbox.
+            {
+                ...(agentCfg.sandbox !== undefined && { sandbox: agentCfg.sandbox }),
+                ...(agentCfg.tools !== undefined && { tools: agentCfg.tools }),
+                ...(agentCfg.disallowedTools !== undefined && {
+                    disallowedTools: agentCfg.disallowedTools,
+                }),
+            });
+            if (!judged.ok) {
+                // Audit 2026-06-03 (MEDIUM #17): a failed / silent-fail / empty
+                // RE-JUDGE can't yield a trustworthy verdict. Mirror the revise-
+                // failure break above: stop and KEEP the last good verdict. Parsing
+                // the failure/empty text would have produced a bogus verdict (usually
+                // "unparseable"), silently dropping the request_changes signal and
+                // skipping the on_exhausted gate — the run would proceed as if the
+                // (unvalidated) revised draft had been approved.
+                break;
+            }
+            const judgedText = typeof judged.value === "string"
+                ? judged.value
+                : JSON.stringify(judged.value);
+            currentVerdict = parseJudgeVerdict(stripLeadingNarration(judgedText));
+            revisions++;
+            // R4 #2 (HIGH): an UNPARSEABLE verdict exits the while-loop (only
+            // "request_changes" continues it), but the exhaustion gate below fires
+            // ONLY on "request_changes" — so an unparseable verdict would leave the
+            // run 'ok' with the unvalidated draft never committed and no error.
+            // Treat it as a hard, non-ok stop (distinct from the failed-re-judge
+            // break above, which keeps the prior good verdict). Do NOT promote the
+            // staged draft.
+            if (currentVerdict.verdict === "unparseable") {
+                const reason = `judge "${judgeStepId}" returned an unparseable verdict after revision`;
+                judgeStepResult.judgeVerdict = currentVerdict;
+                judgeStepResult.revisions = revisions;
+                judgeStepResult.status = "error";
+                judgeStepResult.error = reason;
+                judgeStepResult.haltReason = reason;
+                judgeStepResult.haltCategory = "judge_revisions_exhausted";
+                return {
+                    runError: reason,
+                    haltAfterFailure: !failOpenAgent,
+                };
+            }
+            // R4 #1: verdict accepted the revision (approve, or non-exhausted
+            // continuation). Promote the staged draft to ctx so downstream steps and
+            // the next iteration see the improved, judged value.
+            ctx[reviewsKey] = pendingRevised;
+        }
+        // Record the FINAL verdict + the revision count on the judge step result.
+        judgeStepResult.judgeVerdict = currentVerdict;
+        judgeStepResult.revisions = revisions;
+        // EXHAUSTION: still requesting changes after the loop.
+        if (currentVerdict.verdict === "request_changes") {
+            const onExhausted = agentCfg.on_exhausted ?? "halt";
+            if (onExhausted === "halt") {
+                const reason = `judge "${judgeStepId}" did not approve after ${maxRevisions} revisions`;
+                judgeStepResult.status = "error";
+                judgeStepResult.error = reason;
+                judgeStepResult.haltReason = reason;
+                judgeStepResult.haltCategory = "judge_revisions_exhausted";
+                return {
+                    runError: reason,
+                    // Respect fail-open like other agent failures.
+                    haltAfterFailure: !failOpenAgent,
+                };
+            }
+            // "proceed": leave status ok, keep the recorded (unapproved) verdict.
+        }
+        return { haltAfterFailure: false };
+    };
     // The step loop is wrapped so an uncaught throw from any unguarded
     // call site (a `when`/prompt render on a malformed step, a path-jail
     // re-check, etc.) cannot escape `runYamlRecipe` and strand the
@@ -551,6 +972,26 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
     // finalization path, which marks the run "error".
     try {
         for (const step of recipe.steps) {
+            // Bug (2): abort on a prior fatal failure. chainedRunner throws (and
+            // stops) when a non-optional step fails; the flat runner used to keep
+            // going. Break here so later steps don't run on top of a failed
+            // dependency. Fail-open failures (step.optional / on_error.fallback=
+            // log_only|deliver_original) never set `haltAfterFailure`, so they
+            // still let the run continue exactly as before.
+            if (haltAfterFailure)
+                break;
+            // Run-level cancel: abort when the registry controller fires (H11) OR
+            // when a caller-provided signal is aborted (#850 parity — external
+            // cancellation, e.g. POST /runs/:seq/cancel). An in-flight step is
+            // allowed to finish; the next step is not dispatched.
+            if (runController?.signal.aborted || deps.signal?.aborted) {
+                runError = runError ?? "recipe run cancelled";
+                break;
+            }
+            // Pick up a `~/.patchwork/prices.json` update mid-run for long-running
+            // recipes (honours the refreshPrices() contract). No-op unless a usdMax
+            // cap is set; never disturbs injected (unit-test) price tables.
+            runBudget.refreshPrices();
             const stepIdForEmit = step.into ?? step.agent?.into ?? `step_${stepsRun}`;
             const stepTs = Date.now();
             stepStartTs.set(stepIdForEmit, stepTs);
@@ -567,13 +1008,23 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
             // A falsy guard records the step as `skipped`, increments stepsRun, and
             // continues — it is NOT a failure. Bridge-dev iMessage recipes rely on
             // this to suppress the iMessage agent step when phone is empty.
-            if (typeof step.when === "string" && step.when.length > 0) {
-                const rendered = render(step.when, ctx).trim().toLowerCase();
-                const truthy = !!rendered &&
-                    rendered !== "0" &&
-                    rendered !== "false" &&
-                    rendered !== "null" &&
-                    rendered !== "undefined";
+            if (step.when === false ||
+                (typeof step.when === "string" && step.when.length > 0)) {
+                const rendered = step.when === false
+                    ? "false"
+                    : render(step.when, ctx).trim().toLowerCase();
+                // Falsy if the WHOLE value is a falsy token OR its LAST token is. The
+                // last-token check is what makes a `when` fed an agent's free-text
+                // decision gate correctly: a step like `decide_file` emits paragraphs of
+                // reasoning that END in "true"/"false" (into: should_file), and a bare
+                // "non-empty ⇒ truthy" check treated that prose as truthy and ran the
+                // guarded step even on a "false" verdict. Single-token guards (the common
+                // case — {{phone}}, {{repo}}, "0") are unchanged: last token === whole
+                // value. Trailing punctuation/backticks/quotes are stripped so `` `false`. ``
+                // still reads false.
