pi-crew 0.11.49 → 0.11.51

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -17,12 +17,14 @@
  * See docs/dynamic-workflows.md for the full threat model.
  */
 
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
+import { saveRunManifestAsync } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { packageRoot, projectCrewRoot, userPiRoot } from "../../utils/paths.ts";
@@ -177,26 +179,97 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	const eventsPath = manifest.eventsPath;
 	const scriptPath = resolveScriptPath(workflow, manifest.cwd);
 
-	// F-01: Trust gate — project-sourced .dwf.ts scripts have FULL Node access (process,
+	// w3-dwf-trust: dispatch-time pin stamping (single point). The FIRST entry to the
+	// runner for a run IS the dispatch — stamp manifest.dynamicScriptPin with the exact
+	// resolved script path + sha256 of the CURRENT bytes and persist before any module
+	// load. Both resume arms funnel back through runDynamicWorkflow, so every later
+	// entry hits the pin-mismatch verification below: a plant that swaps the file
+	// between dispatch and resume is refused instead of executing swapped bytes.
+	// Absent pin (legacy manifests) gets stamped on first resume — backward compatible.
+	if (manifest.dynamicScriptPin === undefined) {
+		let sha256: string;
+		try {
+			sha256 = createHash("sha256").update(readFileSync(scriptPath)).digest("hex");
+		} catch (error) {
+			logInternalError("dynamic-workflow-runner: pin stamp hash failed", error);
+			throw new Error(
+				`Dynamic workflow script '${scriptPath}' could not be read for dispatch-time pinning — refusing to execute an unhashable script.`,
+			);
+		}
+		manifest.dynamicScriptPin = { scriptPath, sha256 };
+		try {
+			await saveRunManifestAsync(manifest);
+		} catch (error) {
+			// Pin not durable → verification cannot be trusted later. Fail closed.
+			logInternalError("dynamic-workflow-runner: pin stamp persist failed", error);
+			throw new Error(`Dynamic workflow dispatch failed to persist the script pin — refusing to execute without a durable pin.`);
+		}
+	}
+
+	// F-01: Trust gate — project/user-sourced .dwf.ts scripts have FULL Node access (process,
 	// require, fs, child_process). Cloning a hostile repo and running its workflow = arbitrary
-	// code execution. Default-deny project workflows unless the user explicitly opts in via
-	// PI_CREW_TRUST_PROJECT_DWF=1. Builtin and user workflows proceed without restriction.
+	// code execution; default-deny project workflows unless the user explicitly opts in via
+	// PI_CREW_TRUST_PROJECT_DWF=1.
+	// w3-dwf-trust (2026-10-29): the USER tier gets the SAME default-deny via
+	// PI_CREW_TRUST_USER_DWF=1. ~/.pi/agent/workflows is writable by every WRITE-role
+	// child worker (same OS uid, bash granted by role-tools), so directory location alone
+	// is not human provenance: a worker-planted user-tier .dwf.ts previously executed in
+	// this HOST process (parent env, in-memory broker state) and silently shadowed
+	// same-named builtin/project workflows via the allWorkflows merge order. Builtin
+	// (shipped, package-owned) workflows proceed without restriction.
 	// U2 (2026-10-10): awaited appendEventAsync — the 2026-09-10 M2a revert
 	// was required by BUFFERED (20ms-delayed) writes; awaiting the direct async
 	// append keeps the read-your-writes contract (resume flow, dwf-setresult
 	// tests, status display all read events only after runDynamicWorkflow
 	// resolves) while dropping the sleepSync event-loop block.
-	if (workflow.source === "project" && getCrewEnv("PI_CREW_TRUST_PROJECT_DWF") !== "1") {
+	const trustEnv: "PI_CREW_TRUST_PROJECT_DWF" | "PI_CREW_TRUST_USER_DWF" | undefined =
+		workflow.source === "project" ? "PI_CREW_TRUST_PROJECT_DWF" : workflow.source === "user" ? "PI_CREW_TRUST_USER_DWF" : undefined;
+	if (trustEnv !== undefined && getCrewEnv(trustEnv) !== "1") {
 		await appendEventAsync(eventsPath, {
 			type: "dwf.trust_denied",
 			runId: manifest.runId,
 			data: { workflow: workflow.name, source: workflow.source, script: scriptPath },
 		});
 		throw new Error(
-			`Project dynamic workflow requires explicit trust. Set PI_CREW_TRUST_PROJECT_DWF=1 to allow execution of project .dwf.ts scripts.`,
+			workflow.source === "user"
+				? `User dynamic workflow requires explicit trust. Set PI_CREW_TRUST_USER_DWF=1 to allow execution of user .dwf.ts scripts.`
+				: `Project dynamic workflow requires explicit trust. Set PI_CREW_TRUST_PROJECT_DWF=1 to allow execution of project .dwf.ts scripts.`,
 		);
 	}
 
