pi-crew 0.11.49 → 0.11.51

package/src/runtime/verification/verify-gate.ts

@@ -54,6 +54,32 @@
  * no spec + no explicit checks ⇒ zero checks ⇒ INCONCLUSIVE ⇒ the LLM
  * verifier spawns — absence can never produce a skip.
  *
+ * WORKTREE GROUND TRUTH (W2 fix wave, 2026-10-29 — findings
+ * nonmanifest-ground-truth-self-grading + worktree-verifier-gate-excludes-work
+ * + index-tree-key-mismatch): the M1-7 binding pinned only the 8 manifest
+ * hashes, so a worker could tamper NON-manifest harness files (tracked-
+ * unstaged runners, node_modules shims) and have the pinned checks execute
+ * its stubs — grading its own work. Closures, layered:
+ *   - hostSpec now also pins a dispatch-time TRACKED-working-tree binding
+ *     (treeOid + cleanTree, captured host-side by resolveHostVerifyGateSpec).
+ *     At gate time the task cwd's tracked tree is re-derived and ANY divergence
+ *     — or an unmeasurable tree while a binding was pinned — fails the gate to
+ *     the LLM verifier spawn (never a skip) BEFORE any command runs, mirroring
+ *     the manifest bookend. The binding keys on TRACKED content only:
+ *     untracked files legitimately differ between the leader workspace and
+ *     fresh task worktrees (assertCleanLeader permits them; seeds are
+ *     selective), while the self-grading PoC's harness stubs were tracked-
+ *     unstaged and always move it.
+ *   - the memo key binds the FULL working tree + the workspace path and the
+ *     memo is disabled on any dirty tree (verify-gate-memo.ts) — a recorded
+ *     PASS can no longer be replayed for a different or merely re-dirtied
+ *     tree, nor across worktrees.
+ *   - a gate PASS never certifies work it cannot see: when the verified
+ *     dependency tasks carry uncommitted changes in their OWN worktrees
+ *     (worktree mode — the gate's pristine tree structurally excludes that
+ *     work), the skip is refused and the LLM verifier spawns with the guard
+ *     note (dependencyWorktreeProbes → reason "unverified_worktree_work").
+ *
  * SAFETY: a gate that cannot run (disabled by env, no checks resolved,
  * executor failure) degrades to "spawn the LLM verifier as today" — the
  * pre-gate can only SAVE a spawn on positive deterministic evidence, never
@@ -66,16 +92,18 @@
  *   - crew.verification.verifier_spawns_total{reason} — spawns that still
  *     happened, labeled by which layer let them through.
  */
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import { getCrewEnvBool, getCrewEnvInt } from "../../config/env-vars.ts";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
+import { assertWorktreePointerTrusted, buildGitSafeEnv, hardenGitArgs } from "../../worktree/git-hardening.ts";
 import type { VerifierPreGateResult } from "./classifier-pre-gate.ts";
 import { executeCommand } from "./verification-gates.ts";
 // Static edge is graph-free: verification-integrity.ts is already in the
 // index.bundle value-import graph (goal.ts/goal-wrap.ts/goal-loop-runner.ts
 // import it), so this adds no bundle-graph file (check-lazy-imports budget).
 import { compareSnapshot, snapshotManifests } from "./verification-integrity.ts";
-import { lookupVerifyGateMemo, recordVerifyGateMemo, resolveVerifyGateMemoEnabled } from "./verify-gate-memo.ts";
+import { captureWorkingTreeBinding, lookupVerifyGateMemo, recordVerifyGateMemo, resolveVerifyGateMemoEnabled } from "./verify-gate-memo.ts";
 
 /** One deterministic check to run. Mirrors the phase-gate shape
  *  (verification-gates.ts) but kept local so the tool schema can reuse it. */
@@ -132,6 +160,11 @@ export interface VerifyGateOutcome {
 	 *  the note is also appended to evidenceLines and switches the rendered
 	 *  context trailer to "results UNTRUSTED". */
 	integrityNote?: string;
+	/** W2 (2026-10-29): set when the tracked WORKING TREE diverged from the
+	 *  dispatch-pinned binding (or could not be proven equal) — like
+	 *  integrityNote it is appended to evidenceLines and switches the rendered
+	 *  context trailer to "results UNTRUSTED". */
+	worktreeIntegrityNote?: string;
 }
 