+                const FALSY = new Set(["", "0", "false", "null", "undefined"]);
+                const lastToken = (rendered.split(/\s+/).pop() ?? "").replace(/[^a-z0-9]/g, "");
+                const truthy = !!rendered && !FALSY.has(rendered) && !FALSY.has(lastToken);
                 if (!truthy) {
                     const skipId = step.into ?? step.agent?.into ?? `step_${stepsRun}`;
                     stepResults.push({
@@ -596,6 +1047,80 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                     continue;
                 }
             }
+            // Bug (3): per-recipe token budget gates ALL step types, not just
+            // agent steps. The admission check used to live inside the
+            // `if (step.agent)` branch, so once the budget was breached the run
+            // kept executing tool steps unbounded. Gate here — after the `when:`
+            // guard resolves truthy, before the agent/tool split — so a breach
+            // halts the run regardless of the next step's kind. Subscription
+            // drivers report no usage and fail open inside RunBudget, so this is
+            // a no-op until a measured agent step actually breaches the cap.
+            const budgetAdmission = runBudget.admit();
+            if (!budgetAdmission.admitted) {
+                const reason = budgetAdmission.reason ??
+                    "Run exceeded its token budget — budget_exceeded.";
+                runError = runError ?? reason;
+                haltAfterFailure = true;
+                const budgetStepId = step.into ?? step.agent?.into ?? `step_${stepsRun}`;
+                stepResults.push({
+                    id: budgetStepId,
+                    tool: step.agent ? "agent" : step.tool,
+                    status: "error",
+                    error: reason,
+                    haltReason: reason,
+                    haltCategory: "budget_exceeded",
+                    durationMs: 0,
+                });
+                stepsRun++;
+                persistLiveStepResults();
+                emitStepDone(stepIdForEmit);
+                continue;
+            }
+            // M3 — flat-runner approval gate. Safe-by-default: engages for
+            // `manual`-triggered runs (cron/webhook/recipe runs never block
+            // mid-flight) and only when the bridge injected `requireApprovalFn`
+            // (i.e. approvalGate != "off"). Per-recipe opt-out via
+            // `requireApproval: false`. The injected fn applies the tier threshold
+            // itself and returns `true` for steps that don't need sign-off; a
+            // `false` result is an explicit human rejection → halt the run.
+            //
+            // worker.autonomy: when `gateAutomatedRuns` is set the gate ALSO engages
+            // on automated triggers (that's how workers run), and `requireApprovalFn`
+            // is the worker-aware fn — reversible actions pass, risky-unearned ones
+            // queue. Off → manual-only, byte-identical to pre-flip behaviour.
+            if (deps.requireApprovalFn &&
+                (recipeTriggerKind === "manual" || deps.gateAutomatedRuns) &&
+                recipe.requireApproval !== false) {
+                const approvalToolId = step.agent ? "agent" : (step.tool ?? "unknown");
+                const approved = await deps.requireApprovalFn({
+                    toolId: approvalToolId,
+                    tier: classifyTool(approvalToolId),
+                    summary: step.agent
+                        ? `agent step${step.agent.into ? ` → ${step.agent.into}` : ""}`
+                        : `tool ${approvalToolId}`,
+                    params: step.agent ? undefined : step,
+                    ...(effectiveRunSignal && { signal: effectiveRunSignal }), // L1
+                });
+                if (!approved) {
+                    const reason = `Step rejected by approval gate — approval_rejected.`;
+                    runError = runError ?? reason;
+                    haltAfterFailure = true;
+                    const rejId = step.into ?? step.agent?.into ?? `step_${stepsRun}`;
+                    stepResults.push({
+                        id: rejId,
+                        tool: step.agent ? "agent" : step.tool,
+                        status: "error",
+                        error: reason,
+                        haltReason: reason,
+                        haltCategory: "approval_rejected",
+                        durationMs: 0,
+                    });
+                    stepsRun++;
+                    persistLiveStepResults();
+                    emitStepDone(stepIdForEmit);
+                    continue;
+                }
+            }
             // Handle agent steps separately
             if (step.agent) {
                 const agentCfg = step.agent;
@@ -603,7 +1128,7 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 // PR3a: judge prompt convention. Append the structured-verdict
                 // suffix and, when `reviews: <stepId>` is set, inject the
                 // upstream step's output as an <artefact> block.
-                let renderedPrompt = render(agentCfg.prompt, ctx);
+                let renderedPrompt = render(agentCfg.prompt, redactSecretsForPrompt(ctx, secretKeys));
                 if (isJudge) {
                     if (agentCfg.reviews) {
                         renderedPrompt += buildJudgeArtefactBlock(ctx[agentCfg.reviews]);
@@ -613,44 +1138,81 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 const intoKey = agentCfg.into ?? "agent_output";
                 const stepId = intoKey;
                 const stepStart = Date.now();
+                // P1: fresh per-step usage accumulator for this agent step (and any
+                // judge→refine re-runs it spawns via runAgentText, which share it).
+                currentStepUsage = newStepUsageAccumulator();
                 let agentResult;
-                // PR2b: per-recipe token budget. Admission check before dispatch;
-                // reconcile actual consumption after. Subscription drivers
-                // (Claude CLI, provider subprocess) report `usage === undefined`
-                // — `RunBudget.reconcile` records a fail-open warning per driver
-                // per run and continues.
-                const admission = runBudget.admit();
-                if (!admission.admitted) {
-                    const reason = admission.reason ??
-                        "Run exceeded its token budget — budget_exceeded.";
-                    runError = runError ?? reason;
-                    stepResults.push({
-                        id: stepId,
-                        tool: "agent",
-                        status: "error",
-                        error: reason,
-                        haltReason: reason,
-                        haltCategory: "budget_exceeded",
-                        durationMs: 0,
-                    });
-                    stepsRun++;
-                    persistLiveStepResults();
-                    emitStepDone(stepIdForEmit);
-                    continue;
-                }
+                // Bug (2): fail-open semantics for THIS agent step. Mirrors the
+                // tool-branch `failOpen` (step.optional OR recipe-level
+                // on_error.fallback=log_only|deliver_original). Used to decide
+                // whether an agent failure is fatal (sets `haltAfterFailure`, which
+                // aborts the run at the next loop top) or fail-open (records the
+                // error but lets the run continue, as before).
+                const agentFallback = recipe.on_error?.fallback;
+                const agentFallbackFailOpen = agentFallback === "log_only" || agentFallback === "deliver_original";
+                const failOpenAgent = step.optional === true || agentFallbackFailOpen;
+                // PR2b: per-recipe token budget. Admission is now checked once at the
+                // top of the loop (Bug (3)) so it gates tool steps too; here we only
+                // reconcile actual consumption after the call. Subscription drivers
+                // (Claude CLI, provider subprocess) report `usage === undefined` —
+                // `RunBudget.reconcile` records a fail-open warning per driver per
+                // run and continues.
                 try {
+                    // Phase 4: opt-in cost-aware routing. No-op (returns preferred) when
+                    // the step has no `downshift` list or no USD cap is set.
+                    const routed = resolveRouting({ driver: agentCfg.driver, model: agentCfg.model }, agentCfg.downshift, renderedPrompt, runBudget);
+                    // Worker.autonomy: fold the worker's agent-step sandbox into this
+                    // step's own deny list so the subprocess can't bypass the gate.
