From d2bbb7aeb08d831cc1f2e1ff35916c6602be0864 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 15:54:28 -0400
Subject: [PATCH 01/12] feat(coding-agent): share installed artifact acceptance
 helpers

---
 scripts/artifact-acceptance.mjs       | 117 +-------
 scripts/artifact-installation.mjs     | 119 ++++++++
 scripts/verify-candidate-artifacts.py | 395 +++++++++++++-------------
 3 files changed, 324 insertions(+), 307 deletions(-)
 create mode 100644 scripts/artifact-installation.mjs

diff --git a/scripts/artifact-acceptance.mjs b/scripts/artifact-acceptance.mjs
index f8f60f200..ac4188808 100644
--- a/scripts/artifact-acceptance.mjs
+++ b/scripts/artifact-acceptance.mjs
@@ -1,6 +1,7 @@
+import { assertContained, installConsumer, isolatedEnvironment, verifyTarballs } from "./artifact-installation.mjs";
+export { assertContained, installConsumer, isolatedEnvironment, verifyTarballs } from "./artifact-installation.mjs";
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import {
 	cpSync,
 	existsSync,
@@ -13,20 +14,14 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { cliDistribution } from "./cli-distribution.mjs";
 import { getPublicWorkspacePackages } from "./release-packages.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const readJson = (file) => JSON.parse(readFileSync(file, "utf8"));
 
-export function assertContained(file, directory) {
-	const local = relative(realpathSync(directory), realpathSync(file));
-	assert(local === "" || (!local.startsWith("..") && !isAbsolute(local)), `Path escapes isolated consumer: ${file}`);
-}
-
 export function packageClosure(name, packages) {
 	const result = [];
 	const visiting = new Set();
@@ -52,51 +47,6 @@ export function packageClosure(name, packages) {
 	return result;
 }
 
-export function verifyTarballs(directory, records, packages) {
-	assert.equal(records.length, packages.length, "Incomplete tarball inventory");
-	assert.equal(new Set(records.map((pkg) => pkg.name)).size, packages.length, "Duplicate tarball identity");
-	for (const pkg of packages) {
-		const record = records.find((entry) => entry.name === pkg.name);
-		assert(record && record.version === pkg.version, `Missing tarball: ${pkg.name}`);
-		assert.equal(record.filename, `${pkg.name.replace("@", "").replace("/", "-")}-${pkg.version}.tgz`);
-		assert.equal(
-			digest(readFileSync(join(directory, record.filename))),
-			record.sha256,
-			`Tarball checksum mismatch: ${pkg.name}`,
-		);
-	}
-}
-
-export function isolatedEnvironment(directory) {
-	const env = {};
-	for (const key of ["PATH", "SystemRoot", "WINDIR", "COMSPEC", "PATHEXT", "LANG"]) {
-		if (process.env[key]) env[key] = process.env[key];
-	}
-	for (const dir of ["home", "config", "cache", "prefix", "project", "agent", "temp"])
-		mkdirSync(join(directory, dir), { recursive: true });
-	return {
-		...env,
-		HOME: join(directory, "home"),
-		USERPROFILE: join(directory, "home"),
-		XDG_CONFIG_HOME: join(directory, "config"),
-		XDG_CACHE_HOME: join(directory, "cache"),
-		npm_config_cache: join(directory, "cache", "npm"),
-		npm_config_prefix: join(directory, "prefix"),
-		npm_config_userconfig: join(directory, "empty.npmrc"),
-		npm_config_globalconfig: join(directory, "empty-global.npmrc"),
-		npm_config_registry: "https://registry.npmjs.org",
-		npm_config_update_notifier: "false",
-		BUN_INSTALL_CACHE_DIR: join(directory, "cache", "bun"),
-		TMPDIR: join(directory, "temp"),
-		TMP: join(directory, "temp"),
-		TEMP: join(directory, "temp"),
-		DIFFEX_CODING_AGENT_DIR: join(directory, "agent"),
-		DIFFEX_NO_LOCAL_LLM: "1",
-		DIFFEX_OFFLINE: "1",
-		TERM: "xterm-256color",
-	};
-}
-
 function walk(directory) {
 	return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
 		const path = join(directory, entry.name);
@@ -154,67 +104,6 @@ export const operations = {
 	"@diffexai/diffex-coding-agent-server": `const reporter = api.createDurableUsageReporter({ endpoint: "http://127.0.0.1:1/usage", sharedSecret: "local-artifact-fixture-only-32-bytes", outboxDirectory: path.join(process.env.DIFFEX_CODING_AGENT_DIR, "outbox"), fetch: () => { throw new Error("Unexpected usage"); } }); await reporter.close();`,
 };
 
-export function installConsumer(
-	directory,
-	manager,
-	selected,
-	records,
-	tarballDirectory,
-	cacheDirectory = join(directory, "cache"),
-) {
-	mkdirSync(directory, { recursive: true });
-	const env = isolatedEnvironment(directory);
-	mkdirSync(cacheDirectory, { recursive: true });
-	env.npm_config_cache = join(cacheDirectory, "npm");
-	env.BUN_INSTALL_CACHE_DIR = join(cacheDirectory, "bun");
-	writeFileSync(join(directory, ".npmrc"), "@diffexai:registry=http://127.0.0.1:9/\n");
-	const dependencies = Object.fromEntries(
-		selected.map((pkg) => [
-			pkg.name,
-			`file:${join(tarballDirectory, records.find((record) => record.name === pkg.name).filename)}`,
-		]),
-	);
-	writeFileSync(
-		join(directory, "package.json"),
-		JSON.stringify({ private: true, type: "module", dependencies, overrides: dependencies }),
-	);
-	execFileSync(
-		manager,
-		manager === "npm"
-			? ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"]
-			: ["install", "--production", "--ignore-scripts", "--network-concurrency=8"],
-		{ cwd: directory, env, stdio: "inherit", timeout: 600_000 },
-	);
-	for (const pkg of selected) {
-		const installed = join(directory, "node_modules", pkg.name);
-		assertContained(installed, directory);
-		const info = readJson(join(installed, "package.json"));
-		assert.equal(info.name, pkg.name);
-		assert.equal(info.version, pkg.version);
-		const record = records.find((entry) => entry.name === pkg.name);
-		const inventory = JSON.parse(
-			execFileSync("tar", ["-xOf", join(tarballDirectory, record.filename), "package/distribution-files.json"], {
-				encoding: "utf8",
-				maxBuffer: 10 * 1024 * 1024,
-			}),
-		);
-		assert.deepEqual(
-			readJson(join(installed, "distribution-files.json")),
-			inventory,
-			"Installed inventory differs from the checked tarball",
-		);
-		for (const file of inventory.files) {
-			assertContained(join(installed, file.path), installed);
-			assert.equal(
-				digest(readFileSync(join(installed, file.path))),
-				file.sha256,
-				`Installed bytes differ: ${pkg.name}/${file.path}`,
-			);
-		}
-	}
-	return env;
-}
-
 export function acceptArtifacts(artifactDirectory, outputDirectory, { managers = ["npm", "bun"] } = {}) {
 	assert(
 		managers.length && managers.every((manager) => ["npm", "bun"].includes(manager)),
diff --git a/scripts/artifact-installation.mjs b/scripts/artifact-installation.mjs
new file mode 100644
index 000000000..5421e7568
--- /dev/null
+++ b/scripts/artifact-installation.mjs
@@ -0,0 +1,119 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const readJson = (file) => JSON.parse(readFileSync(file, "utf8"));
+
+export function assertContained(file, directory) {
+	const local = relative(realpathSync(directory), realpathSync(file));
+	assert(local === "" || (!local.startsWith("..") && !isAbsolute(local)), `Path escapes isolated consumer: ${file}`);
+}
+
+export function verifyTarballs(directory, records, packages) {
+	assert.equal(records.length, packages.length, "Incomplete tarball inventory");
+	assert.equal(new Set(records.map((pkg) => pkg.name)).size, packages.length, "Duplicate tarball identity");
+	for (const pkg of packages) {
+		const record = records.find((entry) => entry.name === pkg.name);
+		assert(record && record.version === pkg.version, `Missing tarball: ${pkg.name}`);
+		assert.equal(record.filename, `${pkg.name.replace("@", "").replace("/", "-")}-${pkg.version}.tgz`);
+		assert.equal(
+			digest(readFileSync(join(directory, record.filename))),
+			record.sha256,
+			`Tarball checksum mismatch: ${pkg.name}`,
+		);
+	}
+}
+
+export function isolatedEnvironment(directory) {
+	const env = {};
+	for (const key of ["PATH", "SystemRoot", "WINDIR", "COMSPEC", "PATHEXT", "LANG"]) {
+		if (process.env[key]) env[key] = process.env[key];
+	}
+	for (const dir of ["home", "config", "cache", "prefix", "project", "agent", "temp"])
+		mkdirSync(join(directory, dir), { recursive: true });
+	return {
+		...env,
+		HOME: join(directory, "home"),
+		USERPROFILE: join(directory, "home"),
+		XDG_CONFIG_HOME: join(directory, "config"),
+		XDG_CACHE_HOME: join(directory, "cache"),
+		npm_config_cache: join(directory, "cache", "npm"),
+		npm_config_prefix: join(directory, "prefix"),
+		npm_config_userconfig: join(directory, "empty.npmrc"),
+		npm_config_globalconfig: join(directory, "empty-global.npmrc"),
+		npm_config_registry: "https://registry.npmjs.org",
+		npm_config_update_notifier: "false",
+		BUN_INSTALL_CACHE_DIR: join(directory, "cache", "bun"),
+		TMPDIR: join(directory, "temp"),
+		TMP: join(directory, "temp"),
+		TEMP: join(directory, "temp"),
+		DIFFEX_CODING_AGENT_DIR: join(directory, "agent"),
+		DIFFEX_NO_LOCAL_LLM: "1",
+		DIFFEX_OFFLINE: "1",
+		TERM: "xterm-256color",
+	};
+}
+
+export function installConsumer(
+	directory,
+	manager,
+	selected,
+	records,
+	tarballDirectory,
+	cacheDirectory = join(directory, "cache"),
+) {
+	mkdirSync(directory, { recursive: true });
+	const env = isolatedEnvironment(directory);
+	mkdirSync(cacheDirectory, { recursive: true });
+	env.npm_config_cache = join(cacheDirectory, "npm");
+	env.BUN_INSTALL_CACHE_DIR = join(cacheDirectory, "bun");
+	writeFileSync(join(directory, ".npmrc"), "@diffexai:registry=http://127.0.0.1:9/\n");
+	const dependencies = Object.fromEntries(
+		selected.map((pkg) => [
+			pkg.name,
+			`file:${join(tarballDirectory, records.find((record) => record.name === pkg.name).filename)}`,
+		]),
+	);
+	writeFileSync(
+		join(directory, "package.json"),
+		JSON.stringify({ private: true, type: "module", dependencies, overrides: dependencies }),
+	);
+	execFileSync(
+		manager,
+		manager === "npm"
+			? ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"]
+			: ["install", "--production", "--ignore-scripts", "--network-concurrency=8"],
+		{ cwd: directory, env, stdio: "inherit", timeout: 600_000 },
+	);
+	for (const pkg of selected) {
+		const installed = join(directory, "node_modules", pkg.name);
+		assertContained(installed, directory);
+		const info = readJson(join(installed, "package.json"));
+		assert.equal(info.name, pkg.name);
+		assert.equal(info.version, pkg.version);
+		const record = records.find((entry) => entry.name === pkg.name);
+		const inventory = JSON.parse(
+			execFileSync("tar", ["-xOf", join(tarballDirectory, record.filename), "package/distribution-files.json"], {
+				encoding: "utf8",
+				maxBuffer: 10 * 1024 * 1024,
+			}),
+		);
+		assert.deepEqual(
+			readJson(join(installed, "distribution-files.json")),
+			inventory,
+			"Installed inventory differs from the checked tarball",
+		);
+		for (const file of inventory.files) {
+			assertContained(join(installed, file.path), installed);
+			assert.equal(
+				digest(readFileSync(join(installed, file.path))),
+				file.sha256,
+				`Installed bytes differ: ${pkg.name}/${file.path}`,
+			);
+		}
+	}
+	return env;
+}
+
diff --git a/scripts/verify-candidate-artifacts.py b/scripts/verify-candidate-artifacts.py
index 61ef60bb2..6db297145 100644
--- a/scripts/verify-candidate-artifacts.py
+++ b/scripts/verify-candidate-artifacts.py
@@ -1,199 +1,208 @@
 import os, sys, json, subprocess, tempfile, shutil, pathlib, pty, select, time, re, fcntl, termios, struct
 
-if len(sys.argv) not in (2, 3):
-    raise SystemExit(
-        "Usage: python3 scripts/verify-candidate-artifacts.py ARTIFACT_DIRECTORY"
-    )
-out = pathlib.Path(sys.argv[1]).resolve()
-fixture_source = (
-    pathlib.Path(__file__).resolve().parent / "fixtures/artifact-handoff.mjs"
-)
-executables = {
-    "node": str(out / "node/node_modules/.bin/diffex"),
-    "bun-install": str(out / "bun-install/node_modules/.bin/diffex"),
-}
-if len(sys.argv) == 3:
-    executables = {"consumer": str(pathlib.Path(sys.argv[2]).resolve() / "node_modules/.bin/diffex")}
-results = []
-for runtime, exe in executables.items():
-    root = pathlib.Path(tempfile.mkdtemp(prefix="diffex artifact terminal "))
-    fixture = None
-    try:
-        for d in ["home", "agent", "project"]:
-            (root / d).mkdir()
-        env = {
-            "PATH": os.environ["PATH"],
-            "HOME": str(root / "home"),
-            "USERPROFILE": str(root / "home"),
-            "XDG_CONFIG_HOME": str(root / "home/config"),
-            "XDG_CACHE_HOME": str(root / "home/cache"),
-            "TMPDIR": str(root),
-            "DIFFEX_CODING_AGENT_DIR": str(root / "agent"),
-            "DIFFEX_NO_LOCAL_LLM": "1",
-            "TERM": "xterm-256color",
-            "LANG": "en_US.UTF-8",
-            "DIFFEX_HANDOFF_RECORD": str(root / "events.jsonl"),
-        }
-        (root / "agent/settings.json").write_text(
-            json.dumps({"theme": "dark", "packages": []})
-        )
-        (root / "events.jsonl").write_text("")
-        fixture_fd, fixture_path = tempfile.mkstemp(prefix="artifact-fixture-", suffix=".mjs", dir=pathlib.Path(exe).parent.parent.parent)
-        os.close(fixture_fd)
-        fixture = pathlib.Path(fixture_path)
-        shutil.copyfile(fixture_source, fixture)
-        args = [
-            exe,
-            "--no-session",
-            "--no-extensions",
-            "--no-skills",
-            "--no-context-files",
-            "--no-prompt-templates",
-            "-e",
-            str(fixture),
-            "--model",
-            "handoff/fixture",
-        ]
-        for command in [["--version"], ["--help"], ["auth", "--help"]]:
-            p = subprocess.run(
-                [exe] + command,
-                cwd=root / "project",
-                env={**env, "DIFFEX_OFFLINE": "1"},
-                capture_output=True,
-                text=True,
-                timeout=30,
-            )
-            assert p.returncode == 0, p.stderr
-            results.append(
-                {"runtime": runtime, "command": command, "exitCode": p.returncode}
-            )
-        for command, expected in [
-            (["--list-models"], "fixture"),
-            (["-p", "Reply with the fixture confirmation."], "handoff-fixture-ok"),
-        ]:
-            p = subprocess.run(
-                args + command,
-                cwd=root / "project",
-                env=env,
-                capture_output=True,
-                text=True,
-                timeout=30,
-            )
-            assert p.returncode == 0, (p.stdout, p.stderr)
-            assert expected in p.stdout, (p.stdout, p.stderr)
-            results.append(
-                {
-                    "runtime": runtime,
-                    "command": command,
-                    "exitCode": p.returncode,
-                    "expected": expected,
-                }
-            )
-        pid, fd = pty.fork()
-        if pid == 0:
-            os.chdir(root / "project")
-            fcntl.ioctl(1, termios.TIOCSWINSZ, struct.pack("HHHH", 30, 100, 0, 0))
-            os.execve(exe, args, env)
-        raw = b""
-        text = ""
-        stage = "startup"
-        deadline = time.monotonic() + 30
-        mark = 0
+
+def verify(out, executables, fixture_source=None):
+    out = pathlib.Path(out).resolve()
+    out.mkdir(parents=True, exist_ok=True)
+    fixture_source = fixture_source or pathlib.Path(__file__).resolve().parent / "fixtures/artifact-handoff.mjs"
+    results = []
+    for runtime, exe in executables.items():
+        root = pathlib.Path(tempfile.mkdtemp(prefix="diffex artifact terminal "))
+        fixture = None
         try:
-            while time.monotonic() < deadline:
-                if not select.select([fd], [], [], 0.1)[0]:
-                    continue
-                try:
-                    chunk = os.read(fd, 65536)
-                except OSError:
-                    break
-                if not chunk:
-                    break
-                raw += chunk
-                text = re.sub(
-                    r"\x1b\[[0-?]*[ -/]*[@-~]", "", raw.decode(errors="replace")
+            for d in ["home", "agent", "project"]:
+                (root / d).mkdir()
+            env = {
+                "PATH": os.environ["PATH"],
+                "HOME": str(root / "home"),
+                "USERPROFILE": str(root / "home"),
+                "XDG_CONFIG_HOME": str(root / "home/config"),
+                "XDG_CACHE_HOME": str(root / "home/cache"),
+                "TMPDIR": str(root),
+                "DIFFEX_CODING_AGENT_DIR": str(root / "agent"),
+                "DIFFEX_NO_LOCAL_LLM": "1",
+                "TERM": "xterm-256color",
+                "LANG": "en_US.UTF-8",
+                "DIFFEX_HANDOFF_RECORD": str(root / "events.jsonl"),
+            }
+            (root / "agent/settings.json").write_text(
+                json.dumps({"theme": "dark", "packages": []})
+            )
+            (root / "events.jsonl").write_text("")
+            fixture_fd, fixture_path = tempfile.mkstemp(prefix="artifact-fixture-", suffix=".mjs", dir=pathlib.Path(exe).parent.parent.parent)
+            os.close(fixture_fd)
+            fixture = pathlib.Path(fixture_path)
+            shutil.copyfile(fixture_source, fixture)
+            args = [
+                exe,
+                "--no-session",
+                "--no-extensions",
+                "--no-skills",
+                "--no-context-files",
+                "--no-prompt-templates",
+                "-e",
+                str(fixture),
+                "--model",
+                "handoff/fixture",
+            ]
+            for command in [["--version"], ["--help"], ["auth", "--help"]]:
+                p = subprocess.run(
+                    [exe] + command,
+                    cwd=root / "project",
+                    env={**env, "DIFFEX_OFFLINE": "1"},
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
                 )
-                if stage == "startup" and "Diffex v" in text:
-                    os.write(fd, b"Reply with the fixture confirmation.\r")
-                    stage = "reply"
-                elif stage == "reply" and "handoff-fixture-ok" in text:
-                    os.write(fd, b"/login\r")
-                    stage = "login"
-                elif stage == "login" and "Select authentication method:" in text:
-                    os.write(fd, b"\r")
-                    stage = "accounts"
-                elif stage == "accounts" and all(
-                    name in text for name in ["ChatGPT", "OpenRouter", "xAI"]
-                ):
-                    assert not re.search(r"\bRadius\b", text), text
-                    mark = len(raw)
-                    os.write(fd, b"radius")
-                    stage = "account-search"
-                elif stage == "account-search" and b"No matching providers" in raw[mark:]:
-                    mark = len(raw)
-                    os.write(fd, b"\x03")
-                    stage = "back"
-                elif stage == "back" and b"Select authentication method:" in raw[mark:]:
-                    mark = len(raw)
-                    os.write(fd, b"\x1b[B\r")
-                    stage = "api-keys"
-                elif stage == "api-keys" and b"Select provider to configure:" in raw[mark:]:
-                    mark = len(raw)
-                    os.write(fd, b"radius")
-                    stage = "api-key-search"
-                elif stage == "api-key-search" and b"No matching providers" in raw[mark:]:
-                    mark = len(raw)
-                    os.write(fd, b"\x03")
-                    stage = "api-key-back"
-                elif stage == "api-key-back" and b"Select authentication method:" in raw[mark:]:
-                    mark = len(raw)
-                    os.write(fd, b"\x03")
-                    stage = "editor"
-                elif stage == "editor" and b"Ask Diffex" in raw[mark:]:
-                    os.write(fd, b"/exit\r")
-                    stage = "exit"
-            (out / f"{runtime}-terminal.txt").write_text(text)
-            assert stage == "exit", (stage, text[-4000:])
-            ended, status = os.waitpid(pid, os.WNOHANG)
-            reap_deadline = time.monotonic() + 2
-            while not ended and time.monotonic() < reap_deadline:
-                time.sleep(0.02)
+                assert p.returncode == 0, p.stderr
+                results.append(
+                    {"runtime": runtime, "command": command, "exitCode": p.returncode}
+                )
+            for command, expected in [
+                (["--list-models"], "fixture"),
+                (["-p", "Reply with the fixture confirmation."], "handoff-fixture-ok"),
+            ]:
+                p = subprocess.run(
+                    args + command,
+                    cwd=root / "project",
+                    env=env,
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                )
+                assert p.returncode == 0, (p.stdout, p.stderr)
+                assert expected in p.stdout, (p.stdout, p.stderr)
+                results.append(
+                    {
+                        "runtime": runtime,
+                        "command": command,
+                        "exitCode": p.returncode,
+                        "expected": expected,
+                    }
+                )
+            pid, fd = pty.fork()
+            if pid == 0:
+                os.chdir(root / "project")
+                fcntl.ioctl(1, termios.TIOCSWINSZ, struct.pack("HHHH", 30, 100, 0, 0))
+                os.execve(exe, args, env)
+            raw = b""
+            text = ""
+            stage = "startup"
+            deadline = time.monotonic() + 30
+            mark = 0
+            try:
+                while time.monotonic() < deadline:
+                    if not select.select([fd], [], [], 0.1)[0]:
+                        continue
+                    try:
+                        chunk = os.read(fd, 65536)
+                    except OSError:
+                        break
+                    if not chunk:
+                        break
+                    raw += chunk
+                    text = re.sub(
+                        r"\x1b\[[0-?]*[ -/]*[@-~]", "", raw.decode(errors="replace")
+                    )
+                    if stage == "startup" and "Diffex v" in text:
+                        os.write(fd, b"Reply with the fixture confirmation.\r")
+                        stage = "reply"
+                    elif stage == "reply" and "handoff-fixture-ok" in text:
+                        os.write(fd, b"/login\r")
+                        stage = "login"
+                    elif stage == "login" and "Select authentication method:" in text:
+                        os.write(fd, b"\r")
+                        stage = "accounts"
+                    elif stage == "accounts" and all(
+                        name in text for name in ["ChatGPT", "OpenRouter", "xAI"]
+                    ):
+                        assert not re.search(r"\bRadius\b", text), text
+                        mark = len(raw)
+                        os.write(fd, b"radius")
+                        stage = "account-search"
+                    elif stage == "account-search" and b"No matching providers" in raw[mark:]:
+                        mark = len(raw)
+                        os.write(fd, b"\x03")
+                        stage = "back"
+                    elif stage == "back" and b"Select authentication method:" in raw[mark:]:
+                        mark = len(raw)
+                        os.write(fd, b"\x1b[B\r")
+                        stage = "api-keys"
+                    elif stage == "api-keys" and b"Select provider to configure:" in raw[mark:]:
+                        mark = len(raw)
+                        os.write(fd, b"radius")
+                        stage = "api-key-search"
+                    elif stage == "api-key-search" and b"No matching providers" in raw[mark:]:
+                        mark = len(raw)
+                        os.write(fd, b"\x03")
+                        stage = "api-key-back"
+                    elif stage == "api-key-back" and b"Select authentication method:" in raw[mark:]:
+                        mark = len(raw)
+                        os.write(fd, b"\x03")
+                        stage = "editor"
+                    elif stage == "editor" and b"Ask Diffex" in raw[mark:]:
+                        os.write(fd, b"/exit\r")
+                        stage = "exit"
+                (out / f"{runtime}-terminal.txt").write_text(text)
+                assert stage == "exit", (stage, text[-4000:])
                 ended, status = os.waitpid(pid, os.WNOHANG)
-            assert ended == pid, "Terminal did not exit within its bounded deadline"
-            pid = None
-            assert os.waitstatus_to_exitcode(status) == 0
-            (out / f"{runtime}-terminal.txt").write_text(text)
-            events = [
-                json.loads(l) for l in (root / "events.jsonl").read_text().splitlines()
-            ]
-            assert not any(e["type"] == "blocked-network" for e in events), events
-            assert sum(e["type"] == "inference" for e in events) == 2, events
-            requests = [e["url"] for e in events if e["type"] == "request"]
-            assert requests and set(requests) == {
-                "https://api.diffex.ai/api/latest-version"
-            }, events
-            results.append(
-                {
-                    "runtime": runtime,
-                    "command": "interactive prompt, subscription and API-key Radius exclusion, exit",
-                    "exitCode": 0,
-                    "events": events,
-                    "accounts": ["ChatGPT", "OpenRouter", "xAI"],
-                    "cleanup": "process exited and isolated directories removed",
-                }
-            )
+                reap_deadline = time.monotonic() + 2
+                while not ended and time.monotonic() < reap_deadline:
+                    time.sleep(0.02)
+                    ended, status = os.waitpid(pid, os.WNOHANG)
+                assert ended == pid, "Terminal did not exit within its bounded deadline"
+                pid = None
+                assert os.waitstatus_to_exitcode(status) == 0
+                (out / f"{runtime}-terminal.txt").write_text(text)
+                events = [
+                    json.loads(l) for l in (root / "events.jsonl").read_text().splitlines()
+                ]
+                assert not any(e["type"] == "blocked-network" for e in events), events
+                assert sum(e["type"] == "inference" for e in events) == 2, events
+                requests = [e["url"] for e in events if e["type"] == "request"]
+                assert requests and set(requests) == {
+                    "https://api.diffex.ai/api/latest-version"
+                }, events
+                results.append(
+                    {
+                        "runtime": runtime,
+                        "command": "interactive prompt, subscription and API-key Radius exclusion, exit",
+                        "exitCode": 0,
+                        "events": events,
+                        "accounts": ["ChatGPT", "OpenRouter", "xAI"],
+                        "cleanup": "process exited and isolated directories removed",
+                    }
+                )
+            finally:
+                os.close(fd)
+                if pid:
+                    try:
+                        os.kill(pid, 9)
+                    except ProcessLookupError:
+                        pass
+                    os.waitpid(pid, 0)
         finally:
-            os.close(fd)
-            if pid:
-                try:
-                    os.kill(pid, 9)
-                except ProcessLookupError:
-                    pass
-                os.waitpid(pid, 0)
-    finally:
-        if fixture is not None:
-            fixture.unlink(missing_ok=True)
-        shutil.rmtree(root)
-        assert not root.exists()
-(out / "smoke.json").write_text(json.dumps(results, indent=2) + "\n")
-print(json.dumps(results, indent=2))
+            if fixture is not None:
+                fixture.unlink(missing_ok=True)
+            shutil.rmtree(root)
+            assert not root.exists()
+    (out / "smoke.json").write_text(json.dumps(results, indent=2) + "\n")
+    print(json.dumps(results, indent=2))
+    return results
+
+if __name__ == "__main__":
+    if len(sys.argv) not in (2, 3):
+        raise SystemExit(
+            "Usage: python3 scripts/verify-candidate-artifacts.py ARTIFACT_DIRECTORY"
+        )
+    out = pathlib.Path(sys.argv[1]).resolve()
+    fixture_source = (
+        pathlib.Path(__file__).resolve().parent / "fixtures/artifact-handoff.mjs"
+    )
+    executables = {
+        "node": str(out / "node/node_modules/.bin/diffex"),
+        "bun-install": str(out / "bun-install/node_modules/.bin/diffex"),
+    }
+    if len(sys.argv) == 3:
+        executables = {"consumer": str(pathlib.Path(sys.argv[2]).resolve() / "node_modules/.bin/diffex")}
+    verify(out, executables, fixture_source)

