phase-loop-runtime 0.7.23__tar.gz → 0.7.24__tar.gz

{phase_loop_runtime-0.7.23/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.23
+Version: 0.7.24
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -50,7 +50,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.23      # …or pin an exact version
+pip install phase-loop-runtime==0.7.24      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.23      # …or pin an exact version
+pip install phase-loop-runtime==0.7.24      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.23"
+version = "0.7.24"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -156,6 +156,7 @@ phase_loop_runtime = [
 markers = [
     "dotfiles_integration: test requires a dotfiles fleet tree (skipped standalone)",
     "quarantine(reason): known flake tracked by an OPEN issue; deselected on pull-request CI only (agent-harness#1029)",
+    "host_seat_credentials: live jailed-seat test that reads the host's Claude login and seat-jail state (agent-harness#1132)",
 ]
 
 [tool.setuptools.data-files]

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.23"
+__version__ = "0.7.24"

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -563,6 +563,15 @@ only in a private 0600 per-leg file under the run's stream dir (`leg-logs/`, 070
 reasons or the board summary. Its name carries only closed fields:
 `leg-logs/<registry harness | leg>-<24 hex>.log`.
 
+**Seat-jail codes (agent-harness#1132, F030).** Every seat-jail notice code is an exact
+literal of `_HARNESS_DETAIL_CODES`: `seat_sandbox_unavailable_{host,seat_uid,tiocsti}`,
+`seat_sandbox_not_staged`, each `seat_sandbox_refused:<sub>` as its own literal
+(`jail_build`, `namespace`, `identity`, `preseed`, `token_file_unsafe`,
+`gemini_credential_unsafe`, `stage_not_private`, `stage_changed`, `output_unsafe`),
+`seat_sandbox_retained_after_teardown`, and the `claude_seat_*` / `gemini_seat_*` codes. No
+regex template admits a seat code, and there is no parallel vocabulary: `seat_jail.NOTICES`
+only renders each code's literal what/why/fix, and a test holds the two sets equal.
+
 **Threat model.** I3 defends against untrusted TEXT: CLI stdout/stderr, leg bodies, exception messages and PTY output. None of it can choose or enter `detail`. In-process Python code is trusted runtime code and is out of scope: it can do anything (for example `object.__setattr__` on arbitrary objects, or replacing this module's functions). The exact-type checks (`PanelLegResult` refuses any subclass instance; only an exact `_HarnessCode` / `_LegFailure` has provenance; contents are read with `str.__str__` and re-created as a fresh `_HarnessCode`) close the cheap structural bypasses, but they are not a sandbox against hostile in-process code.
 
 ## ABDMODE — Purpose-derived default mode + advisory prompt hygiene · `panel_invoker.py` (#107)
@@ -889,8 +898,9 @@ set `gemini_heartbeat.QUALIFIED_IMAGES`: 1.2.11 SHA256
 `ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56`, 1.2.12 SHA256
 `ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`, 1.2.14 SHA256
 `0d0d3eba22daf29504dd290151c7ed9a4d33b0c6aa0acfc5da27bc3b01d2f029`, 1.2.15 SHA256
-`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164` or 1.2.16 SHA256
-`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86`. Each member
+`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164`, 1.2.16 SHA256
+`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86` or 1.2.17 SHA256
+`c54ef90651a8646ae67334d39212c81f5946feec373ad6aa335f9ef401662bc5`. Each member
 carries its measured help digest and has its own qualification record; the
 evidence catalog and the runtime set must name exactly the same members.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
@@ -1043,6 +1053,281 @@ A non-release `agy` image is admitted only by verifying it, never by trusting it
   created PR back (the PR body's copy is display-only). "Up to date" requires that local record, `headRefOid` and `ls-remote` to
   agree. It refuses when it cannot prove its open-PR listing complete.
 
