toolroll 0.9.62 → 0.9.65

package/dist/invoke.js

@@ -16,8 +16,10 @@
  * (`adapterFor`), and only builder, planner, reviewer, and scout import
  * `invokeAgent`.
  */
-import { adapterFor, auditOf, isolationUnsupported } from "./provider.js";
+import { adapterFor, auditOf, claudePluginEnv, isolationUnsupported, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
+import { ACP_AGENTS, isAcpProvider, isKeyedProvider } from "./acp-agents.js";
+import { launchFromJson, verifyLaunch } from "./acp-attest.js";
 import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
@@ -26,11 +28,16 @@ import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
-import { noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { readFileSync, realpathSync } from "node:fs";
+import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
+import { mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { agentFence, linuxFenceAvailable, macosFenceAvailable, taskBoundary } from "./agent-fence.js";
+import { dirname, join } from "node:path";
+import { poolRootOf } from "./worktree.js";
+import { BRIDGE_DIR } from "./agent-fence.js";
+import { agentFence, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
+import { proxyEnv, providerOnlyNetwork, startEgressProxy } from "./egress.js";
+import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
+import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
  * describe history; new code carries a resolved AgentSpec instead. */
@@ -98,13 +105,6 @@ function transportSessionId(id) {
     const normalized = id.trim();
     return normalized === "" ? null : normalized;
 }
-/**
- * Spend money, on the record. Throws — never refuses quietly — when the run
- * is missing, already finished, or recorded against a different provider:
- * a caller that reaches for a harness without a matching open run is a
- * bug, not a case. Attestation and protocol refusals are VALUES (above),
- * not throws — those are cases, and they must dispose cleanly.
- */
 export async function invokeAgent(store, runId, spec, invocation, options) {
     const clock = options.clock ?? (() => new Date());
     if (options.accumulateUsage && (invocation.phase !== "review" || invocation.resumeSession === null)) {
@@ -173,7 +173,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // Tier-2 attestation (A2/B3): the authoritative check, immediately
     // before the spawn it authorizes. Tier-1 providers return null here and
     // keep their road byte-identical.
-    const attested = await attestProvider(spec.provider, adapter.binary, options.versionProbe);
+    // An ACP agent is admitted by its own record (acp-attest.ts), read below; the version ranges are for the others.
+    const attested = isAcpProvider(spec.provider) ? null : await attestProvider(spec.provider, adapter.binary, options.versionProbe);
     if (attested !== null && !attested.ok) {
         if (attested.version !== null)
             store.stampProviderVersion(runId, attested.version);
@@ -184,13 +185,61 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             diagnostic: attested.problem,
         };
     }
+    // AN ACP AGENT'S ADMISSION (docs/plans/acp-adapter.md § Admission): a passed conformance check of the exact binary
+    // on this runner, or nothing runs — absence is denial. It builds and repairs only, on a model it offered when it was
+    // checked, and no dollar cap rides it (it can't hold one; the scheduler refuses capped work first, this is the belt).
+    // An ACP spawn is admitted by its agent's attestation on this runner — or, for the conformance check alone, by the
+    // check request that will create it (acpCheck: set only by the check job). The two never stand in for each other.
+    const acpCheckAsk = options.acpCheck ?? null;
+    const acpAttestation = isAcpProvider(spec.provider) && acpCheckAsk === null ? store.acpAttestationFor(spec.provider, run.runner) : null;
+    const acpCheckRequest = isAcpProvider(spec.provider) && acpCheckAsk !== null ? store.acpCheckAdmitting(acpCheckAsk.requestId, acpCheckAsk.step, runId, clock()) : null;
+    const acpCheckLaunch = acpCheckRequest?.launchJson == null ? null : launchFromJson(acpCheckRequest.launchJson);
+    /** The plane's own isolation reading for a check's first step (below, before spawn); null when none was asked. */
+    let acpIsolation = null;
+    /** What starts the agent, and who the handshake must say it is (unknown, for a check: the check learns it). */
+    const acpLaunch = acpAttestation !== null ? acpAttestation.launch : acpCheckLaunch;
+    if (!isAcpProvider(spec.provider) && acpCheckAsk !== null)
+        throw new Error("only an ACP agent is checked");
+    if (isAcpProvider(spec.provider)) {
+        const name = ACP_AGENTS[spec.provider].name;
+        const refuse = (diagnostic) => ({ kind: "refused", reason: "provider-unattested", providerVersion: acpAttestation?.agent.version ?? null, diagnostic });
+        if (acpCheckAsk !== null) {
+            if (acpCheckRequest === null || acpCheckLaunch === null)
+                return refuse(`this check isn't running, has expired, lost its watch, or isn't this step's run`);
+            if (acpCheckRequest.provider !== spec.provider || acpCheckRequest.runner !== run.runner || acpCheckRequest.model !== spec.model || acpCheckRequest.taskRef !== run.taskRef) {
+                return refuse("this run isn't the check's: another agent, runner, model or task");
+            }
+            if (invocation.phase !== "build")
+                return refuse(`${name}'s check runs as a build`);
+        }
+        else {
+            if (acpAttestation === null)
+                return refuse(`${name} isn't checked on ${run.runner} — run \`toolroll agents check ${spec.provider}\` there`);
+            if (invocation.phase !== "build" && invocation.phase !== "repair")
+                return refuse(`${name} builds and repairs only`);
+            if (spec.model === null || !acpAttestation.models.includes(spec.model))
+                return refuse(`${name} didn't offer ${spec.model ?? "a model"} when it was checked — check it again, or choose one it offered`);
+        }
+        if (invocation.maxBudgetUsd !== undefined)
+            return refuse(`${name} can't hold a dollar cap, so it doesn't run capped work (budget-unenforceable)`);
+        // The billing the run was admitted under must be for the model about to be chosen.
