pi-crew 0.11.49 → 0.11.51

package/src/runtime/child-pi/child-pi-steering.ts

@@ -13,6 +13,7 @@
  */
 
 import * as fs from "node:fs";
+import { signSteeringEntry } from "../../state/coordination/mailbox.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { killProcessTree } from "./child-pi-kill.ts";
 
@@ -74,7 +75,13 @@ export class ChildPiSteeringController {
 			// a failed write must NOT kill the worker.
 			if (steeringFile) {
 				try {
-					fs.appendFileSync(steeringFile, JSON.stringify({ type: "steer", message: STEER_WRAP_UP_MESSAGE }) + "\n", "utf-8");
+					// w1a sender binding: sign the advisory line (steering file is
+					// same-uid writable; worker pollSteering drops unauthenticated lines).
+					fs.appendFileSync(
+						steeringFile,
+						`${JSON.stringify(signSteeringEntry({ type: "steer", message: STEER_WRAP_UP_MESSAGE }))}\n`,
+						"utf-8",
+					);
 				} catch (err) {
 					logInternalError("child-pi.steer-write-failed", err instanceof Error ? err : new Error(String(err)), `pid=${pid}`);
 				}

package/src/runtime/child-pi/child-pi.ts

@@ -281,7 +281,8 @@ export interface ChildPiRunInput {
 	 * in the parent's in-memory `Map<runId, token>` and in the child's env.
 	 * NEVER persisted to manifest, events, mailbox, or any run-dir file.
 	 *
-	 * OPT-IN fd3 route (PI_CREW_BROKER_STDIN=1, FIX-1 2026-10-28): the token
+	 * DEFAULT-ON fd3 route (PI_CREW_BROKER_STDIN — '0' opts out; DEFAULT-ON
+	 * flip 2026-10-28, FIX-1 2026-10-28): the token
 	 * is still written into built.env for every brokered spawn — RPC/surface
 	 * branches compose WITHOUT the payload and need the env credential, but
 	 * the headless JSON branch composes WITH ctx.brokerStdinPayload and

package/src/runtime/child-pi/inference-broker.ts

@@ -377,6 +377,10 @@ async function handleRequest(
 	res: http.ServerResponse,
 	ctx: { routes: Map<string, ProviderRoute>; workers: Map<string, WorkerEntry> },
 ): Promise<void> {
+	// Assigned AFTER concurrency admission (step 2b). The catch path releases
+	// the slot for body-read/upstream failures that bypass the normal
+	// response-close settlement; the release itself is idempotent.
+	let releaseSlot: (() => void) | undefined;
 	try {
 		// (0) Provider routing: the FIRST path segment names the provider
 		// ("/anthropic/v1/messages", "/openai/chat/completions"); the broker
@@ -411,12 +415,35 @@ async function handleRequest(
 			deny(res, 429, "too many concurrent inference requests for this worker");
 			return;
 		}
+		// (2b) Take the concurrency slot BEFORE the body read, and release it
+		// EXACTLY once on every post-admission exit path: the "close" handler
+		// covers normal completion, client aborts, and post-admission denies
+		// (deny() ends the response → close fires), and the idempotent guard
+		// makes the explicit catch-path call a no-op when close already fired.
+		// Without the matching increment the >= cap gate above was dead code
+		// (inFlight only ever walked negative after the first response close),
+		// so one valid worker token could hold unbounded concurrent requests —
+		// each buffering up to MAX_BODY_BYTES in parent-process memory — for
+		// the life of the token.
+		worker.inFlight += 1;
+		const usage = new UsageCounter();
+		let settled = false;
+		const settle = (): void => {
+			if (settled) return;
+			settled = true;
+			worker.inFlight -= 1;
+			worker.inputTokens += usage.input;
+			worker.outputTokens += usage.output;
+		};
+		releaseSlot = settle;
+		res.on("close", settle);
 		// (3) Read the request body (bounded).
 		const chunks: Buffer[] = [];
 		let size = 0;
 		for await (const chunk of req) {
 			size += (chunk as Buffer).length;
 			if (size > MAX_BODY_BYTES) {
+				settle();
 				deny(res, 413, "request body too large");
 				return;
 			}
@@ -445,13 +472,8 @@ async function handleRequest(
 		});
 		res.writeHead(upstreamRes.status, outHeaders);
 		worker.requests += 1;
-		const usage = new UsageCounter();
-		const finish = () => {
-			worker.inFlight -= 1;
-			worker.inputTokens += usage.input;
-			worker.outputTokens += usage.output;
-		};
-		res.on("close", finish);
+		// Slot settlement + usage accounting were wired at admission (2b);
+		// "close" fires here on normal completion (res.end / pipe drain).
 		if (!upstreamRes.body) {
 			res.end();
 			return;
@@ -463,6 +485,10 @@ async function handleRequest(
 		});
 		nodeStream.pipe(usage.tee).pipe(res);
 	} catch (error) {
+		// Release the admitted concurrency slot for body-read/upstream failures
+		// (client abort mid-body, fetch throw, ...) — idempotent when the
+		// response close already settled it.
+		releaseSlot?.();
 		logInternalError("inference-broker.forward", undefined, error instanceof Error ? error.message : String(error), "warn");
 		if (!res.headersSent) deny(res, 502, "inference broker upstream failure");
 		else res.destroy();
@@ -648,3 +674,11 @@ export function __resetInferenceBrokerForTests(): void {
 export function __inferenceBrokerTokenMapKeysForTests(): string[] {
 	return broker ? [...broker.workers.keys()] : [];
 }
+
+/** @internal TESTS ONLY — the live per-worker in-flight counter (looked up
+ * by worker key, never the raw token). Pins the MAX_INFLIGHT_PER_WORKER
+ * admission cap: incremented at admission, exactly one release per settled
+ * request (success, upstream failure, client abort, post-admission deny). */
+export function __inferenceBrokerInFlightForTests(workerKey: string): number | undefined {
+	return broker?.byKey.get(workerKey)?.inFlight;
+}