+	// w3-dwf-trust: dispatch-time script pin. When the dispatcher stamped
+	// manifest.dynamicScriptPin, re-hash the script bytes before EVERY load — fresh
+	// dispatch AND both resume arms funnel through runDynamicWorkflow — so a plant
+	// that swaps the file between dispatch and resume cannot execute. Optional/absent
+	// on manifests dispatched before this field existed (and on dispatchers that do
+	// not stamp it yet) → no pin verification (backward compatible).
+	const pin = manifest.dynamicScriptPin;
+	if (pin !== undefined) {
+		let actualSha256: string | undefined;
+		try {
+			actualSha256 = createHash("sha256").update(readFileSync(scriptPath)).digest("hex");
+		} catch {
+			// Unreadable/missing script cannot match its pin — treat as mismatch.
+			actualSha256 = undefined;
+		}
+		if (pin.scriptPath !== scriptPath || actualSha256 === undefined || pin.sha256 !== actualSha256) {
+			await appendEventAsync(eventsPath, {
+				type: "dwf.trust_denied",
+				runId: manifest.runId,
+				data: {
+					workflow: workflow.name,
+					source: workflow.source,
+					script: scriptPath,
+					reason: "script-pin-mismatch",
+					...(actualSha256 !== undefined ? { expectedSha256: pin.sha256, actualSha256 } : {}),
+				},
+			});
+			throw new Error(
+				`Dynamic workflow script does not match the dispatch-time pin (path/sha256) — refusing to load a possibly swapped script. Re-dispatch the run to re-pin the current script bytes.`,
+			);
+		}
+	}
+
 	await appendEventAsync(eventsPath, {
 		type: "dwf.started",
 		runId: manifest.runId,
@@ -208,7 +281,10 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	// <stateRoot>/dwf-checkpoint.json (no double-nesting). A missing checkpoint (fresh run)
 	// yields undefined — makeWorkflowCtx starts with empty defaults (backward compatible).
 	const dwfStore = new DwfStore(manifest.stateRoot);
-	const resumedState = dwfStore.load();
+	// w3-dwf-trust: bind the checkpoint to THIS run — a checkpoint whose runId
+	// differs (stale/planted/enumerated under .crew/state/runs/) is rejected and
+	// the run restarts fresh instead of replaying worker-writable state.
+	const resumedState = dwfStore.load(manifest.runId);
 	if (resumedState) {
 		// R14-C3 (wave 7): fingerprint check — a resume that changes the dispatch
 		// context (modelOverride/team) still replays the completed-call cache, but