+        const stamp = store.acpBillingOfRun(runId);
+        if (stamp !== null && stamp.model !== spec.model)
+            return refuse(`this run was admitted to bill ${stamp.model}, not ${spec.model}`);
+        // And the money moment holds it to the hard monthly budgets as stamped — immutable since admission, so a
+        // declaration changed between a gate and this spawn changes nothing: metered work a budget holds never starts.
+        const billed = stamp?.kind === "plan" ? "subscription" : "api-key";
+        const held = store.budgetGate(clock())({ ...store.budgetSubject(run.taskRef), agents: [{ provider: spec.provider, billing: billed }] });
+        if (held.over !== null)
+            return refuse(`a monthly budget holds metered work, and ${name} on ${spec.model ?? "this model"} is metered here (budget)`);
+    }
     // Auth mode decides how the credential reaches the process (the operator
     // keeps BOTH and prefers the subscription): in "api-key" mode the
     // managed file wins, the ambient env is a real fallback (explicit
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -211,9 +260,12 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         if (problem !== null)
             return { kind: "refused", reason: "auth-mode", providerVersion: attested?.version ?? null, diagnostic: problem };
     }
-    const ownKeyEnv = OWN_KEY_ENV[spec.provider];
-    const managedKey = authMode === "api-key"
-        ? readProviderKey(spec.provider, keyHome) ?? (process.env[PROVIDER_KEY_ENV[spec.provider]] || null)
+    // An ACP agent has no key Toolroll holds or injects: its own and everyone else's are shed (adapter.extraOmitEnv).
+    const keyed = isKeyedProvider(spec.provider) ? spec.provider : null;
+    const ownKeyEnv = keyed === null ? [] : OWN_KEY_ENV[keyed];
+    const keyEnvName = keyed === null ? null : PROVIDER_KEY_ENV[keyed];
+    const managedKey = authMode === "api-key" && keyed !== null && keyEnvName !== null
+        ? readProviderKey(keyed, keyHome) ?? (process.env[keyEnvName] || null)
         : null;
     // Resume XOR mint, enforced at the GATEWAY (Codex gemini verify round 2,
     // finding 3): a resume and a minted start id are mutually exclusive —
@@ -227,73 +279,6 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     if (startSessionId !== undefined) {
         store.stampRun(runId, { sessionId: startSessionId });
     }
-    // The stamp precedes the spawn, so a crash between the two leaves a run
-    // that claims spend which never happened — the honest direction. A spawn
-    // before the stamp would leave spend no record claims, which is the lie
-    // the invariant exists to rule out. For attested providers the probed
-    // version rides the SAME durable write (B2).
-    // The spawn leg of the runner gate (MCP spec v6, review finding 4):
-    // the tuple re-proven against LIVE rows AFTER every awaited step, in
-    // the same breath as the stamp — a takeover during the attestation
-    // await can no longer slip a stale process through.
-    // THE PLANNER'S ROUTE, RE-PROVED AT THE SPAWN (final authority closure):
-    // the provenance the planner was admitted under is held to the authority
-    // its task holds RIGHT NOW — the strict working projection of a filed
-    // scope (exact terms, resolved profile, route parity, digest,
-    // live auth mode), or the bare word `legacy` on a task with no scope. A
-    // scope rewritten, corrupted, or unresolved between the claim and this
-    // instant invokes no provider: a value-shaped refusal, no spend.
-    if (run.role === "planner") {
-        const proved = store.proveRouteForSpawn(runId, clock());
-        if (!proved.ok) {
-            return {
-                kind: "refused",
-                reason: "route-authority",
-                providerVersion: attested === null ? null : attested.version,
-                diagnostic: `the planner's route authority lapsed before spawn — ${proved.problem}`,
-            };
-        }
-    }
-    if (!store.proveRunnerCustodyForSpawn(runId, clock())) {
-        return {
-            kind: "refused",
-            reason: "runner-custody",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: "the run's runner custody lapsed before spawn — the lease, the runner, or its repo binding no longer stands",
-        };
-    }
-    // THE STOP FENCE at the spawn (v52): a stop recorded against this run
-    // — or the attempt it runs under — before this instant spawns nothing.
-    // A value-shaped refusal, no stamp, no process, no spend; the road's
-    // settlement seals the attempt as interrupted.
-    const stopBeforeSpawn = store.applicableStopFor(runId);
-    if (stopBeforeSpawn !== null) {
-        return {
-            kind: "refused",
-            reason: "stopped",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: `stopped by ${stopBeforeSpawn.requestedBy} (run #${stopBeforeSpawn.run}) before the provider spawned — nothing was spent`,
-        };
-    }
-    // THE CONTAINMENT FENCE at the spawn (OS containment plan): a required
-    // native policy this runner cannot meet — macOS, an undelegated cgroup,
-    // a missing helper — spawns nothing. A value-shaped refusal in the
-    // policy's own words, no stamp, no process, no spend.
-    const containment = currentContainment();
-    if (containment.refusal !== null) {
-        return {
-            kind: "refused",
-            reason: "containment",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: containment.refusal,
-        };
-    }
-    if (attested !== null)
-        store.stampProviderStart(runId, clock(), attested.version);
-    else
-        store.stampProviderStart(runId, clock());
-    // The brief is the live session's first message, queued before the spawn writes it.
-    liveInput?.begin(invocation.brief);
     const spawn = witnessedRunner(store, runId, clock, runner ?? adapter.defaultRunner);
     let transportAnnouncedSessionId = null;
     let transportSessionConflict = false;
@@ -304,23 +289,153 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // already ambient in the environment keeps working; the managed file,
     // being deliberate, wins.
     const isolatedDb = isolatedAgentDatabase(runId);
+    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
+    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
+    // How a tool server the broker starts is fenced: as its agent is, once that fence is fixed below.