package/src/runtime/child-pi/pi-version.ts

@@ -19,8 +19,11 @@
  *     a real child; the default seam wraps node:child_process execFile with a
  *     5s timeout (utf8).
  *   - Single-flight memoized per process: the FIRST call creates the promise;
- *     every later call (any args) returns the same one. Failures memoize too
- *     (null = unknown) — a missing/old pi binary does not re-probe per spawn.
+ *     every later call (any args) returns the same one. SUCCESSFUL probes memoize
+ *     forever; FAILED/unknown probes (null) re-arm after a short TTL
+ *     (PROBE_FAILURE_RETRY_TTL_MS, 60s) — one transient cold-start failure must
+ *     not permanently drop version-gated safety flags (--no-mcp) for the
+ *     process lifetime (SEC-2026-11 N2: parity-spawn-mcp-cut-version-gated).
  *   - NEVER rejects: spawn error / nonzero exit / timeout / unparseable
  *     stdout all resolve null. The result is a hint, never a failure channel.
  *
@@ -155,6 +158,15 @@ export function piVersionAtLeast(version: string | null | undefined, floor: stri
 /** Memoized single-flight probe promise (null = unknown, failures included). */
 let memoizedProbe: Promise<string | null> | null = null;
 
+/**
+ * SEC-2026-11 N2: how long a FAILED/unknown probe stays memoized before a
+ * later spawn may retry. Successes memoize forever; failures must not —
+ * a single transient probe miss (e.g. 5s cold-start timeout) otherwise drops
+ * --no-mcp from every later parity spawn in the process, silently widening
+ * the MCP exposure window on hosts that DO support the flag.
+ */
+export const PROBE_FAILURE_RETRY_TTL_MS = 60_000;
+
 async function runPiVersionProbe(exec: ExecPiVersionFn): Promise<string | null> {
 	const { command, args } = getPiSpawnCommand(["--version"]);
 	const { stdout } = await exec(command, args, { timeout: PI_VERSION_PROBE_TIMEOUT_MS, encoding: "utf8" });
@@ -170,7 +182,23 @@ async function runPiVersionProbe(exec: ExecPiVersionFn): Promise<string | null>
  * matter what they pass. NEVER rejects; unknown resolves null.
  */
 export function probePiVersion(exec: ExecPiVersionFn = defaultExec): Promise<string | null> {
-	if (!memoizedProbe) memoizedProbe = runPiVersionProbe(exec).catch(() => null);
+	if (!memoizedProbe) {
+		const memo = runPiVersionProbe(exec)
+			.catch(() => null)
+			.then((version) => {
+				if (version === null) {
+					// Failure/unknown: re-arm the memo after the TTL so a later spawn
+					// retries (see PROBE_FAILURE_RETRY_TTL_MS). Only clear OUR memo — a
+					// concurrent success must not be evicted.
+					const timer: NodeJS.Timeout = setTimeout(() => {
+						if (memoizedProbe === memo) memoizedProbe = null;
+					}, PROBE_FAILURE_RETRY_TTL_MS);
+					timer.unref();
+				}
+				return version;
+			});
+		memoizedProbe = memo;
+	}
 	return memoizedProbe;
 }
 