+                    const agentDisallowed = mergeAgentDisallowedTools(agentCfg.disallowedTools, deps.agentDisallowedTools);
                     const agentReturn = await _executeAgent({
                         prompt: renderedPrompt,
-                        driver: agentCfg.driver === "api" ? "anthropic" : agentCfg.driver,
-                        model: agentCfg.model,
+                        driver: routed.driver === "api" ? "anthropic" : routed.driver,
+                        model: routed.model,
                         ...(agentCfg.mcpAccess !== undefined && {
                             mcpAccess: agentCfg.mcpAccess,
                         }),
+                        // P0-5 opt-in tool sandbox: thread sandbox + allow/deny lists onto
+                        // the executor input so the subprocess driver can enforce them via
+                        // --allowed-tools / --disallowed-tools / --permission-mode dontAsk.
+                        ...(agentCfg.sandbox !== undefined && {
+                            sandbox: agentCfg.sandbox,
+                        }),
+                        ...(agentCfg.tools !== undefined && {
+                            allowedTools: agentCfg.tools,
+                        }),
+                        ...(agentDisallowed !== undefined && {
+                            disallowedTools: agentDisallowed,
+                        }),
+                        // Worker sandbox is enforceable only on the subprocess driver;
+                        // fail closed on any other driver rather than run un-sandboxed.
+                        ...(deps.agentDisallowedTools?.length && {
+                            enforceSandbox: true,
+                        }),
+                        // Constrained decoding: enforce a pure-JSON verdict on judge steps
+                        // (OpenAI-compatible drivers honor it; others ignore it). Pairs
+                        // with the pure-JSON JUDGE_PROMPT_SUFFIX + tolerant parser.
+                        ...(isJudge && {
+                            providerOptions: { responseFormat: { type: "json_object" } },
+                        }),
                     }, buildAgentExecutorDeps(stepDeps, deps));
                     agentResult = agentReturn.text;
-                    runBudget.reconcile(agentCfg.driver === "api"
-                        ? "anthropic"
-                        : (agentCfg.driver ?? "auto"), agentReturn.usage);
+                    runBudget.reconcile(
+                    // Prefer the driver executeAgent actually resolved+ran; the routed
+                    // value is only the fallback for non-executeAgent callers (it is
+                    // often undefined → previously logged "auto").
+                    agentReturn.servedBy?.driver ??
+                        (routed.driver === "api"
+                            ? "anthropic"
+                            : (routed.driver ?? "auto")), agentReturn.usage, 
+                    // Resolved model for USD pricing (Phase 3); absent → fail open.
+                    agentReturn.servedBy?.model, 
+                    // Char counts for the opt-in unmeasured-driver ≈$ estimate.
+                    {
+                        inputChars: renderedPrompt.length,
+                        outputChars: agentReturn.text.length,
+                    });
+                    // P1: fold this primary agent call into the current step's usage.
+                    accumulateAgentUsage(currentStepUsage, agentReturn.usage, agentReturn.servedBy, priceTable);
                     // Catch both `[agent step failed: ...]` (existing) and the
                     // silent-fail patterns `[agent step skipped: ...]` etc. via the
                     // shared detector. Per-step opt-out via `silentFailDetection: false`.
@@ -663,6 +1225,8 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                             ? `silent-fail detected (${agentSilentFail.reason}): ${agentSilentFail.matched}`
                             : agentResult;
                         runError = runError ?? reason;
+                        if (!failOpenAgent)
+                            haltAfterFailure = true;
                         stepResults.push({
                             id: stepId,
                             tool: "agent",
@@ -680,6 +1244,8 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                         if (!stripped.trim()) {
                             const errMsg = `[agent step failed: ${agentCfg.driver ?? "agent"} returned only narration or whitespace — no content]`;
                             runError = runError ?? errMsg;
+                            if (!failOpenAgent)
+                                haltAfterFailure = true;
                             stepResults.push({
                                 id: stepId,
                                 tool: "agent",
@@ -695,12 +1261,15 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                             try {
                                 const jsonMatch = /```(?:json)?\s*([\s\S]*?)```/.exec(stripped) ?? [null, stripped];
                                 const parsed = sanitizeParsed(JSON.parse((jsonMatch[1] ?? "").trim()));
-                                ctx[intoKey] = parsed;
+                                if (!isJudge)
+                                    ctx[intoKey] = parsed;
                             }
                             catch {
-                                ctx[intoKey] = stripped;
+                                if (!isJudge)
+                                    ctx[intoKey] = stripped;
                             }
-                            outputs.push(intoKey);
+                            if (!isJudge)
+                                outputs.push(intoKey);
                             // PR3a: parse + stash the judge verdict on the step result.
                             // Augment-only: a `request_changes` verdict still yields
                             // `status: "ok"`. The verdict surfaces via the runlog +
@@ -708,13 +1277,43 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                             const judgeVerdict = isJudge
                                 ? parseJudgeVerdict(stripped)
                                 : undefined;
-                            stepResults.push({
+                            const judgeStepResult = {
                                 id: stepId,
                                 tool: "agent",
                                 status: "ok",
                                 ...(judgeVerdict !== undefined && { judgeVerdict }),
                                 durationMs: Date.now() - stepStart,
-                            });
+                            };
+                            stepResults.push(judgeStepResult);
+                            // ── OPT-IN judge → refine loop ───────────────────────────────
+                            // ⚠️ INVARIANT DEPARTURE: when the judge step opts in via
+                            // `max_revisions > 0`, a `request_changes` verdict now DRIVES a
+                            // bounded revise→re-judge loop instead of merely stashing the
+                            // verdict. This deliberately departs the augment-only invariant
+                            // (see judgeVerdict.ts) — but ONLY when the opt-in fields are
+                            // present. With them absent the block below is skipped entirely
+                            // and behavior is byte-identical to the PR3a augment-only path.