+    let serverFence = null;
+    // The run's containment, fixed before any tool is prepared: this platform and the OS fence its run gets (a build
+    // has one wherever the plane has a database to fence). It decides which tools may hold secrets in a process the
+    // build could otherwise read; nothing the launch or the checkout writes feeds it.
+    const containment = { platform: process.platform, fence: invocation.phase === "review" ? "none" : fenceMethod(spec.provider, store.databaseFile() !== null) };
     // The project's tools (v80): exactly its MCP servers, and none of the
-    // operator's global or a repository's own. A review keeps its isolation.
-    const tools = invocation.phase === "review" ? null : runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld);
+    // operator's global or a repository's own, served by this launch's broker
+    // (tool-broker.ts), which alone holds their secrets. A review keeps its isolation.
+    const launchTools = invocation.phase === "review" ? null : await runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld, containment, {
+        env: { ...process.env, ...(runOptions.env ?? {}) },
+        omitEnv: [...(runOptions.omitEnv ?? []), ...ALL_CREDENTIAL_ENV],
+        pass: childDatabaseEnv(isolatedDb.file),
+        ...(workspace === null ? {} : { cwd: workspace }),
+        wrap: () => serverFence,
+    });
+    if (launchTools !== null && "refused" in launchTools) {
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: launchTools.refused };
+    }
+    const tools = launchTools;
+    const codexHarness = spec.provider === "codex" || spec.provider === "openrouter";
+    // A Codex build's own CODEX_HOME (provider-home.ts): the operator's sign-in and sessions, linked, and nothing else.
+    let codexHome = null;
+    if (codexHarness && invocation.phase !== "review") {
+        try {
+            codexHome = isolatedCodexHome(codexHomeDir({ ...process.env, ...(runOptions.env ?? {}) }, keyHome ?? homedir()));
+        }
+        catch {
+            tools?.cleanup();
+            removeAgentDatabase(isolatedDb.dir);
+            return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: "The build's private Codex home could not be created; check access to its sign-in and sessions folders, then retry." };
+        }
+    }
     // The agent fence: Toolroll's own secrets, database and other runs'
     // evidence stay out of reach, whatever the permission mode. A review is
     // already confined to its sealed files.
     // A build's fence also holds its task boundary: home configuration and
-    // the repositories beside its own, fresh and resumed alike.
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [] } : runFence(store, runId, spec.provider, options.keyHome);
-    const baseFence = fenceOf.fence;
-    const toolsDir = (spec.provider === "codex" || spec.provider === "openrouter") && baseFence.length > 0 ? tools?.privateDir : undefined;
-    const fence = toolsDir === undefined ? baseFence : [...baseFence, realpathSync(toolsDir)];
-    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
-    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
-    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }) };
+    // the repositories beside its own, fresh and resumed alike. Codex starts
+    // tool servers outside its command sandbox, so its own launch folder is
+    // fenced too; Claude reads its config from there, inside the sandbox.
+    const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools);
+    if (fenceOf.problem !== undefined) {
+        tools?.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: fenceOf.problem };
+    }
+    const fence = [...fenceOf.fence, ...(fenceOf.fence.length > 0 && codexHarness ? [ownTools, codexHome === null ? null : realpathSync(codexHome.dir)].filter((path) => path !== null) : [])];
+    const grants = { ...fenceOf.grants };
+    // The run's network (egress.ts): sealed by its approval, or the provider's hosts alone, or the caller's own proxy.
+    const network = launchNetwork ?? { policy: providerOnlyNetwork(spec.provider) };
+    // Codex's command sandbox has no proxy (its argv is fixed just below): its commands are online only for a sealed
+    // open network, and offline otherwise.
+    if (fence.length > 0 && codexHarness) {
+        grants.network = "policy" in network && network.policy.mode === "open" ? { mode: "open" }
+            : { mode: "allowlist", proxyPort: 0, brokerPorts: [], loopback: "proxy-only", socketRoots: [] };
+    }
+    const inherited = spec.model === null && invocation.phase !== "review" ? inheritedDefaults(spec.provider, { ...process.env, ...(runOptions.env ?? {}) }, keyHome ?? homedir()) : undefined;
+    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fenceGrants: grants, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }), ...(inherited === undefined ? {} : { inherited }) };
     const launchArgv = tools === null ? argv : adapter.argv(buildInvocation);
     const fenced = fenceLaunch(spec.provider, fence);
+    // An ACP agent runs only inside the OS fence: nothing else holds it (it may run commands without asking).
+    if (isAcpProvider(spec.provider) && fenced.method !== "macos-sandbox" && fenced.method !== "linux-bubblewrap") {
+        tools?.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: acpAttestation?.agent.version ?? null, diagnostic: `${ACP_AGENTS[spec.provider].name} runs only inside the OS fence (the macOS sandbox or bubblewrap), and this launch has neither (fence-unavailable)` };
+    }
+    // The tools were chosen for the fence decided above: a launch that got any other starts nothing.
+    // Only a prepared project-tool broker depends on the earlier decision. Empty Claude configs also have a privateDir.
+    if (tools?.serverPids !== undefined && fenced.method !== containment.fence) {
+        tools.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: "The build's fence changed while its tools were prepared. Nothing was started; retry the task." };
+    }
+    // A tool server the broker starts is fenced by what this platform supports, whatever the provider: Codex's own
+    // profile fences only its agent's commands, and the broker starts servers outside it.
+    if (fence.length > 0) {
+        // A tool server keeps its own reach (it holds its tool's secrets, not the agent's code): never the agent's network.
+        const serverGrants = () => { const { network: _agentOnly, ...rest } = grants; return rest; };
+        if (macosFenceAvailable())
+            serverFence = (file, args) => macosFenced(file, args, fence, serverGrants());
+        else if (linuxFenceAvailable())
+            serverFence = (file, args) => linuxFenced(file, args, fence, serverGrants());
+    }
+    // No silent fallback (arc 1): a build this machine can't confine at the OS — Claude reduced to its own file-tool
+    // rules, Gemini to nothing — doesn't start unless the instance operator allowed unconfined agents here. An injected
+    // runner (tests) starts no real agent.