From 93e37c9185c2a72b82fb0aba02806af6eae8a403 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 15:59:09 -0400
Subject: [PATCH 02/12] feat(coding-agent): add installed CLI and terminal
 behavior scenarios

---
 .../baselines/startup-120x40.txt              |  40 ++
 .../baselines/startup-80x24.txt               |  24 ++
 .../baselines/startup-resize-80x24.txt        |  24 ++
 scripts/daytona-behaviors/fixture.mjs         | 235 ++++++++++
 scripts/daytona-behaviors/fixture.test.mjs    | 144 +++++++
 scripts/daytona-behaviors/install.mjs         |  22 +
 scripts/daytona-behaviors/installed.py        | 408 ++++++++++++++++++
 scripts/daytona-behaviors/live-guard.mjs      |  35 ++
 scripts/daytona-behaviors/live-guard.test.mjs |  41 ++
 scripts/daytona-behaviors/test_installed.py   |  69 +++
 10 files changed, 1042 insertions(+)
 create mode 100644 scripts/daytona-behaviors/baselines/startup-120x40.txt
 create mode 100644 scripts/daytona-behaviors/baselines/startup-80x24.txt
 create mode 100644 scripts/daytona-behaviors/baselines/startup-resize-80x24.txt
 create mode 100644 scripts/daytona-behaviors/fixture.mjs
 create mode 100644 scripts/daytona-behaviors/fixture.test.mjs
 create mode 100644 scripts/daytona-behaviors/install.mjs
 create mode 100644 scripts/daytona-behaviors/installed.py
 create mode 100644 scripts/daytona-behaviors/live-guard.mjs
 create mode 100644 scripts/daytona-behaviors/live-guard.test.mjs
 create mode 100644 scripts/daytona-behaviors/test_installed.py

