pi-crew 0.11.50 → 0.11.52

package/src/runtime/broker/crew-broker.ts

@@ -44,6 +44,7 @@ import {
 	appendMailboxMessageIdempotentAsync,
 	type MailboxMessage,
 	registerMailboxAppendObserver,
+	signSteeringEntry,
 } from "../../state/coordination/mailbox.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunManifest, saveRunTasks } from "../../state/stores/state-store.ts";
@@ -1334,13 +1335,18 @@ export class CrewBroker {
 				try {
 					const steeringDir = `${loaded.manifest.artifactsRoot}/steering`;
 					const steeringPath = resolveRealContainedPath(loaded.manifest.artifactsRoot, `steering/${targetTaskId}.jsonl`);
+					// w1a sender binding: the steering file is same-uid writable, so the
+					// line must carry this (broker/writer) process's Ed25519 signature —
+					// the worker's pollSteering drops unauthenticated lines.
 					const line =
-						JSON.stringify({
-							type: "steer",
-							message: body,
-							id: messageId,
-							ts: new Date().toISOString(),
-						}) + "\n";
+						JSON.stringify(
+							signSteeringEntry({
+								type: "steer",
+								message: body,
+								id: messageId,
+								ts: new Date().toISOString(),
+							}),
+						) + "\n";
 					await fsp.mkdir(steeringDir, { recursive: true });
 					await fsp.appendFile(steeringPath, line, "utf-8");
 				} catch (fileErr) {

package/src/runtime/broker/protocol/wait-resolve.ts

@@ -21,7 +21,7 @@ import type { TeamRunManifest, TeamTaskState } from "../../../state/types.ts";
 import { logInternalError } from "../../../utils/internal-error.ts";
 import type { ServerConnection } from "./connection-state.ts";
 import { parseWaitResolveParams } from "./request-parsers.ts";
-import { recordWaitPolicyRejection } from "./wait-auth.ts";
+import { recordWaitPolicyRejection, waitAuthError } from "./wait-auth.ts";
 
 /**
  * M3-6 (R21-M1, fix-wave 6): resolve ONE park without un-shielding the others.
@@ -110,6 +110,20 @@ export async function handleWaitResolve(
 		helpers.sendError(conn, id, "auth", "not authed");
 		return;
 	}
+	// w1a (broker-bare-run-token-forged-task-identity): enforce the compound-token
+	// rule on wait.resolve — the SAME rule its wait.request sibling applies at
+	// crew-broker.ts:1488 (and delegate.request inline). Without this, a legacy
+	// bare-runId-token connection that forged a victim taskId at hello could
+	// resolve the victim's parked ask (waiting→running flip + false
+	// respond_delivered recorded under the victim's taskId). runId-fallback
+	// matches are rejected with the migrate hint; orchestrator connections are
+	// rejected by role. Placement mirrors handleWaitRequest: presence check →
+	// auth kind → params parse.
+	const authErr = waitAuthError(conn);
+	if (authErr) {
+		helpers.sendError(conn, id, authErr.code, authErr.message);
+		return;
+	}
 	const parsed = parseWaitResolveParams(params);
 	if (!parsed) {
 		helpers.sendError(conn, id, "bad-params", "wait.resolve: invalid params");