package/src/runtime/child-pi/sandbox.ts

@@ -28,6 +28,7 @@
  */
 import { type SpawnSyncOptions, type SpawnSyncReturns, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 
 export const SANDBOX_ENV = "PI_CREW_SANDBOX";
@@ -122,14 +123,33 @@ function toolchainBinds(spec: { command: string; args: string[] }, isPackageRoot
 		}
 	}
 	// --extension / --skill resources: bind the value + ancestors up to the
-	// nearest package root (extensions import across their package tree).
+	// nearest package root (extensions import across their package tree) —
+	// but NEVER at or above the user trust boundary. User-global skill roots
+	// (~/.pi/agent/skills — the default pi user-skill location) have NO
+	// package.json ancestor before $HOME, so an uncapped walk climbed all the
+	// way up and emitted `--ro-bind-try $HOME $HOME` (plus `~/.pi/agent`, the
+	// auth.json directory), mounting the whole host home — credentials
+	// included — read-only inside the sandbox. The walk now stops BELOW the
+	// pi agent dir / $HOME, and a value that would mount the home, the agent
+	// dir, or any ancestor containing either is SKIPPED entirely (fail-closed
+	// ENOENT inside the sandbox — never a HOME bind).
+	const home = os.homedir();
+	const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(home, ".pi", "agent");
+	// Protect the DEFAULT agent dir too: a PI_CODING_AGENT_DIR override moves
+	// the effective dir, but ~/.pi/agent keeps holding real credentials on
+	// default installs — fail closed for both locations.
+	const trustBoundaries = [home, agentDir, path.join(home, ".pi", "agent")];
 	for (let i = 0; i < spec.args.length - 1; i++) {
 		const flag = spec.args[i];
 		if (flag !== "--extension" && flag !== "--skill") continue;
 		const value = spec.args[i + 1];
 		if (!value || !path.isAbsolute(value)) continue;
+		if (crossesUserTrustBoundary(value, trustBoundaries)) continue;
 		binds.add(value);
 		for (let dir = path.dirname(value); dir !== path.dirname(dir); dir = path.dirname(dir)) {
+			// never climb at/above the user trust boundary: the pi agent dir
+			// (auth.json!) and the home dir itself stay unmounted
+			if (crossesUserTrustBoundary(dir, trustBoundaries)) break;
 			binds.add(dir);
 			if (isPackageRoot(dir)) break;
 		}
@@ -137,6 +157,23 @@ function toolchainBinds(spec: { command: string; args: string[] }, isPackageRoot
 	return [...binds];
 }
 
+/**
+ * True when binding `dir` would mount a trust boundary itself or any
+ * ancestor CONTAINING one (e.g. `dir` == $HOME, ~/.pi, /home, or /) — the
+ * caller must skip/break (fail closed) instead of binding. Comparison goes
+ * through path.relative, which is case-insensitive on win32.
+ */
+function crossesUserTrustBoundary(dir: string, boundaries: string[]): boolean {
+	for (const boundary of boundaries) {
+		const rel = path.relative(dir, boundary);
+		// rel === "" → dir IS the boundary; a rel that stays inside dir (no
+		// ".." prefix, not absolute) → the boundary lives UNDER dir, so
+		// binding dir would mount it.
+		if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) return true;
+	}
+	return false;
+}
+
 /** Default package-root probe: a directory carrying package.json (extensions import across their package tree). */
 function defaultIsPackageRoot(dir: string): boolean {
 	try {