 /** Injected command executor. The TOOL path wraps ctx.executeTool("bash");
@@ -228,6 +261,18 @@ export function defaultVerifyGateChecks(dir: string): VerifyGateCheck[] {
 export interface VerifyGateHostSpec {
 	snapshot: Record<string, string>;
 	checks: VerifyGateCheck[];
+	/** W2 (2026-10-29, nonmanifest-ground-truth-self-grading): dispatch-time
+	 *  TRACKED-working-tree binding — the full tracked content (staged +
+	 *  unstaged) the host saw before any worker ran (temp-index
+	 *  read-tree HEAD → add -u → write-tree). Absent when it could not be
+	 *  computed (non-git cwd, git failure) — the gate then falls back to the
+	 *  manifest bookends alone (structural shape on run manifests predates
+	 *  this field; old pinned specs simply carry no binding). */
+	treeOid?: string;
+	/** W2: tracked-clean probe at dispatch (status --porcelain -uno empty).
+	 *  Fallback binding when no treeOid is available: a clean-at-dispatch tree
+	 *  that is dirty at gate time is drift. Absent when the probe failed. */
+	cleanTree?: boolean;
 }
 
 /** HOST-SIDE (dispatch) — build the verify spec for `cwd` (the project root
@@ -238,7 +283,17 @@ export function resolveHostVerifyGateSpec(cwd: string): VerifyGateHostSpec | und
 	const snapshot = snapshotManifests(cwd);
 	const checks = defaultVerifyGateChecks(cwd);
 	if (Object.keys(snapshot).length === 0 && checks.length === 0) return undefined;
-	return { snapshot, checks };
+	// W2: bind the TRACKED working tree AT DISPATCH (host process, pre-worker)
+	// so the gate can prove the task cwd still contains what the host pinned —
+	// non-manifest tracked files included. Unavailable measurements are omitted
+	// (never guessed): the gate then acts on the manifest bookends alone.
+	const binding = captureWorkingTreeBinding(cwd);
+	return {
+		snapshot,
+		checks,
+		...(binding.oid !== undefined ? { treeOid: binding.oid } : {}),
+		...(binding.clean !== undefined ? { cleanTree: binding.clean } : {}),
+	};
 }
 
 /** Gate-time integrity probe (M1-7): re-hash the manifests in `cwd` and diff
@@ -250,6 +305,38 @@ export function detectHostSpecDrift(cwd: string, spec: VerifyGateHostSpec): stri
 	return compareSnapshot(spec.snapshot, snapshotManifests(cwd));
 }
 