+                            if (isJudge &&
+                                agentCfg.reviews &&
+                                typeof agentCfg.max_revisions === "number" &&
+                                agentCfg.max_revisions > 0 &&
+                                judgeVerdict?.verdict === "request_changes") {
+                                const loopOutcome = await runJudgeRefineLoop({
+                                    agentCfg,
+                                    reviewsKey: agentCfg.reviews,
+                                    maxRevisions: agentCfg.max_revisions,
+                                    judgeStepId: stepId,
+                                    firstVerdict: judgeVerdict,
+                                    judgeStepResult,
+                                    failOpenAgent,
+                                });
+                                if (loopOutcome.runError !== undefined) {
+                                    runError = runError ?? loopOutcome.runError;
+                                }
+                                if (loopOutcome.haltAfterFailure) {
+                                    haltAfterFailure = true;
+                                }
+                            }
                             // Slice 2 — per-step expect eval. Runs on the value just
                             // committed to ctx[intoKey]. Halt failure flips the just-pushed
                             // result to error and rolls back the ctx commit so downstream
@@ -730,11 +1329,9 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                                             last.error = `expect_failed: ${failures.join("; ")}`;
                                             last.haltReason = `expect_failed in step "${stepId}": ${failures.join("; ")}`;
                                             last.haltCategory = "expect_failed";
-                                            const fbk = recipe.on_error?.fallback;
-                                            const fbkOpen = fbk === "log_only" || fbk === "deliver_original";
-                                            const failOpenAgent = step.optional === true || fbkOpen;
                                             if (!failOpenAgent) {
                                                 runError = runError ?? last.haltReason;
+                                                haltAfterFailure = true;
                                             }
                                             delete ctx[intoKey];
                                         }
@@ -750,6 +1347,8 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
                     runError = runError ?? `agent step "${stepId}" failed: ${msg}`;
+                    if (!failOpenAgent)
+                        haltAfterFailure = true;
                     stepResults.push({
                         id: stepId,
                         tool: "agent",
@@ -760,6 +1359,14 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                         durationMs: Date.now() - stepStart,
                     });
                 }
+                // P1: attach this agent step's summed token usage (across primary +
+                // any judge→refine re-runs) to the result just pushed, and fold it
+                // into the run-level total. Fields are ABSENT when no usage measured.
+                const pushedAgentResult = stepResults[stepResults.length - 1];
+                if (pushedAgentResult) {
+                    Object.assign(pushedAgentResult, stepUsageFields(currentStepUsage));
+                }
+                foldStepIntoRun(runUsage, currentStepUsage);
                 stepsRun++;
                 persistLiveStepResults();
                 emitStepDone(stepIdForEmit);
@@ -768,10 +1375,22 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
             const stepStart = Date.now();
             const stepId = step.into ?? `step_${stepsRun}`;
             // Resolve retry policy: step-level overrides recipe-level.
-            const retryCount = step.retry ?? recipe.on_error?.retry ?? 0;
+            // Clamp to 0 as a safety net against negative values slipping past
+            // schema validation (M31: negative retry loops 0 times, skipping step).
+            const retryCount = Math.max(0, step.retry ?? recipe.on_error?.retry ?? 0);
             const retryDelayMs = step.retryDelay ?? recipe.on_error?.retryDelay ?? 1000;
             let result = null;
             let stepError;
+            // Bug (2): distinguish a HARD tool error (a thrown error or a
+            // `{ok:false}` JSON envelope) from a SOFT silent-fail detection
+            // (`{count:0,error}` connector envelopes, string placeholders). Only
+            // hard failures abort the run; soft silent-fail detections keep the
+            // run going so connector health-check recipes can still deliver the
+            // degraded payload downstream (a long-standing, tested contract —
+            // see "linear.list_issues — returns error payload" tests). Silent-fail
+            // detection is an observability augment; it was never meant to gate
+            // delivery for these envelopes.
+            let stepErrorIsSilentFail = false;
             let thrownError;
             let thrownErrorCode;
             for (let attempt = 0; attempt <= retryCount; attempt++) {
@@ -779,6 +1398,7 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                     await new Promise((r) => setTimeout(r, retryDelayMs));
                 }
                 stepError = undefined;
+                stepErrorIsSilentFail = false;
                 thrownError = undefined;
                 thrownErrorCode = undefined;
                 try {
@@ -835,6 +1455,7 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                         const detected = detectSilentFail(result);
                         if (detected) {
                             stepError = `silent-fail detected (${detected.reason}): ${detected.matched}`;
+                            stepErrorIsSilentFail = true;
                         }
                     }
                 }
@@ -850,6 +1471,21 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 }
                 if (!stepError && !thrownError)
                     break;
+                // Audit 2026-06-10 recipe-runners-2: do NOT retry on a step_timeout.
+                // The timed-out attempt's underlying tool call keeps running in the
+                // background (Promise.race only abandons the wait, it does not cancel
+                // the call). Re-issuing the step here is, at best, pointless — for a
+                // write tool the in-flight idempotency ledger short-circuits the retry
+                // to the SAME promise (no second side effect, but also no progress) —
+                // and, at worst, a second side effect for any tool the ledger cannot
+                // dedup (non-write tools, or a write tool whose first attempt already
+                // committed its effect then threw). A true cancel needs an AbortSignal
+                // threaded through every tool/connector call, which is out of scope
+                // here; until then, refusing to retry on timeout is the safe contract.
+                // (Genuine transient failures — non-timeout throws / {ok:false} — still
+                // retry below.)
+                if (thrownError?.startsWith("step_timeout:"))
+                    break;
             }
             // Recipe-level fallback: log_only / deliver_original treat step failure
             // as non-fatal (fail-open) — same semantics as step-level optional: true.
@@ -872,6 +1508,7 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 });
                 if (!failOpen) {
                     runError = runError ?? `${step.tool} failed: ${thrownError}`;
+                    haltAfterFailure = true;
                 }
                 else if (fallbackFailOpen && !step.optional) {
                     console.warn(`step ${stepId} failed but on_error.fallback=${fallback} — treating as non-fatal: ${thrownError}`);
@@ -880,6 +1517,24 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
             else {
                 const finalStatus = result === null ? "skipped" : stepError ? "error" : "ok";
                 const retryNote = retryCount > 0 ? ` after ${retryCount + 1} attempts` : "";
+                // Outcome attribution: capture the filed-issue URL on github.create_issue
+                // steps so trust-replay can look up the issue's eventual disposition in
+                // the outcome store (confirmed/junk/unknown). Targeted to this one tool
+                // only — storing all tool outputs would bloat the run log unnecessarily.
+                let stepOutput;
+                if (finalStatus === "ok" &&
+                    result !== null &&
+                    step.tool === "github.create_issue") {
+                    try {
+                        const parsed = JSON.parse(result);
+                        if (typeof parsed.url === "string") {
+                            stepOutput = { url: parsed.url, issueNumber: parsed.issueNumber };
+                        }
+                    }
+                    catch {
+                        /* non-JSON or missing url — skip output capture */
+                    }
+                }
                 stepResults.push({
                     id: stepId,
                     tool: step.tool,
@@ -891,11 +1546,17 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                             haltCategory: "tool_error",
                         }
                         : {}),
+                    ...(stepOutput !== undefined ? { output: stepOutput } : {}),
                     durationMs: Date.now() - stepStart,
                 });
                 if (stepError) {
                     if (!failOpen) {
                         runError = runError ?? `${step.tool} failed: ${stepError}`;
+                        // Soft silent-fail detections (connector error envelopes) record
+                        // the error but must NOT abort the run — see the
+                        // `stepErrorIsSilentFail` note above. Hard `{ok:false}` errors do.