package/src/runtime/dwf-state-store.ts

@@ -13,6 +13,14 @@
  * corrupt checkpoint is treated as a fresh run (load() returns undefined). If a crash
  * happens mid-agent, that agent simply re-runs from scratch on resume — agent results
  * are expected to be idempotent-ish.
+ *
+ * w3-dwf-trust (2026-10-29): the checkpoint path (<crewRoot>/state/runs/<runId>/) is
+ * writable by every WRITE-role child worker of the run (same OS uid), so the "sole
+ * writer is the runner" assumption is FALSE. load() therefore validates at the
+ * hydration boundary: runId binding (expectedRunId), numeric clamps on spent/
+ * agentCount, container-shape checks, and a producer-shape verdict allowlist over
+ * completedAgentCalls entries — forged or schema-invalid state fails closed to
+ * re-execution instead of replaying as trusted. See sanitizeCheckpoint below.
  */
 
 import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
@@ -59,6 +67,157 @@ export interface DwfCheckpointState {
 	updatedAt: string;
 }
 
+// ─── w3-dwf-trust (2026-10-29): hydration-boundary validation ─────────────
+// The checkpoint file lives under the shared repo where WRITE-role child
+// workers can write it, so load() revalidates instead of blind-casting. These
+// helpers narrow the parsed JSON (typed as `unknown` — no `any`) into a
+// DwfCheckpointState, dropping or resetting anything the runner could not
+// have produced. Fail-closed policy: schema-invalid containers reject the
+// whole checkpoint (fresh run); invalid per-call entries are dropped (call
+// re-executes); invalid numeric accumulators clamp to 0.
+
+const isPlainObject = (value: unknown): value is Record<string, unknown> =>
+	typeof value === "object" && value !== null && !Array.isArray(value);
+
+/** String[] narrowing: non-array → undefined (reject), non-string elements filtered out. */
+const sanitizeStringArray = (value: unknown): string[] | undefined => {
+	if (!Array.isArray(value)) return undefined;
+	return value.filter((entry): entry is string => typeof entry === "string");
+};
+
+/** Numeric control accumulator clamp: finite non-negative numbers pass; anything else → 0
+ *  (a forged negative `spent` inflated budget.remaining() past the dispatched cap, and a
+ *  negative/reset `agentCount` re-armed the agent-call cap). */
+const clampNonNegativeNumber = (value: unknown): number => (typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0);
+
+/** Optional finite non-negative number field (usage parts, durationMs): keep when valid, drop when not. */
+const optionalNonNegativeNumber = (value: unknown): number | undefined =>
+	typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+
+/** Validate one hydrated completedAgentCalls entry against the runner's producer shape.
+ *  Verdict allowlist: the runner caches ONLY successful results (ok exactly boolean true,
+ *  string text) — anything else was never produced by loadWorkflowModule's runner, so it
+ *  is dropped (the call re-executes on resume) rather than replayed with ok forced true.
+ *  Optional fields are kept only when correctly typed; `structured` is post-JSON-parse by
+ *  construction and survives as-is (deep schema re-validation needs the call's schema,
+ *  which the checkpoint format does not carry — the dispatch-side pin/runId binding is
+ *  the load-bearing control for forged-but-well-formed entries). */
+function sanitizeAgentResult(value: unknown): AgentResult | undefined {
+	if (!isPlainObject(value)) return undefined;
+	if (value.ok !== true) return undefined;
+	if (typeof value.text !== "string") return undefined;
+	const result: AgentResult = { ok: true, text: value.text };
+	if (value.structured !== undefined) result.structured = value.structured;
+	if (isPlainObject(value.usage)) {
+		const usage: AgentResult["usage"] = {};
+		const input = optionalNonNegativeNumber(value.usage.input);
+		const output = optionalNonNegativeNumber(value.usage.output);
+		const cost = optionalNonNegativeNumber(value.usage.cost);
+		const turns = optionalNonNegativeNumber(value.usage.turns);
+		if (input !== undefined) usage.input = input;
+		if (output !== undefined) usage.output = output;
+		if (cost !== undefined) usage.cost = cost;
+		if (turns !== undefined) usage.turns = turns;
+		if (Object.keys(usage).length > 0) result.usage = usage;
+	}
+	if (typeof value.runId === "string") result.runId = value.runId;
+	if (typeof value.taskId === "string") result.taskId = value.taskId;