+/**
+ * Gate-time tree probe (W2, nonmanifest-ground-truth-self-grading): re-derive
+ * the tracked working tree of `cwd` and compare it against the dispatch
+ * binding. Returns a drift note when the gate cwd can NOT be proven
+ * bit-identical to the tree the host pinned — changed tracked content, or an
+ * unmeasurable tree while a binding was pinned (fail closed on missing
+ * evidence) — and undefined when no binding was pinned or equality holds.
+ * Untracked files are deliberately NOT part of the binding (they legitimately
+ * differ between workspaces; the memo separately refuses dirty trees).
+ */
+export function detectWorkingTreeDrift(cwd: string, spec: VerifyGateHostSpec): string | undefined {
+	const binding = captureWorkingTreeBinding(cwd);
+	if (spec.treeOid !== undefined) {
+		if (binding.oid === undefined) {
+			return "working-tree-integrity: the tracked working tree could not be measured (git unavailable or failed) — the dispatch-pinned tree cannot be proven intact";
+		}
+		if (binding.oid !== spec.treeOid) {
+			return "working-tree-integrity: tracked files changed since the host snapshot taken at dispatch (inspect with git status / git diff)";
+		}
+		return undefined;
+	}
+	if (spec.cleanTree === true) {
+		if (binding.clean === undefined) {
+			return "working-tree-integrity: the working tree could not be probed for changes (git unavailable or failed) — the dispatch-time clean state cannot be proven intact";
+		}
+		if (binding.clean === false) {
+			return "working-tree-integrity: tracked files are modified in the gate's workspace but the tree was clean at dispatch";
+		}
+	}
+	return undefined;
+}
+
 function tailOutput(output: string): string {
 	if (output.length <= OUTPUT_TAIL_MAX_CHARS) return output;
 	return `…${output.slice(-OUTPUT_TAIL_MAX_CHARS)}`;
@@ -554,11 +641,13 @@ export function renderVerifyGateContext(outcome: VerifyGateOutcome): string {
 	const executorDeath = outcome.checks.some((c) => !c.skipped && c.exitCode === null);
 	const trailer = outcome.integrityNote
 		? "Manifest integrity check FAILED: project manifest files changed since the host snapshot taken at dispatch. These gate results and any transcript claims about build/test state are UNTRUSTED — inspect what changed and re-run the verification commands yourself before concluding."
-		: executorDeath
-			? "A verification command could not run (executor error — exit=err). Treat the build/test state as UNKNOWN; run the build/tests yourself before concluding."
-			: outcome.determinismNote
-				? "The gate rerun detected NONDETERMINISM (a check passed once and failed on rerun). These gate results are NOT reliable — re-run the affected command yourself and treat the build/test state as UNKNOWN."
-				: "The deterministic gate already ran these commands — do NOT re-run them; verify the WORK (diff, files, acceptance), using these results as ground truth for build/test state.";
+		: outcome.worktreeIntegrityNote
+			? "Working-tree integrity check FAILED: tracked files in the gate's workspace changed since the host snapshot taken at dispatch (or the tree could not be proven identical to it). These gate results and any transcript claims about build/test state are UNTRUSTED — inspect what changed (git status / git diff) and re-run the verification commands yourself before concluding."
+			: executorDeath
+				? "A verification command could not run (executor error — exit=err). Treat the build/test state as UNKNOWN; run the build/tests yourself before concluding."
+				: outcome.determinismNote
+					? "The gate rerun detected NONDETERMINISM (a check passed once and failed on rerun). These gate results are NOT reliable — re-run the affected command yourself and treat the build/test state as UNKNOWN."
+					: "The deterministic gate already ran these commands — do NOT re-run them; verify the WORK (diff, files, acceptance), using these results as ground truth for build/test state.";
 	lines.push("", trailer);
 	return lines.join("\n");
 }
@@ -568,6 +657,81 @@ export function renderVerifyGateSummary(outcome: VerifyGateOutcome, reason: stri
 	return [`verify_gate: ${outcome.verdict} (skip reason: ${reason})`, ...outcome.evidenceLines].join("\n");
 }
 