package/src/runtime/live-session/live-session-runtime.ts

@@ -8,7 +8,14 @@ import { redactSecrets } from "../../utils/redaction.ts";
 import { BoundedTail } from "../compaction/compact-stages/bounded-tail.ts";
 import { createIrcTool } from "../custom-tools/irc-tool.ts";
 import { createSubmitResultTool } from "../custom-tools/submit-result-tool.ts";
-import { g2EnforcementDegradationReason, mcpPermittedForRole, shouldFailClosedMcpEnforcement, stripMcpExtensions } from "../mcp-proxy.ts";
+import {
+	foreignMcpExtensionsAgainstAllowlist,
+	g2EnforcementDegradationReason,
+	McpForeignExtensionError,
+	mcpPermittedForRole,
+	shouldFailClosedMcpEnforcement,
+	stripMcpExtensions,
+} from "../mcp-proxy.ts";
 import { buildConfiguredModelRouting, modelRefToString, warnOutOfScopeSoft } from "../model/model-fallback.ts";
 import { isLiveSessionRuntimeAvailable } from "../model/runtime-resolver.ts";
 import { awaitRuntimeWarmup } from "../model/runtime-warmup.ts";
@@ -360,13 +367,42 @@ export function collectForeignExtensions(session: LiveSessionLike | undefined, a
 	const runner = session?.extensionRunner;
 	if (typeof runner?.getExtensionPaths !== "function") return [];
 	try {
-		const allowed = new Set(allowedPaths);
-		return runner.getExtensionPaths().filter((extensionPath: string) => !allowed.has(extensionPath));
+		// N1 (security-audit run-1): the allowlist check itself has exactly ONE
+		// implementation — mcp-proxy.ts `foreignMcpExtensionsAgainstAllowlist` —
+		// so the fast-path assert and the legacy-loader-route assert below share
+		// identical semantics (set membership against allowedLiveExtensionPaths).
+		return foreignMcpExtensionsAgainstAllowlist(runner.getExtensionPaths(), allowedPaths);
 	} catch {
 		return [];
 	}
 }
 
+/**
+ * N1 (security-audit run-1): the post-creation assert DECISION for the LEGACY
+ * `DefaultResourceLoader` route (the `!sharedServicesAvailable` branch) — the
+ * same backstop the shared-services fast path's own assert gives it, with
+ * identical allowlist semantics (`collectForeignExtensions` +
+ * `allowedLiveExtensionPaths`). The loader-level `stripMcpExtensions` control
+ * is a NAME-based denylist, so a differently-named MCP adapter survives it;
+ * for a NON-MCP-permitted role the allowlist is empty, hence ANY extension
+ * that still loaded is a violation.
+ *
+ * Armed ONLY for non-MCP-permitted roles on the legacy route: permitted roles
+ * keep their extensions there (no strip is armed for them), and the fast path
+ * owns its own assert (pass `sharedServices: true` to disarm this one). The
+ * no-loader degradation case never reaches an assert — it already failed
+ * closed earlier via `g2EnforcementDegradationReason` +
+ * `shouldFailClosedMcpEnforcement`. Returns the offending foreign extension
+ * paths; empty = pass.
+ */
+export function legacyLoaderMcpAllowlistViolation(
+	session: LiveSessionLike | undefined,
+	route: { sharedServices: boolean; mcpPermitted: boolean },
+): string[] {
+	if (route.sharedServices || route.mcpPermitted) return [];
+	return collectForeignExtensions(session, allowedLiveExtensionPaths(false));
+}
+
 function appendTranscript(filePath: string | undefined, event: unknown): void {
 	if (!filePath) return;
 	// Task 26 (2026-08-24): serialize + redact at queue time, then route
@@ -971,6 +1007,45 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				);
 			}
 		}
+		// N1 (security-audit run-1, w9-n1): allowlist-shaped post-creation assert
+		// for the LEGACY DefaultResourceLoader route — the same backstop the
+		// shared-services fast path gets above, with identical semantics (single
+		// mcp-proxy check via collectForeignExtensions). stripMcpExtensions is a
+		// NAME-based denylist, so a differently-named MCP adapter (e.g.
+		// 'mcp-bridge') survives it; any extension that still loaded for a
+		// NON-MCP-permitted role is foreign (its allowlist is empty) and must
+		// fail the task instead of silently loading and connecting its servers.
+		// NOT armed for permitted roles (the legacy route keeps their extensions)
+		// and unreachable for the no-loader degradation path (that already failed
+		// closed above via g2EnforcementDegradationReason).
+		const legacyForeignExtensions = legacyLoaderMcpAllowlistViolation(session, {
+			sharedServices: Boolean(sharedBundle),
+			mcpPermitted,
+		});
+		if (legacyForeignExtensions.length > 0) {
+			const failClosedCode = "mcp-allowlist-fail-closed";
+			const legacyAllowedPaths = allowedLiveExtensionPaths(false);
+			appendEventFireAndForget(input.manifest.eventsPath, {
+				type: "live-session.foreign_extension_blocked",
+				runId: input.manifest.runId,
+				taskId: input.task.id,
+				message: `G2 MCP policy ABORTED live-session spawn for role "${input.task.role ?? "unknown"}" (${failClosedCode}): child session (legacy loader route) loaded extension(s) ${legacyForeignExtensions.join(
+					", ",
+				)} not sanctioned for a non-MCP-permitted role — failing closed instead of silently running with them.`,
+				data: {
+					foreignExtensions: legacyForeignExtensions,
+					allowed: legacyAllowedPaths,
+					route: "legacy-loader",
+					code: failClosedCode,
+					role: input.task.role ?? null,
+				},
+			});
+			throw new McpForeignExtensionError({
+				foreignExtensions: legacyForeignExtensions,
+				allowedExtensions: legacyAllowedPaths,
+				role: input.task.role,
+			});
+		}
 		// U3: register the test-only provider override (faux E2E seam) before
 		// anything streams. No-op in production (modelProviderOverride stays
 		// undefined there).