+                        if (!stepErrorIsSilentFail)
+                            haltAfterFailure = true;
                     }
                     else if (fallbackFailOpen && !step.optional) {
                         console.warn(`step ${stepId} failed but on_error.fallback=${fallback} — treating as non-fatal: ${stepError}`);
@@ -932,6 +1593,7 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                                 last.haltCategory = "expect_failed";
                                 if (!failOpen) {
                                     runError = runError ?? last.haltReason;
+                                    haltAfterFailure = true;
                                 }
                                 result = null;
                             }
@@ -967,6 +1629,13 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
         const msg = err instanceof Error ? err.message : String(err);
         runError = runError ?? `recipe run aborted: ${msg}`;
     }
+    finally {
+        // Drop the run from the registry (success, failure, or cancel) so
+        // the seq can't be cancelled post-hoc and the map doesn't leak (H11).
+        if (runController !== undefined && runSeq !== undefined) {
+            unregisterRun(runSeq);
+        }
+    }
     // Evaluate expect block before persisting so failures are stored in the
     // run log. Guarded: a throw here must not skip finalization and strand
     // the run at "running".
@@ -998,8 +1667,21 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                 ...(s.haltReason ? { haltReason: s.haltReason } : {}),
                 ...(s.haltCategory ? { haltCategory: s.haltCategory } : {}),
                 ...(s.judgeVerdict ? { judgeVerdict: s.judgeVerdict } : {}),
+                // P1: carry per-step token usage through to the persisted run row.
+                // Absent for tool / unmeasured-driver steps (round-trips unchanged).
+                ...(typeof s.inputTokens === "number"
+                    ? { inputTokens: s.inputTokens }
+                    : {}),
+                ...(typeof s.outputTokens === "number"
+                    ? { outputTokens: s.outputTokens }
+                    : {}),
+                ...(typeof s.costUsd === "number" ? { costUsd: s.costUsd } : {}),
                 durationMs: s.durationMs,
             }));
+            // P1: run-level token aggregate + budget totals (latter only when a
+            // budget was configured — never persist all-zero no-budget totals).
+            const tokenTotals = runTokenTotals(runUsage);
+            const budgetTotals = recipe.budget ? runBudget.totals() : undefined;
             if (deps.runLog && runSeq !== undefined) {
                 deps.runLog.completeRun(runSeq, {
                     status: runError ? "error" : "done",
@@ -1010,6 +1692,11 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                     ...(runError !== undefined && { errorMessage: runError }),
                     ...(assertionFailures.length > 0 ? { assertionFailures } : {}),
                     ...(inboxOutputs.length > 0 ? { inboxOutputs } : {}),
+                    ...(runBudget.finalWarnings().length > 0
+                        ? { budgetWarnings: runBudget.finalWarnings() }
+                        : {}),
+                    ...(tokenTotals ? { tokenTotals } : {}),
+                    ...(budgetTotals ? { budgetTotals } : {}),
                 });
                 emit("recipe_done", {
                     runSeq,
@@ -1047,6 +1734,8 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
                     stepResults: finalStepResults,
                     ...(assertionFailures.length > 0 ? { assertionFailures } : {}),
                     ...(inboxOutputs.length > 0 ? { inboxOutputs } : {}),
+                    ...(tokenTotals ? { tokenTotals } : {}),
+                    ...(budgetTotals ? { budgetTotals } : {}),
                 });
             }
         }
@@ -1093,6 +1782,14 @@ export async function runYamlRecipe(recipe, deps = {}, seedContext = {}) {
         stepResults,
         errorMessage: runError,
         ...(assertionFailures.length > 0 ? { assertionFailures } : {}),
+        ...(runBudget.finalWarnings().length > 0
+            ? { budgetWarnings: runBudget.finalWarnings() }
+            : {}),
+        // P1: forward run-level token aggregate to callers / persisters.
+        ...(() => {
+            const tt = runTokenTotals(runUsage);
+            return tt ? { tokenTotals: tt } : {};
+        })(),
     };
 }
 export async function executeStep(step, ctx, deps) {
@@ -1296,6 +1993,18 @@ export function defaultGitStaleBranches(days, workdir) {
         return "(git branches unavailable)";
     }
 }
+/**
+ * True when running under the vitest harness (same VITEST / NODE_ENV signal
+ * `src/recipes/migrations/index.ts` guards on). Used only to DEFAULT `testMode` on so a
+ * bare `runYamlRecipe(...)` in a unit test never appends a synthetic row to the
+ * operator's real `~/.patchwork/runs.jsonl` — which is also the de-facto
+ * worker-trust store and rotates at 1 MB / 10k lines, so test rows would evict
+ * real trust evidence and pollute every operator halt surface. An explicit
+ * `deps.testMode` (true or false) always wins over this default.
+ */
+function isVitestEnv() {
+    return process.env.VITEST != null || process.env.NODE_ENV === "test";
+}
 /** Resolve all RunnerDeps to concrete StepDeps with production defaults filled in. */
 function resolveStepDeps(deps, scope) {
     const workdir = deps.workdir ?? process.cwd();
@@ -1354,7 +2063,8 @@ function resolveStepDeps(deps, scope) {
                 return getValidAccessToken();
             }),
         logDir: deps.logDir,
-        testMode: deps.testMode ?? false,
+        activityLog: deps.activityLog,
+        testMode: deps.testMode ?? isVitestEnv(),
         // PR5a/b: per-attempt idempotency ledger. Disk-backed when
         // `ledgerDir` + `manualRunId` + recipe name are all available so a
         // retry of the same logical attempt re-uses prior records (resume
@@ -1383,12 +2093,19 @@ function buildAgentExecutorDeps(stepDeps, runnerDeps, claudeCodeFnOverride) {
     const claudeCliFn = claudeCodeFnOverride ?? stepDeps.claudeCodeFn;
     return {
         anthropicFn: async (prompt, model) => toAgentResult(await stepDeps.claudeFn(prompt, model)),
-        providerDriverFn: async (driver, prompt, model) => toAgentResult(await stepDeps.providerDriverFn(driver, prompt, model)),
+        providerDriverFn: async (driver, prompt, model, providerOptions) => toAgentResult(
+        // Keep the 3-arg call shape when unconstrained (backward-compatible
+        // with deps.providerDriverFn mocks that assert exact arity).
+        providerOptions
+            ? await stepDeps.providerDriverFn(driver, prompt, model, providerOptions)
+            : await stepDeps.providerDriverFn(driver, prompt, model)),
         claudeCliFn: async (prompt, opts) => toAgentResult(await claudeCliFn(prompt, opts)),
         localFn: async (prompt, model) => toAgentResult(await stepDeps.localFn(prompt, model)),
         probeClaudeCli: () => {
             if (runnerDeps.claudeFn !== undefined)
                 return false;
+            if (_claudeCliProbeCache !== undefined)
+                return _claudeCliProbeCache.result;
             // Use the same resolution as defaultClaudeCodeFn so the auto-detect
             // branch in agentExecutor.ts doesn't probe "claude" via PATH and
             // then later fail to spawn the configured override (or vice versa).