+// ─── W2 finding worktree-verifier-gate-excludes-work: guard probes ──────────
+
+/** One probe per dependency task whose work the verifier is meant to certify.
+ *  `worktreePath` absent ⇒ shared-cwd workspace — that task's work lives IN
+ *  the gate's own cwd and needs no probe. */
+export interface VerifierGateWorkProbe {
+	taskId: string;
+	worktreePath?: string;
+}
+
+/** Dirty probe for a task worktree: TRUE when `git status --porcelain` is
+ *  non-empty (tracked modifications AND untracked files — an executor's
+ *  typical output is new untracked files; build outputs stay gitignored) or
+ *  when the probe FAILS (missing/corrupted worktree — fail closed:
+ *  unverifiable work must reach the LLM verifier, never a silent skip).
+ *  w9-n4 follow-up: routed through the MED-1 composition (hardenGitArgs +
+ *  buildGitSafeEnv + assertWorktreePointerTrusted) with the same deliberate
+ *  deviation as verify-gate-memo.ts — the pointer-trust assert sits INSIDE
+ *  the try so a corrupted worktree converts to dirty=true (fail closed)
+ *  instead of throwing into the gate flow. */
+export function worktreeHasUncommittedWork(worktreePath: string): boolean {
+	try {
+		assertWorktreePointerTrusted(worktreePath);
+		const st = execFileSync("git", hardenGitArgs(["status", "--porcelain"]), {
+			cwd: worktreePath,
+			env: buildGitSafeEnv("en_US.UTF-8"),
+			stdio: ["ignore", "pipe", "ignore"],
+			encoding: "utf-8",
+			timeout: 10_000,
+			windowsHide: true,
+		});
+		return st.trim().length > 0;
+	} catch {
+		return true;
+	}
+}
+
+/** Dependency task ids whose worktree carries uncommitted work that the
+ *  gate's evaluated tree does not contain. Probes without a worktree path are
+ *  skipped (shared-cwd work is inside the gate cwd itself). */
+export function findTasksWithWorktreeWork(probes: VerifierGateWorkProbe[]): string[] {
+	const dirty: string[] = [];
+	for (const probe of probes) {
+		if (!probe.worktreePath) continue;
+		if (worktreeHasUncommittedWork(probe.worktreePath)) dirty.push(probe.taskId);
+	}
+	return dirty;
+}
+
+/**
+ * W2 guard (worktree-verifier-gate-excludes-work): a gate PASS — fresh or
+ * memoized — may only suppress the LLM verifier when the checks evaluated the
+ * work under verification. In worktree mode the gate runs in the verifier's
+ * own pristine tree while the executor's changes live in a different
+ * worktree; a PASS there certifies the untouched base. When any probed
+ * dependency worktree carries uncommitted work, the skip is refused and the
+ * LLM verifier spawns with the guard evidence (reason
+ * "unverified_worktree_work"). Non-skip decisions pass through untouched.
+ */
+function resolveWorktreeGuardDecision(
+	probes: VerifierGateWorkProbe[] | undefined,
+	outcome: VerifyGateOutcome,
+): { outcome: VerifyGateOutcome; decision: VerifierSpawnDecision; forcedSpawn: boolean } {
+	const decision = resolveVerifierSpawnDecision(outcome);
+	if (!decision.skipVerifier || !probes || probes.length === 0) return { outcome, decision, forcedSpawn: false };
+	const dirtyDeps = findTasksWithWorktreeWork(probes);
+	if (dirtyDeps.length === 0) return { outcome, decision, forcedSpawn: false };
+	const note = `worktree-guard: dependency task(s) ${dirtyDeps.join(", ")} carry uncommitted changes in their worktrees — the gate evaluated a tree that does not contain that work; refusing the deterministic skip`;
+	return {
+		outcome: { ...outcome, evidenceLines: [...outcome.evidenceLines, note] },
+		decision: { skipVerifier: false, reason: "unverified_worktree_work", attachGateContext: true },
+		forcedSpawn: true,
+	};
+}
+
 export interface VerifierGatePreGateInput {
 	cwd: string;
 	/** Explicit checks take precedence over every other source (tool path /
@@ -599,6 +763,13 @@ export interface VerifierGatePreGateInput {
 	/** PHASE 4 (U13-ADJ): explicit layer-3 determinism toggle — env
 	 *  PI_CREW_VERIFY_DETERMINISM beats this; both default OFF. */
 	determinism?: boolean;
+	/** W2 (worktree-verifier-gate-excludes-work): one probe per dependency task
+	 *  whose work this verifier certifies (taskId + its worktree path). When any
+	 *  probed worktree carries uncommitted changes, a gate PASS — fresh OR
+	 *  memoized — refuses the skipVerifier decision (the gate evaluated a tree
+	 *  that structurally excludes that work) and the LLM verifier spawns with
+	 *  the guard note (reason "unverified_worktree_work"). */
+	dependencyWorktreeProbes?: VerifierGateWorkProbe[];
 }
 