package/src/runtime/mcp-proxy.ts

@@ -144,12 +144,21 @@ export function mcpPermittedForRole(role: string | undefined): boolean {
  *   "replaces the built-in MCP support"). Both must be dropped to actually
  *   deny MCP; a path-segment match keeps npm-installed and file-path forms.
  *
- * KNOWN LIMITATION (security-review follow-up): this is a NAME-based
- * denylist. A third-party MCP adapter that registers `/mcp` under a
- * different name is NOT stripped and would re-enable discovery for
- * non-permitted roles on the live-session path. An allowlist-shaped
- * extension filter is the root fix — tracked as a follow-up work item
- * (SDD-2 §13, G2 hardening backlog).
+ * KNOWN LIMITATION (name-denylist gap — CLOSED at the assert layer,
+ * security-audit run-1 N1): this remains a NAME-based denylist, so a
+ * third-party MCP adapter that registers `/mcp` under a different name
+ * (e.g. `mcp-bridge`) is NOT stripped here and would re-enable discovery
+ * for non-permitted roles. The root allowlist fix is now layered on top:
+ * after the child session is created on the legacy `DefaultResourceLoader`
+ * route, the live-session runtime runs the same-shaped post-creation assert
+ * the shared-services fast path runs (`foreignMcpExtensionsAgainstAllowlist`
+ * below, fed by `allowedLiveExtensionPaths`) and FAILS the task for a
+ * non-MCP-permitted role when ANY extension survived the strip — a
+ * differently-named adapter now hard-fails (`McpForeignExtensionError`)
+ * instead of silently loading and connecting its servers. Permitted roles
+ * are unaffected (the strip is not armed for them); the no-loader
+ * degradation path already fails closed via `g2EnforcementDegradationReason`
+ * + `shouldFailClosedMcpEnforcement`.
  */
 export function isMcpExtensionPath(extensionPath: string): boolean {
 	if (extensionPath === "builtin:mcp") return true;
@@ -216,3 +225,53 @@ export function stripMcpExtensions(base: LoadedExtensionsShape): LoadedExtension
 export function shouldFailClosedMcpEnforcement(mcpPermitted: boolean, degradationReason: string | undefined): boolean {
 	return degradationReason !== undefined && !mcpPermitted;
 }
+
+/**
+ * N1 (security-audit run-1): the allowlist-shaped control the KNOWN
+ * LIMITATION block above called the root fix — given the extension paths a
+ * child session ACTUALLY loaded and the sanctioned allowlist, return the
+ * foreign/offending entries.
+ *
+ * Semantics are MIRRORED EXACTLY from the shared-services fast path's
+ * post-creation assert in live-session-runtime.ts (`allowedLiveExtensionPaths`
+ * + `collectForeignExtensions`): an extension is foreign iff its path is not
+ * a member of the allowlist — no name heuristics, no substring matching. For
+ * a non-MCP-permitted role the allowlist is empty, so ANY loaded extension
+ * (including a differently-named MCP adapter that survives
+ * `stripMcpExtensions`) is foreign; for a permitted role the allowlist is
+ * exactly `builtin:mcp`. `collectForeignExtensions` delegates here so both
+ * live-session routes share ONE implementation of these semantics.
+ */
+export function foreignMcpExtensionsAgainstAllowlist(
+	loadedExtensionPaths: readonly string[],
+	allowedExtensionPaths: readonly string[],
+): string[] {
+	const allowed = new Set(allowedExtensionPaths);
+	return loadedExtensionPaths.filter((extensionPath) => !allowed.has(extensionPath));
+}
+
+/**
+ * N1 (security-audit run-1, fail-closed): thrown by the live-session
+ * runtime's post-creation assert on the LEGACY `DefaultResourceLoader` route
+ * when the child session loaded extension(s) not sanctioned for a
+ * non-MCP-permitted role (e.g. a differently-named MCP adapter that survived
+ * `stripMcpExtensions`). Mirrors `LiveSessionEmbeddedEnforcementError`'s
+ * pattern: plain fields assigned in the constructor body (strip-types
+ * rejects TS parameter properties), a stamped `name`, and a `[<code>]`-
+ * prefixed message consistent with the G2 fail-closed style.
+ */
+export class McpForeignExtensionError extends Error {
+	readonly foreignExtensions: string[];
+	readonly allowedExtensions: string[];
+
+	constructor(input: { foreignExtensions: readonly string[]; allowedExtensions: readonly string[]; role: string | undefined }) {
+		super(
+			`[mcp-allowlist-fail-closed] Live-session spawn refused for role "${input.role ?? "unknown"}": child session loaded extension(s) not sanctioned for a non-MCP-permitted role: ${input.foreignExtensions.join(
+				", ",
+			)} (allowed: ${input.allowedExtensions.length === 0 ? "none" : input.allowedExtensions.join(", ")}) — failing closed instead of silently running with them.`,
+		);
+		this.foreignExtensions = [...input.foreignExtensions];
+		this.allowedExtensions = [...input.allowedExtensions];
+		this.name = "McpForeignExtensionError";
+	}
+}