+    const unconfined = fence.length > 0 && (fenced.method === "claude-rules" || fenced.method === "none");
+    if (unconfined && runner === undefined && !store.unfencedAgentsAllowed()) {
+        tools?.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
+            diagnostic: "This machine can't confine an agent (no macOS sandbox, no working bubblewrap), so nothing was started. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`." };
+    }
+    let egress = null;
+    let bridge = null;
+    let runTemp = null;
+    const confinedOs = fenced.method === "macos-sandbox" || fenced.method === "linux-bubblewrap";
+    if (fence.length > 0 && !codexHarness && confinedOs) {
+        const brokerPorts = tools?.brokerPort === undefined ? [] : [tools.brokerPort];
+        // Unix sockets only under this run's own folders: its checkout, and a temp folder of its own inside its private
+        // launch folder (the system temp folder holds other programs' sockets — editors, agents, password managers).
+        if (ownTools !== null) {
+            runTemp = join(ownTools, "tmp");
+            mkdirSync(runTemp, { recursive: true, mode: 0o700 });
+        }
+        const socketRoots = [...(runTemp === null ? [] : [runTemp]), ...(workspace === null ? [] : [realpathSync(workspace)])];
+        try {
+            if ("via" in network) {
+                const [proxyPort, ...more] = network.via;
+                grants.network = { mode: "allowlist", proxyPort: proxyPort ?? 0, brokerPorts: [...more, ...brokerPorts], loopback: "proxy-only", socketRoots };
+            }
+            else if (network.policy.mode === "open") {
+                grants.network = { mode: "open" };
+            }
+            else {
+                egress = await startEgressProxy({ hosts: network.policy.hosts });
+                grants.network = { mode: "allowlist", proxyPort: egress.port, brokerPorts, loopback: network.policy.loopback, socketRoots };
+            }
+            if (fenced.method === "linux-bubblewrap" && grants.network.mode === "allowlist") {
+                const database = store.databaseFile();
+                // The plane's own fenced folder, unless a socket there would be too long a path (a unix socket's path is capped
+                // near 100 bytes): then the system temp folder, which a confined Linux build doesn't see (its /tmp is its own).
+                const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
+                bridge = await startEgressBridge([grants.network.proxyPort, ...grants.network.brokerPorts], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
+                grants.network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
+                // Its private /tmp gives back only its own folders: its checkout and its launch folder (its temp is inside).
+                grants.network.keep = [...(workspace === null ? [] : [realpathSync(workspace)]), ...(ownTools === null ? [] : [ownTools]), ...(fenceOf.gitPaths ?? [])];
+            }
+        }
+        catch (error) {
+            await egress?.close();
+            await bridge?.close();
+            tools?.cleanup();
+            codexHome?.cleanup();
+            removeAgentDatabase(isolatedDb.dir);
+            return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
+                diagnostic: `The build's network could not be set up, so nothing was started: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
     if (invocation.phase !== "review")
         store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
     const billingSeen = { keySource: null, model: null, planWindows: false, answered: false };
@@ -329,87 +444,248 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     const codexLogin = spec.provider === "codex" && authMode === "subscription" && runner === undefined
         ? await codexLoginBilling(attested !== null ? attested.executable : adapter.binary, [...(runOptions.omitEnv ?? []), ...adapter.extraOmitEnv, ...ownKeyEnv])
         : null;
+    const childEnv = {
+        ...(runOptions.env ?? {}),
+        ...(adapter.env?.(buildInvocation) ?? {}),
+        ...(tools?.env ?? {}),
+        // A fenced build's git never expires a reflog, so gc never rewrites another task's (agent-fence.ts).
+        ...(fence.length > 0 ? fencedGitEnv({ ...process.env, ...(runOptions.env ?? {}) }) : {}),
+        ...(codexHome === null ? {} : { CODEX_HOME: codexHome.dir }),
+        ...(managedKey === null || keyEnvName === null ? {} : { [keyEnvName]: managedKey }),
+        // The run's own proxy, in every spelling a program reads (egress.ts): after every other setting, so no caller's
+        // environment points the build around it. A program that ignores them is refused by the OS fence instead.
+        ...(egress === null || !("policy" in network) ? {} : proxyEnv(egress, network.policy.loopback)),
+        // Its own temp folder, where its tools' sockets may live (the only one its fence admits besides its checkout).
+        ...(runTemp === null ? {} : { TMPDIR: runTemp, TMP: runTemp, TEMP: runTemp }),
+        // This key is deliberately last: no caller may point an agent back at
+        // the live control database through a generic RunOptions override.
+        ...childDatabaseEnv(isolatedDb.file),
+    };
+    const childOmitEnv = [
+        ...(runOptions.omitEnv ?? []),
+        ...adapter.extraOmitEnv,
+        // A Claude build loads no plugin, from settings or the environment (a review's safe mode already loads none).
+        ...(spec.provider === "claude" && invocation.phase !== "review" ? claudePluginEnv({ ...process.env, ...(runOptions.env ?? {}) }) : []),
+        // Subscription mode: shed this provider's OWN key too, so an ambient
+        // one cannot force API billing over the login the operator prefers.
+        // Api-key mode: shed every OTHER own-key alias (finding 1) — gemini
+        // reads GOOGLE_API_KEY as well as GEMINI_API_KEY, and a stray alias
+        // must not override the ONE canonical key this mode injected.