+## SEATJAIL — Full-permission review seats inside a per-seat jail (agent-harness#1132)
+
+Plan: `plans/detailed-seat-sandbox-permissions-1132-20260928.md`. Maintainer decisions D1-D8
+are recorded on agent-harness#1132.
+
+- **Route (J7).** A production brokered Claude or Gemini leg decides its route once, after
+  the public-entry authorization and before staging, in this order; the first failure wins
+  and yields exactly one code: (0) no staged tree -> `seat_sandbox_not_staged`; (1) a
+  recorded Gemini P4/P3 stop -> its code (today `gemini_seat_egress_unconfined`: the agy
+  token carries `cloud-platform`, and the "prove then enable" containment probe found jail
+  egress not limited to agy's inference hosts; P3 was not run and the tooled profile is not
+  built); (2) host capability -> `seat_sandbox_unavailable_host`,
+  `_tiocsti`, or `_seat_uid`; (3) credential presence -> `claude_seat_token_missing` /
+  `gemini_seat_credential_missing`; (4) Gemini tooled qualification ->
+  `gemini_seat_profile_unqualified`. Steps 0-4 send the seat to the sealed inline route,
+  byte-identical to before, with that notice, except a Claude seat's step 3, which is not
+  run (plan amendment A3b, below). Codex and grok are not jailed
+  (agent-harness#895) and carry `seat_filesystem_unconfined` when given a tree.
+- **No sealed fallback for a jail-eligible seat (plan amendment A3b).** A Claude seat that
+  would take the jailed route but cannot (no credential, a failed first-use qualification,
+  a login not renewed within the wait, an unqualified or unsafe gate, an unsafe override)
+  is DEGRADED and NOT RUN, typed, with a fix. It is never a toolless substitute.
+  `seat_jail.JAIL_NOT_RUN_CODES` names the route codes this applies to; none of them is in
+  `SEALED_FALLBACK_CODES`. The sealed route stays for hosts without the jail prerequisites,
+  an unstaged review and the Gemini seat (agent-harness#1244).
+- **The jailed route is Claude-only.** `JAILED_LEGS` is exactly `{"claude"}`. A Gemini
+  seat always takes the sealed route with its typed notice, whatever its credential,
+  qualification or recorded stop; a tooled Gemini seat is agent-harness#1170.
+- **EC-EXECFIND-2 gate.** A jailed route whose jail profile digest has no EC-EXECFIND-2
+  falsifier pass recorded on THIS host is REFUSED before any effect with
+  `seat_sandbox_refused:jail_unqualified`. The notice names the per-host qualification as
+  the fix.
+  - **Where passes live:** per user and per host, at
+    `$XDG_STATE_HOME/phase-loop/seat-jail-passes/<digest>.json`. A record qualifies only if it
+    binds all of:
+    - the digest;
+    - this host (sha256 of `/etc/machine-id`);
+    - the EC-EXECFIND-2 falsifier-run layout: `seat_jail.falsifier_layout_identity()`, a
+      digest of the EXECFIND staging and run code, so a change to either invalidates every
+      pass;
+    - the run's evidence file, which the gate re-hashes and which must name the same values.
+
+    The record and the evidence must be regular, operator-owned files that are not group- or
+    other-writable and are not links. They are read non-blocking with size caps.
+  - **The directory chain:** every directory up to the state home must be operator-owned,
+    must not be a link, and must not be other-writable. It may be group-writable only when
+    its group is the operator's user-private group, which is the umask-002 default. That
+    means all of the following hold:
+    - it is the operator's primary gid;
+    - the group is named after the operator;
+    - it lists no other member;
+    - no other account has it as its primary group.
+
+    Any other chain is refused with `seat_sandbox_refused:pass_store_unsafe`, whose notice
+    names the chmod. The recorder applies the same rule and never re-permissions an
+    existing directory.
+  - **One fail-closed boundary:** the whole evaluation is inside a single
+    `except Exception`. Any error is the typed refusal `jail_unqualified`, and no provider
+    is launched. The route detail stays the closed code. The verdict's typed reason
+    (`no_record`, `binding_mismatch`, `evidence_mismatch`, `store_unsafe:...` or
+    `error:<ExceptionClass>`) is logged, and is carried in the launch refusal's message.
+  - **Checked at launch:** qualification is re-checked against the jail actually built.
+  - **Threat model:** the operator's own account can forge a record, and is trusted to. The
+    store defends against the seat uid, stale records, other hosts and accidental reuse.
+  - **Why per host:** the digest binds the host's layout (maintainer decision, option A).
+    A shipped host-independent policy digest plus a first-use self-check is
+    agent-harness#1186.
+  - **Recording a pass:** `phase-loop seat-sandbox qualify` runs EC-EXECFIND-2's jail
+    falsifiers (`seat_jail_qualification`) against a real falsifier run, using the EXECFIND
+    staging, the dependency snapshot and the bounded bwrap runner:
+    - the run holds a nonce sentinel in every protected directory, a sentinel process, and
+      TCP, UDP, pathname Unix and abstract Unix listeners;
+    - concurrently, a probe program running as the seat in the production jail tries to