package/src/runtime/model/pi-args.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
+import { resolveToolPolicy } from "../../agents/agent-config.ts";
 import { getCrewEnv, getCrewEnvBool } from "../../config/env-vars.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { hasRunStateLayout, packageRoot, userPiRoot } from "../../utils/paths.ts";
@@ -383,19 +384,16 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 	if (input.agent.disableTools === true) {
 		args.push("--no-tools"); // capability-locked agents giữ hành vi (goal-judge)
 	} else {
-		// AgentConfig.tools is string[] (parseToolsField normalizes the
-		// frontmatter CSV), but inline/runtime-constructed agents may still
-		// carry the raw CSV string — normalize both.
-		const rawTools: unknown = input.agent.tools;
-		const declared =
-			typeof rawTools === "string"
-				? rawTools
-						.split(",")
-						.map((t) => t.trim())
-						.filter(Boolean)
-				: Array.isArray(rawTools)
-					? rawTools.map((t) => String(t).trim()).filter(Boolean)
-					: [];
+		// S-7 (w4b security fix): the tool surface is now emitted from the unified
+		// resolveToolPolicy — the SAME seam live-session's filterActiveTools
+		// consumes — instead of the raw frontmatter declaration. This brings the
+		// source-aware allowlist precedence, the additive role denylist, and the
+		// read_only execution-tool floor (bash/edit/write stripped + excluded for
+		// default-deny/custom read-only roles regardless of frontmatter) onto the
+		// child spawn path. Role comes from input.role (the teamRole / spawn role);
+		// resolveToolPolicy normalizes the raw CSV-string form internally.
+		const policy = resolveToolPolicy(input.agent, input.role ?? input.agent.name);
+		const declared = policy.tools ?? [];
 		if (declared.length > 0) {
 			// L2-3 (pi 1.1.0 `+name` modifier syntax) — OPT-IN via
 			// PI_CREW_TOOLS_MODIFIERS=1, default OFF. Decision rationale (Wave A,
@@ -421,7 +419,10 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		// buildSubagentToolAllowlist của pi-interactive-subagents index.ts:809-811).
 		// B2 (fix round 1): `disallowedTools:` frontmatter is a
 		// declaration-driven denylist (opt-in like `tools:`) — NOT the
-		// role-based policy D5 removed.
+		// role-based policy D5 removed. S-7 (w4b): the set now starts from
+		// resolveToolPolicy's excludeTools — which ALREADY merges
+		// agent.disallowedTools + the additive role denylist + the read_only
+		// execution-tool floor — so every policy cut reaches the child argv.
 		// U2-lite (pi 1.0.4 `--tools` semantics drift): on 1.0.4, `--tools` no
 		// longer cuts MCP — ambient MCP servers stay connected on parity
 		// (NON-hermetic) spawns. Fold `mcp__*` into the exclude list to restore
@@ -437,7 +438,7 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		// `--no-tools` already locks the whole tool surface, an extra cut would
 		// be dead weight. Surface TUI panes strip argv flags after build
 		// (child-pi.ts stripHeadlessOnlyFlags), so this cut never reaches them.
-		const disallowed = new Set((input.agent.disallowedTools ?? []).map((t) => t.trim()).filter(Boolean));
+		const disallowed = new Set((policy.excludeTools ?? []).map((t) => t.trim()).filter(Boolean));
 		const paritySpawn = !resolveHermeticWorkers(input.hermeticWorkers);
 		if (paritySpawn) disallowed.add("mcp__" + "*");
 		if (disallowed.size > 0) args.push("--exclude-tools", [...disallowed].join(","));