+        ...(authMode === "subscription"
+            ? ownKeyEnv
+            : ownKeyEnv.filter(name => name !== keyEnvName)),
+    ];
+    const launchOptions = {
+        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants }),
+        ...runOptions,
+        ...(workspace === null ? {} : { cwd: workspace }),
+        // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
+        onStreamEvent: event => {
+            if (event["type"] === "system" && event["subtype"] === "init") {
+                if (typeof event["apiKeySource"] === "string")
+                    billingSeen.keySource = event["apiKeySource"].slice(0, 80);
+                if (typeof event["model"] === "string")
+                    billingSeen.model = event["model"].slice(0, 200);
+            }
+            else if (event["type"] === "rate_limit_event") {
+                billingSeen.planWindows = true;
+            }
+            else if (event["type"] === "result" && event["is_error"] !== true && event["subtype"] === "success") {
+                billingSeen.answered = true;
+            }
+            runOptions.onStreamEvent?.(event);
+        },
+        owner: runOwnerTag(store, runId),
+        beforeSpawn: () => store.applicableStopFor(runId) === null && store.getRun(runId)?.outcome === null,
+        onSpawn: pid => {
+            runOptions.onSpawn?.(pid);
+            if (store.applicableStopFor(runId) !== null)
+                throw new Error("the attempt was stopped before spawn custody completed");
+        },
+        ...(stdin === undefined ? {} : { stdin }),
+        ...(liveInput === null ? {} : { liveInput }),
+        // One ACP conversation: the brief, the sealed model, and who the check says the agent is.
+        ...(acpLaunch === null || spec.model === null ? {} : { acp: { prompt: buildInvocation.brief, model: spec.model, expect: acpAttestation?.agent ?? null, ...(runOptions.acp?.onControl === undefined ? {} : { onControl: runOptions.acp.onControl }), ...(runOptions.acp?.handshakeMs === undefined ? {} : { handshakeMs: runOptions.acp.handshakeMs }) } }),
+        ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
+        ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
+        ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
+        env: childEnv,
+        omitEnv: childOmitEnv,
+        // Providers run in their own process group (M6.12): the harness spawns
+        // shells and tools of its own, and both the timeout and the watch's
+        // hard stop must end the whole tree, not orphan the grandchildren.
+        processGroup: true,
+        // The session registry's crash guarantee (M6.9): the id is stamped the
+        // moment the stream announces it, first write wins — a daemon that
+        // dies mid-turn still knows which session to offer the successor.
+        onSessionId: id => {
+            const normalized = transportSessionId(id);
+            if (normalized === null)
+                return;
+            if (transportAnnouncedSessionId === null)
+                transportAnnouncedSessionId = normalized;
+            else if (transportAnnouncedSessionId !== normalized)
+                transportSessionConflict = true;
+            store.stampRun(runId, { sessionId: normalized });
+        },
+    };
     let result;
-    const spawnedAt = Date.now();
+    let spawnedAt;
     try {
+        if (fence.length > 0 && workspace !== null && (codexHarness || launchOptions.fence !== undefined)) {
+            const inheritedEnv = launchOptions.envAllowlist === undefined ? process.env
+                : Object.fromEntries(launchOptions.envAllowlist.map(name => [name, process.env[name]]));
+            const probeOptions = {
+                cwd: workspace, env: checkoutGitEnv({ ...inheritedEnv, ...childEnv }), omitEnv: childOmitEnv, envAllowlist: [],
+            };
+            // A broken checkout is not evidence of a broken fence. No provider is invoked by either check.
+            const gitArgs = [...HARDENED_GIT_ARGS, "rev-parse", "HEAD"];
+            const control = await runCommand("git", gitArgs, probeOptions);
+            if (control.code === 0) {
+                const executable = attested !== null ? attested.executable : adapter.binary;
+                const insideFence = (file, args) => codexHarness
+                    ? runCommand(executable, ["sandbox", ...codexFenceArgv(fence, invocation.skipPermissions, grants),
+                        "-P", "standing-orders", "--", file, ...args], probeOptions)
+                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence,
+                        ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }) });
+                const check = await insideFence("git", gitArgs);
+                if (check.code !== 0) {
+                    const trivial = await insideFence("true", []);
+                    if (trivial.code === 0)
+                        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
+                            diagnostic: "The build fence blocks this checkout's own Git data.\n\nDetails:\n" + check.stderr.slice(0, 2000) + "\nDenied paths:\n" + fence.join("\n").slice(0, 12000) };
+                }
+            }
+        }
+        // THE CHECK'S ISOLATION, PROVEN BY THE PLANE (docs/plans/acp-adapter.md § Layer E): inside the exact fence and
+        // child environment the agent is about to get, a canary file in the fenced state must be unreadable and a canary
+        // key in the launching environment must be absent. No agent takes part, so no agent can fake it.
+        if (acpCheckAsk?.isolation !== undefined && launchOptions.fence !== undefined && workspace !== null) {
+            // processGroup: run() applies the fence only on the process-group road (a plain execFile carries none).
+            const probe = { cwd: workspace, env: childEnv, omitEnv: childOmitEnv, fence: launchOptions.fence, ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }), timeoutMs: 15_000, processGroup: true };
+            const read = await runCommand("/bin/cat", [acpCheckAsk.isolation.file], probe);
+            const env = await runCommand("/usr/bin/env", [], probe);
+            acpIsolation = {
+                fileDenied: read.code !== 0 && !read.stdout.includes(acpCheckAsk.isolation.fileCanary),
+                envClear: env.code === 0 && !env.stdout.includes(acpCheckAsk.isolation.envValue),
+            };
+        }
+        // The stamp precedes the spawn, so a crash between the two leaves a run
+        // that claims spend which never happened — the honest direction. A spawn
+        // before the stamp would leave spend no record claims, which is the lie
+        // the invariant exists to rule out. For attested providers the probed
+        // version rides the SAME durable write (B2).