diff --git a/scripts/daytona-behaviors/baselines/startup-120x40.txt b/scripts/daytona-behaviors/baselines/startup-120x40.txt
new file mode 100644
index 000000000..13db84d0a
--- /dev/null
+++ b/scripts/daytona-behaviors/baselines/startup-120x40.txt
@@ -0,0 +1,40 @@
+
+  /----\_/----\
+ |     \|/     |
+   \---\ /---/        Diffex v<VERSION>
+        X             <PROJECT>
+   /---/ \---\
+ |     /|\     |
+  \____/^\____/
+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+
+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+› Ask Diffex to do something for you.
+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+fixture · thinking off · context 0.0% / 131k · harness default · ctrl+p model · /hotkeys
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/scripts/daytona-behaviors/baselines/startup-80x24.txt b/scripts/daytona-behaviors/baselines/startup-80x24.txt
new file mode 100644
index 000000000..157153cd5
--- /dev/null
+++ b/scripts/daytona-behaviors/baselines/startup-80x24.txt
@@ -0,0 +1,24 @@
+
+  /----\_/----\
+ |     \|/     |
+   \---\ /---/        Diffex v<VERSION>
+        X             <PROJECT>
+   /---/ \---\
+ |     /|\     |
+  \____/^\____/
+────────────────────────────────────────────────────────────────────────────────
+
+────────────────────────────────────────────────────────────────────────────────
+› Ask Diffex to do something for you.
+────────────────────────────────────────────────────────────────────────────────
+fixture · thinking off · context 0.0% / 131k · harness default · /hotkeys
+
+
+
+
+
+
+
+
+
+
diff --git a/scripts/daytona-behaviors/baselines/startup-resize-80x24.txt b/scripts/daytona-behaviors/baselines/startup-resize-80x24.txt
new file mode 100644
index 000000000..157153cd5
--- /dev/null
+++ b/scripts/daytona-behaviors/baselines/startup-resize-80x24.txt
@@ -0,0 +1,24 @@
+
+  /----\_/----\
+ |     \|/     |
+   \---\ /---/        Diffex v<VERSION>
+        X             <PROJECT>
+   /---/ \---\
+ |     /|\     |
+  \____/^\____/
+────────────────────────────────────────────────────────────────────────────────
+
+────────────────────────────────────────────────────────────────────────────────
+› Ask Diffex to do something for you.
+────────────────────────────────────────────────────────────────────────────────
+fixture · thinking off · context 0.0% / 131k · harness default · /hotkeys
+
+
+
+
+
+
+
+
+
+
diff --git a/scripts/daytona-behaviors/fixture.mjs b/scripts/daytona-behaviors/fixture.mjs
new file mode 100644
index 000000000..b15bc767f
--- /dev/null
+++ b/scripts/daytona-behaviors/fixture.mjs
@@ -0,0 +1,235 @@
+// Installed acceptance extension: only provider inference/HTTP are synthetic.
+// Sessions, built-in tools, auth resolution, agent orchestration and UI remain real.
+import { appendFileSync } from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { Socket } from "node:net";
+import { createAssistantMessageEventStream } from "@diffexai/diffex-ai";
+
+const toolSteps = [
+	{ name: "read", arguments: { path: "input.txt" } },
+	{ name: "write", arguments: { path: "output.txt", content: "behavior-written\n" } },
+	{
+		name: "edit",
+		arguments: { path: "output.txt", edits: [{ oldText: "written", newText: "edited" }] },
+	},
+	{ name: "bash", arguments: { command: "cat output.txt > bash-result.txt" } },
+];
+
+function textOf(message) {
+	return typeof message.content === "string"
+		? message.content
+		: message.content.filter((block) => block.type === "text").map((block) => block.text).join("\n");
+}
+
+function checkedResults(messages, promptIndex) {
+	const following = messages.slice(promptIndex + 1);
+	const calls = following.flatMap((message) =>
+		message.role === "assistant" ? message.content.filter((block) => block.type === "toolCall") : [],
+	);
+	const results = following.filter((message) => message.role === "toolResult");
+	if (results.length > toolSteps.length || calls.length !== results.length) {
+		throw new Error("Behavior tools context has missing or extra tool results");
+	}
+	for (const [index, result] of results.entries()) {
+		const step = toolSteps[index];
+		const call = calls[index];
+		if (
+			result.isError ||
+			result.toolName !== step.name ||
+			call.name !== step.name ||
+			call.id !== result.toolCallId ||
+			JSON.stringify(call.arguments) !== JSON.stringify(step.arguments)
+		) {
+			throw new Error(`Behavior ${step.name} tool result/context mismatch`);
+		}
+	}
+	return results;
+}
+
+function authResponse() {
+	const text = "behavior-auth-ok";
+	const item = {
+		type: "message",
+		id: "msg_behavior_auth",
+		role: "assistant",
+		status: "completed",
+		content: [{ type: "output_text", text, annotations: [] }],
+	};
+	const events = [
+		{ type: "response.created", response: { id: "resp_behavior_auth", status: "in_progress" } },
+		{ type: "response.output_item.added", output_index: 0, item: { ...item, status: "in_progress", content: [] } },
+		{ type: "response.content_part.added", output_index: 0, content_index: 0, item_id: item.id, part: { type: "output_text", text: "", annotations: [] } },
+		{ type: "response.output_text.delta", output_index: 0, content_index: 0, item_id: item.id, delta: text },
+		{ type: "response.output_text.done", output_index: 0, content_index: 0, item_id: item.id, text },
+		{ type: "response.output_item.done", output_index: 0, item },
+		{
+			type: "response.completed",
+			response: {
+				id: "resp_behavior_auth",
+				object: "response",
+				model: "gpt-4.1-mini",
+				status: "completed",
+				output: [item],
+				usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2, input_tokens_details: { cached_tokens: 0 }, output_tokens_details: { reasoning_tokens: 0 } },
+			},
+		},
+	];
+	const encoder = new TextEncoder();
+	return new Response(new ReadableStream({
+		start(controller) {
+			for (const [sequence_number, event] of events.entries()) {
+				controller.enqueue(encoder.encode(`event: ${event.type}\ndata: ${JSON.stringify({ ...event, sequence_number })}\n\n`));
+			}
+			controller.close();
+		},
+	}), { headers: { "content-type": "text/event-stream", "x-request-id": "req_behavior_auth" } });
+}
+
+export default function (diffex) {
+	const recordPath = process.env.DIFFEX_BEHAVIOR_RECORD;
+	if (!recordPath) throw new Error("DIFFEX_BEHAVIOR_RECORD is required");
+	const record = (value) => appendFileSync(recordPath, `${JSON.stringify(value)}\n`);
+	diffex.on("agent_settled", () => { record({ type: "settled" }); });
+	diffex.on("tool_result", (event) => { record({ ...event, type: "tool_result" }); });
+	const transport = process.env.DIFFEX_BEHAVIOR_TRANSPORT === "1";
+	const blocked = (details) => {
+		record({ type: "blocked-network", ...details });
+		throw new Error("Network disabled by behavior acceptance fixture");
+	};
+	globalThis.fetch = async (input, init) => {
+		const url = input instanceof Request ? input.url : String(input);
+		const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+		record({ type: "request", url, method });
+		if (url === "https://api.diffex.ai/api/latest-version" && method === "GET") {
+			return Response.json({ error: "no_published_release" }, { status: 404 });
+		}
+		if (!transport || url !== "https://api.openai.com/v1/responses" || method !== "POST") {
+			return blocked({ transport: "fetch", url, method });
+		}
+		const headers = new Headers(input instanceof Request ? input.headers : undefined);
+		new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+		const allowedHeaders = new Set([
+			"accept", "authorization", "content-type", "user-agent", "session_id", "x-client-request-id",
+			"x-stainless-arch", "x-stainless-lang", "x-stainless-os", "x-stainless-package-version",
+			"x-stainless-runtime", "x-stainless-runtime-version", "x-stainless-retry-count", "x-stainless-timeout",
+		]);
+		for (const name of headers.keys()) {
+			if (!allowedHeaders.has(name)) return blocked({ transport: "fetch", url, header: name });
+		}
+		if (process.env.OPENAI_API_KEY !== "fake" || headers.get("authorization") !== "Bearer fake" || headers.get("content-type") !== "application/json") {
+			return blocked({ transport: "fetch", url, reason: "Unexpected auth or content-type" });
+		}
+		const body = init?.body ?? (input instanceof Request ? await input.text() : undefined);
+		if (typeof body !== "string") return blocked({ transport: "fetch", url, reason: "Expected JSON body" });
+		const payload = JSON.parse(body);
+		if (payload.model !== "gpt-4.1-mini" || payload.stream !== true || !Array.isArray(payload.input)) {
+			return blocked({ transport: "fetch", url, reason: "Unexpected model or streaming payload" });
+		}
+		record({ type: "inference", provider: "openai", model: payload.model, transport: "fetch", credentialVerified: true });
+		record({ type: "context", transport: "fetch", input: payload.input });
+		record({ type: "auth-request", url, credentialVerified: true, headers: { ...Object.fromEntries(headers), authorization: "Bearer [fixture]" }, payload });
+		return authResponse();
+	};
+	Socket.prototype.connect = function () {
+		return blocked({ transport: "socket" });
+	};
+	syncBuiltinESMExports();
+	// Crucially, transport mode does not register/override any provider or auth.
+	if (transport) return;
+
+	diffex.registerProvider("behavior", {
+		baseUrl: "https://behavior.invalid",
+		apiKey: "local-fixture",
+		api: "behavior",
+		models: [{
+			id: "fixture",
+			name: "Behavior fixture",
+			reasoning: false,
+			input: ["text"],
+			cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+			contextWindow: 131072,
+			maxTokens: 1024,
+		}],
+		streamSimple(model, context, options = {}) {
+			const stream = createAssistantMessageEventStream();
+			const message = {
+				role: "assistant", content: [], api: model.api, provider: model.provider, model: model.id,
+				usage: { input: 1, output: 1, cacheRead: 0, cacheWrite: 0, totalTokens: 2, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+				stopReason: "pending", timestamp: Date.now(),
+			};
+			queueMicrotask(async () => {
+				try {
+					const messages = context.messages;
+					const promptIndex = messages.findLastIndex((entry) => entry.role === "user");
+					const prompt = promptIndex < 0 ? "" : textOf(messages[promptIndex]);
+					const modes = prompt.match(/\bBEHAVIOR_(?:PRINT|TOOLS|CANCEL|RECOVER|RESUME)\b/g) ?? [];
+					if (new Set(modes).size !== 1) throw new Error("Expected exactly one BEHAVIOR mode in latest user prompt");
+					const mode = modes[0];
+					record({ type: "inference", provider: model.provider, model: model.id, mode, prompt });
+					record({ type: "context", mode, messages, tools: context.tools?.map((tool) => tool.name) ?? [] });
+					for (const result of messages.filter((entry) => entry.role === "toolResult")) {
+						record({ type: "tool-result", mode, ...result });
+					}
+					await options.onPayload?.({ model: model.id, messages }, model);
+					await options.onResponse?.({ status: 200, headers: {} }, model);
+					if (options.signal?.aborted) throw new Error("Request was aborted");
+					stream.push({ type: "start", partial: message });
+					let text;
+					if (mode === "BEHAVIOR_TOOLS") {
+						const results = checkedResults(messages, promptIndex);
+						if (results.length < toolSteps.length) {
+							const step = toolSteps[results.length];
+							if (!context.tools?.some((tool) => tool.name === step.name)) throw new Error(`Missing built-in ${step.name} tool`);
+							const call = { type: "toolCall", id: `behavior_${promptIndex}_${step.name}`, ...step };
+							message.content.push(call);
+							stream.push({ type: "toolcall_start", contentIndex: 0, partial: message });
+							stream.push({ type: "toolcall_delta", contentIndex: 0, delta: JSON.stringify(step.arguments), partial: message });
+							stream.push({ type: "toolcall_end", contentIndex: 0, toolCall: call, partial: message });
+							message.stopReason = "toolUse";
+							stream.push({ type: "done", reason: "toolUse", message });
+							stream.end(message);
+							return;
+						}
+						text = "behavior-tools-ok";
+					} else if (mode === "BEHAVIOR_RESUME") {
+						const earlierIndex = messages.findLastIndex((entry, index) => index < promptIndex && entry.role === "user" && /\bBEHAVIOR_TOOLS\b/.test(textOf(entry)));
+						if (earlierIndex < 0 || checkedResults(messages.slice(0, promptIndex), earlierIndex).length !== toolSteps.length || !messages.slice(earlierIndex + 1, promptIndex).some((entry) => entry.role === "assistant" && textOf(entry) === "behavior-tools-ok")) {
+							throw new Error("Resumed context is missing the earlier BEHAVIOR_TOOLS prompt, results or final answer");
+						}
+						record({ type: "resume-verified", prompt: textOf(messages[earlierIndex]), toolNames: toolSteps.map((step) => step.name) });
+						text = "behavior-resumed-ok";
+					} else {
+						text = { BEHAVIOR_PRINT: "behavior-print-ok", BEHAVIOR_RECOVER: "behavior-recovered-ok", BEHAVIOR_CANCEL: "behavior-cancel-started" }[mode];
+					}
+					message.content.push({ type: "text", text });
+					stream.push({ type: "text_start", contentIndex: 0, partial: message });
+					stream.push({ type: "text_delta", contentIndex: 0, delta: text, partial: message });
+					if (mode === "BEHAVIOR_CANCEL") {
+						if (!options.signal) throw new Error("Cancellation fixture requires an AbortSignal");
+						record({ type: "cancel-started" });
+						await new Promise((resolve) => {
+							// Keep print/RPC processes alive as a real pending HTTP request would.
+							const keepAlive = setInterval(() => {}, 1000);
+							const abort = () => { clearInterval(keepAlive); resolve(); };
+							options.signal.addEventListener("abort", abort, { once: true });
+							if (options.signal.aborted) { options.signal.removeEventListener("abort", abort); abort(); }
+						});
+						record({ type: "abort", mode, aborted: options.signal.aborted });
+						throw new Error("Behavior fixture request aborted");
+					}
+					stream.push({ type: "text_end", contentIndex: 0, content: text, partial: message });
+					message.stopReason = "stop";
+					stream.push({ type: "done", reason: "stop", message });
+					stream.end(message);
+				} catch (error) {
+					message.stopReason = options.signal?.aborted ? "aborted" : "error";
+					message.errorMessage = error instanceof Error ? error.message : String(error);
+					record({ type: "stream-error", reason: message.stopReason, message: message.errorMessage });
+					stream.push({ type: "error", reason: message.stopReason, error: message });
+					stream.end(message);
+				}
+			});
+			return stream;
+		},
+	});
+}
diff --git a/scripts/daytona-behaviors/fixture.test.mjs b/scripts/daytona-behaviors/fixture.test.mjs
new file mode 100644
index 000000000..11c837d0d
--- /dev/null
+++ b/scripts/daytona-behaviors/fixture.test.mjs
@@ -0,0 +1,144 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { Socket } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+import fixture from "./fixture.mjs";
+
+const cli = fileURLToPath(new URL("../../packages/coding-agent/dist/cli.js", import.meta.url));
+const extension = fileURLToPath(new URL("./fixture.mjs", import.meta.url));
+
+function records(path) {
+	return readFileSync(path, "utf8").trim().split("\n").map((line) => JSON.parse(line));
+}
+
+function runCli(directory, record, args, env = {}) {
+	const result = spawnSync(process.execPath, [cli, "--no-extensions", "-e", extension, ...args], {
+		cwd: directory,
+		env: {
+			...process.env,
+			DIFFEX_CODING_AGENT_DIR: join(directory, "config"),
+			DIFFEX_BEHAVIOR_RECORD: record,
+			DIFFEX_BEHAVIOR_TRANSPORT: "0",
+			...env,
+		},
+		encoding: "utf8",
+		timeout: 30000,
+	});
+	assert.equal(result.error, undefined);
+	assert.equal(result.status, 0, result.stderr || result.stdout);
+	return result.stdout;
+}
+
+test("installed extension drives real print, built-in tools and persisted resume", () => {
+	const directory = mkdtempSync(join(tmpdir(), "behavior-fixture-"));
+	try {
+		const record = join(directory, "record.jsonl");
+		const session = join(directory, "session.jsonl");
+		writeFileSync(join(directory, "input.txt"), "behavior-input\n");
+		assert.match(runCli(directory, record, ["--model", "behavior/fixture", "--no-session", "-p", "BEHAVIOR_PRINT"]), /behavior-print-ok/);
+		assert.match(runCli(directory, record, ["--model", "behavior/fixture", "--session", session, "-p", "BEHAVIOR_TOOLS"]), /behavior-tools-ok/);
+		assert.equal(readFileSync(join(directory, "output.txt"), "utf8"), "behavior-edited\n");
+		assert.equal(readFileSync(join(directory, "bash-result.txt"), "utf8"), "behavior-edited\n");
+		assert.match(runCli(directory, record, ["--model", "behavior/fixture", "--session", session, "-p", "BEHAVIOR_RESUME"]), /behavior-resumed-ok/);
+		const events = records(record);
+		assert.equal(events.filter((event) => event.type === "settled").length, 3);
+		assert.deepEqual(events.filter((event) => event.type === "tool_result").map((event) => event.toolName), ["read", "write", "edit", "bash"]);
+		assert.equal(events.filter((event) => event.type === "resume-verified").length, 1);
+		assert.equal(events.some((event) => event.type === "blocked-network"), false);
+		const resumed = events.find((event) => event.type === "context" && event.mode === "BEHAVIOR_RESUME");
+		assert.equal(resumed.messages.filter((message) => message.role === "toolResult").length, 4);
+	} finally {
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
+
+test("built-in OpenAI provider resolves fake environment credentials and consumes Responses SSE", () => {
+	const directory = mkdtempSync(join(tmpdir(), "behavior-auth-"));
+	try {
+		const record = join(directory, "record.jsonl");
+		assert.match(runCli(directory, record, ["--model", "openai/gpt-4.1-mini", "--no-session", "-p", "BEHAVIOR_AUTH"], {
+			DIFFEX_BEHAVIOR_TRANSPORT: "1", OPENAI_API_KEY: "fake",
+		}), /behavior-auth-ok/);
+		const events = records(record);
+		assert(events.some((event) => event.type === "auth-request" && event.credentialVerified));
+		assert.equal(events.filter((event) => event.type === "settled").length, 1);
+		assert.equal(events.some((event) => event.type === "blocked-network"), false);
+	} finally {
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
+
+test("cancellation stays pending until AbortSignal, then recovery and missing-resume checks work", async () => {
+	const directory = mkdtempSync(join(tmpdir(), "behavior-cancel-"));
+	const originalFetch = globalThis.fetch;
+	const originalConnect = Socket.prototype.connect;
+	const originalEnv = { ...process.env };
+	try {
+		const record = join(directory, "record.jsonl");
+		process.env.DIFFEX_BEHAVIOR_RECORD = record;
+		process.env.DIFFEX_BEHAVIOR_TRANSPORT = "0";
+		let provider;
+		fixture({ on() {}, registerProvider(_name, config) { provider = config; } });
+		const model = { api: "behavior", provider: "behavior", id: "fixture" };
+		const controller = new AbortController();
+		const stream = provider.streamSimple(model, { messages: [{ role: "user", content: "BEHAVIOR_CANCEL", timestamp: 1 }] }, { signal: controller.signal });
+		let settled = false;
+		stream.result().then(() => { settled = true; });
+		for await (const event of stream) {
+			if (event.type === "text_delta") {
+				assert.equal(event.delta, "behavior-cancel-started");
+				await new Promise((resolve) => setTimeout(resolve, 20));
+				assert.equal(settled, false);
+				assert.equal(records(record).some((entry) => entry.type === "abort"), false);
+				controller.abort();
+			}
+		}
+		assert.equal((await stream.result()).stopReason, "aborted");
+		assert(records(record).some((entry) => entry.type === "abort" && entry.aborted));
+		const recovered = await provider.streamSimple(model, { messages: [{ role: "user", content: "BEHAVIOR_RECOVER", timestamp: 2 }] }).result();
+		assert.equal(recovered.content[0].text, "behavior-recovered-ok");
+		const invalidResume = await provider.streamSimple(model, { messages: [{ role: "user", content: "BEHAVIOR_RESUME", timestamp: 3 }] }).result();
+		assert.equal(invalidResume.stopReason, "error");
+		assert.match(invalidResume.errorMessage, /missing the earlier/);
+		await assert.rejects(fetch("https://example.com/"), /Network disabled/);
+		assert.throws(() => new Socket().connect(443, "example.com"), /Network disabled/);
+		assert.equal((await fetch("https://api.diffex.ai/api/latest-version")).status, 404);
+	} finally {
+		globalThis.fetch = originalFetch;
+		Socket.prototype.connect = originalConnect;
+		process.env = originalEnv;
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
+
+test("transport rejects unexpected hosts, credentials and custom headers without registering providers", async () => {
+	const directory = mkdtempSync(join(tmpdir(), "behavior-network-"));
+	const originalFetch = globalThis.fetch;
+	const originalConnect = Socket.prototype.connect;
+	const originalEnv = { ...process.env };
+	try {
+		process.env.DIFFEX_BEHAVIOR_RECORD = join(directory, "record.jsonl");
+		process.env.DIFFEX_BEHAVIOR_TRANSPORT = "1";
+		process.env.OPENAI_API_KEY = "fake";
+		fixture({ on() {}, registerProvider() { assert.fail("Transport fixture must not register a provider"); } });
+		const request = {
+			method: "POST",
+			headers: { authorization: "Bearer fake", "content-type": "application/json" },
+			body: JSON.stringify({ model: "gpt-4.1-mini", stream: true, input: [] }),
+		};
+		await assert.rejects(fetch("https://unexpected.example/v1/responses", request), /Network disabled/);
+		await assert.rejects(fetch("https://api.openai.com/v1/responses", { ...request, headers: { ...request.headers, authorization: "Bearer real-secret" } }), /Network disabled/);
+		await assert.rejects(fetch("https://api.openai.com/v1/responses", { ...request, headers: { ...request.headers, "x-api-key": "unexpected" } }), /Network disabled/);
+		assert.equal(records(process.env.DIFFEX_BEHAVIOR_RECORD).filter((event) => event.type === "blocked-network").length, 3);
+		assert.equal(readFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, "utf8").includes("real-secret"), false);
+	} finally {
+		globalThis.fetch = originalFetch;
+		Socket.prototype.connect = originalConnect;
+		process.env = originalEnv;
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
diff --git a/scripts/daytona-behaviors/install.mjs b/scripts/daytona-behaviors/install.mjs
new file mode 100644
index 000000000..10f221cee
--- /dev/null
+++ b/scripts/daytona-behaviors/install.mjs
@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import { readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { installConsumer, verifyTarballs } from "../artifact-installation.mjs";
+
+const [artifacts, consumer, manager, commit] = process.argv.slice(2);
+assert(artifacts && consumer && ["npm", "bun"].includes(manager) && /^[a-f0-9]{40}$/.test(commit),
+	"Usage: node install.mjs ARTIFACTS CONSUMER npm|bun COMMIT");
+const manifest = JSON.parse(readFileSync(join(artifacts, "manifest.json"), "utf8"));
+assert.equal(manifest.source.commit, commit, "Retained source does not match triggering commit");
+assert.equal(manifest.schemaVersion, 1);
+const packages = manifest.packages;
+assert.equal(packages.length, 1, "Expected the standalone CLI distribution");
+assert.equal(packages[0].name, "@diffexai/diffex");
+verifyTarballs(artifacts, packages, packages);
+installConsumer(resolve(consumer), manager, packages, packages, resolve(artifacts));
+const executable = join(resolve(consumer), "node_modules/.bin/diffex");
+assert(realpathSync(executable).startsWith(`${resolve(consumer)}/node_modules/`));
+writeFileSync(join(consumer, "installation.json"), `${JSON.stringify({
+	manager, executable, resolved: realpathSync(executable), commit,
+	artifacts: packages.map(({ name, sha256 }) => ({ name, sha256 })), integrity: "passed",
+}, null, 2)}\n`);
diff --git a/scripts/daytona-behaviors/installed.py b/scripts/daytona-behaviors/installed.py
new file mode 100644
index 000000000..9b8ee57dd
--- /dev/null
+++ b/scripts/daytona-behaviors/installed.py
@@ -0,0 +1,408 @@
+"""Installed-package acceptance. No repository imports, provider keys in evidence, or UI mocks."""
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import shlex
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+import xml.etree.ElementTree as ET
+
+HERE = Path(__file__).resolve().parent
+
+
+def read_events(path):
+    return [json.loads(line) for line in path.read_text().splitlines()] if path.exists() else []
+
+
+def write_json(path, value):
+    path.write_text(json.dumps(value, indent=2) + "\n")
+
+
+class Terminal:
+    """Real tmux PTY, isolated server, bounded state waits, and incremental capture."""
+    def __init__(self, executable, args, env, project, evidence, deadline):
+        self.socket = "diffex-behavior-" + uuid.uuid4().hex
+        self.evidence, self.deadline = evidence, deadline
+        self.env = env
+        (evidence / "tmux.conf").write_text("set -g extended-keys on\nset -gq extended-keys-format csi-u\n")
+        self.command("new-session", "-d", "-s", "behavior", "-x", "80", "-y", "24",
+                     "-c", str(project),
+                     " ".join(shlex.quote(a) for a in [executable, *args]))
+        self.command("set-option", "-g", "remain-on-exit", "on")
+        self.command("pipe-pane", "-o", "cat >> " + shlex.quote(str(evidence / "terminal.raw")))
+
+    def command(self, *args):
+        result = subprocess.run(["tmux", "-f", str(self.evidence / "tmux.conf"), "-L", self.socket, *args], capture_output=True, text=True,
+                                timeout=10, env=self.env)
+        if result.returncode:
+            raise RuntimeError("tmux: " + result.stderr)
+        return result.stdout
+
+    def send(self, text):
+        self.command("send-keys", "-l", text)
+        self.command("send-keys", "Enter")
+
+    def capture(self):
+        screen = self.command("capture-pane", "-p", "-S", "-2000")
+        (self.evidence / "terminal.txt").write_text(screen)
+        return screen
+
+    def wait(self, text, seconds=30):
+        end = min(self.deadline, time.monotonic() + seconds)
+        while time.monotonic() < end:
+            screen = self.capture()
+            if text in screen:
+                return screen
+            time.sleep(.1)
+        raise AssertionError(f"Terminal did not reach {text!r} within bounded wait")
+
+    def settled(self, record, previous, seconds=30):
+        end = min(self.deadline, time.monotonic() + seconds)
+        while time.monotonic() < end:
+            self.capture()
+            if sum(e["type"] == "settled" for e in read_events(record)) > previous:
+                return
+            time.sleep(.1)
+        raise AssertionError("Agent did not settle before deadline")
+
+    def screen(self, name, size, baseline):
+        width, height = size
+        self.command("resize-window", "-x", str(width), "-y", str(height))
+        # Wait for a stable rendered layout, not an arbitrary startup sleep.
+        end = min(self.deadline, time.monotonic() + 5)
+        previous, stable = None, 0
+        while time.monotonic() < end:
+            screen = self.command("capture-pane", "-p")
+            stable = stable + 1 if screen == previous else 0
+            previous = screen
+            if stable >= 3:
+                break