+      create entries, change sentinels, signal and connect, through the host paths and
+      through anything it resolves by device and inode;
+    - the parent judges the result: sentinels intact, no events, single-link protected
+      files, no seat mount or descriptor resolving to a protected object or an ancestor, and
+      the run `green_on_head`.
+
+    Only a pass is recorded.
+  - **`seat_sandbox_refused:identity`** remains the code for a jail that is not the
+    qualified profile at launch, or a failed identity probe.
+- **Jail profile (`seat_jail_v1`).** bwrap, no `--unshare-user` and no `--unshare-net`:
+  read-only `/usr` (merged-`/usr` links recreated), an `/etc` subset, the provider image at
+  `/seat/bin/<leg>`, the bundle and instructions as sealed memfds at `/seat/review/`, the
+  staged clone read-write at `/seat/tree`, fresh `/seat/home` and `/seat/out`, tmpfs `/tmp`
+  and `/dev/shm`, `--remount-ro /`, `--clearenv` plus a declared environment (the seat's
+  `TMPDIR` and `CLAUDE_CODE_TMPDIR` are `/seat/home/.tmp`, on the disk-backed staging root,
+  never the tmpfs `/tmp`; agent-harness#1147), and the J14
+  seccomp filter (architecture kill, x32 EPERM, nested user/mount namespaces, `setns`,
+  `clone3` ENOSYS, key syscalls, AF_ALG sockets, TIOCSTI/TIOCLINUX). The profile digest
+  covers the mount set, the flags and the filter digest.
+- **Seat uid (D8).** The seat runs as a subordinate uid leased from the operator's
+  `/etc/subuid` range, inside an egress holder namespace mapped by `newuidmap`/`newgidmap`
+  (in it, uid 0 is the operator). Launch order: fresh session keyring, `nsenter` into H,
+  the private-inode hand-off (`seat_sandbox_refused:stage_not_private` on any hard link),
+  bwrap with `--cap-drop ALL` then exactly `CAP_SETUID`, `CAP_SETGID`, `CAP_SETPCAP` (P5:
+  bwrap as namespace root otherwise keeps every capability), then `setpriv` to the seat
+  uid with every capability set, the bounding set included, emptied and no-new-privs set,
+  then `env --chdir=/seat/tree` as the seat. `/seat`, `/seat/bin`, `/seat/review` and
+  `/etc` are created 0755 and the tmpfs mounts 1777, so the seat uid can traverse and use
+  them (P5, P1).
+  The host prerequisite (`apt install uidmap`, `usermod --add-subuids/--add-subgids`) is a
+  one-time root step by the maintainer, never run by the runtime.
+- **Credential channels (plan amendment A1).** The Claude credential is resolved afresh at
+  each jailed launch, in this order:
+  1. The seat-token override, the record `$XDG_STATE_HOME/phase-loop/seat-credentials/
+     claude.override.json` (owner-only, in a 0700 directory, owned by the euid). It is
+     written only by `phase-loop seat-sandbox store-token` and used only when it is bound to
+     the account and organization the launching session is logged in to (plan amendment A4,
+     below). A hand-placed raw `seat-credentials/claude` file is never used.
+  2. Otherwise, the current Claude login's `claudeAiOauth.accessToken` only, never its
+     refresh token. It comes from the CLI's own store: `$CLAUDE_CONFIG_DIR/.credentials.json`
+     or `~/.claude/.credentials.json`, and the login Keychain on macOS.
+
+  - **The login token's margin:** it must have the seat's hard deadline (its explicit
+    per-leg timeout, else the 1800 s backstop) or `PHASE_LOOP_SEAT_LOGIN_TOKEN_MARGIN_S`
+    left. One function (`_claude_seat_login_margin_s`) gives this margin to the pre-launch
+    seat mode, the wait and the launch.
+  - **A short login (plan amendment A3):** the harness never runs the Claude CLI to renew a
+    credential. The mode line carries `claude_seat_login_token_awaiting_refresh` with the
+    minutes left. Before staging, and before any seat id or namespace is held, the seat
+    waits: `seat_credentials.await_login_margin` reads the store read-only every
+    `PHASE_LOOP_SEAT_LOGIN_REFRESH_POLL_S` (30 s), for up to
+    `PHASE_LOOP_SEAT_LOGIN_REFRESH_WAIT_S` (900 s; 0 means no wait).
+    - **Renewed:** the seat runs jailed (logged `jailed (login refreshed)`), re-reading the
+      token at launch.
+    - **Not renewed in time:** the seat is DEGRADED and NOT RUN with
+      `claude_seat_login_token_expiring`. A store that stops yielding a login ends it with
+      `claude_seat_token_missing`. Nothing is launched (plan amendment A3b).
+    - **Monitoring:** under `heartbeat_only` the wait is recorded as `login_wait` in the
+      monitoring record, not as a stall, and the stall clock starts after it. Under a
+      bounded policy it is charged to the leg's deadline. The monitor's cancel event and the
+      quiescence latch end it.
+  - **Delivery:** either credential is delivered only through one drained pipe named by
+    `CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`. No credential is in any argv, environment
+    value, evidence or log.
+  - **The output scan:** seat output is scanned for the credential's bytes and its
+    standard, URL-safe and hex encodings (`claude_seat_token_in_output`).
+  - **The residual:** a seat can use the credential for its remaining lifetime. That is
+    hours for a login access token. The response is to log out and back in; the token also
+    expires on its own.