@@ -1396,7 +2113,8 @@ function buildAgentExecutorDeps(stepDeps, runnerDeps, claudeCodeFnOverride) {
                 encoding: "utf-8",
                 timeout: 5000,
             });
-            return !probe.error;
+            _claudeCliProbeCache = { result: !probe.error };
+            return _claudeCliProbeCache.result;
         },
         loadPatchworkConfig: () => {
             // Synchronous static import — earlier `require()` form silently failed
@@ -1454,19 +2172,35 @@ export function defaultClaudeCodeFn(prompt, opts) {
     if (opts?.mcpAccess === true) {
         return Promise.resolve("[agent step failed: recipe_mcp_unsupported — defaultClaudeCodeFn does not support mcpAccess:true; route via SubprocessDriver or unset the mcpAccess flag on this step]");
     }
+    // P0-5 opt-in tool sandbox on the `recipe run --local` / non-bridge path.
+    // Without this the sandbox would be silently ignored here (a one-path gap);
+    // mirror the SubprocessDriver argv rule (§3): filter argv-injection values,
+    // run in --permission-mode dontAsk + --allowed-tools when sandbox is active,
+    // and always apply --disallowed-tools regardless of mode.
+    const sandboxAllowed = (Array.isArray(opts?.allowedTools) ? opts.allowedTools : []).filter((t) => typeof t === "string" && t.length > 0 && !t.startsWith("-"));
+    const sandboxDenied = (Array.isArray(opts?.disallowedTools) ? opts.disallowedTools : []).filter((t) => typeof t === "string" && t.length > 0 && !t.startsWith("-"));
+    const localArgs = [
+        "-p",
+        prompt,
+        // --strict-mcp-config: never load ~/.claude.json or .mcp.json. Recipes
+        // are sandboxed by default (mcpAccess defaults to false above). This
+        // also prevents accidental session attachment when the parent process
+        // had a bridge MCP entry in ~/.claude.json.
+        "--strict-mcp-config",
+        "--system-prompt",
+        "You are a helpful assistant processing a recipe task. Use ONLY the data explicitly provided in the user message — treat it as ground truth. Do not call tools to look up git history, emails, or any other information; all necessary data is already included.",
+        "--no-session-persistence",
+    ];
+    if (opts?.sandbox === true && sandboxAllowed.length > 0) {
+        localArgs.push("--permission-mode", "dontAsk");
+        localArgs.push("--allowed-tools", ...sandboxAllowed);
+    }
+    // Deny rules apply in ANY mode.
+    if (sandboxDenied.length > 0) {
+        localArgs.push("--disallowed-tools", ...sandboxDenied);
+    }
     try {
-        const result = spawnSync(binary, [
-            "-p",
-            prompt,
-            // --strict-mcp-config: never load ~/.claude.json or .mcp.json. Recipes
-            // are sandboxed by default (mcpAccess defaults to false above). This
-            // also prevents accidental session attachment when the parent process
-            // had a bridge MCP entry in ~/.claude.json.
-            "--strict-mcp-config",
-            "--system-prompt",
-            "You are a helpful assistant processing a recipe task. Use ONLY the data explicitly provided in the user message — treat it as ground truth. Do not call tools to look up git history, emails, or any other information; all necessary data is already included.",
-            "--no-session-persistence",
-        ], {
+        const result = spawnSync(binary, localArgs, {
             cwd: workspace.path,
             // sanitizeEnv strips CLAUDECODE / CLAUDE_CODE_* / MCP_* from the
             // child so the spawn doesn't re-authenticate as, or nest under,
@@ -1493,10 +2227,74 @@ export function defaultClaudeCodeFn(prompt, opts) {
         return Promise.resolve(`[agent step failed: ${err instanceof Error ? err.message : String(err)}]`);
     }
 }
+/**
+ * Map a driver's `providerMeta` to AgentUsage. Returns undefined unless BOTH
+ * token counts are present as numbers — a half-populated count would mislead
+ * RunBudget. Pure + exported for tests.
+ */
+export function providerMetaToUsage(meta) {
+    if (!meta)
+        return undefined;
+    const inputTokens = meta.inputTokens;
+    const outputTokens = meta.outputTokens;
+    if (typeof inputTokens === "number" && typeof outputTokens === "number") {
+        // Reject NaN/Infinity/negative counts: a negative count would price to a
+        // negative cost and silently *reduce* usdSpent, defeating the usdMax cap.
+        if (!Number.isFinite(inputTokens) ||
+            inputTokens < 0 ||
+            !Number.isFinite(outputTokens) ||
+            outputTokens < 0) {
+            return undefined;
+        }
+        return { inputTokens, outputTokens };
+    }
+    return undefined;
+}
+const ROUTER_CHARS_PER_TOKEN = 4;
+/**
+ * Empirical output:input token ratio used for pre-dispatch cost estimates.
+ * LLMs typically produce far fewer output tokens than they consume on input for
+ * most agentic tasks (completion, classification, summarisation). The old 1:1
+ * assumption made models appear 2–5× more expensive than reality, causing
+ * unnecessary downshifts to cheaper models.
+ *
+ * 0.3 is a deliberately-conservative upper bound (real ratios are often 0.1–0.2
+ * for short-form steps). Using a higher-than-typical value avoids under-estimating
+ * cost and over-spending, while still being far more accurate than 1:1.
+ *
+ * The real cost is always reconciled after the call (see the cost-routing ADR),
+ * so this estimate only affects routing decisions, never final billing.
+ */
+const ROUTER_OUTPUT_RATIO = 0.3;
+/**
+ * Apply opt-in cost-aware routing (Phase 4) to choose the driver/model for an
+ * agent dispatch. Returns `preferred` UNCHANGED when there is no downshift list
+ * or no USD cap is set (byte-identical to no routing). The output-token figure
+ * uses a 0.3:1 output:input estimate (conservative upper bound; the 1:1 default
+ * doubled apparent cost and caused unnecessary model downshifts — audit
+ * 2026-06-03 LOW #7). The real cost is reconciled after the call.
+ * Exported for unit testing.
+ */
+export function resolveRouting(preferred, downshift, promptText, budget) {
+    if (!downshift || downshift.length === 0)
+        return preferred;
+    const remainingUsd = budget.remainingUsd();
+    if (remainingUsd === undefined)
+        return preferred; // no USD cap → no routing
+    const estInputTokens = Math.ceil(promptText.length / ROUTER_CHARS_PER_TOKEN);
+    // Fix (audit 2026-06-03 LOW #7): use a realistic 0.3:1 output:input ratio
+    // instead of 1:1. LLMs produce far fewer output tokens than input for most
+    // tasks; 0.3 is a conservative upper bound that avoids under-estimating cost.