+        // The spawn leg of the runner gate (MCP spec v6, review finding 4):
+        // the tuple re-proven against LIVE rows AFTER every awaited step, in
+        // the same breath as the stamp — a takeover during the attestation
+        // await can no longer slip a stale process through.
+        // THE PLANNER'S ROUTE, RE-PROVED AT THE SPAWN (final authority closure):
+        // the provenance the planner was admitted under is held to the authority
+        // its task holds RIGHT NOW — the strict working projection of a filed
+        // scope (exact terms, resolved profile, route parity, digest,
+        // live auth mode), or the bare word `legacy` on a task with no scope. A
+        // scope rewritten, corrupted, or unresolved between the claim and this
+        // instant invokes no provider: a value-shaped refusal, no spend.
+        if (run.role === "planner") {
+            const proved = store.proveRouteForSpawn(runId, clock());
+            if (!proved.ok) {
+                return {
+                    kind: "refused",
+                    reason: "route-authority",
+                    providerVersion: attested === null ? null : attested.version,
+                    diagnostic: `the planner's route authority lapsed before spawn — ${proved.problem}`,
+                };
+            }
+        }
+        if (!store.proveRunnerCustodyForSpawn(runId, clock())) {
+            return {
+                kind: "refused",
+                reason: "runner-custody",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: "the run's runner custody lapsed before spawn — the lease, the runner, or its repo binding no longer stands",
+            };
+        }
+        // THE STOP FENCE at the spawn (v52): a stop recorded against this run
+        // — or the attempt it runs under — before this instant spawns nothing.
+        // A value-shaped refusal, no stamp, no process, no spend; the road's
+        // settlement seals the attempt as interrupted.
+        const stopBeforeSpawn = store.applicableStopFor(runId);
+        if (stopBeforeSpawn !== null) {
+            return {
+                kind: "refused",
+                reason: "stopped",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: `stopped by ${stopBeforeSpawn.requestedBy} (run #${stopBeforeSpawn.run}) before the provider spawned — nothing was spent`,
+            };
+        }
+        // THE CONTAINMENT FENCE at the spawn (OS containment plan): a required
+        // native policy this runner cannot meet — macOS, an undelegated cgroup,
+        // a missing helper — spawns nothing. A value-shaped refusal in the
+        // policy's own words, no stamp, no process, no spend.
+        const containment = currentContainment();
+        if (containment.refusal !== null) {
+            return {
+                kind: "refused",
+                reason: "containment",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: containment.refusal,
+            };
+        }
+        // The ACP launch re-proved HERE, after every await: each bound file is still the one that passed its check.
+        if (acpCheckAsk !== null && acpCheckRequest !== null && acpCheckLaunch !== null) {
+            // The check request is read again here, after every await: still running, unexpired, owned, this step's run.
+            const still = store.acpCheckAdmitting(acpCheckAsk.requestId, acpCheckAsk.step, runId, clock());
+            if (still === null || still.launchJson !== acpCheckRequest.launchJson) {
+                return { kind: "refused", reason: "provider-unattested", providerVersion: null, diagnostic: "the check stopped admitting this run while it was being set up — nothing was started" };
+            }
+            const verified = verifyLaunch(acpCheckLaunch);
+            if (!verified.ok)
+                return { kind: "refused", reason: "provider-unattested", providerVersion: null, diagnostic: verified.problem };
+        }
+        if (acpAttestation !== null) {
+            // The record is read again here, after every await: a check revoked or replaced during setup starts nothing.
+            const live = store.acpAttestationFor(spec.provider, run.runner);
+            if (live === null || live.id !== acpAttestation.id) {
+                return { kind: "refused", reason: "provider-unattested", providerVersion: acpAttestation.agent.version, diagnostic: `${ACP_AGENTS[spec.provider].name}'s check was revoked or replaced while this run was being set up — nothing was started` };
+            }
+            const verified = verifyLaunch(live.launch);
+            if (!verified.ok) {
+                return { kind: "refused", reason: "provider-unattested", providerVersion: acpAttestation.agent.version, diagnostic: verified.problem };
+            }
+        }
+        if (attested !== null)
+            store.stampProviderStart(runId, clock(), attested.version);
+        else if (acpAttestation !== null)
+            store.stampProviderStart(runId, clock(), acpAttestation.agent.version);
+        else
+            store.stampProviderStart(runId, clock());
+        // The brief is queued only once the checkout has passed the fence check.
+        liveInput?.begin(invocation.brief);
+        spawnedAt = Date.now();
         // Under the stop watch (v52): the run's stop row is re-read while the
         // provider runs, and a stop kills THIS run's process group through the
         // handle registered under its owner tag — the exact-attempt road,
         // never the global sweep. Settlement then reads the same row.
-        result = await underStopWatch(store, runId, () => spawn(attested !== null ? attested.executable : adapter.binary, launchArgv, {
-            ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap }),
-            ...runOptions,
-            // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
-            onStreamEvent: event => {
-                if (event["type"] === "system" && event["subtype"] === "init") {
-                    if (typeof event["apiKeySource"] === "string")
-                        billingSeen.keySource = event["apiKeySource"].slice(0, 80);
-                    if (typeof event["model"] === "string")
-                        billingSeen.model = event["model"].slice(0, 200);
-                }
-                else if (event["type"] === "rate_limit_event") {
-                    billingSeen.planWindows = true;
-                }
-                else if (event["type"] === "result" && event["is_error"] !== true && event["subtype"] === "success") {
-                    billingSeen.answered = true;
-                }
-                runOptions.onStreamEvent?.(event);
-            },
-            owner: runOwnerTag(store, runId),
-            beforeSpawn: () => store.applicableStopFor(runId) === null && store.getRun(runId)?.outcome === null,
-            onSpawn: pid => {
-                runOptions.onSpawn?.(pid);
-                if (store.applicableStopFor(runId) !== null)
-                    throw new Error("the attempt was stopped before spawn custody completed");
-            },
-            ...(stdin === undefined ? {} : { stdin }),
-            ...(liveInput === null ? {} : { liveInput }),
-            ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
-            ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
-            ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
-            env: {
-                ...(runOptions.env ?? {}),
-                ...(adapter.env?.(buildInvocation) ?? {}),
-                ...(tools?.env ?? {}),
-                ...(managedKey === null ? {} : { [PROVIDER_KEY_ENV[spec.provider]]: managedKey }),
-                // This key is deliberately last: no caller may point an agent back at
-                // the live control database through a generic RunOptions override.