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -22,6 +22,7 @@ import * as path from "node:path";
 import { childPiBaseAllowlist } from "../../config/env-allowlist-registry.ts";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { isScratchpadEnabledForRole } from "../../config/role-tools.ts";
+import { COORDINATION_VERIFY_KEY_ENV, getMailboxVerifyKeyPublic } from "../../state/coordination/mailbox.ts";
 import { buildScopedAllowList, providerEnvKeys, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
@@ -491,6 +492,22 @@ export function prepareSpawnContext(
 	// stateRoot. Absent (non-team spawn) → var stays unset and the ask tool
 	// fast-fails with a structured notice instead of hanging.
 	if (input.eventsPath) built.env.PI_CREW_STATE_ROOT = path.dirname(input.eventsPath);
+	// w1a (coordination-durable-files-no-sender-binding): hand the child the
+	// PUBLIC Ed25519 verify key for the durable coordination channels (mailbox
+	// + steering JSONL). The signing PRIVATE key never leaves the writer process
+	// heap; this is a public key — non-secret, env-safe (control-namespace key).
+	// Key resolution for THIS spawn's run:
+	//   1. relay our own env key when we are a worker spawning a same-run
+	//      grandchild (our key came from the same root writer),
+	//   2. else our own process keypair (we are the run's writer: root session
+	//      or nested host — lazy-created once, heap-only).
+	// A child without this key drops every coordination row (fail-closed).
+	if (input.eventsPath) {
+		const relayedVerifyKey = getCrewEnv(COORDINATION_VERIFY_KEY_ENV);
+		const relayMatchesRun =
+			relayedVerifyKey !== undefined && input.runId !== undefined && getCrewEnv("PI_CREW_BROKER_RUN_ID") === input.runId;
+		built.env[COORDINATION_VERIFY_KEY_ENV] = relayMatchesRun ? relayedVerifyKey : getMailboxVerifyKeyPublic();
+	}
 	// Phase 0 inter-pi broker: inject socket path + token (control-namespace keys,
 	// safe under assertOnlyControlEnvKeys). Only when the parent broker issued
 	// credentials for this run — i.e. the broker is enabled AND this run is

package/src/runtime/child-pi/child-pi-steering.ts

@@ -13,6 +13,7 @@
  */
 
 import * as fs from "node:fs";
+import { signSteeringEntry } from "../../state/coordination/mailbox.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { killProcessTree } from "./child-pi-kill.ts";
 
@@ -74,7 +75,13 @@ export class ChildPiSteeringController {
 			// a failed write must NOT kill the worker.
 			if (steeringFile) {
 				try {
-					fs.appendFileSync(steeringFile, JSON.stringify({ type: "steer", message: STEER_WRAP_UP_MESSAGE }) + "\n", "utf-8");
+					// w1a sender binding: sign the advisory line (steering file is
+					// same-uid writable; worker pollSteering drops unauthenticated lines).
+					fs.appendFileSync(
+						steeringFile,
+						`${JSON.stringify(signSteeringEntry({ type: "steer", message: STEER_WRAP_UP_MESSAGE }))}\n`,
+						"utf-8",
+					);
 				} catch (err) {
 					logInternalError("child-pi.steer-write-failed", err instanceof Error ? err : new Error(String(err)), `pid=${pid}`);
 				}