+    const estOutputTokens = Math.ceil(estInputTokens * ROUTER_OUTPUT_RATIO);
+    return costRouter(preferred, downshift, {
+        remainingUsd,
+        quote: (driver, model) => budget.quoteUsd(driver, model, estInputTokens, estOutputTokens),
+    });
+}
 /** Returns a providerDriverFn with a per-run driver cache (not shared across runs). */
-function makeProviderDriverFn() {
+export function makeProviderDriverFn() {
     const cache = new Map();
-    return async function defaultProviderDriverFn(driverName, prompt, model) {
+    return async function defaultProviderDriverFn(driverName, prompt, model, providerOptions) {
         try {
             let driver = cache.get(driverName);
             if (!driver) {
@@ -1520,14 +2318,45 @@ function makeProviderDriverFn() {
                     startupTimeoutMs,
                     signal: controller.signal,
                     model,
+                    ...(providerOptions && { providerOptions }),
                 });
                 if (result.exitCode !== undefined && result.exitCode !== 0) {
                     const detail = result.stderrTail ?? result.text ?? "";
                     return `[agent step failed: ${driverName} exited ${result.exitCode}${detail ? ` — ${detail.slice(0, 200)}` : ""}]`;
                 }
+                // API drivers (OpenAI / Grok) never set exitCode. On failure they
+                // resolve with `{ text: "", wasAborted?/errorMessage }` — surface the
+                // real cause (timeout / 401 / 429) instead of the generic
+                // "empty output" branch below, which swallows the actual reason.
+                if (result.wasAborted) {
+                    return `[agent step failed: ${driverName} timed out or was cancelled]`;
+                }
+                if (result.errorMessage) {
+                    return `[agent step failed: ${driverName} — ${result.errorMessage.slice(0, 200)}]`;
+                }
                 if (!result.text) {
                     return `[agent step failed: ${driverName} returned empty output (possible timeout or auth error)]`;
                 }
+                // Forward token usage (when the driver reported it) so RunBudget can
+                // enforce a real budget for openai/grok/gemini instead of failing
+                // open. No usage → bare string, normalised to {text} downstream.
+                const usage = providerMetaToUsage(result.providerMeta);
+                // Carry the model the driver ACTUALLY resolved+billed (providerMeta.
+                // model, e.g. openai's "gpt-4o" default when the step omitted model) so
+                // RunBudget prices the real model. executeAgent's stamp() is idempotent
+                // — it preserves this servedBy rather than re-deriving from raw input.
+                const resolvedModel = typeof result.providerMeta?.model === "string"
+                    ? result.providerMeta.model
+                    : undefined;
+                if (usage || resolvedModel) {
+                    return {
+                        text: result.text,
+                        ...(usage ? { usage } : {}),
+                        ...(resolvedModel
+                            ? { servedBy: { driver: driverName, model: resolvedModel } }
+                            : {}),
+                    };
+                }
                 return result.text;
             }
             finally {
@@ -1539,13 +2368,30 @@ function makeProviderDriverFn() {
         }
     };
 }
-async function defaultClaudeFn(prompt, model) {
+/** Default Anthropic API request timeout. Mirrors the provider path (300s). */
+const DEFAULT_CLAUDE_API_TIMEOUT_MS = 300_000;
+/**
+ * R4 #4 (HIGH): default max output tokens. The old hard-coded 1024 silently
+ * truncated structured JSON (judge verdicts, multi-field agent outputs).
+ */
+const DEFAULT_CLAUDE_MAX_TOKENS = 4096;
+export async function defaultClaudeFn(prompt, model, opts) {
     const apiKey = process.env.ANTHROPIC_API_KEY;
     if (!apiKey)
         return { text: "[agent step skipped: ANTHROPIC_API_KEY not set]" };
+    const maxTokens = typeof opts?.maxTokens === "number" && opts.maxTokens > 0
+        ? opts.maxTokens
+        : DEFAULT_CLAUDE_MAX_TOKENS;
+    // R4 #3 (HIGH): abort a stalled gateway instead of hanging the run forever.
+    const timeoutMs = typeof opts?.timeoutMs === "number" && opts.timeoutMs > 0
+        ? opts.timeoutMs
+        : DEFAULT_CLAUDE_API_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
         const res = await fetch("https://api.anthropic.com/v1/messages", {
             method: "POST",
+            signal: controller.signal,
             headers: {
                 "x-api-key": apiKey,
                 "anthropic-version": "2023-06-01",
@@ -1553,7 +2399,7 @@ async function defaultClaudeFn(prompt, model) {
             },
             body: JSON.stringify({
                 model,
-                max_tokens: 1024,
+                max_tokens: maxTokens,
                 messages: [
                     {
                         role: "user",
@@ -1571,25 +2417,57 @@ async function defaultClaudeFn(prompt, model) {
         // versions) and downstream (subscription/CLI driver returns
         // undefined here).
         const data = (await res.json());
-        const text = data.content?.[0]?.text ?? "[agent step failed: empty response]";
+        let text = data.content?.[0]?.text ?? "[agent step failed: empty response]";
+        // R4 #4: detect+warn when the response was cut off at the token cap so a
+        // truncated (likely unparseable) JSON payload isn't silently trusted.
+        if (data.stop_reason === "max_tokens") {
+            text = `[warning: response truncated at max_tokens=${maxTokens}; raise max_tokens]\n${text}`;
+        }
         const inputTokens = data.usage?.input_tokens;
         const outputTokens = data.usage?.output_tokens;
-        if (typeof inputTokens === "number" && typeof outputTokens === "number") {
+        if (typeof inputTokens === "number" &&
+            typeof outputTokens === "number" &&
+            Number.isFinite(inputTokens) &&
+            inputTokens >= 0 &&
+            Number.isFinite(outputTokens) &&
+            outputTokens >= 0) {
             return { text, usage: { inputTokens, outputTokens } };
         }
         return { text };
     }
     catch (err) {
+        const aborted = controller.signal.aborted ||
+            (err instanceof Error && err.name === "AbortError");
+        if (aborted) {
+            return {
+                text: `[agent step failed: Anthropic API request timed out after ${timeoutMs}ms]`,
+            };
+        }
         return {
             text: `[agent step failed: ${err instanceof Error ? err.message : String(err)}]`,
         };
     }
+    finally {
+        clearTimeout(timeout);
+    }
 }
-async function defaultLocalFn(prompt, model) {
+export async function defaultLocalFn(prompt, model) {
     try {
         const { createLocalAdapter } = await import("../adapters/local.js");
         const { loadConfig: loadPatchworkConfig } = await import("../patchworkConfig.js");
         const cfg = loadPatchworkConfig();
+        // Anti-SSRF: the local adapter streams the prompt to `cfg.localEndpoint`
+        // (dashboard/config-controlled). A `driver: local` recipe must not be
+        // able to POST the prompt to an arbitrary public host. Mirror the
+        // LocalApiDriver gate (src/drivers/local/index.ts): reject any non
+        // loopback/private endpoint unless LOCAL_ENDPOINT_ALLOW_REMOTE=1.