+            time.sleep(.1)
+        assert stable >= 3, "Terminal layout never stabilized"
+        (self.evidence / (name + ".txt")).write_text(screen)
+        normalized = normalize_screen(screen, self.env)
+        (self.evidence / (name + ".normalized.txt")).write_text(normalized)
+        expected = HERE / "baselines" / (name + ".txt")
+        if baseline:
+            expected.parent.mkdir(exist_ok=True)
+            expected.write_text(normalized)
+        assert expected.exists(), f"Missing reviewed baseline: {expected.name}"
+        assert normalized == expected.read_text(), f"Layout differs: {expected.name} (see captures)"
+        assert len(screen.splitlines()) == height, "Incorrect terminal height"
+        assert all(len(line) <= width for line in screen.splitlines()), "Terminal overflow"
+
+    def exit(self):
+        self.send("/exit")
+        end = min(self.deadline, time.monotonic() + 10)
+        while time.monotonic() < end:
+            self.capture()
+            dead = self.command("display-message", "-p", "#{pane_dead}:#{pane_dead_status}").strip()
+            if dead.startswith("1:"):
+                assert dead == "1:0", f"Unclean terminal exit: {dead}"
+                return
+            time.sleep(.1)
+        raise AssertionError("Terminal failed to exit")
+
+    def close(self):
+        try:
+            self.capture()
+        finally:
+            self.command("kill-server")
+
+
+def normalize_screen(screen, env):
+    # Only machine-specific identity/timing is normalized; whitespace and geometry remain exact.
+    screen = screen.replace(str(Path(env["DIFFEX_PROJECT"]).resolve()), "<PROJECT>")
+    screen = screen.replace(env["HOME"], "<HOME>").replace(env["DIFFEX_PROJECT"], "<PROJECT>")
+    screen = re.sub(r"Diffex v[\w.\-]+", "Diffex v<VERSION>", screen)
+    screen = re.sub(r"\b\d+(?:\.\d+)?[km]?/\d+(?:\.\d+)?[km]?", "<TOKENS>", screen)
+    screen = re.sub(r"\b\d+(?:\.\d+)?(?:ms|s)\b", "<TIME>", screen)
+    return screen
+
+
+class Runner:
+    def __init__(self, args):
+        self.args = args
+        self.output = args.output.resolve()
+        self.output.mkdir(parents=True, exist_ok=True)
+        self.results = []
+        self.hashes = {}
+        self.deadline = time.monotonic() + (180 if args.mode == "live" else 1200)
+        self.secrets = [os.environ.get("OPENAI_API_KEY", "")] if args.mode == "live" else []
+
+    def save(self):
+        result = {"schemaVersion": 1, "commit": self.args.commit, "mode": self.args.mode,
+                  "artifactHashes": self.hashes, "scenarios": self.results,
+                  "outcome": "passed" if self.results and all(r["outcome"] == "passed" for r in self.results) else "failed"}
+        write_json(self.output / "results.json", result)
+        suite = ET.Element("testsuite", name="installed-" + self.args.mode, tests=str(len(self.results)),
+                           failures=str(sum(r["outcome"] != "passed" for r in self.results)))
+        for r in self.results:
+            case = ET.SubElement(suite, "testcase", name=r["id"], time=str(r["duration"]), classname=r["category"])
+            if r["outcome"] != "passed":
+                ET.SubElement(case, "failure", message=r.get("error", "failed")).text = r.get("error", "failed")
+            ET.SubElement(case, "system-out").text = json.dumps({"commit": self.args.commit, "artifactHashes": self.hashes, "evidence": r["evidence"]})
+        ET.ElementTree(suite).write(self.output / "results.xml", encoding="unicode")
+
+    def scenario(self, identity, operation, category="product"):
+        evidence = self.output / identity
+        evidence.mkdir(parents=True, exist_ok=True)
+        started = time.monotonic()
+        item = {"id": identity, "commit": self.args.commit, "artifactHashes": self.hashes,
+                "outcome": "failed", "category": category, "evidence": [str(evidence.relative_to(self.output))]}
+        try:
+            assert time.monotonic() < self.deadline, "Run deadline exceeded"
+            operation(evidence)
+            item["outcome"] = "passed"
+        except Exception as error:
+            message = str(error)
+            for secret in self.secrets:
+                if secret:
+                    message = message.replace(secret, "[REDACTED]")
+            item["error"] = message
+            # Availability/configuration is distinct from an assertion about product behavior.
+            statuses = [event["status"] for file in evidence.glob("**/events.jsonl") for event in read_events(file) if event["type"] == "response"]
+            if any(s in (401, 403) for s in statuses):
+                item["category"] = "configuration"
+            elif any(s == 429 or s >= 500 for s in statuses):
+                item["category"] = "provider"
+        finally:
+            item["duration"] = round(time.monotonic() - started, 3)
+            self.results.append(item)
+            self.save()
+        return item["outcome"] == "passed"
+
+    def environment(self, root):
+        for name in ("home", "agent", "project", "temp"):
+            (root / name).mkdir()
+        write_json(root / "agent/settings.json", {"theme": "dark", "packages": [], "retry": {"enabled": False}})
+        env = {"PATH": os.environ["PATH"], "HOME": str(root / "home"), "USERPROFILE": str(root / "home"),
+               "XDG_CONFIG_HOME": str(root / "home/config"), "XDG_CACHE_HOME": str(root / "home/cache"),
+               "TMPDIR": str(root / "temp"), "DIFFEX_CODING_AGENT_DIR": str(root / "agent"),
+               "DIFFEX_NO_LOCAL_LLM": "1", "TERM": "xterm-256color", "LANG": "C.UTF-8",
+               "DIFFEX_PROJECT": str(root / "project"), "DIFFEX_BEHAVIOR_RECORD": str(root / "events.jsonl")}
+        return env
+
+    def args_for(self, extension, model):
+        return ["--no-extensions", "--no-skills", "--no-context-files", "--no-prompt-templates", "-e", str(extension), "--model", model]
+
+    def process(self, executable, args, env, project, evidence):
+        remaining = self.deadline - time.monotonic()
+        assert remaining > 0, "Run deadline exceeded"
+        result = subprocess.run([executable, *args], cwd=project, env=env, capture_output=True, text=True, timeout=min(40, remaining))
+        (evidence / "stdout.txt").write_text(result.stdout)
+        (evidence / "stderr.txt").write_text(result.stderr)
+        assert result.returncode == 0, f"Exit code {result.returncode}; see stdout/stderr"
+        return result.stdout
+
+    def behavior(self, executable, evidence, action):
+        with tempfile.TemporaryDirectory(prefix="db-", dir="/tmp") as temporary:
+            root = Path(temporary)
+            env = self.environment(root)
+            # Keep the fixture beside node_modules so its import resolves the installed SDK, never the repository.
+            fixture = Path(executable).parent.parent.parent / ("behavior-" + uuid.uuid4().hex + ".mjs")
+            shutil.copyfile(HERE / ("live-guard.mjs" if self.args.mode == "live" else "fixture.mjs"), fixture)
+            try:
+                action(env, root, fixture)
+                if self.args.mode == "deterministic":
+                    assert not any(e["type"] == "blocked-network" for e in read_events(root / "events.jsonl")), "Unexpected external request"
+            finally:
+                fixture.unlink(missing_ok=True)
+                for source, target in [(root / "events.jsonl", evidence / "events.jsonl"),
+                                       (root / "agent/sessions", evidence / "sessions"),
+                                       (root / "project", evidence / "project")]:
+                    if source.is_dir():
+                        shutil.copytree(source, target)
+                    elif source.exists():
+                        shutil.copyfile(source, target)
+                # Never copy home, agent/auth.json, settings, or process environment.
+                for file in evidence.rglob("*"):
+                    if file.is_file():
+                        text = file.read_text(errors="replace")
+                        for secret in self.secrets:
+                            if secret:
+                                text = text.replace(secret, "[REDACTED]")
+                        file.write_text(text)
+
+    def deterministic(self, executable, runtime):
+        def run_case(name, fn):
+            return self.scenario(runtime + "-" + name, lambda evidence: self.behavior(executable, evidence, lambda env, root, fixture: fn(env, root, fixture, evidence)))
+
+        def installation(env, root, fixture, evidence):
+            assert Path(executable).is_file(), "Executable missing"
+            resolved = str(Path(executable).resolve())
+            write_json(evidence / "resolution.json", {"requested": executable, "resolved": resolved})
+            args = self.args_for(fixture, "behavior/fixture")
+            for command, expected in [(["--help"], "Usage"), (["--version"], ""), (args + ["--list-models"], "fixture")]:
+                output = self.process(executable, command, env, root / "project", evidence)
+                assert expected in output and output.strip(), "Installation command output missing"
+        run_case("installation", installation)
+
+        def printed(env, root, fixture, evidence):
+            output = self.process(executable, self.args_for(fixture, "behavior/fixture") + ["--no-session", "-p", "BEHAVIOR_PRINT"], env, root / "project", evidence)
+            assert "behavior-print-ok" in output
+        run_case("print", printed)
+
+        def transport(env, root, fixture, evidence):
+            env.update(DIFFEX_BEHAVIOR_TRANSPORT="1", OPENAI_API_KEY="fake")
+            output = self.process(executable, self.args_for(fixture, "openai/gpt-4.1-mini") + ["--no-session", "-p", "BEHAVIOR_AUTH"], env, root / "project", evidence)
+            assert "behavior-auth-ok" in output
+        run_case("builtin-auth-transport", transport)
+
+        def tools(env, root, fixture, evidence):
+            project = root / "project"
+            (project / "input.txt").write_text("behavior-input-marker\n")
+            args = self.args_for(fixture, "behavior/fixture")
+            record = root / "events.jsonl"
+            terminal = Terminal(executable, args, env, project, evidence, self.deadline)
+            try:
+                terminal.wait("Ask Diffex")
+                terminal.screen("startup-80x24", (80, 24), self.args.update_baselines)
+                terminal.screen("startup-120x40", (120, 40), self.args.update_baselines)
+                terminal.screen("startup-resize-80x24", (80, 24), self.args.update_baselines)
+                before = sum(e["type"] == "settled" for e in read_events(record))
+                terminal.send("BEHAVIOR_TOOLS")
+                terminal.wait("behavior-tools-ok")
+                terminal.settled(record, before)
+                assert (project / "output.txt").read_text() == "behavior-edited\n"
+                assert (project / "bash-result.txt").read_text() == "behavior-edited\n"
+                events = read_events(record)
+                assert {"read", "write", "edit", "bash"} <= {e.get("toolName") for e in events if e["type"] == "tool_result"}
+                terminal.send("BEHAVIOR_CANCEL")
+                terminal.wait("behavior-cancel-started")
+                terminal.command("send-keys", "Escape")
+                end = time.monotonic() + 10
+                while not any(e["type"] == "abort" for e in read_events(record)) and time.monotonic() < end:
+                    terminal.capture()
+                    time.sleep(.1)
+                assert any(e["type"] == "abort" for e in read_events(record)), "Cancel did not abort provider"
+                before = sum(e["type"] == "settled" for e in read_events(record))
+                terminal.send("BEHAVIOR_RECOVER")
+                terminal.wait("behavior-recovered-ok")
+                terminal.settled(record, before)
+                terminal.exit()
+            finally:
+                terminal.close()
+            sessions = list((root / "agent/sessions").rglob("*.jsonl"))
+            assert len(sessions) == 1, "Expected one persisted conversation"
+            output = self.process(executable, args + ["--session", str(sessions[0]), "-p", "BEHAVIOR_RESUME"], env, project, evidence)
+            assert "behavior-resumed-ok" in output
+            assert not any(e["type"] == "blocked-network" for e in read_events(record)), "Unexpected external network"
+        run_case("terminal-tools-cancel-resume", tools)
+
+        # Retain the existing artifact-acceptance CLI/login coverage unchanged.
+        def legacy(evidence):
+            spec = importlib.util.spec_from_file_location("artifact_terminal", HERE.parent / "verify-candidate-artifacts.py")
+            module = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(module)
+            module.verify(evidence, {runtime: executable}, HERE.parent / "fixtures/artifact-handoff.mjs")
+        self.scenario(runtime + "-artifact-terminal", legacy)
+
+    def live(self, executable):
+        def operation(evidence):
+            def action(env, root, fixture):
+                assert os.environ.get("OPENAI_API_KEY"), "Missing OPENAI_API_KEY"
+                env["OPENAI_API_KEY"] = os.environ["OPENAI_API_KEY"]
+                env["DIFFEX_BEHAVIOR_STARTED"] = str(int(time.time() * 1000))
+                args = self.args_for(fixture, self.args.model)
+                marker = "behavior-live-" + uuid.uuid4().hex
+                project = root / "project"
+                (project / "input.txt").write_text(marker + "\n")
+                output = self.process(executable, args + ["--no-session", "-p", "Reply with exactly: " + marker], env, project, evidence)
+                assert marker in output, "Live print marker absent"
+                terminal = Terminal(executable, args, env, project, evidence, self.deadline)
+                try:
+                    terminal.wait("Ask Diffex")
+                    terminal.send("Use read to read input.txt, then use write to copy its exact contents into output.txt. Do not use bash. Then reply with exactly: completed " + marker)
+                    terminal.wait("completed " + marker, seconds=120)
+                    terminal.settled(root / "events.jsonl", 1, seconds=20)
+                    assert (project / "output.txt").read_text() == marker + "\n"
+                    events = read_events(root / "events.jsonl")
+                    assert {"read", "write"} <= {e.get("toolName") for e in events if e["type"] == "tool_result" and not e.get("isError")}
+                    assert sum(e["type"] == "request" for e in events) <= 6
+                    assert any(e["type"] == "streamed-text" and e.get("delta") for e in events), "No streamed text observed"
+                    terminal.exit()
+                finally:
+                    terminal.close()
+            self.behavior(executable, evidence, action)
+        self.scenario("npm-live-openai", operation)
+
+    def run(self):
+        installations = []
+        if self.args.executable:
+            installations.append(("local", str(self.args.executable.absolute())))
+        else:
+            def manifest_check(evidence):
+                manifest = json.loads((self.args.artifacts / "manifest.json").read_text())
+                assert manifest["source"]["commit"] == self.args.commit, "Artifact commit mismatch"
+                for record in manifest["packages"]:
+                    archive = self.args.artifacts / record["filename"]
+                    assert archive.parent == self.args.artifacts, "Invalid artifact path"
+                    actual = hashlib.sha256(archive.read_bytes()).hexdigest()
+                    assert actual == record["sha256"], "Artifact checksum mismatch"
+                    self.hashes[record["filename"]] = actual
+                toolchain = {}
+                for tool, expected in (("node", "v22.23.2"), ("npm", "11.16.0"), ("bun", "1.3.11"), ("tmux", None), ("rg", None), ("fd", None)):
+                    command = [tool, "-V" if tool == "tmux" else "--version"]
+                    actual = subprocess.check_output(command, text=True, timeout=10).strip()
+                    toolchain[tool] = actual
+                    if expected:
+                        assert actual == expected, f"Toolchain {tool}: expected {expected}, got {actual}"
+                toolchain["python"] = sys.version
+                assert sys.version_info >= (3, 11), "Python 3.11+ required"
+                write_json(evidence / "toolchain.json", toolchain)
+                write_json(evidence / "manifest.json", manifest)
+            if not self.scenario("artifact-integrity", manifest_check, "configuration"):
+                return False
+            for manager in (["npm"] if self.args.mode == "live" else ["npm", "bun"]):
+                consumer = Path(tempfile.mkdtemp(prefix="diffex-installed-"))
+                def install(evidence):
+                    result = subprocess.run(["node", str(HERE / "install.mjs"), str(self.args.artifacts), str(consumer), manager, self.args.commit], capture_output=True, text=True, timeout=600)
+                    (evidence / "install.txt").write_text(result.stdout + result.stderr)
+                    assert result.returncode == 0, "Artifact installation/integrity failed; see install.txt"
+                    shutil.copyfile(consumer / "installation.json", evidence / "installation.json")
+                if self.scenario(manager + "-package-integrity", install, "configuration"):
+                    installations.append((manager, str(consumer / "node_modules/.bin/diffex")))
+                else:
+                    shutil.rmtree(consumer)
+            # npm and Bun scenarios are sequential in this process/sandbox.
+        for runtime, executable in installations:
+            try:
+                if self.args.mode == "live":
+                    self.deadline = time.monotonic() + 180
+                    self.live(executable)
+                else:
+                    self.deterministic(executable, runtime)
+            finally:
+                if not self.args.executable:
+                    shutil.rmtree(Path(executable).parent.parent.parent)
+        self.save()
+        return bool(self.results) and all(r["outcome"] == "passed" for r in self.results)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    source = parser.add_mutually_exclusive_group(required=True)
+    source.add_argument("--artifacts", type=lambda s: Path(s).resolve())
+    source.add_argument("--executable", type=Path)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--mode", choices=["deterministic", "live"], default="deterministic")
+    parser.add_argument("--commit", required=True)
+    parser.add_argument("--model", default="openai/gpt-4.1-mini")
+    parser.add_argument("--update-baselines", action="store_true", help="Local review only; never passed by CI")
+    args = parser.parse_args()
+    if not re.fullmatch("[a-f0-9]{40}", args.commit):
+        parser.error("--commit must be a full SHA")
+    raise SystemExit(0 if Runner(args).run() else 1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/daytona-behaviors/live-guard.mjs b/scripts/daytona-behaviors/live-guard.mjs
new file mode 100644
index 000000000..bfc6e6971
--- /dev/null
+++ b/scripts/daytona-behaviors/live-guard.mjs
@@ -0,0 +1,35 @@
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+
+// Observes the installed provider transport; never supplies a model response.
+export default function (diffex) {
+	const record = (event) => appendFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, `${JSON.stringify(event)}\n`);
+	const originalFetch = globalThis.fetch;
+	const started = Number(process.env.DIFFEX_BEHAVIOR_STARTED);
+	let requests = existsSync(process.env.DIFFEX_BEHAVIOR_RECORD)
+		? readFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, "utf8").trim().split("\n").filter((line) => line && JSON.parse(line).type === "request").length
+		: 0;
+	globalThis.fetch = async (input, init) => {
+		const request = new Request(input, init);
+		const url = new URL(request.url);
+		if (url.href === "https://api.diffex.ai/api/latest-version")
+			return Response.json({ error: "no_published_release" }, { status: 404 });
+		if (url.origin !== "https://api.openai.com" || !url.pathname.startsWith("/v1/"))
+			throw new Error("Unexpected live provider destination");
+		if (++requests > 6 || Date.now() - started > 180_000) throw new Error("Live request budget exceeded");
+		const body = JSON.parse(await request.text());
+		if (url.pathname.endsWith("/responses")) body.max_output_tokens = 512;
+		else body.max_completion_tokens = 512;
+		record({ type: "request", request: requests, path: url.pathname, maxOutputTokens: 512 });
+		const response = await originalFetch(new Request(request, {
+			body: JSON.stringify(body), signal: AbortSignal.any([request.signal, AbortSignal.timeout(180_000 - (Date.now() - started))]),
+		}));
+		record({ type: "response", status: response.status });
+		return response;
+	};
+	diffex.on("tool_result", (event) => record({ type: "tool_result", toolName: event.toolName, content: event.content, isError: event.isError }));
+	diffex.on("message_update", (event) => {
+		if (event.assistantMessageEvent.type === "text_delta") record({ type: "streamed-text", delta: event.assistantMessageEvent.delta });
+	});
+	diffex.on("agent_end", (event) => record({ type: "agent_end", messages: event.messages }));
+	diffex.on("agent_settled", () => record({ type: "settled" }));
+}
diff --git a/scripts/daytona-behaviors/live-guard.test.mjs b/scripts/daytona-behaviors/live-guard.test.mjs
new file mode 100644
index 000000000..ff382881b
--- /dev/null
+++ b/scripts/daytona-behaviors/live-guard.test.mjs
@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import guard from "./live-guard.mjs";
+
+test("live transport shares six-request budget across CLI and TUI and caps output", async () => {
+	const root = mkdtempSync(join(tmpdir(), "behavior-live-guard-"));
+	const original = globalThis.fetch;
+	const oldRecord = process.env.DIFFEX_BEHAVIOR_RECORD;
+	const oldStarted = process.env.DIFFEX_BEHAVIOR_STARTED;
+	const record = join(root, "events.jsonl");
+	let sent = 0;
+	try {
+		process.env.DIFFEX_BEHAVIOR_RECORD = record;
+		process.env.DIFFEX_BEHAVIOR_STARTED = String(Date.now());
+		writeFileSync(record, Array.from({ length: 5 }, () => `${JSON.stringify({ type: "request" })}\n`).join(""));
+		globalThis.fetch = async (request) => {
+			sent++;
+			assert.equal(JSON.parse(await request.text()).max_output_tokens, 512);
+			return new Response("ok");
+		};
+		guard({ on() {} });
+		const call = () => globalThis.fetch("https://api.openai.com/v1/responses", {
+			method: "POST", body: JSON.stringify({ max_output_tokens: 9000 }),
+		});
+		await call();
+		await assert.rejects(call, /budget exceeded/);
+		assert.equal(sent, 1);
+		assert.equal(readFileSync(record, "utf8").split("\n").filter((line) => line && JSON.parse(line).type === "request").length, 6);
+		await assert.rejects(() => globalThis.fetch("https://unexpected.invalid"), /destination/);
+	} finally {
+		globalThis.fetch = original;
+		if (oldRecord === undefined) delete process.env.DIFFEX_BEHAVIOR_RECORD;
+		else process.env.DIFFEX_BEHAVIOR_RECORD = oldRecord;
+		if (oldStarted === undefined) delete process.env.DIFFEX_BEHAVIOR_STARTED;
+		else process.env.DIFFEX_BEHAVIOR_STARTED = oldStarted;
+		rmSync(root, { recursive: true, force: true });
+	}
+});
diff --git a/scripts/daytona-behaviors/test_installed.py b/scripts/daytona-behaviors/test_installed.py
new file mode 100644
index 000000000..54aefe23e
--- /dev/null
+++ b/scripts/daytona-behaviors/test_installed.py
@@ -0,0 +1,69 @@
+"""Fast report/normalization/budget regression tests; installed integration is a separate command."""
+import argparse
+import importlib.util
+import json
+from pathlib import Path
+import tempfile
+import unittest
+import xml.etree.ElementTree as ET
+
+SPEC = importlib.util.spec_from_file_location("installed", Path(__file__).with_name("installed.py"))
+installed = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(installed)
+
+
+class InstalledTests(unittest.TestCase):
+    def runner(self, output, artifacts=None):
+        return installed.Runner(argparse.Namespace(output=Path(output), commit="a" * 40,
+            mode="deterministic", executable=None, artifacts=artifacts, model="openai/gpt-4.1-mini", update_baselines=False))
+
+    def test_failed_assertion_is_recorded_once_and_not_retried(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            runner = self.runner(temporary)
+            calls = []
+            def fail(evidence):
+                calls.append(evidence)
+                raise AssertionError("intentional assertion failure")
+            self.assertFalse(runner.scenario("fixture-failure", fail))
+            self.assertEqual(len(calls), 1)
+            report = json.loads((Path(temporary) / "results.json").read_text())
+            self.assertEqual(report["outcome"], "failed")
+            self.assertEqual(report["scenarios"][0]["category"], "product")
+            self.assertEqual(ET.parse(Path(temporary) / "results.xml").getroot().attrib["failures"], "1")
+
+    def test_corrupt_artifact_fails_before_install(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            archive = root / "cli.tgz"
+            archive.write_bytes(b"tampered")
+            installed.write_json(root / "manifest.json", {"source": {"commit": "a" * 40}, "packages": [
+                {"filename": "cli.tgz", "sha256": "0" * 64}]})
+            runner = self.runner(root / "output", root)
+            self.assertFalse(runner.run())
+            self.assertEqual([s["id"] for s in runner.results], ["artifact-integrity"])
+            self.assertIn("checksum", runner.results[0]["error"])
+
+    def test_provider_and_configuration_failures_are_distinct(self):
+        for status, category in ((401, "configuration"), (429, "provider"), (503, "provider")):
+            with self.subTest(status=status), tempfile.TemporaryDirectory() as temporary:
+                runner = self.runner(temporary)
+                def fail(evidence):
+                    (evidence / "events.jsonl").write_text(json.dumps({"type": "response", "status": status}) + "\n")
+                    raise AssertionError("No response")
+                self.assertFalse(runner.scenario("live", fail))
+                self.assertEqual(runner.results[0]["category"], category)
+
+    def test_normalization_preserves_layout_and_behavior_text(self):
+        env = {"HOME": "/tmp/home", "DIFFEX_PROJECT": "/tmp/project"}
+        actual = installed.normalize_screen("Diffex v0.4.0\n  /tmp/project\nbehavior-tools-ok\n", env)
+        self.assertEqual(actual, "Diffex v<VERSION>\n  <PROJECT>\nbehavior-tools-ok\n")
+
+    def test_empty_results_cannot_pass(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            runner = self.runner(temporary)
+            runner.save()
+            self.assertEqual(json.loads((Path(temporary) / "results.json").read_text())["outcome"], "failed")
+
+
+if __name__ == "__main__":
+    unittest.main()