+	if (typeof value.artifactPath === "string") result.artifactPath = value.artifactPath;
+	if (typeof value.error === "string") result.error = value.error;
+	const durationMs = optionalNonNegativeNumber(value.durationMs);
+	if (durationMs !== undefined) result.durationMs = durationMs;
+	return result;
+}
+
+/** Bind + revalidate a version-guarded checkpoint record into a DwfCheckpointState.
+ *  Returns undefined when the record is schema-invalid or bound to another run
+ *  (fail closed to re-execution, never trusted replay). */
+function sanitizeCheckpoint(record: Record<string, unknown>, expectedRunId: string | undefined): DwfCheckpointState | undefined {
+	// (1) RunId binding: the runner passes manifest.runId, so a checkpoint for a
+	// different (stale/planted/enumerated) run never hydrates as this run's state.
+	if (expectedRunId !== undefined && record.runId !== expectedRunId) {
+		logInternalError(
+			"dwf-state-store.load",
+			new Error("checkpoint runId mismatch — rejecting checkpoint, run restarts fresh"),
+			`expectedRunId=${expectedRunId}, checkpointRunId=${record.runId}`,
+		);
+		return undefined;
+	}
+	if (typeof record.runId !== "string") return undefined;
+	const runId = record.runId;
+
+	// (2) Required-shape containers. Non-conforming shape → reject the whole
+	// checkpoint (schema-invalid state must never hydrate partially).
+	if (record.vars !== undefined && !isPlainObject(record.vars)) return undefined;
+	const phases = sanitizeStringArray(record.phases);
+	if (phases === undefined) return undefined;
+	const logs = sanitizeStringArray(record.logs);
+	if (logs === undefined) return undefined;
+	if (record.currentPhase !== undefined && typeof record.currentPhase !== "string") return undefined;
+	const currentPhase: string | undefined = record.currentPhase;
+
+	// (3) Numeric control accumulators clamp (never trust worker-writable arithmetic).
+	const spent = clampNonNegativeNumber(record.spent);
+	const agentCount = clampNonNegativeNumber(record.agentCount);
+
+	// (4) Per-call replay cache: drop schema-invalid / non-producer-reachable entries.
+	let completedAgentCalls: Record<string, AgentResult> | undefined;
+	if (record.completedAgentCalls !== undefined) {
+		if (!isPlainObject(record.completedAgentCalls)) {
+			logInternalError(
+				"dwf-state-store.load",
+				new Error("checkpoint completedAgentCalls is not an object — dropping the replay cache (calls re-execute on resume)"),
+				`runId=${runId}`,
+			);
+		} else {
+			completedAgentCalls = {};
+			let dropped = 0;
+			for (const [callId, entry] of Object.entries(record.completedAgentCalls)) {
+				const sanitized = sanitizeAgentResult(entry);
+				if (sanitized !== undefined) {
+					completedAgentCalls[callId] = sanitized;
+				} else {
+					dropped++;
+				}
+			}
+			if (dropped > 0) {
+				logInternalError(
+					"dwf-state-store.load",
+					new Error(
+						`${dropped} checkpoint agent-call entr${dropped === 1 ? "y" : "ies"} failed hydration validation and ${dropped === 1 ? "was" : "were"} dropped (the call${dropped === 1 ? " re-executes" : "s re-execute"} on resume)`,
+					),
+					`runId=${runId}`,
+				);
+			}
+		}
+	}
+
+	// (5) dispatchContext fingerprint: keep only correctly typed fields (the runner
+	// compares it against the current dispatch and emits a mismatch event).
+	let dispatchContext: DwfCheckpointState["dispatchContext"];
+	if (isPlainObject(record.dispatchContext)) {
+		dispatchContext = {};
+		if (typeof record.dispatchContext.modelOverride === "string") dispatchContext.modelOverride = record.dispatchContext.modelOverride;
+		if (typeof record.dispatchContext.team === "string") dispatchContext.team = record.dispatchContext.team;
+	}
+
+	// vars was shape-checked above (undefined or plain object); default {} for legacy absence.
+	const vars: Record<string, unknown> = isPlainObject(record.vars) ? record.vars : {};
+	return {
+		version: DWF_CHECKPOINT_VERSION,
+		runId,
+		vars,
+		phases,
+		currentPhase,
+		logs,
+		spent,
+		agentCount,
+		...(completedAgentCalls !== undefined ? { completedAgentCalls } : {}),
+		...(dispatchContext !== undefined ? { dispatchContext } : {}),
+		updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : new Date().toISOString(),
+	};
+}
+
 /**
  * DwfStore — atomic CRUD for a single run's DWF checkpoint.
  *
@@ -83,16 +242,42 @@ export class DwfStore {
 		return `${this.stateRoot}/dwf-checkpoint.json`;
 	}
 