package/src/runtime/plan-replan.ts

@@ -22,6 +22,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { withRunLockSync } from "../state/coordination/locks.ts";
+import { signSteeringEntry } from "../state/coordination/mailbox.ts";
 import { appendEvent } from "../state/event-log/event-log.ts";
 import { getCurrentPlanRecord } from "../state/stores/plan-store.ts";
 import { loadRunManifestById, saveRunManifest, saveRunTasks } from "../state/stores/state-store.ts";
@@ -56,7 +57,9 @@ function appendSteeringAdvisory(manifest: TeamRunManifest, taskId: string): bool
 		}
 		fs.appendFileSync(
 			safePath,
-			`${JSON.stringify({ type: "steer", message: WRAP_UP_ADVISORY, ts: new Date().toISOString() })}\n`,
+			// w1a sender binding: sign the advisory line (steering file is same-uid
+			// writable; worker pollSteering drops unauthenticated lines).
+			`${JSON.stringify(signSteeringEntry({ type: "steer", message: WRAP_UP_ADVISORY, ts: new Date().toISOString() }))}\n`,
 			"utf-8",
 		);
 		return true;

package/src/runtime/task-runner/child-executor.ts

@@ -31,6 +31,7 @@ import { loadConfig } from "../../config/config.ts";
 import { getCrewEnv, getCrewEnvInt } from "../../config/env-vars.ts";
 import { errors } from "../../errors.ts";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
+import { signSteeringEntry } from "../../state/coordination/mailbox.ts";
 import { appendEventAsync, appendEventBuffered } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import { upsertOwnershipEntry } from "../../state/stores/ownership-map.ts";
@@ -86,14 +87,19 @@ async function appendSteeringAsync(steeringDir: string, taskId: string, steers:
 	try {
 		await fs.promises.mkdir(steeringDir, { recursive: true });
 		const steeringPath = resolveRealContainedPath(steeringDir, `${taskId}.jsonl`);
+		// w1a sender binding: the steering file is same-uid writable — each line
+		// carries this process's Ed25519 signature (worker pollSteering drops
+		// unauthenticated lines).
 		const lines = steers
 			.map(
 				(msg) =>
-					JSON.stringify({
-						type: "steer",
-						message: msg,
-						ts: new Date().toISOString(),
-					}) + "\n",
+					JSON.stringify(
+						signSteeringEntry({
+							type: "steer",
+							message: msg,
+							ts: new Date().toISOString(),
+						}),
+					) + "\n",
 			)
 			.join("");
 		await fs.promises.appendFile(steeringPath, lines, "utf-8");