From ef47a8c0f7f22668ab83639e4da7a1df12c71b9b Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:04:46 -0400
Subject: [PATCH 03/12] feat(coding-agent): orchestrate isolated Daytona
 behavior runs and recovery

---
 scripts/daytona-behaviors/Dockerfile          |  22 +
 scripts/daytona-behaviors/daytona_runner.py   | 560 ++++++++++++++++++
 scripts/daytona-behaviors/installed.py        |  29 +-
 scripts/daytona-behaviors/live-guard.mjs      |  15 +-
 scripts/daytona-behaviors/requirements.txt    |   3 +
 .../daytona-behaviors/test_daytona_runner.py  | 470 +++++++++++++++
 scripts/daytona-behaviors/test_installed.py   |  11 +-
 7 files changed, 1097 insertions(+), 13 deletions(-)
 create mode 100644 scripts/daytona-behaviors/Dockerfile
 create mode 100644 scripts/daytona-behaviors/daytona_runner.py
 create mode 100644 scripts/daytona-behaviors/requirements.txt
 create mode 100644 scripts/daytona-behaviors/test_daytona_runner.py

diff --git a/scripts/daytona-behaviors/Dockerfile b/scripts/daytona-behaviors/Dockerfile
new file mode 100644
index 000000000..30db33690
--- /dev/null
+++ b/scripts/daytona-behaviors/Dockerfile
@@ -0,0 +1,22 @@
+# Toolchain only: no repository COPY, release artifacts, credentials, or agent config.
+FROM node:22.23.2-bookworm-slim
+
+ARG BUN_VERSION=1.3.11
+ARG NPM_VERSION=11.16.0
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl unzip python3 tmux ripgrep fd-find git \
+    && rm -rf /var/lib/apt/lists/* \
+    && ln -s /usr/bin/fdfind /usr/local/bin/fd \
+    && npm install --global --ignore-scripts npm@${NPM_VERSION} \
+    && test "$(node --version)" = "v22.23.2" \
+    && test "$(npm --version)" = "${NPM_VERSION}"
+RUN test "$(dpkg --print-architecture)" = amd64 \
+    && curl --fail --silent --show-error --location \
+       "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" -o /tmp/bun.zip \
+    && unzip /tmp/bun.zip -d /tmp/bun \
+    && install /tmp/bun/bun-linux-x64/bun /usr/local/bin/bun \
+    && rm -rf /tmp/bun /tmp/bun.zip \
+    && test "$(bun --version)" = "${BUN_VERSION}" \
+    && python3 --version && tmux -V && rg --version && fd --version
+WORKDIR /tmp
diff --git a/scripts/daytona-behaviors/daytona_runner.py b/scripts/daytona-behaviors/daytona_runner.py
new file mode 100644
index 000000000..95b5eb6f1
--- /dev/null
+++ b/scripts/daytona-behaviors/daytona_runner.py
@@ -0,0 +1,560 @@
+#!/usr/bin/env python3
+"""Independent Daytona behavior orchestration (Python 3.11+, no Harbor).
+
+Workflow contract::
+
+    python daytona_runner.py prepare-snapshot --name diffex-behaviors-toolchain --output snapshot-record
+    python daytona_runner.py run --run-id "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+        --artifacts retained-release --bundle behavior-bundle.tar.gz \
+        --snapshot diffex-behaviors-toolchain --output daytona-results \
+        --mode deterministic --commit "$GITHUB_SHA"
+    python daytona_runner.py recover --output daytona-results
+
+Always retain/upload the entire output directory, including state.json. Recovery never
+creates a replacement or replays a possibly-started command. OPENAI_API_KEY is read only
+for live mode and passed through process.exec(env=...), never sandbox env or metadata.
+DAYTONA_API_KEY is used by the local SDK only. Installed.py owns artifact installation.
+
+SDK 0.226.1 API and lifecycle semantics inspected at:
+https://www.daytona.io/docs/en/sandboxes/#wall-clock-ttl
+https://www.daytona.io/docs/en/python-sdk/sync/daytona/
+`ttl_minutes=45` destroys in every state; auto_delete_interval alone is NOT a TTL.
+Snapshots inherit resources, so both snapshot and sandbox resources are checked.
+"""
+from __future__ import annotations
+
+import argparse
+from contextlib import contextmanager
+from dataclasses import asdict, dataclass, field
+import hashlib
+from importlib.metadata import version
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import shlex
+import signal
+import tarfile
+import tempfile
+import time
+from typing import Iterator
+import uuid
+import xml.etree.ElementTree as ET
+
+from daytona import (
+    CreateSandboxFromSnapshotParams, CreateSnapshotParams, Daytona,
+    DaytonaNotFoundError, Image, ListSandboxesQuery, Resources, Sandbox,
+)
+
+SDK_VERSION = "0.226.1"
+TTL_MINUTES = 45
+RESOURCES = {"cpu": 2, "memory": 4, "disk": 8}
+REMOTE_BUNDLE = "/tmp/diffex-behaviors"
+REMOTE_RELEASE = "/tmp/diffex-release"
+REMOTE_EVIDENCE = "/tmp/diffex-evidence"
+INSTALLED = f"{REMOTE_BUNDLE}/scripts/daytona-behaviors/installed.py"
+MAX_FILE_BYTES = 64 * 1024 * 1024
+MAX_EVIDENCE_BYTES = 512 * 1024 * 1024
+
+# Uploaded scripts contain no credentials, even for live mode.
+EXTRACT_SCRIPT = '''import hashlib, os, pathlib, shutil, stat, sys, tarfile
+# Verify BOTH uploads before extracting either input.
+for archive, expected in zip(("/tmp/diffex-release.tar.gz", "/tmp/diffex-bundle.tar.gz"), sys.argv[1:], strict=True):
+    with open(archive, "rb") as stream:
+        actual = hashlib.file_digest(stream, "sha256").hexdigest()
+    if actual != expected:
+        raise ValueError("uploaded input SHA256 mismatch")
+for archive, destination in (("/tmp/diffex-release.tar.gz", "/tmp/diffex-release"),
+                             ("/tmp/diffex-bundle.tar.gz", "/tmp/diffex-behaviors")):
+    root = pathlib.Path(destination)
+    root.mkdir(parents=True, exist_ok=True)
+    with tarfile.open(archive) as source:
+        for member in source:
+            path = pathlib.PurePosixPath(member.name)
+            if path.is_absolute() or ".." in path.parts or not (member.isdir() or member.isfile()):
+                raise ValueError("unsafe archive member")
+            target = root.joinpath(*path.parts)
+            target.parent.mkdir(parents=True, exist_ok=True)
+            if member.isdir():
+                target.mkdir(exist_ok=True)
+            else:
+                with source.extractfile(member) as src, target.open("wb") as dst:
+                    shutil.copyfileobj(src, dst)
+                target.chmod(member.mode & 0o777)
+'''
+MANIFEST_SCRIPT = '''import hashlib, json, os, pathlib, stat
+root = pathlib.Path("/tmp/diffex-evidence")
+files = []
+for directory, dirs, names in os.walk(root, followlinks=False):
+    dirs[:] = sorted(d for d in dirs if not pathlib.Path(directory, d).is_symlink())
+    for name in sorted(names):
+        path = pathlib.Path(directory, name)
+        info = path.lstat()
+        if not stat.S_ISREG(info.st_mode):
+            raise ValueError("nonregular evidence")
+        if info.st_size > 67108864:
+            raise ValueError("evidence file too large")
+        with path.open("rb") as stream:
+            digest = hashlib.file_digest(stream, "sha256").hexdigest()
+        files.append({"path": path.relative_to(root).as_posix(), "size": info.st_size, "sha256": digest})
+print(json.dumps(files))
+'''
+
+
+class OrchestrationError(Exception):
+    """Safe, locally constructed diagnostic (never includes credentials)."""
+
+
+def atomic_json(path: Path, value: object) -> None:
+    temporary = path.with_name(path.name + ".tmp")
+    with temporary.open("w", encoding="utf-8") as stream:
+        json.dump(value, stream, indent=2, sort_keys=True)
+        stream.write("\n")
+        stream.flush()
+        os.fsync(stream.fileno())
+    temporary.replace(path)
+
+
+def sha256(path: Path) -> str:
+    with path.open("rb") as stream:
+        return hashlib.file_digest(stream, "sha256").hexdigest()
+
+
+def safe_relative(name: str) -> PurePosixPath:
+    path = PurePosixPath(name)
+    if not name or not path.parts or path.is_absolute() or ".." in path.parts or "\\" in name:
+        raise OrchestrationError("unsafe artifact path")
+    return path
+
+
+def archive_directory(source: Path, destination: Path) -> None:
+    """Archive only explicit inputs; never follow symlinks or read ambient config."""
+    if not source.is_dir() or source.is_symlink():
+        raise OrchestrationError("input must be a regular directory")
+    with tarfile.open(destination, "w:gz") as archive:
+        for path in sorted(source.rglob("*")):
+            name = path.relative_to(source).as_posix()
+            safe_relative(name)
+            if path.is_symlink() or not (path.is_file() or path.is_dir()):
+                raise OrchestrationError("input contains links or special files")
+            if path.name == ".env" or path.name.startswith(".env.") or path.name in (".npmrc", ".netrc"):
+                raise OrchestrationError("input contains credential configuration")
+            archive.add(path, arcname=name, recursive=False)
+
+
+def validate_archive(path: Path) -> None:
+    with tarfile.open(path) as archive:
+        for member in archive:
+            safe_relative(member.name)
+            if not (member.isfile() or member.isdir()):
+                raise OrchestrationError("bundle contains links or special files")
+            name = PurePosixPath(member.name).name
+            if name == ".env" or name.startswith(".env.") or name in (".npmrc", ".netrc"):
+                raise OrchestrationError("bundle contains credential configuration")
+
+
+@dataclass
+class State:
+    run_id: str
+    name: str
+    labels: dict[str, str]
+    commit: str
+    mode: str
+    snapshot: str
+    created_at: float
+    deadline: float
+    sandbox_id: str | None = None
+    create_attempted: bool = False
+    create_returned: bool = False
+    launch_attempted: bool = False
+    execution: str = "pending"
+    cleanup: str = "pending"
+    exit_code: int | None = None
+    errors: list[str] = field(default_factory=list)
+    downloaded: dict[str, str] = field(default_factory=dict)
+    inputs: dict[str, str] = field(default_factory=dict)
+
+    def save(self, output: Path) -> None:
+        atomic_json(output / "state.json", asdict(self))
+
+    def error(self, stage: str, error: Exception) -> None:
+        # SDK error bodies can contain HTTP request details. Do not serialize them.
+        detail = str(error) if isinstance(error, OrchestrationError) else type(error).__name__
+        self.errors.append(f"{stage}: {detail}")
+
+
+@contextmanager
+def termination_handlers() -> Iterator[None]:
+    def terminate(signum: int, _frame: object) -> None:
+        # A second TERM must not interrupt the independent cleanup/final report.
+        signal.signal(signal.SIGTERM, signal.SIG_IGN)
+        signal.signal(signal.SIGINT, signal.SIG_IGN)
+        raise OrchestrationError(f"interrupted by signal {signum}")
+    previous = {sig: signal.signal(sig, terminate) for sig in (signal.SIGTERM, signal.SIGINT)}
+    try:
+        yield
+    finally:
+        for sig, handler in previous.items():
+            signal.signal(sig, handler)
+
+
+class Runner:
+    def __init__(self, client: Daytona, output: Path, state: State, poll_seconds: float = 5):
+        self.client = client
+        self.output = output.resolve()
+        self.state = state
+        self.poll_seconds = poll_seconds
+
+    def owned(self, sandbox: Sandbox) -> Sandbox:
+        if sandbox.name != self.state.name or any(
+            sandbox.labels.get(key) != value for key, value in self.state.labels.items()
+        ):
+            raise OrchestrationError("sandbox identity/ownership mismatch; refusing access or deletion")
+        if self.state.sandbox_id and sandbox.id != self.state.sandbox_id:
+            raise OrchestrationError("sandbox ID changed; refusing access or deletion")
+        return sandbox
+
+    def lookup(self) -> Sandbox:
+        return self.owned(self.client.get(self.state.sandbox_id or self.state.name, request_timeout=10))
+
+    def create(self) -> Sandbox:
+        snapshot = self.client.snapshot.get(self.state.snapshot)
+        self.check_resources(snapshot)
+        if str(snapshot.state) != "active":
+            raise OrchestrationError("snapshot must already be active")
+        self.state.create_attempted = True
+        self.state.save(self.output)  # durable name + labels BEFORE the only create request
+        sandbox = self.client.create(CreateSandboxFromSnapshotParams(
+            name=self.state.name, snapshot=self.state.snapshot, labels=dict(self.state.labels),
+            public=False, auto_stop_interval=0, auto_pause_interval=0,
+            auto_delete_interval=0, ttl_minutes=TTL_MINUTES,
+        ), timeout=180)
+        self.owned(sandbox)
+        self.state.sandbox_id = sandbox.id
+        self.state.create_returned = True
+        self.state.save(self.output)
+        self.check_resources(sandbox)
+        return sandbox
+
+    @staticmethod
+    def check_resources(resource: object) -> None:
+        # Snapshot DTO calls memory `mem`; Sandbox exposes `memory`.
+        actual = {"cpu": getattr(resource, "cpu", None),
+                  "memory": getattr(resource, "memory", getattr(resource, "mem", None)),
+                  "disk": getattr(resource, "disk", None)}
+        if actual != RESOURCES:
+            raise OrchestrationError(f"expected resources {RESOURCES}, got {actual}")
+
+    @staticmethod
+    def execute(sandbox: Sandbox, command: str, env: dict[str, str] | None = None) -> str:
+        result = sandbox.process.exec(command, env=env, timeout=30)
+        if result.exit_code != 0:
+            raise OrchestrationError("remote orchestration command failed")
+        return result.result
+
+    def stage(self, sandbox: Sandbox, artifacts: Path, bundle: Path) -> None:
+        with tempfile.TemporaryDirectory(prefix="diffex-daytona-") as directory:
+            temp = Path(directory)
+            release_archive = temp / "release.tar.gz"
+            archive_directory(artifacts, release_archive)
+            bundle_archive = bundle
+            if bundle.is_dir():
+                bundle_archive = temp / "bundle.tar.gz"
+                archive_directory(bundle, bundle_archive)
+            validate_archive(bundle_archive)
+            self.state.inputs = {"release_sha256": sha256(release_archive),
+                                 "bundle_sha256": sha256(bundle_archive)}
+            self.state.save(self.output)
+            sandbox.fs.upload_file(str(release_archive), "/tmp/diffex-release.tar.gz", timeout=120)
+            sandbox.fs.upload_file(str(bundle_archive), "/tmp/diffex-bundle.tar.gz", timeout=120)
+        sandbox.fs.upload_file(EXTRACT_SCRIPT.encode(), "/tmp/diffex-extract.py", timeout=30)
+        self.execute(sandbox, "python3 /tmp/diffex-extract.py "
+                     + self.state.inputs["release_sha256"] + " " + self.state.inputs["bundle_sha256"])
+        self.execute(sandbox, f"test -f {INSTALLED} && mkdir -p {REMOTE_EVIDENCE}")
+
+    def launch(self, sandbox: Sandbox, live_key: str | None) -> None:
+        argv = ["python3", INSTALLED, "--artifacts", REMOTE_RELEASE,
+                "--output", REMOTE_EVIDENCE, "--mode", self.state.mode,
+                "--commit", self.state.commit]
+        script = (
+            "import json, os, pathlib, subprocess\n"
+            f"root = pathlib.Path({REMOTE_EVIDENCE!r})\n"
+            "with (root / 'installed.log').open('wb') as log:\n"
+            f"    result = subprocess.run({argv!r}, cwd={REMOTE_BUNDLE!r}, stdout=log, stderr=subprocess.STDOUT)\n"
+            "temporary = root / '.orchestration-exit.tmp'\n"
+            "temporary.write_text(json.dumps({'exit_code': result.returncode}))\n"
+            "temporary.replace(root / '.orchestration-exit.json')\n"
+        )
+        sandbox.fs.upload_file(script.encode(), "/tmp/diffex-launch.py", timeout=30)
+        self.state.launch_attempted = True
+        self.state.execution = "running"
+        self.state.save(self.output)  # ambiguous exec is never replayed by recover
+        env = {"OPENAI_API_KEY": live_key} if self.state.mode == "live" and live_key else {}
+        self.execute(sandbox,
+                     "nohup python3 /tmp/diffex-launch.py </dev/null "
+                     f">{REMOTE_EVIDENCE}/launcher.log 2>&1 &", env=env)
+
+    def collect(self, sandbox: Sandbox) -> None:
+        manifest = json.loads(self.execute(sandbox, "python3 -c " + shlex.quote(MANIFEST_SCRIPT)))
+        if not isinstance(manifest, list):
+            raise OrchestrationError("invalid evidence manifest")
+        total = 0
+        evidence = self.output / "evidence"
+        evidence.mkdir(exist_ok=True)
+        for entry in manifest:
+            name = entry["path"]
+            relative = safe_relative(name)
+            size, digest = entry["size"], entry["sha256"]
+            total += size
+            if size < 0 or size > MAX_FILE_BYTES or total > MAX_EVIDENCE_BYTES:
+                raise OrchestrationError("evidence exceeds download limits")
+            target = evidence.joinpath(*relative.parts)
+            # Do not follow pre-existing local symlinks, including parent directories.
+            if any(path.is_symlink() for path in [target, *target.parents]):
+                raise OrchestrationError("local evidence symlink")
+            if self.state.downloaded.get(name) == digest and target.is_file() and sha256(target) == digest:
+                continue
+            target.parent.mkdir(parents=True, exist_ok=True)
+            temporary = target.with_name(target.name + ".download")
+            received = 0
+            try:
+                with temporary.open("wb") as stream:
+                    for chunk in sandbox.fs.download_file_stream(f"{REMOTE_EVIDENCE}/{name}", timeout=30):
+                        received += len(chunk)
+                        if received > MAX_FILE_BYTES:
+                            raise OrchestrationError("evidence grew beyond download limit")
+                        stream.write(chunk)
+                if received != size or sha256(temporary) != digest:
+                    # A log may change while downloading. Keep the previous complete copy.
+                    continue
+                temporary.replace(target)
+                self.state.downloaded[name] = digest
+                self.state.save(self.output)
+            finally:
+                temporary.unlink(missing_ok=True)
+
+    def poll(self, sandbox: Sandbox, deadline: float) -> None:
+        while True:
+            try:
+                self.collect(sandbox)
+                exit_file = self.output / "evidence" / ".orchestration-exit.json"
+                if exit_file.is_file():
+                    code = json.loads(exit_file.read_text())["exit_code"]
+                    if not isinstance(code, int):
+                        raise OrchestrationError("invalid installed runner exit code")
+                    self.state.exit_code = code
+                    self.state.execution = "passed" if code == 0 else "failed"
+                    self.state.save(self.output)
+                    return
+            except Exception as error:
+                self.state.error("evidence", error)
+                self.state.save(self.output)
+            if time.time() >= deadline:
+                raise OrchestrationError("evidence/execution deadline exceeded")
+            time.sleep(min(self.poll_seconds, max(0, deadline - time.time())))
+
+    def cleanup(self, attempts: int = 6) -> None:
+        if not self.state.create_attempted:
+            self.state.cleanup = "not-needed"
+            self.state.save(self.output)
+            return
+        for attempt in range(attempts):
+            try:
+                sandbox = self.lookup()
+                self.state.sandbox_id = sandbox.id
+                self.state.save(self.output)
+                try:
+                    self.client.delete(sandbox, timeout=15, wait=False)
+                except Exception as error:
+                    self.state.error("delete-request", error)
+            except DaytonaNotFoundError:
+                pass
+            except Exception as error:
+                self.state.error("cleanup-lookup", error)
+            # Independent fresh reads, even when deletion raised or claimed success.
+            try:
+                identifiers = {self.state.name}
+                if self.state.sandbox_id:
+                    identifiers.add(self.state.sandbox_id)
+                for identifier in identifiers:
+                    try:
+                        found = self.client.get(identifier, request_timeout=10)
+                    except DaytonaNotFoundError:
+                        continue
+                    self.owned(found)
+                    raise OrchestrationError("sandbox still visible after deletion")
+                remaining = list(self.client.list(ListSandboxesQuery(labels=self.state.labels), request_timeout=10))
+                if remaining:
+                    raise OrchestrationError("sandbox labels still visible after deletion")
+                # A 404 immediately after an ambiguous POST is not proof it cannot appear later.
+                if not self.state.sandbox_id:
+                    raise OrchestrationError("creation unresolved; recover by saved name/labels; TTL bounds lifetime")
+                self.state.cleanup = "confirmed"
+                self.state.save(self.output)
+                return
+            except Exception as error:
+                self.state.error("cleanup-confirm", error)
+            self.state.cleanup = "unconfirmed"
+            self.state.save(self.output)
+            if attempt + 1 < attempts:
+                time.sleep(self.poll_seconds)
+
+    def report(self) -> int:
+        results_path = self.output / "evidence" / "results.json"
+        installed: dict[str, object] = {}
+        try:
+            if results_path.exists():
+                installed = json.loads(results_path.read_text())
+        except (ValueError, OSError):
+            self.state.errors.append("report: invalid installed results.json")
+        reports_complete = (
+            results_path.is_file() and (self.output / "evidence" / "results.xml").is_file()
+            and installed.get("outcome") in ("passed", "failed")
+        )
+        success = (self.state.execution == "passed" and self.state.exit_code == 0
+                   and installed.get("outcome") == "passed" and reports_complete
+                   and self.state.cleanup in ("confirmed", "not-needed"))
+        report = {"outcome": "passed" if success else "failed", "category": "daytona",
+                  "input_hashes": self.state.inputs, "run_id": self.state.run_id,
+                  "commit": self.state.commit, "mode": self.state.mode, "name": self.state.name,
+                  "sandbox_id": self.state.sandbox_id, "execution": self.state.execution,
+                  "exit_code": self.state.exit_code, "installed_outcome": installed.get("outcome"),
+                  "reports_complete": reports_complete, "cleanup": self.state.cleanup,
+                  "duration_seconds": max(0, time.time() - self.state.created_at),
+                  "artifact_hashes": self.state.downloaded, "errors": self.state.errors}
+        atomic_json(self.output / "orchestration.json", report)
+        suite = ET.Element("testsuite", name="daytona-orchestration", tests="3", failures=str(sum((
+            self.state.execution != "passed", not reports_complete or installed.get("outcome") != "passed",
+            self.state.cleanup not in ("confirmed", "not-needed")))))
+        for name, passed, detail in (
+            ("execution", self.state.execution == "passed", self.state.execution),
+            ("installed-evidence", reports_complete and installed.get("outcome") == "passed", str(installed.get("outcome"))),
+            ("cleanup", self.state.cleanup in ("confirmed", "not-needed"), self.state.cleanup),
+        ):
+            case = ET.SubElement(suite, "testcase", name=name, classname="daytona")
+            if not passed:
+                ET.SubElement(case, "failure", message=detail).text = "\n".join(self.state.errors)
+        ET.ElementTree(suite).write(self.output / "orchestration.xml", encoding="utf-8", xml_declaration=True)
+        self.state.save(self.output)
+        return 0 if success else 1
+
+    def run(self, artifacts: Path, bundle: Path, live_key: str | None) -> int:
+        try:
+            sandbox = self.create()
+            self.stage(sandbox, artifacts, bundle)
+            self.launch(sandbox, live_key)
+            self.poll(sandbox, self.state.deadline)
+        except Exception as error:
+            self.state.execution = "failed"
+            self.state.error("run", error)
+        finally:
+            if self.state.launch_attempted:
+                try:
+                    self.collect(self.lookup())
+                except Exception as error:
+                    self.state.error("final-evidence", error)
+            try:
+                self.cleanup()
+            except Exception as error:
+                self.state.cleanup = "unconfirmed"
+                self.state.error("cleanup", error)
+            self.state.save(self.output)
+        return self.report()
+
+    def recover(self, wait_seconds: float) -> int:
+        try:
+            if self.state.create_attempted and self.state.cleanup != "confirmed":
+                sandbox = self.lookup()
+                if self.state.launch_attempted:
+                    self.poll(sandbox, min(self.state.deadline, time.time() + wait_seconds))
+        except DaytonaNotFoundError:
+            pass
+        except Exception as error:
+            self.state.error("recover-evidence", error)
+        finally:
+            try:
+                self.cleanup()
+            except Exception as error:
+                self.state.cleanup = "unconfirmed"
+                self.state.error("recover-cleanup", error)
+        return self.report()
+
+
+def prepare_snapshot(client: Daytona, name: str, output: Path) -> int:
+    dockerfile = Path(__file__).with_name("Dockerfile")
+    record: dict[str, object] = {"name": name, "dockerfile_sha256": sha256(dockerfile),
+                                "resources": RESOURCES, "status": "requested"}
+    output.mkdir(parents=True, exist_ok=False)
+    atomic_json(output / "snapshot.json", record)
+    try:
+        # No replacement or delete: an existing name or ambiguous POST requires inspection.
+        snapshot = client.snapshot.create(CreateSnapshotParams(
+            name=name, image=Image.from_dockerfile(dockerfile, strict_context=True),
+            resources=Resources(**RESOURCES),
+        ), timeout=1200)
+        Runner.check_resources(snapshot)
+        record.update(status="active", id=snapshot.id)
+        return 0
+    except Exception as error:
+        record.update(status="failed-or-ambiguous", error=type(error).__name__)
+        return 1
+    finally:
+        atomic_json(output / "snapshot.json", record)
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    commands = parser.add_subparsers(dest="command", required=True)
+    run = commands.add_parser("run")
+    run.add_argument("--artifacts", type=Path, required=True)
+    run.add_argument("--bundle", type=Path, required=True)
+    run.add_argument("--snapshot", required=True)
+    run.add_argument("--run-id", required=True)
+    run.add_argument("--commit", required=True)
+    run.add_argument("--mode", choices=("deterministic", "live"), required=True)
+    run.add_argument("--timeout-seconds", type=int, default=2100)
+    run.add_argument("--live-key-env", choices=("OPENAI_API_KEY",), default="OPENAI_API_KEY")
+    recover = commands.add_parser("recover")
+    recover.add_argument("--wait-seconds", type=int, default=0)
+    snapshot = commands.add_parser("prepare-snapshot")
+    snapshot.add_argument("--name", required=True)
+    for command in (run, recover, snapshot):
+        command.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args(argv)
+    if version("daytona") != SDK_VERSION:
+        parser.error(f"install requirements.txt: daytona=={SDK_VERSION} required")
+    if args.command == "run":
+        if not re.fullmatch(r"[0-9a-fA-F]{40}", args.commit):
+            parser.error("--commit must be a full 40-character commit SHA")
+        if not re.fullmatch(r"[A-Za-z0-9_-]{1,80}", args.run_id):
+            parser.error("--run-id must be 1-80 alphanumeric, dash or underscore characters")
+        if not 1 <= args.timeout_seconds <= 2400:
+            parser.error("--timeout-seconds must be 1..2400, below the 45-minute wall-clock TTL")
+        if not args.artifacts.is_dir() or not args.bundle.exists():
+            parser.error("artifacts directory and bundle must exist")
+        live_key = os.environ.get(args.live_key_env) if args.mode == "live" else None
+        if args.mode == "live" and not live_key:
+            parser.error("live mode requires OPENAI_API_KEY")
+        args.output.mkdir(parents=True, exist_ok=False)
+        token = uuid.uuid4().hex
+        now = time.time()
+        state = State(run_id=args.run_id, name=f"diffex-behaviors-{args.run_id[:32]}-{token[:12]}",
+                      labels={"diffex-purpose": "installed-behaviors", "diffex-run": token,
+                              "diffex-run-id": args.run_id, "diffex-commit": args.commit},
+                      commit=args.commit, mode=args.mode, snapshot=args.snapshot,
+                      created_at=now, deadline=now + args.timeout_seconds)
+        state.save(args.output)
+        with termination_handlers():
+            return Runner(Daytona(), args.output, state).run(args.artifacts, args.bundle, live_key)
+    if args.command == "recover":
+        if args.wait_seconds < 0 or args.wait_seconds > 2400:
+            parser.error("--wait-seconds must be 0..2400")
+        state = State(**json.loads((args.output / "state.json").read_text()))
+        with termination_handlers():
+            return Runner(Daytona(), args.output, state).recover(args.wait_seconds)
+    with termination_handlers():
+        return prepare_snapshot(Daytona(), args.name, args.output)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/daytona-behaviors/installed.py b/scripts/daytona-behaviors/installed.py
index 9b8ee57dd..c49e616e7 100644
--- a/scripts/daytona-behaviors/installed.py
+++ b/scripts/daytona-behaviors/installed.py
@@ -169,10 +169,11 @@ def scenario(self, identity, operation, category="product"):
                     message = message.replace(secret, "[REDACTED]")
             item["error"] = message
             # Availability/configuration is distinct from an assertion about product behavior.
-            statuses = [event["status"] for file in evidence.glob("**/events.jsonl") for event in read_events(file) if event["type"] == "response"]
-            if any(s in (401, 403) for s in statuses):
+            events = [event for file in evidence.glob("**/events.jsonl") for event in read_events(file)]
+            statuses = [event["status"] for event in events if event["type"] == "response"]
+            if any(s in (400, 401, 403, 404) for s in statuses):
                 item["category"] = "configuration"
-            elif any(s == 429 or s >= 500 for s in statuses):
+            elif any(s == 429 or s >= 500 for s in statuses) or any(e["type"] == "provider-error" for e in events):
                 item["category"] = "provider"
         finally:
             item["duration"] = round(time.monotonic() - started, 3)
@@ -241,9 +242,13 @@ def installation(env, root, fixture, evidence):
             resolved = str(Path(executable).resolve())
             write_json(evidence / "resolution.json", {"requested": executable, "resolved": resolved})
             args = self.args_for(fixture, "behavior/fixture")
-            for command, expected in [(["--help"], "Usage"), (["--version"], ""), (args + ["--list-models"], "fixture")]:
-                output = self.process(executable, command, env, root / "project", evidence)
+            for name, command, expected in [("help", ["--help"], "Usage"), ("version", ["--version"], ""), ("models", args + ["--list-models"], "fixture")]:
+                command_evidence = evidence / name
+                command_evidence.mkdir()
+                output = self.process(executable, command, env, root / "project", command_evidence)
                 assert expected in output and output.strip(), "Installation command output missing"
+                if name == "version":
+                    assert re.fullmatch(r"\d+\.\d+\.\d+(?:[-+]\S+)?", output.strip()), "Malformed version output"
         run_case("installation", installation)
 