+  - **Gemini:** the D7 access-token-only copy (builder only; the tooled Gemini route is gated
+    on P4 then P3).
+- **Credential outcomes by source.** For the override: `claude_seat_token_rate_limited` and
+  `claude_seat_token_rejected`. For the login: `claude_seat_login_rate_limited` and
+  `claude_seat_login_rejected`. A login token at or past its launch-time expiry fails as
+  `claude_seat_login_token_expired`, in both the detail and the notice, and is safe to
+  relaunch. None of these is a `seat_sandbox_refused:*` code. On both the sealed and the
+  jailed route, an authentication failure in the PTY tail takes priority over the generic
+  journaled give-up (`claude_seat_provider_api_error`), so a credential outcome is never
+  hidden behind it; every typed give-up (limits, output budget, rejected transcript) keeps
+  its priority.
+- **First-use qualification (plan amendment A2; folds in agent-harness#1186 option C).** A
+  jailed route with no recorded pass for this host, digest and layout runs the host's jail
+  qualification once, before launch. It is serialized by an exclusive lock in the per-user
+  state directory, and on a pass it records the pass.
+  - **On a pass:** the seat stays jailed, and its mode reports `qualified_now`.
+  - **On a failure, or a run that cannot happen (a cached failure included):** the seat is
+    DEGRADED and NOT RUN with `seat_jail_qualification_failed` and a typed reason
+    (`prerequisite_missing`, `store_unsafe`, `falsifiers_failed`, `timeout` or `error`),
+    each with a literal fix (plan amendment A3b supersedes A2's sealed fallback).
+  - **The failure cache:** failures are cached per host, digest and layout for
+    `PHASE_LOOP_SEAT_JAIL_QUALIFY_RETRY_S` (default 3600 s). A lock timeout is not cached.
+  - **The launch-time re-check** against the built jail still refuses an unrecorded digest.
+- **Seat modes (plan amendment A1).** Before any seat launches, every board publishes one
+  mode per seat: `jailed`, `unconfined`, `sealed`, `degraded` or `native`. Each mode carries
+  its notice code, reason and fix, and the modes are delivered through `on_seat_modes`, the
+  log and `seat-modes.json`. The `advisor-board` CLI prints them to stderr and carries them as
+  `seat_modes` in `--json`.
+- **Launch helpers.** The pre-jail and in-namespace helpers (`seat_keyring_exec`, the
+  `seat_uid` handoff and its in-namespace verbs) run from the installation the parent
+  imported: `python -I` with this package's root put first on the import path
+  (`seat_uid.trusted_module_argv`), never `python -m`, whatever the launch's working
+  directory is. An inventory test fails on any `sys.executable -m` launch of a package
+  module.
+- **Scratch decision (agent-harness#1147).** A jailed launch's helper chain gets one env
+  from `child_scratch_env` (`_jail_launch_env`), and that same object is handed to the
+  identity probe and the launch. The seat never sees it: bwrap clears the environment and
+  sets the seat's own.
+- **The override follows the launching session (plan amendment A4).** A seat's credential
+  follows the subscription of the session that launched the leg.
+  - **Storing:** `phase-loop seat-sandbox store-token` reads the override with no echo, or
+    from stdin. A terminal that cannot hide the input is refused. The token and its account
+    are stored as ONE record, `seat-credentials/claude.override.json`
+    (`{"schema": "seat_credential_override.v1", "account": ..., "token": ...}`).
+    - **The account** is the current login's `oauthAccount.accountUuid`, from
+      `$CLAUDE_CONFIG_DIR/.claude.json` or `~/.claude.json`, read without running the CLI.
+    - **Refused** with no login. An unsafe account file is named in the refusal.
+    - **The write:** it goes relative to the held directory descriptors (each directory
+      component opened without following links and checked on the descriptor), as a new
+      0600 file under a random name renamed into place. A store is therefore atomic, and
+      concurrent stores leave one complete record.
+  - **At launch:** the record is read once, without following a link and without blocking.
+    - **Used:** only when its account equals the launching session's account, and the
+      launch uses exactly the token bytes whose account was checked.
+    - **Not used:** when the accounts differ, when either is unknown, when the record is
+      malformed, or when only a hand-placed raw `seat-credentials/claude` exists. The seat
+      then uses the login and carries the notice `claude_seat_override_other_subscription`,
+      also on its mode line, beside any login notice. That notice is not a jail refusal.
+    - **Unsafe:** a record that is not a private regular file the euid owns refuses the
+      launch (`seat_sandbox_refused:token_file_unsafe`).
+  - **When the seat does not run:** a refusal (no login, a login short of the margin, a wait
+    that ended short) carries `claude_seat_override_other_subscription` beside its one
+    refusal code whenever a stored override was ignored. The seat's notices, the A3b
+    DEGRADED result and the mode line all carry it.
+  - **Per harness:** the rule lives once, in `override_decision(adapter)`. Each harness's