package/src/runtime/task-runner/hybrid-tier.ts

@@ -46,6 +46,7 @@
  */
 
 import type { CrewRuntimeConfig } from "../../config/config.ts";
+import { embeddedTierRefusedBySandbox, embeddedTierSandboxRefusalReason } from "../../config/sanitize-project-config.ts";
 import { flushPendingAtomicWrites } from "../../state/atomic-write.ts";
 import { appendEventFireAndForget } from "../../state/event-log/event-log.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
@@ -180,6 +181,22 @@ export function planEmbeddedTier(input: PlanEmbeddedTierInput): EmbeddedTierPlan
 	const threshold = resolveEmbeddedFaultThreshold(policy);
 	const env = input.env ?? process.env;
 	const { manifest } = input;
+	// w4b defense-in-depth wiring (SEC-2026-11 embeddedWorkers.project-tier-routing):
+	// a live sandbox posture (PI_CREW_SANDBOX=bwrap) means the user opted into an
+	// OS boundary around workers. The embedded tier runs IN-PROCESS with neither
+	// the bwrap boundary nor the child-env secret scrub, so routing would void
+	// that opt-in. Fail closed: refuse embedded routing (subprocess tier keeps
+	// the sandbox), with a visible tier.decision warning.
+	if (embeddedTierRefusedBySandbox(env)) {
+		appendEventFireAndForget(manifest.eventsPath, {
+			type: "tier.decision",
+			runId: manifest.runId,
+			taskId: input.task.id,
+			message: embeddedTierSandboxRefusalReason(env),
+			data: { route: "subprocess", to: input.baseRuntimeKind, reason: "sandbox-opt-in" },
+		});
+		return undefined;
+	}
 	const resolved = resolveTaskRuntimeKind(input.baseRuntimeKind, input.role, input.isolationPolicy, env, {
 		policy,
 		faultCount,

package/src/runtime/task-runner/pre-execution.ts

@@ -272,19 +272,26 @@ export async function prepareTaskExecutionContext(
 
 	// Deterministic pre-step: run script, inject stdout into worker prompt
 	let preStepOutput: string | undefined;
-	if (input.step.preStepScript && input.step.source !== "builtin" && input.step.source !== "user") {
-		// F-02 SECURITY FIX (allowlist): only builtin/user-sourced workflows may
-		// execute pre-step scripts. Project-sourced AND programmatic
+	if (input.step.preStepScript && input.step.source !== "builtin") {
+		// F-02 SECURITY FIX (allowlist, w3-dwf-trust tightening): only builtin-sourced
+		// workflows may execute pre-step scripts. Project-sourced AND programmatic
 		// (source=undefined) steps are denied — a hostile repo clone could embed
 		// arbitrary code via preStepScript + execFileSync, and steps constructed
 		// without explicit trusted provenance should not auto-trust file
-		// execution. Deny by default; discover-workflows strips project scripts
-		// upstream so legitimate builtin/user scripts still run.
+		// execution. The 'user' tier was REMOVED from the allowlist (w3-dwf-trust,
+		// 2026-10-29): ~/.pi/agent/workflows is writable by every WRITE-role child
+		// worker (same OS uid), so a planted user-tier *.workflow.md carrying a
+		// preStepScript previously executed it via execFileSync in this HOST
+		// process (F-02 only stripped project scripts at the discover layer).
+		// Deny by default; re-introduce via an explicit dispatch-time hash pin if a
+		// legitimate user-tier pre-step need appears (see
+		// TeamRunManifest.dynamicScriptPin). discover-workflows strips project
+		// scripts upstream so legitimate builtin scripts still run.
 		appendEventFireAndForget(manifest.eventsPath, {
 			type: "hook.pre_step_skipped",
 			runId: manifest.runId,
 			taskId: task.id,
-			message: `preStepScript '${input.step.preStepScript}' skipped: only builtin/user-sourced workflows may execute pre-step scripts for security (F-02).`,
+			message: `preStepScript '${input.step.preStepScript}' skipped: only builtin-sourced workflows may execute pre-step scripts for security (F-02; user tier tightened in w3-dwf-trust — user config dirs are writable by same-uid workers).`,
 			data: { script: input.step.preStepScript, source: input.step.source ?? "unknown" },
 		});
 		preStepOutput = undefined;