         def printed(env, root, fixture, evidence):
@@ -276,6 +281,7 @@ def tools(env, root, fixture, evidence):
                 assert (project / "bash-result.txt").read_text() == "behavior-edited\n"
                 events = read_events(record)
                 assert {"read", "write", "edit", "bash"} <= {e.get("toolName") for e in events if e["type"] == "tool_result"}
+                assert any(e["type"] == "tool_result" and e.get("toolName") == "read" and "behavior-input-marker" in json.dumps(e.get("content")) for e in events), "Read did not return fixture contents"
                 terminal.send("BEHAVIOR_CANCEL")
                 terminal.wait("behavior-cancel-started")
                 terminal.command("send-keys", "Escape")
@@ -295,6 +301,8 @@ def tools(env, root, fixture, evidence):
             assert len(sessions) == 1, "Expected one persisted conversation"
             output = self.process(executable, args + ["--session", str(sessions[0]), "-p", "BEHAVIOR_RESUME"], env, project, evidence)
             assert "behavior-resumed-ok" in output
+            resumed = [e for e in read_events(record) if e["type"] == "context" and e.get("mode") == "BEHAVIOR_RESUME"]
+            assert resumed and any(m["role"] == "toolResult" and m.get("toolName") == "read" and "behavior-input-marker" in json.dumps(m.get("content")) for m in resumed[-1]["messages"]), "Resumed conversation lost read contents"
             assert not any(e["type"] == "blocked-network" for e in read_events(record)), "Unexpected external network"
         run_case("terminal-tools-cancel-resume", tools)
 