 export interface VerifierGatePreGateResult {
@@ -656,6 +827,39 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 			return { outcome, decision, promptContext: renderVerifyGateContext(outcome) };
 		}
 	}
+	// ── W2 (nonmanifest-ground-truth-self-grading): tree binding BEFORE any
+	// command runs ────────────────────────────────────────────────────────
+	// The manifest bookends pin only the 8 manifest files, but the pinned
+	// checks execute whatever harness the WORKING TREE resolves (runners,
+	// shims, test files). When the host pinned a dispatch-time tree binding,
+	// any tracked divergence — or an unmeasurable tree — means the checks
+	// would execute content the host never pinned: the self-grading exploit.
+	// Fail the gate to the LLM verifier spawn (never a skip) before running
+	// anything, exactly like the manifest drift path above.
+	if (input.hostSpec) {
+		const treeDriftNote = detectWorkingTreeDrift(input.cwd, input.hostSpec);
+		if (treeDriftNote) {
+			const outcome: VerifyGateOutcome = {
+				verdict: "FAILED",
+				checks: [],
+				evidenceLines: [treeDriftNote],
+				allPassed: false,
+				totalDurationMs: 0,
+				worktreeIntegrityNote: treeDriftNote,
+			};
+			const decision = resolveVerifierSpawnDecision(outcome);
+			incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {
+				verdict: outcome.verdict,
+			});
+			incMetric(
+				input.metricRegistry,
+				"crew.verification.verifier_spawns_total",
+				"LLM verifier spawns that still ran, labeled by the deciding layer",
+				{ reason: decision.reason },
+			);
+			return { outcome, decision, promptContext: renderVerifyGateContext(outcome) };
+		}
+	}
 	// ── M1-7: NO package.json fallback ─────────────────────────────────────
 	// Checks come from the caller or the dispatch-pinned host spec ONLY —
 	// nothing here reads the worker-mutable task cwd. Zero resolvable checks
@@ -670,9 +874,12 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 	if (resolveVerifyGateMemoEnabled()) {
 		const memoHit = lookupVerifyGateMemo(input.cwd, checks);
 		if (memoHit) {
-			const decision = resolveVerifierSpawnDecision(memoHit);
+			// W2: the guard runs on memo hits too — a recorded PASS for a pristine
+			// tree must not skip the verifier when the verified dependency work
+			// lives outside this tree (the original finding-3 memo-replay PoC).
+			const guarded = resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, memoHit);
 			incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {
-				verdict: memoHit.verdict,
+				verdict: guarded.outcome.verdict,
 			});
 			incMetric(
 				input.metricRegistry,
@@ -680,22 +887,36 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 				"W10-2 memoized PASS verdicts served without re-running checks",
 				{},
 			);
-			if (decision.skipVerifier) {
+			if (guarded.forcedSpawn) {
+				incMetric(
+					input.metricRegistry,
+					"crew.verification.verifier_gate_worktree_guard_total",
+					"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
+					{ result: "spawn_forced" },
+				);
+			}
+			if (guarded.decision.skipVerifier) {
 				incMetric(
 					input.metricRegistry,
 					"crew.verification.verifier_spawns_skipped_total",
 					"LLM verifier spawns saved by the U13 deterministic pre-gate",
-					{ reason: decision.reason },
+					{ reason: guarded.decision.reason },
 				);
 			} else {
 				incMetric(
 					input.metricRegistry,
 					"crew.verification.verifier_spawns_total",
 					"LLM verifier spawns that still ran, labeled by the deciding layer",
-					{ reason: decision.reason },
+					{ reason: guarded.decision.reason },
 				);
 			}
-			return { outcome: memoHit, decision, promptContext: "" };
+			return {
+				outcome: guarded.outcome,
+				decision: guarded.decision,
+				// A guard-forced spawn must carry the WHY into the verifier's prompt
+				// (plain memo hits normally render no context at all).
+				promptContext: guarded.forcedSpawn ? renderVerifyGateContext(guarded.outcome) : "",
+			};
 		}
 	}
 	const exec = createSubprocessVerifyGateExecutor();
@@ -743,6 +964,24 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 			};
 		}
 	}
+	// ── W2 bookend: tree binding AFTER a green gate (mirrors the manifest
+	// bookend above) ─────────────────────────────────────────────────────
+	// A PASS is only trustworthy if the tracked tree that produced it is STILL
+	// the dispatch-pinned tree when the gate finishes — a mid-gate harness
+	// swap (concurrent writer in a shared cwd) downgrades the verdict to
+	// INCONCLUSIVE so the LLM verifier spawns. Downgrade-only, like above.
+	if (input.hostSpec && outcome.verdict === "PASS") {
+		const treeDriftNote = detectWorkingTreeDrift(input.cwd, input.hostSpec);
+		if (treeDriftNote) {
+			const note = `${treeDriftNote} (during the gate run)`;
+			outcome = {
+				...outcome,
+				verdict: "INCONCLUSIVE",
+				evidenceLines: [...outcome.evidenceLines, note],
+				worktreeIntegrityNote: note,
+			};
+		}
+	}
 	// ── M3-28 (R47-V2, fix-wave 6): the U6B classifier layer is NOT consulted ──
 	// The consult used to live here, guarded by `outcome.verdict === "INCONCLUSIVE"`
 	// and fed the literal gate verdict. That input can never be pass-shaped:
@@ -771,7 +1010,20 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 		);
 	}
 	const preGate: VerifierPreGateResult | undefined = undefined;
-	const decision = resolveVerifierSpawnDecision(outcome, preGate);
+	// W2: the guard runs on fresh verdicts too — a green gate in the verifier's
+	// own pristine worktree must not skip the verifier when the dependency work
+	// it certifies lives in other, uncommitted worktrees.
+	const guarded = resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, outcome);
+	if (guarded.forcedSpawn) {
+		incMetric(
+			input.metricRegistry,
+			"crew.verification.verifier_gate_worktree_guard_total",
+			"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
+			{ result: "spawn_forced" },
+		);
+	}
+	outcome = guarded.outcome;
+	const decision = guarded.decision;
 	incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {
 		verdict: outcome.verdict,
 	});

package/src/runtime/workspace-lock.ts

@@ -46,10 +46,20 @@
  * non-Linux platforms where /proc startTime is unavailable.
  */
 