package/src/runtime/task-runner.ts

@@ -182,6 +182,20 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 					// package.json. Absent (old manifests / goal-loop runs) ⇒ the gate
 					// resolves no checks ⇒ INCONCLUSIVE ⇒ verifier spawns (fail-closed).
 					...(manifest.verifyGateSpec ? { hostSpec: manifest.verifyGateSpec } : {}),
+					// W2 (worktree-verifier-gate-excludes-work): a green gate in THIS
+					// task's tree must never certify dependency work it cannot see —
+					// probe each dependency task's worktree; uncommitted work there
+					// forces the LLM verifier spawn even on a PASS verdict (reason
+					// "unverified_worktree_work"). Shared-cwd deps (no worktree) need
+					// no probe — their work is inside the gate's own cwd.
+					...(ctx.task.dependsOn.length > 0
+						? {
+								dependencyWorktreeProbes: ctx.task.dependsOn.map((depId) => ({
+									taskId: depId,
+									worktreePath: ctx.tasks.find((t) => t.id === depId)?.worktree?.path,
+								})),
+							}
+						: {}),
 					signal: input.signal,
 					classifier: {
 						enabled: resolveClassifierEnabled(input.runtimeConfig?.classifierEnabled),

package/src/runtime/team-runner.ts

@@ -158,6 +158,16 @@ function startPerfSampler(manifest: TeamRunManifest, team: TeamConfig, signal?:
 			{ detached: true, stdio: ["ignore", "ignore", "pipe"], signal },
 		);
 		// diagnostics: sampler stderr → perf-obs.log (best-effort; never affects the run)
+		// Abort-safety (B6 mirror, child-pi.ts taskkill): the sampler is spawned
+		// WITH the run AbortSignal (R11-4 teardown-kill) but detached+unref'd, so it
+		// can exit BEFORE the signal fires — Node's spawn-signal listener then
+		// throws AbortError synchronously AND emits 'error' on the ChildProcess;
+		// without a listener that emission is an uncaught exception that kills the
+		// host (observed: run-deadline abort ~300ms into a resumed run raced the
+		// sampler's exit). The listener keeps abort-after-exit bounded.
+		child.on("error", (err: Error) => {
+			logInternalError("team-runner.perf-sampler.child-error", err, `runId=${manifest.runId}`, "warn");
+		});
 		child.stderr?.on("data", (d: Buffer) => {
 			try {
 				fs.appendFileSync(logPath, String(d));
@@ -382,6 +392,22 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		{ allowTerminalExit: input.isResume === true },
 	);
 
+	// Manifest-derived re-arm (resume-disarms-run-budget-enforcement fix): a caller
+	// that reconstructs the input without budget fields (handleResume static-path
+	// re-entry) must not silently disarm the operator's persisted spend cap —
+	// enforceRunBudget gates solely on ctx.input.budgetTotal (budget-enforcement.ts)
+	// and the manifest budget is persisted input→manifest only, so persistence
+	// alone never re-arms enforcement on a later execution. Seed any missing input
+	// budget fields from the loaded manifest BEFORE the persist block so EVERY
+	// execution of the same run keeps its declared bounds regardless of caller
+	// diligence. Caller-supplied values (dispatch paths forward params.budget*,
+	// detached re-entry forwards manifest.budget*) always win — `??=` never
+	// overrides an explicitly forwarded field.
+	input.budgetTotal ??= manifest.budgetTotal;
+	input.budgetWarning ??= manifest.budgetWarning;
+	input.budgetAbort ??= manifest.budgetAbort;
+	input.budgetUnlimited ??= manifest.budgetUnlimited;
+
 	// Persist budget fields on the manifest so all subsequent saveRunManifest
 	// calls (there are many in executeTeamRunCore) preserve the budget config.
 	// Without this, the spread in updateRunStatus and other transformations