package/src/runtime/child-pi/inference-broker.ts

@@ -377,6 +377,10 @@ async function handleRequest(
 	res: http.ServerResponse,
 	ctx: { routes: Map<string, ProviderRoute>; workers: Map<string, WorkerEntry> },
 ): Promise<void> {
+	// Assigned AFTER concurrency admission (step 2b). The catch path releases
+	// the slot for body-read/upstream failures that bypass the normal
+	// response-close settlement; the release itself is idempotent.
+	let releaseSlot: (() => void) | undefined;
 	try {
 		// (0) Provider routing: the FIRST path segment names the provider
 		// ("/anthropic/v1/messages", "/openai/chat/completions"); the broker
@@ -411,12 +415,35 @@ async function handleRequest(
 			deny(res, 429, "too many concurrent inference requests for this worker");
 			return;
 		}
+		// (2b) Take the concurrency slot BEFORE the body read, and release it
+		// EXACTLY once on every post-admission exit path: the "close" handler
+		// covers normal completion, client aborts, and post-admission denies
+		// (deny() ends the response → close fires), and the idempotent guard
+		// makes the explicit catch-path call a no-op when close already fired.
+		// Without the matching increment the >= cap gate above was dead code
+		// (inFlight only ever walked negative after the first response close),
+		// so one valid worker token could hold unbounded concurrent requests —
+		// each buffering up to MAX_BODY_BYTES in parent-process memory — for
+		// the life of the token.
+		worker.inFlight += 1;
+		const usage = new UsageCounter();
+		let settled = false;
+		const settle = (): void => {
+			if (settled) return;
+			settled = true;
+			worker.inFlight -= 1;
+			worker.inputTokens += usage.input;
+			worker.outputTokens += usage.output;
+		};
+		releaseSlot = settle;
+		res.on("close", settle);
 		// (3) Read the request body (bounded).
 		const chunks: Buffer[] = [];
 		let size = 0;
 		for await (const chunk of req) {
 			size += (chunk as Buffer).length;
 			if (size > MAX_BODY_BYTES) {
+				settle();
 				deny(res, 413, "request body too large");
 				return;
 			}
@@ -445,13 +472,8 @@ async function handleRequest(
 		});
 		res.writeHead(upstreamRes.status, outHeaders);
 		worker.requests += 1;
-		const usage = new UsageCounter();
-		const finish = () => {
-			worker.inFlight -= 1;
-			worker.inputTokens += usage.input;
-			worker.outputTokens += usage.output;
-		};
-		res.on("close", finish);
+		// Slot settlement + usage accounting were wired at admission (2b);
+		// "close" fires here on normal completion (res.end / pipe drain).
 		if (!upstreamRes.body) {
 			res.end();
 			return;
@@ -463,6 +485,10 @@ async function handleRequest(
 		});
 		nodeStream.pipe(usage.tee).pipe(res);
 	} catch (error) {
+		// Release the admitted concurrency slot for body-read/upstream failures
+		// (client abort mid-body, fetch throw, ...) — idempotent when the
+		// response close already settled it.
+		releaseSlot?.();
 		logInternalError("inference-broker.forward", undefined, error instanceof Error ? error.message : String(error), "warn");
 		if (!res.headersSent) deny(res, 502, "inference broker upstream failure");
 		else res.destroy();
@@ -648,3 +674,11 @@ export function __resetInferenceBrokerForTests(): void {
 export function __inferenceBrokerTokenMapKeysForTests(): string[] {
 	return broker ? [...broker.workers.keys()] : [];
 }
+
+/** @internal TESTS ONLY — the live per-worker in-flight counter (looked up
+ * by worker key, never the raw token). Pins the MAX_INFLIGHT_PER_WORKER
+ * admission cap: incremented at admission, exactly one release per settled
+ * request (success, upstream failure, client abort, post-admission deny). */
+export function __inferenceBrokerInFlightForTests(workerKey: string): number | undefined {
+	return broker?.byKey.get(workerKey)?.inFlight;
+}

package/src/runtime/child-pi/pi-version.ts

@@ -19,8 +19,11 @@
  *     a real child; the default seam wraps node:child_process execFile with a
  *     5s timeout (utf8).
  *   - Single-flight memoized per process: the FIRST call creates the promise;
- *     every later call (any args) returns the same one. Failures memoize too
- *     (null = unknown) — a missing/old pi binary does not re-probe per spawn.
+ *     every later call (any args) returns the same one. SUCCESSFUL probes memoize
+ *     forever; FAILED/unknown probes (null) re-arm after a short TTL
+ *     (PROBE_FAILURE_RETRY_TTL_MS, 60s) — one transient cold-start failure must
+ *     not permanently drop version-gated safety flags (--no-mcp) for the
+ *     process lifetime (SEC-2026-11 N2: parity-spawn-mcp-cut-version-gated).
  *   - NEVER rejects: spawn error / nonzero exit / timeout / unparseable
  *     stdout all resolve null. The result is a hint, never a failure channel.
  *
@@ -155,6 +158,15 @@ export function piVersionAtLeast(version: string | null | undefined, floor: stri
 /** Memoized single-flight probe promise (null = unknown, failures included). */
 let memoizedProbe: Promise<string | null> | null = null;
 
+/**
+ * SEC-2026-11 N2: how long a FAILED/unknown probe stays memoized before a
+ * later spawn may retry. Successes memoize forever; failures must not —
+ * a single transient probe miss (e.g. 5s cold-start timeout) otherwise drops
+ * --no-mcp from every later parity spawn in the process, silently widening
+ * the MCP exposure window on hosts that DO support the flag.
+ */
+export const PROBE_FAILURE_RETRY_TTL_MS = 60_000;
+
 async function runPiVersionProbe(exec: ExecPiVersionFn): Promise<string | null> {
 	const { command, args } = getPiSpawnCommand(["--version"]);
 	const { stdout } = await exec(command, args, { timeout: PI_VERSION_PROBE_TIMEOUT_MS, encoding: "utf8" });
@@ -170,7 +182,23 @@ async function runPiVersionProbe(exec: ExecPiVersionFn): Promise<string | null>
  * matter what they pass. NEVER rejects; unknown resolves null.
  */
 export function probePiVersion(exec: ExecPiVersionFn = defaultExec): Promise<string | null> {
-	if (!memoizedProbe) memoizedProbe = runPiVersionProbe(exec).catch(() => null);
+	if (!memoizedProbe) {
+		const memo = runPiVersionProbe(exec)
+			.catch(() => null)
+			.then((version) => {
+				if (version === null) {
+					// Failure/unknown: re-arm the memo after the TTL so a later spawn
+					// retries (see PROBE_FAILURE_RETRY_TTL_MS). Only clear OUR memo — a
+					// concurrent success must not be evicted.
+					const timer: NodeJS.Timeout = setTimeout(() => {
+						if (memoizedProbe === memo) memoizedProbe = null;
+					}, PROBE_FAILURE_RETRY_TTL_MS);
+					timer.unref();
+				}
+				return version;
+			});
+		memoizedProbe = memo;
+	}
 	return memoizedProbe;
 }
 