-import { createHash } from "node:crypto";
-import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import {
+	closeSync,
+	existsSync,
+	mkdirSync,
+	openSync,
+	readdirSync,
+	readFileSync,
+	renameSync,
+	statSync,
+	unlinkSync,
+	writeFileSync,
+} from "node:fs";
 import * as path from "node:path";
-import { atomicWriteJson } from "../state/atomic-write.ts";
 import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 
 /** Heartbeat staleness threshold (ms). Default 60s per RFC §P1g. */
@@ -143,7 +153,22 @@ export function workspaceLockPath(cwd: string): string {
 	return path.join(locksDir, `${hash}.lock`);
 }
 
-/** Read + parse a lockfile. Returns undefined if missing/corrupt. */
+/**
+ * Observe a file's on-disk identity (device + inode). Returns undefined when
+ * the file cannot be stated (missing, permission...).
+ */
+function statLockIdentity(lockPath: string): { dev: number; ino: number } | undefined {
+	try {
+		const stat = statSync(lockPath);
+		return { dev: stat.dev, ino: stat.ino };
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Read + parse a lockfile. Returns undefined if missing/corrupt.
+ */
 function readLock(lockPath: string): WorkspaceLockContents | undefined {
 	if (!existsSync(lockPath)) return undefined;
 	try {
@@ -162,16 +187,6 @@ function readLock(lockPath: string): WorkspaceLockContents | undefined {
 	}
 }
 