+        if (cfg.localEndpoint &&
+            process.env.LOCAL_ENDPOINT_ALLOW_REMOTE !== "1" &&
+            !isLoopbackOrPrivateEndpoint(cfg.localEndpoint)) {
+            return {
+                text: "[agent step failed: localEndpoint is a public host; set LOCAL_ENDPOINT_ALLOW_REMOTE=1 to override]",
+            };
+        }
         const adapter = createLocalAdapter({
             endpoint: cfg.localEndpoint,
             defaultModel: cfg.localModel ?? model,
@@ -1665,17 +2543,38 @@ export function buildChainedDeps(runnerDeps, claudeCodeFnOverride) {
         const result = await executeStep(step, {}, stepDeps);
         return result ?? "";
     };
-    const executeAgent = async (prompt, model, driver, mcpAccess) => {
-        // chainedRunner's AgentExecutor contract still returns a plain string —
-        // PR2b's token-budget consumer will plug in here as well, but for now
-        // we discard `.usage`.
-        const result = await _executeAgent({
+    const executeAgent = async (prompt, model, driver, opts) => {
+        // Surface the FULL AgentResult (text + usage + servedBy) so the chained
+        // runner can reconcile real spend against the run budget — alignment with
+        // the flat path, which already reads `.usage`. (Previously this closure
+        // discarded everything but `.text`, leaving the chained path's budget
+        // unenforced — the S1 SECURITY finding.)
+        //
+        // P0-5 + parity fix: the prior 4th param was `mcpAccess?: boolean`, but the
+        // AgentExecutor type was 3-arg and the chained call site passed only 3 args
+        // → chained recipes silently dropped mcpAccess (and would have dropped the
+        // new sandbox fields too). Threading an opts object closes both gaps.
+        return _executeAgent({
             prompt,
             model,
-            driver,
-            ...(mcpAccess !== undefined && { mcpAccess }),
+            driver: driver === "api" ? "anthropic" : driver,
+            ...(opts?.mcpAccess !== undefined && { mcpAccess: opts.mcpAccess }),
+            ...(opts?.sandbox !== undefined && { sandbox: opts.sandbox }),
+            ...(opts?.allowedTools !== undefined && {
+                allowedTools: opts.allowedTools,
+            }),
+            // Worker.autonomy: single chokepoint for the CHAINED path — fold the
+            // worker's agent-step deny list into every chained agent call so the
+            // subprocess can't bypass the per-step gate (mirrors the flat branch).
+            ...(() => {
+                const merged = mergeAgentDisallowedTools(opts?.disallowedTools, runnerDeps.agentDisallowedTools);
+                return merged !== undefined ? { disallowedTools: merged } : {};
+            })(),
+            // Fail closed if a worker sandbox can't be enforced on the chosen driver.
+            ...(runnerDeps.agentDisallowedTools?.length && {
+                enforceSandbox: true,
+            }),
         }, buildAgentExecutorDeps(stepDeps, runnerDeps, claudeCodeFnOverride));
-        return result.text;
     };
     // ---------------------------------------------------------------------
     // BEGIN A-PR2 EDIT BLOCK — `loadNestedRecipe` jail (dogfood F-04).
@@ -1768,7 +2667,17 @@ export function buildChainedDeps(runnerDeps, claudeCodeFnOverride) {
         }
         return null;
     };
-    return { executeTool, executeAgent, loadNestedRecipe };
+    return {
+        executeTool,
+        executeAgent,
+        loadNestedRecipe,
+        // Tier-1 #4 (audit 2026-06-22): forward the approval gate into the chained
+        // path so it is no longer flat-only. Undefined when the bridge didn't
+        // inject one (approvalGate == "off") — the chained gate then no-ops.
+        ...(runnerDeps.requireApprovalFn && {
+            requireApprovalFn: runnerDeps.requireApprovalFn,
+        }),
+    };
 }
 /**
  * Dispatch a loaded recipe to the appropriate runner.
@@ -1787,10 +2696,21 @@ export async function dispatchRecipe(recipe, deps, seedContext = {}) {
         const chainedRecipe = recipe;
         const now = deps.now ? deps.now() : new Date();
         const options = {
+            // Audit 2026-06-08 (recipe-support-3): only the recipe's declared env
+            // keys reach the template context — NOT the full process.env. Parity with
+            // the flat runner; prevents undeclared-secret exposure via {{env.X}}.
             env: {
-                ...process.env,
+                ...declaredRecipeEnv(chainedRecipe),
                 DATE: now.toISOString().slice(0, 10),
                 TIME: now.toTimeString().slice(0, 5),
+                // Built-in date/time tokens (parity with the flat runner ctx + lint).
+                YYYY: now.toISOString().slice(0, 4),
+                "YYYY-MM": now.toISOString().slice(0, 7),
+                "YYYY-MM-DD": now.toISOString().slice(0, 10),
+                ISO_NOW: now.toISOString(),
+                HH: now.toISOString().slice(11, 13),
+                MM: now.toISOString().slice(14, 16),
+                SS: now.toISOString().slice(17, 19),
                 ...seedContext,
             },
             maxConcurrency: Math.max(1, chainedRecipe.maxConcurrency ?? 4),
@@ -1804,6 +2724,20 @@ export async function dispatchRecipe(recipe, deps, seedContext = {}) {
             activityLog: deps.chainedOptions?.activityLog,
             mockedOutputs: deps.chainedOptions?.mockedOutputs,
             taskIdPrefix: deps.chainedOptions?.taskIdPrefix,
+            // Parity (#850): forward the run-level budget, price table, and
+            // cancellation signal that the chained runner honours. Without these the
+            // chained path silently diverged from the flat path —
+            //   - `budget`     lets a caller inject a shared RunBudget (and is the
+            //                  hook the chained runner uses to enforce usdMax).
+            //   - `priceTable` reuses an already-loaded table instead of forcing the
+            //                  chained RunBudget to re-load it from disk.
+            //   - `signal`     wires AbortSignal-based cancellation into the run; a
+            //                  pre-aborted signal now prevents dispatch on the
+            //                  chained path too (parity target — flat cancellation
+            //                  is still a separate gap).
+            budget: deps.chainedOptions?.budget,
+            priceTable: deps.chainedOptions?.priceTable,
+            signal: deps.chainedOptions?.signal,
         };
         if (!deps.chainedDeps) {
             throw new Error("chainedDeps required for chained recipes (provide executeTool, executeAgent, loadNestedRecipe)");