-                ...childDatabaseEnv(isolatedDb.file),
-            },
-            omitEnv: [
-                ...(runOptions.omitEnv ?? []),
-                ...adapter.extraOmitEnv,
-                // Subscription mode: shed this provider's OWN key too, so an ambient
-                // one cannot force API billing over the login the operator prefers.
-                // Api-key mode: shed every OTHER own-key alias (finding 1) — gemini
-                // reads GOOGLE_API_KEY as well as GEMINI_API_KEY, and a stray alias
-                // must not override the ONE canonical key this mode injected.
-                ...(authMode === "subscription"
-                    ? ownKeyEnv
-                    : ownKeyEnv.filter(name => name !== PROVIDER_KEY_ENV[spec.provider])),
-            ],
-            // Providers run in their own process group (M6.12): the harness spawns
-            // shells and tools of its own, and both the timeout and the watch's
-            // hard stop must end the whole tree, not orphan the grandchildren.
-            processGroup: true,
-            // The session registry's crash guarantee (M6.9): the id is stamped the
-            // moment the stream announces it, first write wins — a daemon that
-            // dies mid-turn still knows which session to offer the successor.
-            onSessionId: id => {
-                const normalized = transportSessionId(id);
-                if (normalized === null)
-                    return;
-                if (transportAnnouncedSessionId === null)
-                    transportAnnouncedSessionId = normalized;
-                else if (transportAnnouncedSessionId !== normalized)
-                    transportSessionConflict = true;
-                store.stampRun(runId, { sessionId: normalized });
-            },
-        }));
+        // An ACP agent starts through its attested launch (the pinned interpreter for a script), never a PATH lookup.
+        result = await underStopWatch(store, runId, () => acpLaunch !== null
+            ? spawn(acpLaunch.file, [...acpLaunch.prefix, ...launchArgv], launchOptions)
+            : spawn(attested !== null ? attested.executable : adapter.binary, launchArgv, launchOptions));
     }
     finally {
         removeAgentDatabase(isolatedDb.dir);
         tools?.cleanup();
+        codexHome?.cleanup();
+        // What the run's proxy saw (shown on its result): connections it made and refused. A connection the OS refused
+        // outright never reached it, and isn't counted.
+        if (invocation.phase !== "review" && grants.network !== undefined) {
+            store.recordRunNetwork(runId, {
+                mode: grants.network.mode, phase: "agent",
+                ...("via" in network ? { via: true } : { hosts: network.policy.hosts.length, loopback: network.policy.loopback }),
+                ...(egress === null ? {} : { counts: egress.counts() }),
+            }, clock());
+        }
+        await egress?.close();
+        await bridge?.close();
     }
     // v105: the run's billing, fixed from evidence before its usage is priced: a key it was given is a key; otherwise
     // what the CLI said (Claude's stream) or was last seen doing (Codex's account), and the setting only when neither.
@@ -421,12 +697,17 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     if (spec.provider === "claude" && managedKey === null && authMode === "subscription" && billingSeen.answered && evidence !== null) {
         store.recordProviderBilling("claude", evidence, new Date());
     }
-    store.fixRunBilling(runId, authMode === "api-key" ? "api-key" : evidence ?? billingOf(spec.provider, store.handle), new Date());
+    // An ACP run bills as its admission stamp says (store.acpBillingOfRun): its agent's own plan, or metered.
+    const acpBilling = isAcpProvider(spec.provider) ? (store.acpBillingOfRun(runId)?.kind === "plan" ? "subscription" : "api-key") : null;
+    store.fixRunBilling(runId, acpBilling ?? (authMode === "api-key" ? "api-key" : evidence ?? billingOf(spec.provider, store.handle)), new Date());
     const envelope = adapter.parse(result.stdout);
+    store.stampAgentReportedUsage(runId, envelope.agentReportedUsage ?? null);
     // An installed CLI too old for a build's own setup refuses its flags
     // before it starts: nothing ran, and the run says what to update.
     const unsupported = result.code !== 0 && envelope.initObserved !== true && invocation.phase !== "review" ? isolationUnsupported(spec.provider, result.stderr) : null;
     if (unsupported !== null) {
+        // The CLI refused its flags before any model turn: the run never started, whatever the stamp said.
+        store.withdrawProviderStart(runId);
         return { kind: "refused", reason: "provider-unattested", providerVersion: attested === null ? null : attested.version, diagnostic: unsupported };
     }
     // The callback is the crash-safe early stamp; the parsed envelope is the
@@ -466,6 +747,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         ...(envelope.tokensOut === null ? {} : { tokensOut: envelope.tokensOut + (options.accumulateUsage ? run.tokensOut ?? 0 : 0) }),
         ...(costUsd === null ? {} : { costUsd: costUsd + (options.accumulateUsage ? run.costUsd ?? 0 : 0) }),
         ...(usageJson === null ? {} : { usageJson }),
+        // How many agent turns it took, where the provider reports it (docs/plans/run-efficiency.md); unknown stays NULL.
+        ...(envelope.ending?.turns == null ? {} : { agentTurns: envelope.ending.turns + (options.accumulateUsage ? run.agentTurns ?? 0 : 0) }),
     });
     // How the attempt ended, classified HERE where the structural terminal
     // still exists; a sign-in that no longer works pauses its provider.