package/src/runtime/child-pi/sandbox.ts

@@ -28,6 +28,7 @@
  */
 import { type SpawnSyncOptions, type SpawnSyncReturns, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 
 export const SANDBOX_ENV = "PI_CREW_SANDBOX";
@@ -122,14 +123,33 @@ function toolchainBinds(spec: { command: string; args: string[] }, isPackageRoot
 		}
 	}
 	// --extension / --skill resources: bind the value + ancestors up to the
-	// nearest package root (extensions import across their package tree).
+	// nearest package root (extensions import across their package tree) —
+	// but NEVER at or above the user trust boundary. User-global skill roots
+	// (~/.pi/agent/skills — the default pi user-skill location) have NO
+	// package.json ancestor before $HOME, so an uncapped walk climbed all the
+	// way up and emitted `--ro-bind-try $HOME $HOME` (plus `~/.pi/agent`, the
+	// auth.json directory), mounting the whole host home — credentials
+	// included — read-only inside the sandbox. The walk now stops BELOW the
+	// pi agent dir / $HOME, and a value that would mount the home, the agent
+	// dir, or any ancestor containing either is SKIPPED entirely (fail-closed
+	// ENOENT inside the sandbox — never a HOME bind).
+	const home = os.homedir();
+	const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(home, ".pi", "agent");
+	// Protect the DEFAULT agent dir too: a PI_CODING_AGENT_DIR override moves
+	// the effective dir, but ~/.pi/agent keeps holding real credentials on
+	// default installs — fail closed for both locations.
+	const trustBoundaries = [home, agentDir, path.join(home, ".pi", "agent")];
 	for (let i = 0; i < spec.args.length - 1; i++) {
 		const flag = spec.args[i];
 		if (flag !== "--extension" && flag !== "--skill") continue;
 		const value = spec.args[i + 1];
 		if (!value || !path.isAbsolute(value)) continue;
+		if (crossesUserTrustBoundary(value, trustBoundaries)) continue;
 		binds.add(value);
 		for (let dir = path.dirname(value); dir !== path.dirname(dir); dir = path.dirname(dir)) {
+			// never climb at/above the user trust boundary: the pi agent dir
+			// (auth.json!) and the home dir itself stay unmounted
+			if (crossesUserTrustBoundary(dir, trustBoundaries)) break;
 			binds.add(dir);
 			if (isPackageRoot(dir)) break;
 		}
@@ -137,6 +157,23 @@ function toolchainBinds(spec: { command: string; args: string[] }, isPackageRoot
 	return [...binds];
 }
 
+/**
+ * True when binding `dir` would mount a trust boundary itself or any
+ * ancestor CONTAINING one (e.g. `dir` == $HOME, ~/.pi, /home, or /) — the
+ * caller must skip/break (fail closed) instead of binding. Comparison goes
+ * through path.relative, which is case-insensitive on win32.
+ */
+function crossesUserTrustBoundary(dir: string, boundaries: string[]): boolean {
+	for (const boundary of boundaries) {
+		const rel = path.relative(dir, boundary);
+		// rel === "" → dir IS the boundary; a rel that stays inside dir (no
+		// ".." prefix, not absolute) → the boundary lives UNDER dir, so
+		// binding dir would mount it.
+		if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) return true;
+	}
+	return false;
+}
+
 /** Default package-root probe: a directory carrying package.json (extensions import across their package tree). */
 function defaultIsPackageRoot(dir: string): boolean {
 	try {