+    `SeatCredentialAdapter` answers `override_present()`, `read_override()` (the record,
+    read once) and `current_account()`, and declares its credential `sources` in precedence
+    order; an adapter without the override source never uses one. Claude is the only
+    adapter today, and `store-token` stores Claude's override.
+  - **One slot per user:** the override lives under the Unix user's `$XDG_STATE_HOME`, so
+    there is one per user, not one per config directory or account. A store from another
+    account replaces it, and sessions on the earlier account then use their login, with
+    the notice.
+  - **Independent reads:** the mode line, the A3 wait and the launch each read the decision
+    afresh. A `/login` between them can change the outcome. Every such change falls toward
+    the login, never toward an unbound override.
+  - **macOS:** the CLI keeps the login in the Keychain service named from
+    `CLAUDE_SECURESTORAGE_CONFIG_DIR` when that is set, and the account in
+    `CLAUDE_CONFIG_DIR/.claude.json`. With only the former set, the account and the login
+    can describe different identities. Set both, or neither.
+  - **Organization (maintainer ruling 2026-10-05):** the record (schema
+    `seat_credential_override.v2`) binds both `oauthAccount.accountUuid` and
+    `oauthAccount.organizationUuid`, read from the same `.claude.json`.
+    - **At launch:** the override applies only when both are known and both equal the
+      session's. A v1 or organization-less record is unbound.
+    - **Storing:** `store-token` refuses when the organization is unknown.
+  - **Permissions:** the record must be owner-only: any group or other bit refuses with
+    `token_file_unsafe`. The store opens every directory component, the state root
+    included, without following links; a linked state root is refused, naming the directory
+    to set `XDG_STATE_HOME` to.
+  - **Refusals after resolution:** a refusal raised after the credential is resolved (the
+    jail build, the pre-seed, the namespace) also carries the ignored-override notice beside
+    its one refusal code.
+  - **Modes without the notice:** sealed, unconfined and native Claude modes carry no
+    override notice, by design: the override is never their credential.
+  - **Status:** `phase-loop seat-sandbox token-status` shows the bound account and
+    organization, this session's, and whether the override applies. It exits 0 only when
+    the override applies, and never shows the token.
+- **Seat-token rotation.** The override record is read at each jailed launch and never
+  cached across legs or rounds.
+  - **Rotating:** `phase-loop seat-sandbox store-token` is the only way to rotate it. It
+    replaces the record with one rename, and the next launch uses the new token; a running
+    leg keeps the token it was launched with.
+  - **By hand:** a token file replaced by hand is ignored.
+  The token is per-launch input only: neither the jail profile digest nor an EC-EXECFIND-2
+  pass binds it, so replacing it trips no qualification check.
+- **A rate-limited seat token is not a jail fault.** When the provider refuses the seat
+  token's subscription for a rate or usage limit (the shared leg-failure classifier's
+  `usage_limit` class, with the provider's reset time when it gives one), the leg ends with
+  that detail and the notice `claude_seat_token_rate_limited`: rotate or replace the seat
+  token, or wait for the reset. It is never a `seat_sandbox_refused:*` code. A token the provider
+  rejects (the classifier's `auth_failure`, measured in P2) carries
+  `claude_seat_token_rejected`.
+- **Pointer-brief preflight.** On a `--pointer-brief` board, a seat whose launch takes the
+  jailed route (the same J7 decision and EC-EXECFIND-2 gate the launch applies) has file
+  access to the staged tree, so it is source-grounded and never marked
+  `seat_pointer_brief_unreadable`. A jail that would be refused is not counted as one.
+- **Pointer mode.** A jailed seat gets a pointer brief: jail-path preamble, the
+  AUTHORITATIVE INSTRUCTIONS inline, and POINTER frames naming the bundle (path, sha256,
+  size) and the tree (path, source commit, approved digest). Evidence records
+  `provider_input_mode: "pointer"`, `provider_input_inline: false`,
+  `sandbox_filesystem_confined: true` and the jail profile id and digests;
+  `verify_harden_evidence.py` reports EC-HARDEN-5 UNMET (accepted residual
+  agent-harness#361, D3) on every such record.
+- **Notices.** `{code, seat_key, what, why, fix}`, rendered only from literals, on the
+  `advisor-board` payload (`notices`, `legs[].notices`) and text summary, and on the
+  governed path as one non-gating `seat_notice` finding per notice (L4b).
+- **Retention.** A failed in-namespace teardown keeps the seat directories under the leg's
+  operator-owned 0700 scratch dir, adds `seat_sandbox_retained_after_teardown`, and records
+  the path. `phase-loop seat-sandbox reap PATH` accepts only a recorded path under the
+  stage root, opened `O_NOFOLLOW|O_DIRECTORY` component by component, and owned by a
+  subordinate uid.
+
 ## ABDFALSIFY — Executable review findings (IF-0-EXECFIND-1)
 