@@ -493,6 +776,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             providerVersion: attested === null ? null : attested.version,
             diagnostic: envelope.protocolError,
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
         };
     }
     // The minted-identity proof (A5): once the harness initialized, the id
@@ -510,6 +794,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 ? "the harness initialized without announcing its session id"
                 : "the harness announced a session id different from the one it was started under",
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
         };
     }
     // An early transport announcement, a pre-existing resume identity, and
@@ -523,6 +808,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             providerVersion: attested === null ? null : attested.version,
             diagnostic: sessionIdentityProblem,
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
         };
     }
     // A provider's explicit failure terminal always wins over its process exit
@@ -535,6 +821,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             providerVersion: attested === null ? null : attested.version,
             diagnostic: "the provider reported a failed terminal despite exiting with code 0",
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
         };
     }
     // The terminal contract (A4): when the audit requires it, a zero exit is
@@ -554,6 +841,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                     ? "the harness exited 0 without its success terminal — the stream ended mid-protocol"
                     : "the harness exited 0 without ever initializing"),
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
         };
     }
     // A run that worked proves its provider's sign-in works: a sign-in pause
@@ -573,7 +861,9 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             notFound: result.notFound,
             sessionId: envelope.sessionId,
             finalMessage: envelope.finalMessage,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
             structuredOutput: envelope.structuredOutput ?? null,
+            ...(envelope.acp === undefined ? {} : { acp: { ...envelope.acp, ...(acpIsolation === null ? {} : { isolation: acpIsolation }) } }),
             ending: envelope.ending ?? null,
             usage: {
                 tokensIn: envelope.tokensIn,
@@ -608,44 +898,82 @@ function usageOf(raw) {
         return {};
     }
 }
+/** What the plane recorded of a checkout's setup: its project and the setup stamped on it (null: none recorded). */
+function linkedFor(store, worktree) {
+    const row = worktree === null ? null : store.getWorktree(worktree);
+    return row === null ? null : { repo: row.repo, setupDigest: row.setupDigest ?? null };
+}
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
- * ~/.toolroll (or its older name), and its task boundary; plus what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome) {
+ * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
+ * (FenceGrants); and what only Claude's file tools refuse. */
+function runFence(store, runId, provider, keyHome, ownTools) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
-            return { fence: [], fileTools: [] };
+            return { fence: [], fileTools: [], grants: NO_GRANTS };
         const worktree = store.getRun(runId)?.worktree ?? null;
         const home = keyHome === undefined ? {} : { home: keyHome };
-        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home });
-        return { fence: agentFence({ databaseFile, worktree, ...home, boundary }), fileTools: boundary?.fileTools ?? [] };
+        const row = worktree === null ? null : store.getWorktree(worktree);
+        if (worktree !== null && row === null)
+            throw new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
+        const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+        const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding });
+        const folders = runFolders(ownTools);
+        return {
+            fence: agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders }),
+            fileTools: boundary?.fileTools ?? [],
+            // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
+            // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
+            // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
+            grants: fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home,
+                poolRoots }),
+            // The checkout's own Git data, which a private /tmp gives back beside the checkout (agent-fence.ts linuxFenced).
+            gitPaths: binding === null ? [] : [binding.gitdir, join(binding.main, ".git")],
+        };
     }
-    catch {
-        return { fence: [], fileTools: [] };
+    catch (error) {
+        return { fence: [], fileTools: [], grants: NO_GRANTS, problem: error instanceof CheckoutBindingError ? error.message : "The build fence could not be prepared." };
     }
 }
+/** The operator's own model choices a build routed with no model keeps (provider-home.ts). */
+function inheritedDefaults(provider, env, home) {
+    if (provider === "claude")
+        return claudeDefaults(claudeConfigDir(env, home));
+    if (provider === "codex")
+        return codexDefaults(codexHomeDir(env, home));
+    return undefined;
+}
 /** How the fence reaches a provider: Codex through its own sandbox profile
  * (already in its argv; wrapping it would nest sandboxes), Claude and
  * Gemini inside the macOS sandbox the spawn road applies (`wrap`), Claude
  * elsewhere through its own file-tool rules only. */
 function fenceLaunch(provider, fence) {
-    if (fence.length === 0)
-        return { wrap: [], method: "none" };
+    const method = fenceMethod(provider, fence.length > 0);
+    return { wrap: method === "macos-sandbox" || method === "linux-bubblewrap" ? fence : [], method };
+}
+/** The fence a launch gets, from its provider, whether it has anything to fence, and what this platform supports. */
+function fenceMethod(provider, fenced) {
+    if (!fenced)
+        return "none";
     if (provider === "codex" || provider === "openrouter")
-        return { wrap: [], method: "codex-profile" };
+        return "codex-profile";
     if (macosFenceAvailable())
-        return { wrap: fence, method: "macos-sandbox" };
+        return "macos-sandbox";
     if (linuxFenceAvailable())
-        return { wrap: fence, method: "linux-bubblewrap" };
-    return { wrap: [], method: provider === "claude" ? "claude-rules" : "none" };
+        return "linux-bubblewrap";
+    return provider === "claude" ? "claude-rules" : "none";
 }
 /** One launch's tools, or — when they cannot be prepared — the same isolation with none, never the operator's global servers. */
-function runTools(store, runId, spec, keyHome, clock, readOnly, withheld) {
+async function runTools(store, runId, spec, keyHome, clock, readOnly, withheld, containment, broker) {
     try {
-        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
+        return await prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), containment, ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }), broker });
     }
-    catch {
+    catch (error) {
+        // Sign-ins made for this run couldn't all be kept (and were revoked): it doesn't start.
+        if (error instanceof RunSignInError)
+            return { refused: error.message };
         return noToolsArgs(spec.provider);
     }
 }