package/src/runtime/dwf-state-store.ts

@@ -13,6 +13,14 @@
  * corrupt checkpoint is treated as a fresh run (load() returns undefined). If a crash
  * happens mid-agent, that agent simply re-runs from scratch on resume — agent results
  * are expected to be idempotent-ish.
+ *
+ * w3-dwf-trust (2026-10-29): the checkpoint path (<crewRoot>/state/runs/<runId>/) is
+ * writable by every WRITE-role child worker of the run (same OS uid), so the "sole
+ * writer is the runner" assumption is FALSE. load() therefore validates at the
+ * hydration boundary: runId binding (expectedRunId), numeric clamps on spent/
+ * agentCount, container-shape checks, and a producer-shape verdict allowlist over
+ * completedAgentCalls entries — forged or schema-invalid state fails closed to
+ * re-execution instead of replaying as trusted. See sanitizeCheckpoint below.
  */
 
 import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
@@ -59,6 +67,157 @@ export interface DwfCheckpointState {
 	updatedAt: string;
 }
 
+// ─── w3-dwf-trust (2026-10-29): hydration-boundary validation ─────────────
+// The checkpoint file lives under the shared repo where WRITE-role child
+// workers can write it, so load() revalidates instead of blind-casting. These
+// helpers narrow the parsed JSON (typed as `unknown` — no `any`) into a
+// DwfCheckpointState, dropping or resetting anything the runner could not
+// have produced. Fail-closed policy: schema-invalid containers reject the
+// whole checkpoint (fresh run); invalid per-call entries are dropped (call
+// re-executes); invalid numeric accumulators clamp to 0.
+
+const isPlainObject = (value: unknown): value is Record<string, unknown> =>
+	typeof value === "object" && value !== null && !Array.isArray(value);
+
+/** String[] narrowing: non-array → undefined (reject), non-string elements filtered out. */
+const sanitizeStringArray = (value: unknown): string[] | undefined => {
+	if (!Array.isArray(value)) return undefined;
+	return value.filter((entry): entry is string => typeof entry === "string");
+};
+
+/** Numeric control accumulator clamp: finite non-negative numbers pass; anything else → 0
+ *  (a forged negative `spent` inflated budget.remaining() past the dispatched cap, and a
+ *  negative/reset `agentCount` re-armed the agent-call cap). */
+const clampNonNegativeNumber = (value: unknown): number => (typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0);
+
+/** Optional finite non-negative number field (usage parts, durationMs): keep when valid, drop when not. */
+const optionalNonNegativeNumber = (value: unknown): number | undefined =>
+	typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+
+/** Validate one hydrated completedAgentCalls entry against the runner's producer shape.
+ *  Verdict allowlist: the runner caches ONLY successful results (ok exactly boolean true,
+ *  string text) — anything else was never produced by loadWorkflowModule's runner, so it
+ *  is dropped (the call re-executes on resume) rather than replayed with ok forced true.
+ *  Optional fields are kept only when correctly typed; `structured` is post-JSON-parse by
+ *  construction and survives as-is (deep schema re-validation needs the call's schema,
+ *  which the checkpoint format does not carry — the dispatch-side pin/runId binding is
+ *  the load-bearing control for forged-but-well-formed entries). */
+function sanitizeAgentResult(value: unknown): AgentResult | undefined {
+	if (!isPlainObject(value)) return undefined;
+	if (value.ok !== true) return undefined;
+	if (typeof value.text !== "string") return undefined;
+	const result: AgentResult = { ok: true, text: value.text };
+	if (value.structured !== undefined) result.structured = value.structured;
+	if (isPlainObject(value.usage)) {
+		const usage: AgentResult["usage"] = {};
+		const input = optionalNonNegativeNumber(value.usage.input);
+		const output = optionalNonNegativeNumber(value.usage.output);
+		const cost = optionalNonNegativeNumber(value.usage.cost);
+		const turns = optionalNonNegativeNumber(value.usage.turns);
+		if (input !== undefined) usage.input = input;
+		if (output !== undefined) usage.output = output;
+		if (cost !== undefined) usage.cost = cost;
+		if (turns !== undefined) usage.turns = turns;
+		if (Object.keys(usage).length > 0) result.usage = usage;
+	}
+	if (typeof value.runId === "string") result.runId = value.runId;
+	if (typeof value.taskId === "string") result.taskId = value.taskId;