-/**
- * Write the lockfile atomically (temp+rename+fsync via atomicWriteJson).
- * Used for HEARTBEAT refresh only (a claim that already owns the lock is refreshing its
- * timestamp — overwrite is correct because the owner verified ownership first).
- */
-function writeLock(lockPath: string, contents: WorkspaceLockContents): void {
-	mkdirSync(path.dirname(lockPath), { recursive: true });
-	atomicWriteJson(lockPath, contents);
-}
-
 export interface RefreshWorkspaceLockHeartbeatOptions {
 	/** Test injection: override current time (ms). Default Date.now(). */
 	now?: () => number;
@@ -191,24 +206,83 @@ export interface RefreshWorkspaceLockHeartbeatOptions {
  * safeRelease). This is what keeps a >60s-running goal's lock from being
  * force-stolen via isLockStale clause (b) despite a live pid.
  *
+ * W6 fix (refresh-clobber-steal): the refresh write is a CONDITIONAL replace
+ * (compare-and-swap on file identity + bytes), never an unconditional
+ * temp+rename. The (dev, ino) identity AND exact bytes observed at read time
+ * are re-verified immediately before the rename; if a concurrent stale-steal
+ * claimed the lock between our read and our rename (the R3-M-B1/FS4 race),
+ * the observed identity/bytes no longer match → the temp file is discarded,
+ * the file is NOT touched, and false is returned — the refresh can never
+ * replace a file it did not observe at read time (the pre-fix rename was
+ * identity-blind and silently clobbered the stealer's verified claim). The
+ * post-write re-read below is kept as belt-and-braces for the mirror-image
+ * race (someone replacing the file AFTER our rename).
+ *
  * Non-throwing by contract: failures surface as false, never as an exception
  * into the caller's loop (the goal-loop still wraps calls in try/catch →
  * logInternalError warn as belt-and-braces, see goal-loop-runner.ts).
  */
 export function refreshWorkspaceLockHeartbeat(lockPath: string, goalId: string, opts: RefreshWorkspaceLockHeartbeatOptions = {}): boolean {
 	try {
+		// Observe identity AND bytes together at read time. A plain readLock()
+		// gives content but no file identity; the identity is what makes the
+		// pre-rename re-check below a real compare-and-swap.
+		let rawObserved: string;
+		try {
+			rawObserved = readFileSync(lockPath, "utf-8");
+		} catch {
+			return false; // missing/unreadable — nothing to refresh
+		}
+		const observedIdentity = statLockIdentity(lockPath);
+		if (!observedIdentity) return false;
 		const current = readLock(lockPath);
 		if (!current) return false;
 		const pid = opts.pid ?? process.pid;
 		if (current.goalId !== goalId || current.pid !== pid) return false;
 		const now = opts.now ?? Date.now;
-		writeLock(lockPath, { ...current, heartbeat: now() });
-		// R3-M-B1/FS4 (Wave-3): writeLock is temp+rename (NOT atomic against a
-		// concurrent stale-steal's unlink→O_EXCL) — a stealer may have replaced
-		// the lock between our read and our rename, and our rename then clobbered
-		// THEIR file. Re-read and verify: if the file no longer holds our
-		// goalId+pid we lost ownership — return false so the heartbeat loop blocks
-		// the goal (never silently keep refreshing a lock another goal owns).
+		// Write the refreshed payload to a SIBLING temp file (same directory →
+		// same filesystem → rename is atomic). Only the pre-rename CAS below
+		// decides whether the rename happens; nothing has touched the lock path
+		// up to that point.
+		mkdirSync(path.dirname(lockPath), { recursive: true });
+		const tempPath = `${lockPath}.${process.pid}.${randomUUID()}.tmp`;
+		writeFileSync(tempPath, JSON.stringify({ ...current, heartbeat: now() }), "utf-8");
+		try {
+			// CAS gate: rename ONLY if the lock path still holds BOTH the observed
+			// (dev, ino) identity AND the observed bytes. A stealer's unlink→O_EXCL
+			// claim in between produces a new inode with different (goalId-bearing)
+			// bytes → both checks miss → refuse (never clobber the new owner).
+			const identityNow = statLockIdentity(lockPath);
+			let rawNow: string | undefined;
+			try {
+				rawNow = readFileSync(lockPath, "utf-8");
+			} catch {
+				rawNow = undefined;
+			}
+			if (
+				!identityNow ||
+				rawNow !== rawObserved ||
+				identityNow.dev !== observedIdentity.dev ||
+				identityNow.ino !== observedIdentity.ino
+			) {
+				// R3-M-B1/FS4 (Wave-3) + W6: the lock was stolen/re-acquired between
+				// our read and our rename — leave the file untouched and report
+				// ownership lost so the heartbeat loop blocks the goal (never
+				// silently keep refreshing a lock another goal owns).
+				return false;
+			}
+			renameSync(tempPath, lockPath);
+		} finally {
+			// Best-effort temp cleanup: after a successful rename the temp is gone
+			// (ENOENT — swallowed); after a refused CAS this is what removes it.
+			try {
+				unlinkSync(tempPath);
+			} catch {
+				/* already renamed away or never existed */
+			}
+		}
+		// Post-write re-read: someone may STILL have replaced the file after our
+		// rename — if it no longer holds our goalId+pid we lost ownership.
 		const reread = readLock(lockPath);
 		if (!reread || reread.goalId !== goalId || reread.pid !== pid) return false;
 		return true;

package/src/schema/config-schema.ts

@@ -158,7 +158,17 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 			),
 		),
 		// U11 (hybrid 2-tier worker model): per-role embedded-tier opt-in.
-		// DEFAULT-OFF — behavior pick, not authority (no sensitive mark).
+		// DEFAULT-OFF. USER-ONLY (sensitive mark, w4b security fix): this is the
+		// THIRD in-process routing knob alongside runtime.mode and
+		// runtime.isolationPolicy (both already sensitive). An embedded-routed
+		// worker's Pi session runs IN-PROCESS in the host pi process, where the
+		// two deterministic host protections do not exist — the PI_CREW_SANDBOX=bwrap
+		// OS boundary is resolved only on the child spawn path (child-pi.ts) and
+		// the env allowlist scrub (sanitizeEnvSecrets) exists only for child envs —
+		// so enabling/role-extending it from untrusted config silently voids the
+		// user's sandbox opt-in and can expose host env/FS to bash-capable roles.
+		// The user-tier config file remains the product knob; project config and
+		// run params (same sensitive walk) may not set it.
 		embeddedWorkers: Type.Optional(
 			Type.Object(
 				{
@@ -167,7 +177,7 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 					maxConcurrent: Type.Optional(Type.Integer({ minimum: 1 })),
 					faultThreshold: Type.Optional(Type.Integer({ minimum: 1 })),
 				},
-				{ additionalProperties: false },
+				{ additionalProperties: false, sensitive: true },
 			),
 		),
 		modelFallback: Type.Optional(PiTeamsModelFallbackConfigSchema),