@@ -321,6 +329,7 @@ def action(env, root, fixture):
                 terminal = Terminal(executable, args, env, project, evidence, self.deadline)
                 try:
                     terminal.wait("Ask Diffex")
+                    event_mark = len(read_events(root / "events.jsonl"))
                     terminal.send("Use read to read input.txt, then use write to copy its exact contents into output.txt. Do not use bash. Then reply with exactly: completed " + marker)
                     terminal.wait("completed " + marker, seconds=120)
                     terminal.settled(root / "events.jsonl", 1, seconds=20)
@@ -328,7 +337,8 @@ def action(env, root, fixture):
                     events = read_events(root / "events.jsonl")
                     assert {"read", "write"} <= {e.get("toolName") for e in events if e["type"] == "tool_result" and not e.get("isError")}
                     assert sum(e["type"] == "request" for e in events) <= 6
-                    assert any(e["type"] == "streamed-text" and e.get("delta") for e in events), "No streamed text observed"
+                    reply = "".join(e["delta"] for e in events[event_mark:] if e["type"] == "streamed-text")
+                    assert "completed " + marker in reply, "Interactive streamed confirmation missing"
                     terminal.exit()
                 finally:
                     terminal.close()
@@ -338,7 +348,12 @@ def action(env, root, fixture):
     def run(self):
         installations = []
         if self.args.executable:
-            installations.append(("local", str(self.args.executable.absolute())))
+            executable = self.args.executable.absolute()
+            self.hashes["installedExecutableSha256"] = hashlib.sha256(executable.resolve().read_bytes()).hexdigest()
+            inventory = executable.parent.parent / "@diffexai/diffex/distribution-files.json"
+            if inventory.exists():
+                self.hashes["installedInventorySha256"] = hashlib.sha256(inventory.read_bytes()).hexdigest()
+            installations.append(("local", str(executable)))
         else:
             def manifest_check(evidence):
                 manifest = json.loads((self.args.artifacts / "manifest.json").read_text())
diff --git a/scripts/daytona-behaviors/live-guard.mjs b/scripts/daytona-behaviors/live-guard.mjs
index bfc6e6971..704c64380 100644
--- a/scripts/daytona-behaviors/live-guard.mjs
+++ b/scripts/daytona-behaviors/live-guard.mjs
@@ -20,11 +20,16 @@ export default function (diffex) {
 		if (url.pathname.endsWith("/responses")) body.max_output_tokens = 512;
 		else body.max_completion_tokens = 512;
 		record({ type: "request", request: requests, path: url.pathname, maxOutputTokens: 512 });
-		const response = await originalFetch(new Request(request, {
-			body: JSON.stringify(body), signal: AbortSignal.any([request.signal, AbortSignal.timeout(180_000 - (Date.now() - started))]),
-		}));
-		record({ type: "response", status: response.status });
-		return response;
+		try {
+			const response = await originalFetch(new Request(request, {
+				body: JSON.stringify(body), signal: AbortSignal.any([request.signal, AbortSignal.timeout(180_000 - (Date.now() - started))]),
+			}));
+			record({ type: "response", status: response.status });
+			return response;
+		} catch (error) {
+			record({ type: "provider-error", error: error instanceof Error ? error.name : "UnknownError" });
+			throw error;
+		}
 	};
 	diffex.on("tool_result", (event) => record({ type: "tool_result", toolName: event.toolName, content: event.content, isError: event.isError }));
 	diffex.on("message_update", (event) => {
diff --git a/scripts/daytona-behaviors/requirements.txt b/scripts/daytona-behaviors/requirements.txt
new file mode 100644
index 000000000..b868e74cd
--- /dev/null
+++ b/scripts/daytona-behaviors/requirements.txt
@@ -0,0 +1,3 @@
+# Standalone orchestration only; no Harbor dependency.
+# ttl_minutes and strict_context APIs inspected in this exact SDK version.
+daytona==0.226.1
diff --git a/scripts/daytona-behaviors/test_daytona_runner.py b/scripts/daytona-behaviors/test_daytona_runner.py
new file mode 100644
index 000000000..a2715eb97
--- /dev/null
+++ b/scripts/daytona-behaviors/test_daytona_runner.py
@@ -0,0 +1,470 @@
+"""Credential-free tests: python -m unittest discover -s scripts/daytona-behaviors -p 'test_daytona_runner.py'."""
+from __future__ import annotations
+
+from dataclasses import asdict
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import signal
+import tarfile
+import tempfile
+import time
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+import xml.etree.ElementTree as ET
+
+from daytona import DaytonaNotFoundError, ExecuteResponse
+
+from daytona_runner import (
+    EXTRACT_SCRIPT, INSTALLED, MANIFEST_SCRIPT, REMOTE_EVIDENCE, RESOURCES,
+    Runner, State, OrchestrationError, archive_directory, main, prepare_snapshot,
+    sha256, termination_handlers, validate_archive,
+)
+
+
+class FakeFS:
+    def __init__(self):
+        self.files: dict[str, bytes] = {}
+        self.uploads: list[tuple[str, bytes]] = []
+        self.downloads: list[str] = []
+        self.corrupt = False
+
+    def upload_file(self, source: str | bytes, destination: str, timeout: int = 0):
+        value = Path(source).read_bytes() if isinstance(source, str) else source
+        self.files[destination] = value
+        self.uploads.append((destination, value))
+
+    def download_file_stream(self, source: str, timeout: int = 0):
+        self.downloads.append(source)
+        content = self.files[source] + (b"changed" if self.corrupt else b"")
+        yield content[:3]
+        yield content[3:]
+
+
+class FakeProcess:
+    def __init__(self, fs: FakeFS):
+        self.fs = fs
+        self.calls: list[tuple[str, dict[str, str] | None]] = []
+        self.product_outcome = "passed"
+        self.exit_code = 0
+        self.raise_on_launch: Exception | None = None
+        self.signal_on_launch = False
+        self.manifest_override: list[dict[str, object]] | None = None
+
+    def exec(self, command: str, env: dict[str, str] | None = None, timeout: int = 0):
+        self.calls.append((command, env))
+        result = ""
+        if command.startswith("python3 -c "):
+            entries = []
+            for path, value in sorted(self.fs.files.items()):
+                if path.startswith(REMOTE_EVIDENCE + "/"):
+                    entries.append({"path": path.removeprefix(REMOTE_EVIDENCE + "/"),
+                                    "size": len(value), "sha256": hashlib.sha256(value).hexdigest()})
+            result = json.dumps(self.manifest_override if self.manifest_override is not None else entries)
+        if command.startswith("nohup "):
+            if self.signal_on_launch:
+                os.kill(os.getpid(), signal.SIGTERM)
+            if self.raise_on_launch:
+                raise self.raise_on_launch
+            self.fs.files.update({
+                REMOTE_EVIDENCE + "/results.json": json.dumps({"outcome": self.product_outcome,
+                    "scenarios": [{"outcome": self.product_outcome, "category": "product"}]}).encode(),
+                REMOTE_EVIDENCE + "/results.xml": b'<testsuite name="installed"/>',
+                REMOTE_EVIDENCE + "/.orchestration-exit.json": json.dumps({"exit_code": self.exit_code}).encode(),
+                REMOTE_EVIDENCE + "/terminal/evidence.txt": b"terminal evidence\n",
+            })
+        return ExecuteResponse(exit_code=0, result=result)
+
+
+class FakeSnapshot:
+    def __init__(self):
+        self.value = SimpleNamespace(name="toolchain", id="snapshot-id", state="active", cpu=2, mem=4, disk=8)
+        self.params = None
+        self.create_error: Exception | None = None
+
+    def get(self, name: str):
+        return self.value
+
+    def create(self, params, timeout: int):
+        self.params = params
+        if self.create_error:
+            raise self.create_error
+        return self.value
+
+
+class FakeClient:
+    def __init__(self, output: Path):
+        self.output = output
+        self.snapshot = FakeSnapshot()
+        self.fs = FakeFS()
+        self.process = FakeProcess(self.fs)
+        self.sandbox = SimpleNamespace(id="sandbox-id", name="", labels={},
+                                       cpu=2, memory=4, disk=8, fs=self.fs, process=self.process)
+        self.exists = False
+        self.create_error: Exception | None = None
+        self.create_accepted = True
+        self.delete_error: Exception | None = None
+        self.delete_removes = True
+        self.read_error: Exception | None = None
+        self.label_residue = False
+        self.params = None
+        self.creates = 0
+        self.deletes = 0
+        self.gets: list[str] = []
+        self.lists = 0
+
+    def create(self, params, timeout: int):
+        self.creates += 1
+        recorded = json.loads((self.output / "state.json").read_text())
+        assert recorded["name"] == params.name
+        assert recorded["labels"] == params.labels
+        assert recorded["create_attempted"] is True
+        assert recorded["sandbox_id"] is None
+        self.params = params
+        self.sandbox.name = params.name
+        self.sandbox.labels = dict(params.labels)
+        self.exists = self.create_accepted
+        if self.create_error:
+            raise self.create_error
+        return self.sandbox
+
+    def get(self, identifier: str, request_timeout: int):
+        self.gets.append(identifier)
+        if self.read_error:
+            raise self.read_error
+        if not self.exists:
+            raise DaytonaNotFoundError("not found")
+        return self.sandbox
+
+    def delete(self, sandbox, timeout: int, wait: bool):
+        assert wait is False
+        self.deletes += 1
+        if self.delete_removes:
+            self.exists = False
+        if self.delete_error:
+            raise self.delete_error
+
+    def list(self, query, request_timeout: int):
+        self.lists += 1
+        return iter([self.sandbox] if self.exists or self.label_residue else [])
+
+
+class RunnerTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        root = Path(self.temp.name)
+        self.output = root / "output"
+        self.output.mkdir()
+        self.artifacts = root / "artifacts"
+        self.artifacts.mkdir()
+        (self.artifacts / "release.json").write_text('{"commit":"abc"}')
+        self.bundle = root / "bundle"
+        (self.bundle / "scripts/daytona-behaviors").mkdir(parents=True)
+        (self.bundle / "scripts/daytona-behaviors/installed.py").write_text("print('installed')")
+        self.state = State("workflow-1", "unique-name", {"diffex-run": "unique-token"},
+                           "a" * 40, "deterministic", "toolchain", time.time(), time.time() + 60)
+        self.state.save(self.output)
+        self.client = FakeClient(self.output)
+        self.runner = Runner(self.client, self.output, self.state, poll_seconds=0)
+
+    def test_end_to_end_fake_resources_ttl_record_before_create_and_reports(self):
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 0)
+        params = self.client.params
+        self.assertEqual(params.ttl_minutes, 45)
+        self.assertEqual(params.auto_stop_interval, 0)
+        self.assertEqual(params.auto_delete_interval, 0)
+        self.assertFalse(params.public)
+        self.assertIsNone(params.env_vars)
+        self.assertIsNone(params.secrets)
+        self.assertEqual(self.client.creates, 1)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertIn("sandbox-id", self.client.gets)
+        self.assertIn("unique-name", self.client.gets)
+        self.assertGreater(self.client.lists, 0)
+        report = json.loads((self.output / "orchestration.json").read_text())
+        self.assertEqual(report["outcome"], "passed")
+        self.assertEqual(report["installed_outcome"], "passed")
+        self.assertEqual(ET.parse(self.output / "orchestration.xml").getroot().attrib["failures"], "0")
+        self.assertEqual((self.output / "evidence/terminal/evidence.txt").read_bytes(), b"terminal evidence\n")
+        launch = self.client.fs.files["/tmp/diffex-launch.py"].decode()
+        self.assertIn(INSTALLED, launch)
+        self.assertIn("--artifacts", launch)
+        self.assertNotIn("npm install", launch)
+        self.assertEqual(len(self.state.inputs), 2)
+        self.assertEqual(report["input_hashes"], self.state.inputs)
+        self.assertEqual(report["category"], "daytona")
+        verify_commands = [command for command, _ in self.client.process.calls
+                           if command.startswith("python3 /tmp/diffex-extract.py ")]
+        self.assertEqual(len(verify_commands), 1)
+        for digest in self.state.inputs.values():
+            self.assertIn(digest, verify_commands[0])
+
+    def test_live_key_is_process_only_never_serialized_or_uploaded(self):
+        self.state.mode = "live"
+        secret = "live-secret-never-persist"
+        with patch.dict(os.environ, {"DAYTONA_API_KEY": "daytona-secret", "OPENAI_API_KEY": secret}):
+            self.assertEqual(self.runner.run(self.artifacts, self.bundle, secret), 0)
+        envs = [env for command, env in self.client.process.calls if command.startswith("nohup ")]
+        self.assertEqual(envs, [{"OPENAI_API_KEY": secret}])
+        self.assertIsNone(self.client.params.env_vars)
+        for path in self.output.rglob("*"):
+            if path.is_file():
+                self.assertNotIn(secret.encode(), path.read_bytes())
+                self.assertNotIn(b"daytona-secret", path.read_bytes())
+        for _, value in self.client.fs.uploads:
+            self.assertNotIn(secret.encode(), value)
+            self.assertNotIn(b"daytona-secret", value)
+
+    def test_deterministic_ignores_even_supplied_key(self):
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, "must-not-forward"), 0)
+        self.assertTrue(all(not env for _, env in self.client.process.calls))
+
+    def test_ambiguous_create_found_deleted_without_replacement(self):
+        self.client.create_error = TimeoutError("sensitive HTTP detail")
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.client.creates, 1)
+        self.assertEqual(self.client.deletes, 1)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertEqual(self.state.sandbox_id, "sandbox-id")
+        self.assertNotIn("sensitive HTTP detail", (self.output / "state.json").read_text())
+
+    def test_ambiguous_create_not_visible_remains_unconfirmed(self):
+        self.client.create_error = TimeoutError()
+        self.client.create_accepted = False
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.state.cleanup, "unconfirmed")
+        self.assertEqual(self.client.creates, 1)
+        self.assertEqual(self.client.deletes, 0)
+        self.assertEqual(self.runner.recover(0), 1)
+        self.assertEqual(self.client.creates, 1)
+
+    def test_delayed_ambiguous_create_recovered_by_saved_name(self):
+        self.client.create_error = TimeoutError()
+        self.client.create_accepted = False
+        self.runner.run(self.artifacts, self.bundle, None)
+        self.client.exists = True
+        self.runner.recover(0)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertEqual(self.client.creates, 1)
+        self.assertEqual(self.client.deletes, 1)
+
+    def test_delete_success_is_not_confirmation(self):
+        self.client.delete_removes = False
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.state.execution, "passed")
+        self.assertEqual(self.state.cleanup, "unconfirmed")
+        self.assertTrue(self.client.exists)
+
+    def test_delete_timeout_still_independently_confirms(self):
+        self.client.delete_error = TimeoutError()
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 0)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertTrue(any(error.startswith("delete-request") for error in self.state.errors))
+
+    def test_lookup_outage_is_not_absence(self):
+        self.runner.create()
+        self.client.read_error = ConnectionError()
+        self.runner.cleanup(attempts=1)
+        self.assertEqual(self.state.cleanup, "unconfirmed")
+        self.assertEqual(self.client.deletes, 0)
+
+    def test_label_query_residue_blocks_confirmation(self):
+        self.client.label_residue = True
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.state.cleanup, "unconfirmed")
+
+    def test_ownership_mismatch_refuses_deletion(self):
+        self.runner.create()
+        self.client.sandbox.labels = {"diffex-run": "somebody-else"}
+        self.runner.cleanup(attempts=1)
+        self.assertEqual(self.client.deletes, 0)
+        self.assertEqual(self.state.cleanup, "unconfirmed")
+
+    def test_wrong_snapshot_resources_never_creates(self):
+        self.client.snapshot.value.mem = 8
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.client.creates, 0)
+        self.assertEqual(self.state.cleanup, "not-needed")
+
+    def test_wrong_sandbox_resources_still_cleans_up(self):
+        self.client.sandbox.disk = 16
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.client.deletes, 1)
+        self.assertEqual(self.state.cleanup, "confirmed")
+
+    def test_incremental_download_only_changed_files(self):
+        self.client.fs.files[REMOTE_EVIDENCE + "/progress.json"] = b"one"
+        self.runner.collect(self.client.sandbox)
+        self.runner.collect(self.client.sandbox)
+        self.assertEqual(len(self.client.fs.downloads), 1)
+        self.client.fs.files[REMOTE_EVIDENCE + "/progress.json"] = b"two"
+        self.runner.collect(self.client.sandbox)
+        self.assertEqual(len(self.client.fs.downloads), 2)
+        self.assertEqual((self.output / "evidence/progress.json").read_bytes(), b"two")
+
+    def test_changed_during_download_keeps_last_good_copy(self):
+        path = REMOTE_EVIDENCE + "/progress.json"
+        self.client.fs.files[path] = b"one"
+        self.runner.collect(self.client.sandbox)
+        self.client.fs.files[path] = b"two"
+        self.client.fs.corrupt = True
+        self.runner.collect(self.client.sandbox)
+        self.assertEqual((self.output / "evidence/progress.json").read_bytes(), b"one")
+        self.assertFalse(list(self.output.rglob("*.download")))
+        self.client.fs.corrupt = False
+        self.runner.collect(self.client.sandbox)
+        self.assertEqual((self.output / "evidence/progress.json").read_bytes(), b"two")
+
+    def test_unsafe_manifest_path_is_rejected(self):
+        self.client.process.manifest_override = [{"path": "../../escape", "size": 0, "sha256": "0" * 64}]
+        with self.assertRaisesRegex(OrchestrationError, "unsafe"):
+            self.runner.collect(self.client.sandbox)
+        self.assertFalse(self.client.fs.downloads)
+
+    def test_local_symlink_is_rejected(self):
+        evidence = self.output / "evidence"
+        evidence.mkdir()
+        (evidence / "escape").symlink_to(self.artifacts, target_is_directory=True)
+        self.client.fs.files[REMOTE_EVIDENCE + "/escape/file"] = b"secret"
+        with self.assertRaisesRegex(OrchestrationError, "symlink"):
+            self.runner.collect(self.client.sandbox)
+
+    def test_launch_failure_still_cleans_and_reports(self):
+        self.client.process.raise_on_launch = TimeoutError("might have launched")
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertTrue(self.state.launch_attempted)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertTrue((self.output / "orchestration.xml").exists())
+        launches = sum(command.startswith("nohup ") for command, _ in self.client.process.calls)
+        self.runner.recover(0)
+        self.assertEqual(sum(command.startswith("nohup ") for command, _ in self.client.process.calls), launches)
+
+    def test_sigterm_performs_cleanup_and_writes_failure(self):
+        self.client.process.signal_on_launch = True
+        previous = signal.getsignal(signal.SIGTERM)
+        with termination_handlers():
+            self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(signal.getsignal(signal.SIGTERM), previous)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertEqual(self.client.deletes, 1)
+        self.assertIn("signal 15", (self.output / "orchestration.json").read_text())
+
+    def test_product_failure_is_not_hidden_by_successful_cleanup(self):
+        self.client.process.product_outcome = "failed"
+        self.client.process.exit_code = 1
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        report = json.loads((self.output / "orchestration.json").read_text())
+        self.assertEqual(report["installed_outcome"], "failed")
+        self.assertEqual(report["cleanup"], "confirmed")
+
+    def test_missing_installed_reports_never_passes(self):
+        self.runner.run(self.artifacts, self.bundle, None)
+        (self.output / "evidence/results.xml").unlink()
+        self.assertEqual(self.runner.report(), 1)
+
+    def test_poll_deadline_retains_partial_evidence(self):
+        self.client.fs.files[REMOTE_EVIDENCE + "/partial.log"] = b"partial"
+        with self.assertRaisesRegex(OrchestrationError, "deadline"):
+            self.runner.poll(self.client.sandbox, time.time() - 1)
+        self.assertEqual((self.output / "evidence/partial.log").read_bytes(), b"partial")
+
+    def test_recover_running_run_collects_without_create_or_launch(self):
+        sandbox = self.runner.create()
+        self.runner.launch(sandbox, None)
+        self.assertEqual(self.runner.recover(0), 0)
+        self.assertEqual(self.client.creates, 1)
+        self.assertEqual(sum(command.startswith("nohup ") for command, _ in self.client.process.calls), 1)
+        self.assertEqual(self.runner.recover(0), 0)
+
+    def test_snapshot_uses_checked_in_toolchain_only(self):
+        destination = self.output / "snapshot"
+        self.assertEqual(prepare_snapshot(self.client, "toolchain", destination), 0)
+        params = self.client.snapshot.params
+        self.assertEqual(asdict(params.resources), {**RESOURCES, "gpu": None, "gpu_type": None})
+        dockerfile = params.image.dockerfile()
+        self.assertIn("node:22.23.2", dockerfile)
+        self.assertIn("BUN_VERSION=1.3.11", dockerfile)
+        self.assertIn("NPM_VERSION=11.16.0", dockerfile)
+        self.assertNotIn("COPY", "\n".join(line for line in dockerfile.splitlines() if not line.startswith("#")))
+        self.assertEqual(params.image._context_list, [])
+        self.assertEqual(json.loads((destination / "snapshot.json").read_text())["status"], "active")
+
+    def test_ambiguous_snapshot_has_retained_record_not_replacement(self):
+        self.client.snapshot.create_error = TimeoutError()
+        destination = self.output / "snapshot"
+        self.assertEqual(prepare_snapshot(self.client, "toolchain", destination), 1)
+        self.assertEqual(json.loads((destination / "snapshot.json").read_text())["status"], "failed-or-ambiguous")
+
+    def test_input_archive_rejects_symlink_and_credential_config(self):
+        destination = self.output / "archive.tar.gz"
+        (self.bundle / "outside").symlink_to(self.artifacts, target_is_directory=True)
+        with self.assertRaisesRegex(OrchestrationError, "links"):
+            archive_directory(self.bundle, destination)
+        (self.bundle / "outside").unlink()
+        (self.bundle / ".env").write_text("SECRET=value")
+        with self.assertRaisesRegex(OrchestrationError, "credential"):
+            archive_directory(self.bundle, destination)
+
+    def test_bundle_tar_rejects_traversal_and_links(self):
+        archive = self.output / "bad.tar"
+        for name, kind in (("../escape", tarfile.REGTYPE), ("link", tarfile.SYMTYPE)):
+            with self.subTest(name=name):
+                with tarfile.open(archive, "w") as stream:
+                    item = tarfile.TarInfo(name)
+                    item.type = kind
+                    item.linkname = "/etc/passwd" if kind == tarfile.SYMTYPE else ""
+                    stream.addfile(item)
+                with self.assertRaises(OrchestrationError):
+                    validate_archive(archive)
+
+    def test_remote_archive_hashes_verified_before_any_extraction(self):
+        root = self.output / "remote"
+        root.mkdir()
+        release = root / "diffex-release.tar.gz"
+        bundle = root / "diffex-bundle.tar.gz"
+        archive_directory(self.artifacts, release)
+        archive_directory(self.bundle, bundle)
+        script = EXTRACT_SCRIPT.replace("/tmp/", root.as_posix() + "/")
+        # A mismatch in the SECOND input must prevent extracting the first too.
+        with patch("sys.argv", ["extract.py", sha256(release), "0" * 64]):
+            with self.assertRaisesRegex(ValueError, "SHA256 mismatch"):
+                exec(compile(script, "extract", "exec"), {})
+        self.assertFalse((root / "diffex-release").exists())
+        self.assertFalse((root / "diffex-behaviors").exists())
+        with patch("sys.argv", ["extract.py", sha256(release), sha256(bundle)]):
+            exec(compile(script, "extract", "exec"), {})
+        self.assertTrue((root / "diffex-release/release.json").is_file())
+        self.assertTrue((root / "diffex-behaviors/scripts/daytona-behaviors/installed.py").is_file())
+
+    def test_remote_helpers_compile(self):
+        compile(EXTRACT_SCRIPT, "extract", "exec")
+        compile(MANIFEST_SCRIPT, "manifest", "exec")
+
+    def test_cli_requires_unique_run_id_and_full_commit(self):
+        args = ["run", "--artifacts", str(self.artifacts), "--bundle", str(self.bundle),
+                "--snapshot", "toolchain", "--output", str(self.output / "cli"),
+                "--mode", "deterministic", "--commit", "bad"]
+        with patch("sys.stderr", new=io.StringIO()):
+            with self.assertRaises(SystemExit):
+                main(args)
+            with self.assertRaises(SystemExit):
+                main(args + ["--run-id", "workflow-1"])
+        self.assertFalse((self.output / "cli").exists())
+
+    def test_cli_deterministic_does_not_read_or_forward_openai_key(self):
+        destination = self.output / "cli"
+        with patch("daytona_runner.Daytona", return_value=FakeClient(destination)), patch.dict(
+            os.environ, {"OPENAI_API_KEY": "ambient-secret"}
+        ):
+            self.assertEqual(main(["run", "--artifacts", str(self.artifacts), "--bundle", str(self.bundle),
+                "--snapshot", "toolchain", "--output", str(destination), "--run-id", "workflow-2",
+                "--mode", "deterministic", "--commit", "b" * 40]), 0)
+        self.assertNotIn("ambient-secret", (destination / "state.json").read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/daytona-behaviors/test_installed.py b/scripts/daytona-behaviors/test_installed.py
index 54aefe23e..c92dd28f2 100644
--- a/scripts/daytona-behaviors/test_installed.py
+++ b/scripts/daytona-behaviors/test_installed.py
@@ -44,7 +44,7 @@ def test_corrupt_artifact_fails_before_install(self):
             self.assertIn("checksum", runner.results[0]["error"])
 
     def test_provider_and_configuration_failures_are_distinct(self):
-        for status, category in ((401, "configuration"), (429, "provider"), (503, "provider")):
+        for status, category in ((400, "configuration"), (401, "configuration"), (404, "configuration"), (429, "provider"), (503, "provider")):
             with self.subTest(status=status), tempfile.TemporaryDirectory() as temporary:
                 runner = self.runner(temporary)
                 def fail(evidence):
@@ -53,6 +53,15 @@ def fail(evidence):
                 self.assertFalse(runner.scenario("live", fail))
                 self.assertEqual(runner.results[0]["category"], category)
 
+    def test_transport_unavailability_is_provider_failure(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            runner = self.runner(temporary)
+            def fail(evidence):
+                (evidence / "events.jsonl").write_text(json.dumps({"type": "provider-error", "error": "TypeError"}) + "\n")
+                raise AssertionError("No response")
+            self.assertFalse(runner.scenario("live", fail))
+            self.assertEqual(runner.results[0]["category"], "provider")
+
     def test_normalization_preserves_layout_and_behavior_text(self):
         env = {"HOME": "/tmp/home", "DIFFEX_PROJECT": "/tmp/project"}
         actual = installed.normalize_screen("Diffex v0.4.0\n  /tmp/project\nbehavior-tools-ok\n", env)

From cd69691908f80bd0239b7aabbdd1ce5bff3fad5e Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:07:15 -0400
Subject: [PATCH 04/12] fix(coding-agent): sanitize behavior evidence before
 incremental collection

---
 scripts/daytona-behaviors/installed.py      | 28 +++++++++--------
 scripts/daytona-behaviors/live-guard.mjs    |  6 +++-
 scripts/daytona-behaviors/test_installed.py | 34 +++++++++++++++++++++
 3 files changed, 55 insertions(+), 13 deletions(-)

diff --git a/scripts/daytona-behaviors/installed.py b/scripts/daytona-behaviors/installed.py
index c49e616e7..4e403fd2b 100644
--- a/scripts/daytona-behaviors/installed.py
+++ b/scripts/daytona-behaviors/installed.py
@@ -37,7 +37,6 @@ def __init__(self, executable, args, env, project, evidence, deadline):
                      "-c", str(project),
                      " ".join(shlex.quote(a) for a in [executable, *args]))
         self.command("set-option", "-g", "remain-on-exit", "on")
-        self.command("pipe-pane", "-o", "cat >> " + shlex.quote(str(evidence / "terminal.raw")))
 
     def command(self, *args):
         result = subprocess.run(["tmux", "-f", str(self.evidence / "tmux.conf"), "-L", self.socket, *args], capture_output=True, text=True,
@@ -52,7 +51,7 @@ def send(self, text):
 
     def capture(self):
         screen = self.command("capture-pane", "-p", "-S", "-2000")
-        (self.evidence / "terminal.txt").write_text(screen)
+        (self.evidence / "terminal.txt").write_text(screen.replace(self.env.get("OPENAI_API_KEY", "\0"), "[REDACTED]"))
         return screen
 
     def wait(self, text, seconds=30):
@@ -199,8 +198,12 @@ def process(self, executable, args, env, project, evidence):
         remaining = self.deadline - time.monotonic()
         assert remaining > 0, "Run deadline exceeded"
         result = subprocess.run([executable, *args], cwd=project, env=env, capture_output=True, text=True, timeout=min(40, remaining))
-        (evidence / "stdout.txt").write_text(result.stdout)
-        (evidence / "stderr.txt").write_text(result.stderr)
+        stdout, stderr = result.stdout, result.stderr
+        for secret in self.secrets:
+            if secret:
+                stdout, stderr = stdout.replace(secret, "[REDACTED]"), stderr.replace(secret, "[REDACTED]")
+        (evidence / "stdout.txt").write_text(stdout)
+        (evidence / "stderr.txt").write_text(stderr)
         assert result.returncode == 0, f"Exit code {result.returncode}; see stdout/stderr"
         return result.stdout
 
@@ -220,18 +223,19 @@ def behavior(self, executable, evidence, action):
                 for source, target in [(root / "events.jsonl", evidence / "events.jsonl"),
                                        (root / "agent/sessions", evidence / "sessions"),
                                        (root / "project", evidence / "project")]:
-                    if source.is_dir():
-                        shutil.copytree(source, target)
-                    elif source.exists():
-                        shutil.copyfile(source, target)
-                # Never copy home, agent/auth.json, settings, or process environment.
-                for file in evidence.rglob("*"):
-                    if file.is_file():
+                    files = source.rglob("*") if source.is_dir() else [source]
+                    for file in files:
+                        if not file.is_file() or file.is_symlink() or file.name in {"auth.json", ".npmrc", ".netrc", ".env"} or file.name.startswith(".env."):
+                            continue
+                        destination = target / file.relative_to(source) if source.is_dir() else target
                         text = file.read_text(errors="replace")
                         for secret in self.secrets:
                             if secret:
                                 text = text.replace(secret, "[REDACTED]")
-                        file.write_text(text)
+                        destination.parent.mkdir(parents=True, exist_ok=True)
+                        destination.write_text(text)
+                # Never copy home, auth files, settings, or process environment.
+                # Redaction happens BEFORE files become incrementally downloadable.
 
     def deterministic(self, executable, runtime):
         def run_case(name, fn):
diff --git a/scripts/daytona-behaviors/live-guard.mjs b/scripts/daytona-behaviors/live-guard.mjs
index 704c64380..dcea8a01a 100644
--- a/scripts/daytona-behaviors/live-guard.mjs
+++ b/scripts/daytona-behaviors/live-guard.mjs
@@ -2,7 +2,11 @@ import { appendFileSync, existsSync, readFileSync } from "node:fs";
 
 // Observes the installed provider transport; never supplies a model response.
 export default function (diffex) {
-	const record = (event) => appendFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, `${JSON.stringify(event)}\n`);
+	const record = (event) => {
+		const serialized = JSON.stringify(event);
+		const key = process.env.OPENAI_API_KEY;
+		appendFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, `${key ? serialized.replaceAll(key, "[REDACTED]") : serialized}\n`);
+	};
 	const originalFetch = globalThis.fetch;
 	const started = Number(process.env.DIFFEX_BEHAVIOR_STARTED);
 	let requests = existsSync(process.env.DIFFEX_BEHAVIOR_RECORD)
diff --git a/scripts/daytona-behaviors/test_installed.py b/scripts/daytona-behaviors/test_installed.py
index c92dd28f2..60e560abf 100644
--- a/scripts/daytona-behaviors/test_installed.py
+++ b/scripts/daytona-behaviors/test_installed.py
@@ -2,9 +2,11 @@
 import argparse
 import importlib.util
 import json
+import os
 from pathlib import Path
 import tempfile
 import unittest
+from unittest.mock import patch
 import xml.etree.ElementTree as ET
 