+	if (typeof value.artifactPath === "string") result.artifactPath = value.artifactPath;
+	if (typeof value.error === "string") result.error = value.error;
+	const durationMs = optionalNonNegativeNumber(value.durationMs);
+	if (durationMs !== undefined) result.durationMs = durationMs;
+	return result;
+}
+
+/** Bind + revalidate a version-guarded checkpoint record into a DwfCheckpointState.
+ *  Returns undefined when the record is schema-invalid or bound to another run
+ *  (fail closed to re-execution, never trusted replay). */
+function sanitizeCheckpoint(record: Record<string, unknown>, expectedRunId: string | undefined): DwfCheckpointState | undefined {
+	// (1) RunId binding: the runner passes manifest.runId, so a checkpoint for a
+	// different (stale/planted/enumerated) run never hydrates as this run's state.
+	if (expectedRunId !== undefined && record.runId !== expectedRunId) {
+		logInternalError(
+			"dwf-state-store.load",
+			new Error("checkpoint runId mismatch — rejecting checkpoint, run restarts fresh"),
+			`expectedRunId=${expectedRunId}, checkpointRunId=${record.runId}`,
+		);
+		return undefined;
+	}
+	if (typeof record.runId !== "string") return undefined;
+	const runId = record.runId;
+
+	// (2) Required-shape containers. Non-conforming shape → reject the whole
+	// checkpoint (schema-invalid state must never hydrate partially).
+	if (record.vars !== undefined && !isPlainObject(record.vars)) return undefined;
+	const phases = sanitizeStringArray(record.phases);
+	if (phases === undefined) return undefined;
+	const logs = sanitizeStringArray(record.logs);
+	if (logs === undefined) return undefined;
+	if (record.currentPhase !== undefined && typeof record.currentPhase !== "string") return undefined;
+	const currentPhase: string | undefined = record.currentPhase;
+
+	// (3) Numeric control accumulators clamp (never trust worker-writable arithmetic).
+	const spent = clampNonNegativeNumber(record.spent);
+	const agentCount = clampNonNegativeNumber(record.agentCount);
+
+	// (4) Per-call replay cache: drop schema-invalid / non-producer-reachable entries.
+	let completedAgentCalls: Record<string, AgentResult> | undefined;
+	if (record.completedAgentCalls !== undefined) {
+		if (!isPlainObject(record.completedAgentCalls)) {
+			logInternalError(
+				"dwf-state-store.load",
+				new Error("checkpoint completedAgentCalls is not an object — dropping the replay cache (calls re-execute on resume)"),
+				`runId=${runId}`,
+			);
+		} else {
+			completedAgentCalls = {};
+			let dropped = 0;
+			for (const [callId, entry] of Object.entries(record.completedAgentCalls)) {
+				const sanitized = sanitizeAgentResult(entry);
+				if (sanitized !== undefined) {
+					completedAgentCalls[callId] = sanitized;
+				} else {
+					dropped++;
+				}
+			}
+			if (dropped > 0) {
+				logInternalError(
+					"dwf-state-store.load",
+					new Error(
+						`${dropped} checkpoint agent-call entr${dropped === 1 ? "y" : "ies"} failed hydration validation and ${dropped === 1 ? "was" : "were"} dropped (the call${dropped === 1 ? " re-executes" : "s re-execute"} on resume)`,
+					),
+					`runId=${runId}`,
+				);
+			}
+		}
+	}
+
+	// (5) dispatchContext fingerprint: keep only correctly typed fields (the runner
+	// compares it against the current dispatch and emits a mismatch event).
+	let dispatchContext: DwfCheckpointState["dispatchContext"];
+	if (isPlainObject(record.dispatchContext)) {
+		dispatchContext = {};
+		if (typeof record.dispatchContext.modelOverride === "string") dispatchContext.modelOverride = record.dispatchContext.modelOverride;
+		if (typeof record.dispatchContext.team === "string") dispatchContext.team = record.dispatchContext.team;
+	}
+
+	// vars was shape-checked above (undefined or plain object); default {} for legacy absence.
+	const vars: Record<string, unknown> = isPlainObject(record.vars) ? record.vars : {};
+	return {
+		version: DWF_CHECKPOINT_VERSION,
+		runId,
+		vars,
+		phases,
+		currentPhase,
+		logs,
+		spent,
+		agentCount,
+		...(completedAgentCalls !== undefined ? { completedAgentCalls } : {}),
+		...(dispatchContext !== undefined ? { dispatchContext } : {}),
+		updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : new Date().toISOString(),
+	};
+}
+
 /**
  * DwfStore — atomic CRUD for a single run's DWF checkpoint.
  *
@@ -83,16 +242,42 @@ export class DwfStore {
 		return `${this.stateRoot}/dwf-checkpoint.json`;
 	}
 