-	/** Load the checkpoint for this run's stateRoot. Returns undefined if missing or corrupt (fresh run). */
-	load(): DwfCheckpointState | undefined {
+	/** Load the checkpoint for this stateRoot.
+	 *
+	 *  w3-dwf-trust (2026-10-29): the checkpoint file lives under the shared repo
+	 *  (<crewRoot>/state/runs/<runId>/dwf-checkpoint.json) where every WRITE-role
+	 *  child worker of the run can also write (same OS uid), so the file can no
+	 *  longer be treated as runner-only ground truth. Hydration now validates at
+	 *  this boundary instead of blind-casting:
+	 *
+	 *  - `expectedRunId` (passed by dynamic-workflow-runner.ts as manifest.runId)
+	 *    binds the checkpoint to the resuming run — a foreign/stale runId is
+	 *    rejected (→ undefined → fresh run) instead of replayed.
+	 *  - Control accumulators are clamped: `spent`/`agentCount` must be finite
+	 *    non-negative numbers, else reset to 0 (a forged negative `spent` used to
+	 *    inflate budget.remaining() past the dispatched cap and a negative
+	 *    `agentCount` re-armed the SDD-3 G13 agent-call cap).
+	 *  - Schema-invalid containers (non-array phases/logs, non-object vars, a
+	 *    non-string currentPhase) reject the WHOLE checkpoint (fail closed to
+	 *    re-execution).
+	 *  - Hydrated `completedAgentCalls` entries are re-validated against the
+	 *    producer's shape: the runner caches ONLY successful results
+	 *    (`ok === true`, string `text`), so entries failing that verdict
+	 *    allowlist/shape are DROPPED (the call re-executes on resume) and
+	 *    optional fields are stripped when mistyped. Anomalies are logged via
+	 *    logInternalError so quarantines are observable (not silently swallowed).
+	 *
+	 *  Returns undefined if missing/corrupt/tampered (fresh run). */
+	load(expectedRunId?: string): DwfCheckpointState | undefined {
 		const path = this.path;
 		try {
 			if (!existsSync(path)) return undefined;
 			const raw = readFileSync(path, "utf-8");
-			const parsed = JSON.parse(raw);
-			// Corrupt-guard: a valid checkpoint must be an object with a string runId
-			// (mirrors GoalStore.load's typeof parsed.goalId !== "string" check).
-			if (!parsed || typeof parsed !== "object" || typeof parsed.runId !== "string") return undefined;
+			const parsed: unknown = JSON.parse(raw);
+			// Corrupt-guard: a valid checkpoint must be a plain JSON object with a
+			// string runId (mirrors GoalStore.load's typeof parsed.goalId !== "string"
+			// check). Arrays and primitives are rejected outright.
+			if (!isPlainObject(parsed) || typeof parsed.runId !== "string") return undefined;
 			// R6-12: version guard, mirroring the recovery/checkpoint.ts runId-guard
 			// style (typed mismatch → treat as not-loadable). A checkpoint from an
 			// unknown FUTURE version is REJECTED (→ undefined → fresh run) rather than
@@ -110,7 +295,8 @@ export class DwfStore {
 				);
 				return undefined;
 			}
-			return parsed as DwfCheckpointState;
+			// w3-dwf-trust: bind + revalidate at the hydration boundary (never blind-cast).
+			return sanitizeCheckpoint(parsed, expectedRunId);
 		} catch {
 			return undefined;
 		}