 An optional `falsifier` attachment names one `FindingFalsifier` with

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/src/phase_loop_runtime/cli.py

@@ -1038,6 +1038,19 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="PATH",
         help="Load the BOM from a fixture JSON instead of live registries (CI/test wiring).",
     )
+    # seat-sandbox reap (agent-harness#1132, F022): remove a jailed seat's directory that
+    # teardown retained. Only a path recorded by a retention notice is accepted.
+    seat_sandbox_sub = subparsers.add_parser(
+        "seat-sandbox",
+        help=("Jailed review-seat maintenance: `qualify` runs the EC-EXECFIND-2 jail "
+              "falsifiers on this host and records its pass; `reap PATH` removes a retained "
+              "seat directory; `store-token` stores a Claude seat-token override (read with no "
+              "echo, or from stdin) bound to the account you are logged in to now; "
+              "`token-status` shows that binding (never the token)."),
+    )
+    seat_sandbox_sub.add_argument("seat_sandbox_action",
+                                  choices=("qualify", "reap", "store-token", "token-status"))
+    seat_sandbox_sub.add_argument("seat_sandbox_path", metavar="PATH", nargs="?")
     # train-status: non-mutating inspection of the cross-repo train ledger (#45).
     # Reads the SAME default ledger path as run-train; opens no PRs, writes nothing.
     train_status_sub = subparsers.add_parser(
@@ -1543,6 +1556,8 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
         return _task_message_broker_serve_command(args=args)
     if command == "advisor-board":
         return _advisor_board_command(args=args)
+    if command == "seat-sandbox":
+        return _seat_sandbox_command(args=args)
     if command == "docs-audit":
         from . import docs_audit
 