-	/** Load the checkpoint for this run's stateRoot. Returns undefined if missing or corrupt (fresh run). */
-	load(): DwfCheckpointState | undefined {
+	/** Load the checkpoint for this stateRoot.
+	 *
+	 *  w3-dwf-trust (2026-10-29): the checkpoint file lives under the shared repo
+	 *  (<crewRoot>/state/runs/<runId>/dwf-checkpoint.json) where every WRITE-role
+	 *  child worker of the run can also write (same OS uid), so the file can no
+	 *  longer be treated as runner-only ground truth. Hydration now validates at
+	 *  this boundary instead of blind-casting:
+	 *
+	 *  - `expectedRunId` (passed by dynamic-workflow-runner.ts as manifest.runId)
+	 *    binds the checkpoint to the resuming run — a foreign/stale runId is
+	 *    rejected (→ undefined → fresh run) instead of replayed.
+	 *  - Control accumulators are clamped: `spent`/`agentCount` must be finite
+	 *    non-negative numbers, else reset to 0 (a forged negative `spent` used to
+	 *    inflate budget.remaining() past the dispatched cap and a negative
+	 *    `agentCount` re-armed the SDD-3 G13 agent-call cap).
+	 *  - Schema-invalid containers (non-array phases/logs, non-object vars, a
+	 *    non-string currentPhase) reject the WHOLE checkpoint (fail closed to
+	 *    re-execution).
+	 *  - Hydrated `completedAgentCalls` entries are re-validated against the
+	 *    producer's shape: the runner caches ONLY successful results
+	 *    (`ok === true`, string `text`), so entries failing that verdict
+	 *    allowlist/shape are DROPPED (the call re-executes on resume) and
+	 *    optional fields are stripped when mistyped. Anomalies are logged via
+	 *    logInternalError so quarantines are observable (not silently swallowed).
+	 *
+	 *  Returns undefined if missing/corrupt/tampered (fresh run). */
+	load(expectedRunId?: string): DwfCheckpointState | undefined {
 		const path = this.path;
 		try {
 			if (!existsSync(path)) return undefined;
 			const raw = readFileSync(path, "utf-8");
-			const parsed = JSON.parse(raw);
-			// Corrupt-guard: a valid checkpoint must be an object with a string runId
-			// (mirrors GoalStore.load's typeof parsed.goalId !== "string" check).
-			if (!parsed || typeof parsed !== "object" || typeof parsed.runId !== "string") return undefined;
+			const parsed: unknown = JSON.parse(raw);
+			// Corrupt-guard: a valid checkpoint must be a plain JSON object with a
+			// string runId (mirrors GoalStore.load's typeof parsed.goalId !== "string"
+			// check). Arrays and primitives are rejected outright.
+			if (!isPlainObject(parsed) || typeof parsed.runId !== "string") return undefined;
 			// R6-12: version guard, mirroring the recovery/checkpoint.ts runId-guard
 			// style (typed mismatch → treat as not-loadable). A checkpoint from an
 			// unknown FUTURE version is REJECTED (→ undefined → fresh run) rather than
@@ -110,7 +295,8 @@ export class DwfStore {
 				);
 				return undefined;
 			}
-			return parsed as DwfCheckpointState;
+			// w3-dwf-trust: bind + revalidate at the hydration boundary (never blind-cast).
+			return sanitizeCheckpoint(parsed, expectedRunId);
 		} catch {
 			return undefined;
 		}