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -26,7 +26,8 @@ import { randomBytes } from "node:crypto";
 import type { TSchema } from "@sinclair/typebox";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
-import { appendMailboxMessage, readMailbox } from "../../state/coordination/mailbox.ts";
+import { renderInboxMessage } from "../../prompt/prompt-runtime.ts";
+import { appendMailboxMessage, type MailboxMessage, readMailbox } from "../../state/coordination/mailbox.ts";
 import { appendEvent } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
@@ -383,6 +384,27 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 	// `while(true){review; if accept break; retry}` loop replay round-1's
 	// verdict forever (stale-verdict hazard, docs/dynamic-workflows.md).
 	const hydratedCallIds = new Set<string>(Object.keys(opts.resumedState?.completedAgentCalls ?? {}));
+	// W1b binding (security fix gatherreplies-replyto-only-binding): messageId →
+	// expected addressee, recorded when ctx.mail() issues each mail. gatherReplies
+	// only accepts a reply row when its broker-authenticated sender (m.from)
+	// equals the expected addressee of the mail the reply claims (m.replyTo) — a
+	// forged replyTo from any other task cannot enter the reply stream.
+	const mailedAddressees = new Map<string, string>();
+	const unresolvedMailLookups = new Set<string>();
+	// Resolve the expected addressee for a mailed id, falling back to the run
+	// outbox ONCE per unknown id (resume path: mails sent by a previous process
+	// of the same workflow are not in the in-memory map; their outbox rows are
+	// host-written — workers cannot append to the outbox lane — so the recorded
+	// `to` is a trusted binding source. Inbox rows are never consulted).
+	const expectedReplyAddressee = (messageId: string): string | undefined => {
+		const known = mailedAddressees.get(messageId);
+		if (known !== undefined) return known;
+		if (unresolvedMailLookups.has(messageId)) return undefined;
+		unresolvedMailLookups.add(messageId);
+		const mailed = readMailbox(manifest, "outbox").find((m) => m.id === messageId && m.from === "dynamic-workflow" && m.to);
+		if (mailed?.to) mailedAddressees.set(messageId, mailed.to);
+		return mailedAddressees.get(messageId);
+	};
 	// round-14 P1-2: frozen budget surface. The closures read wfState.spent so the
 	// object stays live after Object.freeze(ctx). total is a snapshot primitive.
 	const budget = Object.freeze({
@@ -852,18 +874,37 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				replyTo: mailOpts?.replyTo,
 				replyDeadline: mailOpts?.replyDeadline,
 			});
+			// W1b binding: record the expected addressee so gatherReplies can verify
+			// that a reply row's authenticated sender (from) is the task this mail
+			// was addressed to (replyTo target ownership).
+			mailedAddressees.set(msg.id, to);
 			return msg.id;
 		},
 		async gatherReplies(messageIds: string[], deadlineMs: number): Promise<unknown[]> {
+			// W1b binding (security fix gatherreplies-replyto-only-binding): a reply
+			// row counts ONLY when (a) it targets the run-level parent lane
+			// (to === "parent" — the lane this gather polls), (b) its replyTo is one
+			// of the awaited ids, and (c) its broker-authenticated sender (from)
+			// equals the addressee recorded for that id at mail time. Duplicate rows
+			// from one sender no longer satisfy a multi-id gather (distinct
+			// (replyTo, from) pairs are counted toward messageIds.length), and every
+			// delivered body is fenced through renderInboxMessage (same seam as
+			// worker inbox delivery: control-char strip, closing-tag neutralization,
+			// 8192-char cap) before it enters workflow variables.
+			const collectBoundReplies = (): MailboxMessage[] =>
+				readMailbox(manifest, "inbox").filter((m) => {
+					if (!m.replyTo || !messageIds.includes(m.replyTo) || m.to !== "parent") return false;
+					return expectedReplyAddressee(m.replyTo) === m.from;
+				});
+			const distinctReplyPairs = (rows: MailboxMessage[]): number => new Set(rows.map((m) => `${m.replyTo}\u0000${m.from}`)).size;
+			const fenceReplyRow = (m: MailboxMessage): MailboxMessage => ({ ...m, body: renderInboxMessage(m) });
 			const deadline = Date.now() + deadlineMs;
-			while (Date.now() < deadline) {
-				const inbox = readMailbox(manifest, "inbox");
-				const got = inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
-				if (got.length >= messageIds.length) return got;
+			for (;;) {
+				const got = collectBoundReplies();
+				if (distinctReplyPairs(got) >= messageIds.length) return got.map(fenceReplyRow);
+				if (Date.now() >= deadline || ctxSignal.aborted) return got.map(fenceReplyRow);
 				await new Promise((r) => setTimeout(r, 500));
-				if (ctxSignal.aborted) return inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 			}
-			return readMailbox(manifest, "inbox").filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 		},
 		renderTemplate(name: string, vars: Record<string, string>): unknown {
 			return renderPlanTemplate(name, vars);