@@ -2319,6 +2334,14 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
     elif getattr(args, "native_president", None) is not None:
         print("advisor-board: --native-president requires --landing-tier", file=sys.stderr)
         return 2
+    # agent-harness#1132 (plan amendment A1): every seat's launch mode, printed before any
+    # seat launches and carried into the JSON payload.
+    seat_modes: list = []
+
+    def _on_seat_modes(modes) -> None:
+        seat_modes.extend(modes)
+        _print_seat_modes(modes)
+
     try:
         with tempfile.TemporaryDirectory(prefix="advisor-board-") as scratch:
             invoke_kwargs: dict[str, object] = {
@@ -2328,6 +2351,7 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
                 **({"brief_ref": advisory_brief_ref} if advisory else {}),
                 "agy_canary_capture": capture,
                 **({"monitoring_policy": monitoring_policy} if monitoring_policy != "bounded" else {}),
+                "on_seat_modes": _on_seat_modes,
             }
             if pointer_brief:
                 # agent-harness#1204: the preflight's notices are printed BEFORE any launch.
@@ -2436,6 +2460,11 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
             "requested_seats": requested_seats,
             "delivered_seats": usable_count,
             "shortfall": shortfall,
+            # agent-harness#1132: typed seat notices, board-wide and per leg.
+            "notices": _board_notices_json(result.legs),
+            # agent-harness#1132 (plan amendment A1): each seat's launch mode, decided before
+            # any seat launched.
+            "seat_modes": [mode.as_json() for mode in seat_modes],
             "independence": {
                 "level": independence.level,
                 # The sealed evidence floor derives these from concrete leg
@@ -2456,6 +2485,7 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
                     # ABDNATIVE (#183): a deferred claude seat carries the
                     # typed native-fill request the harness must run; None otherwise.
                     "needs_native_agent": _native_agent_request_json(leg),
+                    "notices": [notice.as_json() for notice in leg.seat_notices],
                     # agent-harness#1176: a heartbeat_only seat's monitoring record (progress
                     # notice, provider terminal state); absent under the bounded policy.
                     **({"review_monitoring": dict(leg.review_monitoring)}
@@ -2467,11 +2497,13 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
         if pointer_brief:
             # agent-harness#1204: present only for a pointer-brief board, so every other
             # payload (and the closed capture schema) is unchanged.
+            # The preflight notices join the seat notices (agent-harness#1132); neither
+            # list replaces the other.
             payload["grounded_seats"] = grounded_count
-            payload["notices"] = [n.as_json() for n in result.seat_preflight_notices]
+            payload["notices"] += [n.as_json() for n in result.seat_preflight_notices]
             for entry, leg in zip(payload["legs"], result.legs):
                 entry["source_grounded"] = leg.source_grounded
-                entry["notices"] = [n.as_json() for n in leg.seat_preflight_notices]
+                entry["notices"] += [n.as_json() for n in leg.seat_preflight_notices]
         if advisory:
             payload.update(_advisory_labels(review_brief, composed_board=board.name))
         if capture is not None:
@@ -2491,9 +2523,18 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
                 capture.close()
                 return 2
             payload["agy_canary_capture"] = expected_capture
+            # The private capture board has its own closed schema, which predates seat
+            # notices and seat modes (agent-harness#1132); it is written without them,
+            # byte-for-byte as before.
+            capture_payload = {key: value for key, value in payload.items()
+                               if key not in ("notices", "seat_modes")}
+            capture_payload["legs"] = [
+                {key: value for key, value in leg.items() if key != "notices"}
+                for leg in payload["legs"]
+            ]
             try:
                 private = write_private_board(
-                    capture=capture, basename=private_board_name, payload=payload
+                    capture=capture, basename=private_board_name, payload=capture_payload
                 )
             except AgyCanaryEvidenceError as exc:
                 print(f"advisor-board: private capture sink failed: {exc}", file=sys.stderr)
@@ -2517,6 +2558,8 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
         shown = _finalize_leg_detail(leg.detail)
         detail = f" — {shown}" if shown else ""
         print(f"  [{leg.status}] {leg.seat_key}{detail}")
+        for notice in leg.seat_notices:
+            print(f"      notice {notice.code}: {notice.what} / {notice.why} / fix: {notice.fix}")
         for notice in leg.seat_preflight_notices:
             # agent-harness#1204: once per seat, from the notice table's literals.
             print(f"      notice {notice.code}: {notice.what} -- fix: {notice.fix}")
@@ -2572,6 +2615,109 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
     return exit_code
 
 
+def _seat_store_token() -> int:
+    """`seat-sandbox store-token`: the token is read with no echo (or from stdin when it is
+    not a terminal) and is never printed; it is stored bound to the current login's account."""
+    import getpass
+
+    from . import seat_credentials
+
+    if sys.stdin.isatty():
+        import warnings
+
+        # getpass falls back to reading with echo ON when it cannot control the terminal,
+        # warning first; make that warning a refusal, raised before anything is read.
+        try:
+            with warnings.catch_warnings():
+                warnings.simplefilter("error", getpass.GetPassWarning)
+                token = getpass.getpass("Claude seat token (input hidden): ").encode("utf-8")
+        except getpass.GetPassWarning:
+            print("seat-sandbox store-token: refused: this terminal cannot hide the input; "
+                  "pipe the token on stdin instead", file=sys.stderr)
+            return 1
+    else:
+        token = sys.stdin.buffer.read(64 * 1024)
+    try:
+        identity = seat_credentials.store_override(token)
+    except seat_credentials.StoreRefused as exc:
+        print(f"seat-sandbox store-token: refused: {exc}", file=sys.stderr)
+        return 1
+    except OSError as exc:
+        print(f"seat-sandbox store-token: failed ({type(exc).__name__})", file=sys.stderr)
+        return 1
+    print(f"seat-sandbox store-token: stored, bound to account {identity.account} in "
+          f"organization {identity.organization} (the login you are using now); seats use it "
+          "only while you are logged in to that account and organization. "
+          "`phase-loop seat-sandbox token-status` shows the binding.")
+    return 0
+
+
+def _seat_token_status() -> int:
+    """`seat-sandbox token-status`: the stored override's binding and whether it applies to
+    this session. Never prints the token. Exits 0 only when the override applies."""
+    from . import seat_credentials
+
+    status = seat_credentials.override_status()
+    print(f"seat-sandbox token-status: override {status['state']}"
+          f" (bound: account {status['bound_account'] or '-'},"
+          f" organization {status['bound_organization'] or '-'};"
+          f" this session: account {status['session_account'] or 'unknown'},"
+          f" organization {status['session_organization'] or 'unknown'});"
+          f" applies to this session: {'yes' if status['applies'] else 'no'}"
+          + (f" [{status['notice']}]" if status['notice'] else ""))
+    return 0 if status["applies"] else 1
+
+
+def _seat_sandbox_command(args: argparse.Namespace) -> int:
+    from . import seat_uid
+
+    if args.seat_sandbox_action == "store-token":
+        return _seat_store_token()
+    if args.seat_sandbox_action == "token-status":
+        return _seat_token_status()
+
+    if args.seat_sandbox_action == "qualify":
+        from . import seat_jail_autoqualify, seat_jail_qualification
+
+        try:
+            # The same host lock as a first-use run, so the two never race the store.
+            with seat_jail_autoqualify.qualification_lock():
+                return seat_jail_qualification.main([])
+        except seat_jail_qualification.QualificationError as exc:
+            print(f"seat-sandbox qualify: cannot run: {exc}", file=sys.stderr)
+            return 1
+        except TimeoutError:
+            print("seat-sandbox qualify: cannot run: another qualification holds the lock",
+                  file=sys.stderr)
+            return 1
+    if not args.seat_sandbox_path:
+        print("seat-sandbox reap: PATH is required", file=sys.stderr)
+        return 2
+
+    try:
+        seat_uid.reap(str(args.seat_sandbox_path))
+    except seat_uid.ReapRefused as exc:
+        print(f"seat-sandbox reap: refused: {exc}", file=sys.stderr)
+        return 1
+    except OSError as exc:
+        print(f"seat-sandbox reap: failed ({type(exc).__name__}); {seat_uid.PREREQUISITE}",
+              file=sys.stderr)
+        return 1
+    print(f"seat-sandbox reap: removed {args.seat_sandbox_path}")
+    return 0
+
+
+def _board_notices_json(legs) -> list[dict[str, str]]:
+    """Every leg's typed seat notices (agent-harness#1132), rendered from literals."""
+    return [notice.as_json() for leg in legs for notice in leg.seat_notices]
+
+
+def _print_seat_modes(modes) -> None:
+    """agent-harness#1132 (plan amendment A1): one line per seat, before any seat launches."""
+    for mode in modes:
+        print(f"advisor-board: seat mode: {mode.render()}", file=sys.stderr)
+
+
 def _print_seat_preflight(notices) -> None:
     """agent-harness#1204: the pointer-brief preflight, printed before any seat launches."""
     for notice in notices:

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/src/phase_loop_runtime/gemini_heartbeat.py

@@ -34,6 +34,9 @@ QUALIFIED_IMAGES = {
     # agy 1.2.16
     "a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86":
         "8fcf40227fe84704f7f8155b3b5ebcee79dfdc5208fde6e8b07569c24425f976",
+    # agy 1.2.17
+    "c54ef90651a8646ae67334d39212c81f5946feec373ad6aa335f9ef401662bc5":
+        "8fcf40227fe84704f7f8155b3b5ebcee79dfdc5208fde6e8b07569c24425f976",
 }
 PROFILE_ID = "agy_memfd_home_deny_all_v1"
 PRIVATE_HOME = "/dev/phase-loop-agy"

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.24}/src/phase_loop_runtime/governed_review.py

@@ -239,6 +239,16 @@ def _findings_from_panel(
                 f"record_digest={digest}; president ruling required")
 
     for leg in panel.legs:
+        # agent-harness#1132 (L4b): the leg's typed seat notices reach the governed path
+        # too, one non-gating finding each, rendered only from the notice table's literals.
+        for notice in getattr(leg, "seat_notices", ()):
+            findings.append(ReviewFinding(
+                code="seat_notice",
+                reason=(f"seat {notice.seat_key or leg.leg} notice {notice.code}: "
+                        f"{notice.what} / {notice.why} / fix: {notice.fix}"),
+                severity="warn",
+                reviewed_sha=reviewed_sha,
+            ))
         # agent-harness#1176: a heartbeat_only seat that went without genuine progress past its
         # notice window is recorded, whatever its final status. A warn: the notice is history,
         # never a verdict, and never permission to end a seat.