 SPEC = importlib.util.spec_from_file_location("installed", Path(__file__).with_name("installed.py"))
@@ -67,6 +69,38 @@ def test_normalization_preserves_layout_and_behavior_text(self):
         actual = installed.normalize_screen("Diffex v0.4.0\n  /tmp/project\nbehavior-tools-ok\n", env)
         self.assertEqual(actual, "Diffex v<VERSION>\n  <PROJECT>\nbehavior-tools-ok\n")
 
+    def test_live_evidence_is_redacted_before_publication_and_excludes_auth(self):
+        with tempfile.TemporaryDirectory() as temporary, patch.dict(os.environ, {"OPENAI_API_KEY": "test-secret-never-persist"}):
+            root = Path(temporary)
+            executable = root / "consumer/node_modules/.bin/diffex"
+            executable.parent.mkdir(parents=True)
+            evidence = root / "output"
+            runner = self.runner(evidence)
+            runner.args.mode = "live"
+            runner.secrets = [os.environ["OPENAI_API_KEY"]]
+            def action(env, work, fixture):
+                (work / "events.jsonl").write_text(json.dumps({"type": "test", "content": os.environ["OPENAI_API_KEY"]}) + "\n")
+                (work / "project/result.txt").write_text(os.environ["OPENAI_API_KEY"])
+                (work / "project/auth.json").write_text("must not be copied")
+            runner.behavior(str(executable), evidence, action)
+            self.assertEqual((evidence / "project/result.txt").read_text(), "[REDACTED]")
+            self.assertFalse((evidence / "project/auth.json").exists())
+            self.assertNotIn(os.environ["OPENAI_API_KEY"], (evidence / "events.jsonl").read_text())
+
+    def test_terminal_key_is_never_in_command_arguments_or_capture(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            evidence = Path(temporary)
+            commands = []
+            def command(terminal, *args):
+                commands.append(args)
+                return "test-secret-never-persist" if args[0] == "capture-pane" else ""
+            env = {"HOME": temporary, "OPENAI_API_KEY": "test-secret-never-persist"}
+            with patch.object(installed.Terminal, "command", command):
+                terminal = installed.Terminal("/installed/diffex", [], env, evidence, evidence, 100)
+                terminal.capture()
+            self.assertNotIn(env["OPENAI_API_KEY"], str(commands))
+            self.assertEqual((evidence / "terminal.txt").read_text(), "[REDACTED]")
+
     def test_empty_results_cannot_pass(self):
         with tempfile.TemporaryDirectory() as temporary:
             runner = self.runner(temporary)

From d025b29e554c13c4835a2d592adf47c39d49b752 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:09:13 -0400
Subject: [PATCH 05/12] feat(coding-agent): run post-merge Daytona behaviors
 with retained evidence

---
 .github/workflows/daytona-behaviors.yml     | 317 ++++++++++++++++++++
 docs/daytona-behaviors.md                   | 267 +++++++++++++++++
 scripts/daytona-behaviors-workflow.test.mjs | 179 +++++++++++
 3 files changed, 763 insertions(+)
 create mode 100644 .github/workflows/daytona-behaviors.yml
 create mode 100644 docs/daytona-behaviors.md
 create mode 100644 scripts/daytona-behaviors-workflow.test.mjs

diff --git a/.github/workflows/daytona-behaviors.yml b/.github/workflows/daytona-behaviors.yml
new file mode 100644
index 000000000..e070e651f
--- /dev/null
+++ b/.github/workflows/daytona-behaviors.yml
@@ -0,0 +1,317 @@
+name: Daytona Behaviors
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+env:
+  DIFFEX_SOURCE_COMMIT: ${{ github.sha }}
+
+jobs:
+  prepare:
+    # Dispatch remains available for qualification; pushes spend nothing until approved.
+    if: ${{ github.event_name == 'workflow_dispatch' || vars.DAYTONA_BEHAVIORS_QUALIFIED == 'true' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    steps:
+      - name: Checkout exact event commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.19.0'
+      - name: Install pinned npm and locked dependencies
+        run: |
+          npm install -g npm@11.16.0 --ignore-scripts
+          npm ci --ignore-scripts
+      - name: Freeze, build offline, prepare and verify exact candidate bytes
+        run: |
+          npm run hydrate:model-data
+          node scripts/release-artifacts.mjs freeze .artifacts/release
+          npm run build:offline
+          node scripts/release-artifacts.mjs prepare .artifacts/release
+          node scripts/release-artifacts.mjs verify .artifacts/release
+          git diff --exit-code HEAD
+      - name: Test behavior harness and failure-path orchestration without credentials
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python3 -m venv "$RUNNER_TEMP/behavior-test-venv"
+          "$RUNNER_TEMP/behavior-test-venv/bin/python" -m pip install -r scripts/daytona-behaviors/requirements.txt
+          "$RUNNER_TEMP/behavior-test-venv/bin/python" -m unittest discover -s scripts/daytona-behaviors -p 'test_*.py'
+          node --test scripts/artifact-acceptance.test.mjs scripts/daytona-behaviors-workflow.test.mjs scripts/daytona-behaviors/fixture.test.mjs scripts/daytona-behaviors/live-guard.test.mjs
+      - name: Bundle checked behavior harness without rebuilding the candidate
+        run: |
+          mkdir -p .artifacts/daytona-bundle
+          tar -czf .artifacts/daytona-bundle/bundle.tar.gz \
+            scripts/artifact-installation.mjs \
+            scripts/verify-candidate-artifacts.py \
+            scripts/fixtures/artifact-handoff.mjs \
+            scripts/daytona-behaviors/installed.py \
+            scripts/daytona-behaviors/install.mjs \
+            scripts/daytona-behaviors/fixture.mjs \
+            scripts/daytona-behaviors/live-guard.mjs \
+            scripts/daytona-behaviors/baselines
+          sha256sum .artifacts/daytona-bundle/bundle.tar.gz > .artifacts/daytona-bundle/SHA256SUMS
+      - name: Retain exact private candidate bytes
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: daytona-release-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/release/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 30
+      - name: Retain exact private behavior bundle
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: daytona-bundle-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-bundle/
+          if-no-files-found: error
+          retention-days: 30
+
+  deterministic:
+    needs: prepare
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    environment: daytona-behaviors
+    env:
+      DAYTONA_BEHAVIOR_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-deterministic
+      DAYTONA_SNAPSHOT: ${{ vars.DAYTONA_BEHAVIORS_SNAPSHOT }}
+    steps:
+      - name: Checkout exact event commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Setup Node for artifact verification only
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.19.0'
+      - name: Install pinned Daytona SDK in an isolated environment
+        run: |
+          python3 -m venv "$RUNNER_TEMP/daytona-venv"
+          "$RUNNER_TEMP/daytona-venv/bin/python" -m pip install -r scripts/daytona-behaviors/requirements.txt
+      - name: Download exact candidate bytes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: daytona-release-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/release
+      - name: Download exact behavior bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: daytona-bundle-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-bundle
+      - name: Verify retained source, tarballs and harness bytes
+        run: |
+          node scripts/release-artifacts.mjs verify .artifacts/release
+          sha256sum -c .artifacts/daytona-bundle/SHA256SUMS
+          test -n "$DAYTONA_SNAPSHOT"
+      - name: Run deterministic installed-artifact behaviors in Daytona
+        id: run
+        timeout-minutes: 25
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+        run: |
+          "$RUNNER_TEMP/daytona-venv/bin/python" scripts/daytona-behaviors/daytona_runner.py run \
+            --artifacts .artifacts/release --bundle .artifacts/daytona-bundle/bundle.tar.gz \
+            --snapshot "$DAYTONA_SNAPSHOT" --output .artifacts/daytona-deterministic \
+            --mode deterministic --commit "$DIFFEX_SOURCE_COMMIT" --run-id "$DAYTONA_BEHAVIOR_RUN_ID" \
+            --timeout-seconds 1200
+      - name: Recover evidence and confirm sandbox cleanup without relaunching
+        id: recover
+        if: ${{ always() && steps.run.outcome != 'skipped' }}
+        timeout-minutes: 5
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+        run: |
+          "$RUNNER_TEMP/daytona-venv/bin/python" scripts/daytona-behaviors/daytona_runner.py recover \
+            --output .artifacts/daytona-deterministic
+      - name: Record execution and cleanup outcomes
+        if: always()
+        env:
+          EXECUTION: ${{ steps.run.outcome }}
+          RECOVERY: ${{ steps.recover.outcome }}
+        run: |
+          mkdir -p .artifacts/daytona-deterministic
+          jq -n --arg commit "$DIFFEX_SOURCE_COMMIT" --arg runId "$DAYTONA_BEHAVIOR_RUN_ID" \
+            --arg mode deterministic --arg execution "$EXECUTION" --arg recovery "$RECOVERY" \
+            '{commit: $commit, runId: $runId, mode: $mode, execution: $execution, recovery: $recovery}' \
+            > .artifacts/daytona-deterministic/workflow-job.json
+      - name: Retain deterministic evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: daytona-evidence-deterministic-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-deterministic/
+          if-no-files-found: error
+          retention-days: 30
+
+  live:
+    needs: prepare
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    environment: daytona-behaviors
+    env:
+      DAYTONA_BEHAVIOR_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-live
+      DAYTONA_SNAPSHOT: ${{ vars.DAYTONA_BEHAVIORS_SNAPSHOT }}
+    steps:
+      - name: Checkout exact event commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Setup Node for artifact verification only
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.19.0'
+      - name: Install pinned Daytona SDK in an isolated environment
+        run: |
+          python3 -m venv "$RUNNER_TEMP/daytona-venv"
+          "$RUNNER_TEMP/daytona-venv/bin/python" -m pip install -r scripts/daytona-behaviors/requirements.txt
+      - name: Download exact candidate bytes
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: daytona-release-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/release
+      - name: Download exact behavior bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: daytona-bundle-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-bundle
+      - name: Verify retained source, tarballs and harness bytes
+        run: |
+          node scripts/release-artifacts.mjs verify .artifacts/release
+          sha256sum -c .artifacts/daytona-bundle/SHA256SUMS
+          test -n "$DAYTONA_SNAPSHOT"
+      - name: Run bounded live installed-artifact behaviors in Daytona
+        id: run
+        timeout-minutes: 25
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          "$RUNNER_TEMP/daytona-venv/bin/python" scripts/daytona-behaviors/daytona_runner.py run \
+            --artifacts .artifacts/release --bundle .artifacts/daytona-bundle/bundle.tar.gz \
+            --snapshot "$DAYTONA_SNAPSHOT" --output .artifacts/daytona-live \
+            --mode live --commit "$DIFFEX_SOURCE_COMMIT" --run-id "$DAYTONA_BEHAVIOR_RUN_ID" \
+            --timeout-seconds 1200
+      - name: Recover evidence and confirm sandbox cleanup without relaunching
+        id: recover
+        if: ${{ always() && steps.run.outcome != 'skipped' }}
+        timeout-minutes: 5
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+        run: |
+          "$RUNNER_TEMP/daytona-venv/bin/python" scripts/daytona-behaviors/daytona_runner.py recover \
+            --output .artifacts/daytona-live
+      - name: Record execution and cleanup outcomes
+        if: always()
+        env:
+          EXECUTION: ${{ steps.run.outcome }}
+          RECOVERY: ${{ steps.recover.outcome }}
+        run: |
+          mkdir -p .artifacts/daytona-live
+          jq -n --arg commit "$DIFFEX_SOURCE_COMMIT" --arg runId "$DAYTONA_BEHAVIOR_RUN_ID" \
+            --arg mode live --arg execution "$EXECUTION" --arg recovery "$RECOVERY" \
+            '{commit: $commit, runId: $runId, mode: $mode, execution: $execution, recovery: $recovery}' \
+            > .artifacts/daytona-live/workflow-job.json
+      - name: Retain live evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: daytona-evidence-live-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-live/
+          if-no-files-found: error
+          retention-days: 30
+
+  daytona-behaviors:
+    needs: [prepare, deterministic, live]
+    if: ${{ always() && (github.event_name == 'workflow_dispatch' || vars.DAYTONA_BEHAVIORS_QUALIFIED == 'true') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ github.token }}
+      PREPARE_RESULT: ${{ needs.prepare.result }}
+      DETERMINISTIC_RESULT: ${{ needs.deterministic.result }}
+      LIVE_RESULT: ${{ needs.live.result }}
+    steps:
+      - name: Aggregate both modes, missing evidence and cleanup failures
+        run: |
+          mkdir -p .artifacts/daytona-summary
+          failed=0
+          for result in "$PREPARE_RESULT" "$DETERMINISTIC_RESULT" "$LIVE_RESULT"; do
+            if [[ "$result" != success ]]; then failed=1; fi
+          done
+          for mode in deterministic live; do
+            evidence=".artifacts/daytona-summary/$mode"
+            if ! gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "daytona-evidence-$mode-$DIFFEX_SOURCE_COMMIT-$GITHUB_RUN_ATTEMPT" --dir "$evidence"; then
+              echo "::error::Missing $mode evidence artifact"
+              failed=1
+              continue
+            fi
+            if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" \
+              --arg runId "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$mode" \
+              '.commit == $commit and .mode == $mode and .runId == $runId and .execution == "success" and .recovery == "success"' \
+              "$evidence/workflow-job.json"; then
+              echo "::error::$mode execution or cleanup did not succeed"
+              failed=1
+            fi
+            if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" \
+              --arg runId "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$mode" \
+              '.commit == $commit and .mode == $mode and .run_id == $runId and .outcome == "passed" and .execution == "passed" and .exit_code == 0 and .installed_outcome == "passed" and .reports_complete == true and .cleanup == "confirmed"' \
+              "$evidence/orchestration.json"; then
+              echo "::error::Missing, incomplete or failed $mode orchestration/cleanup result"
+              failed=1
+            fi
+            if [[ "$mode" == deterministic ]]; then
+              expected='["artifact-integrity","npm-package-integrity","bun-package-integrity","npm-installation","npm-print","npm-builtin-auth-transport","npm-terminal-tools-cancel-resume","npm-artifact-terminal","bun-installation","bun-print","bun-builtin-auth-transport","bun-terminal-tools-cancel-resume","bun-artifact-terminal"]'
+            else
+              expected='["artifact-integrity","npm-package-integrity","npm-live-openai"]'
+            fi
+            if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" --argjson expected "$expected" \
+              '.schemaVersion == 1 and .commit == $commit and .mode == $mode and .outcome == "passed" and (.artifactHashes | type == "object" and length > 0) and ((.scenarios | map(.id) | sort) == ($expected | sort)) and all(.scenarios[]; .commit == $commit and .outcome == "passed")' \
+              "$evidence/evidence/results.json"; then
+              echo "::error::Missing, incomplete or failed $mode installed scenarios"
+              failed=1
+            fi
+            for result in orchestration.xml evidence/results.xml; do
+              if [[ ! -s "$evidence/$result" ]]; then
+                echo "::error::Missing $mode $result"
+                failed=1
+              fi
+            done
+          done
+          if ! jq --slurp --exit-status '.[0].artifactHashes == .[1].artifactHashes' \
+            .artifacts/daytona-summary/deterministic/evidence/results.json \
+            .artifacts/daytona-summary/live/evidence/results.json; then
+            echo '::error::Both modes must test the same candidate tarball hashes'
+            failed=1
+          fi
+          jq -n --arg commit "$DIFFEX_SOURCE_COMMIT" --arg prepare "$PREPARE_RESULT" \
+            --arg deterministic "$DETERMINISTIC_RESULT" --arg live "$LIVE_RESULT" --argjson failed "$failed" \
+            '{commit: $commit, jobs: {prepare: $prepare, deterministic: $deterministic, live: $live}, passed: ($failed == 0)}' \
+            > .artifacts/daytona-summary/summary.json
+          {
+            echo '## Daytona installed-artifact behaviors'
+            echo "Commit: \`$DIFFEX_SOURCE_COMMIT\`"
+            echo "Prepare: $PREPARE_RESULT; deterministic: $DETERMINISTIC_RESULT; live: $LIVE_RESULT"
+            echo "Evidence and confirmed cleanup gate: $([[ "$failed" == 0 ]] && echo passed || echo failed)"
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit "$failed"
+      - name: Retain aggregate evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: daytona-summary-${{ github.sha }}-${{ github.run_attempt }}
+          path: .artifacts/daytona-summary/
+          if-no-files-found: error
+          retention-days: 30
diff --git a/docs/daytona-behaviors.md b/docs/daytona-behaviors.md
new file mode 100644
index 000000000..0e7e2b6cd
--- /dev/null
+++ b/docs/daytona-behaviors.md
@@ -0,0 +1,267 @@
+# Daytona installed-artifact behaviors
+
+## Status and scope
+
+The workflow and harness are implementation, not remote qualification evidence.
+A maintainer must provision Daytona access, prepare a snapshot, supply an approved live-provider credential and run the qualification below before enabling automatic runs.
+Local fixture tests, SDK mocks and workflow validation do not establish that Daytona creation, upload, PTY execution, live inference or deletion works against the real service.
+Do not mark the integration qualified until those operations and their failure paths have retained evidence.
+
+This is a standalone acceptance gate for the packaged Diffex CLI, not the hosted product's runtime image, a release publisher or a replacement for native artifact acceptance.
+It installs the exact reviewed candidate tarballs into isolated consumers outside the repository.
+The deterministic mode controls inference while exercising installed behavior; the live mode uses a bounded real OpenAI request path.
+A passing deterministic run is not live-provider evidence.
+The snapshot is toolchain-only; each run uploads its candidate artifacts and checked harness rather than baking repository source or credentials into a snapshot.
+Version 1 covers the Linux installed CLI only; hosted-runtime behavior and subscription/OAuth login qualification are out of scope.
+The workflow performs no automatic reverts and changes no release or publication gates.
+
+## Workflow contract
+
+`.github/workflows/daytona-behaviors.yml` listens to every push to `main` and to manual dispatch.
+There are no path filters or concurrency cancellation: overlapping pushes retain independent run IDs and sandboxes.
+Every checkout explicitly uses `github.sha`, including a manually dispatched run's selected commit.
+A later movement of `main` must not change the source under test.
+
+Automatic pushes are gated by the **repository variable** `DAYTONA_BEHAVIORS_QUALIFIED` being exactly `true`.
+Leave it unset or `false` until qualification passes; unqualified pushes skip the gated jobs rather than reporting remote success.
+Manual dispatch bypasses this variable so qualification and repair remain possible.
+The workflow never sets its own qualification variable.
+
+1. **Prepare, once, with a 35-minute timeout.** Install locked dependencies with lifecycle scripts disabled, hydrate model data once, then run the existing artifact pipeline:
+
+   ```sh
+   npm run hydrate:model-data
+   node scripts/release-artifacts.mjs freeze .artifacts/release
+   npm run build:offline
+   node scripts/release-artifacts.mjs prepare .artifacts/release
+   node scripts/release-artifacts.mjs verify .artifacts/release
+   git diff --exit-code HEAD
+   ```
+
+   This preserves the frozen source/model inputs, manifests and exact reviewed npm tarballs.
+   There is no second candidate build or repack in either behavior job.
+   Preparation also runs the targeted Node fixture/workflow tests and Python fake-client/report tests without credentials.
+   The separate harness bundle contains only:
+
+   ```text
+   scripts/artifact-installation.mjs
+   scripts/verify-candidate-artifacts.py
+   scripts/fixtures/artifact-handoff.mjs
+   scripts/daytona-behaviors/installed.py
+   scripts/daytona-behaviors/install.mjs
+   scripts/daytona-behaviors/fixture.mjs
+   scripts/daytona-behaviors/live-guard.mjs
+   scripts/daytona-behaviors/baselines/
+   ```
+
+   Bundle paths start at `scripts/`; no package source tree is needed.
+   The workflow retains a `SHA256SUMS` sidecar and verifies the downloaded bundle before execution.
+
+2. **Deterministic and live, in separate jobs.** Both depend only on prepare and use the GitHub environment `daytona-behaviors`.
+   Each downloads the same retained release and bundle, re-verifies them and creates its own sandbox.
+   Each job has a 35-minute timeout, a 25-minute execution step, a 1,200-second runner deadline and a separate bounded recovery step.
+   A run ID includes the workflow run ID, attempt and mode, so retry evidence cannot be confused with an earlier attempt.
+
+3. **Recovery and evidence, including failure.** Once execution starts, the always-run recovery step invokes `recover --output DIR`.
+   Recovery retrieves available evidence and confirms cleanup; it does not launch or retry behavior execution.
+   The workflow records execution and recovery outcomes separately in `workflow-job.json` and uploads evidence even after a failure.
+   A recovered transcript does not turn a failed run into a pass.
+
+4. **Aggregate, including missing results.** The final job runs even when dependencies fail or skip on an enabled run.
+   It requires successful prepare, deterministic and live jobs; exact commit/mode/run-ID markers; successful execution and recovery; passing orchestration JSON with confirmed deletion; the complete expected installed scenario inventory; matching candidate tarball hashes in both modes; and nonempty orchestration and installed-suite XML reports.
+   Missing artifacts, incomplete results, execution failure or cleanup failure fail the aggregate.
+   Evidence-upload failure also leaves the producing job failed.
+
+GitHub artifacts retain the release, bundle, per-mode evidence and aggregate evidence for **30 days**.
+Download evidence before expiry if a longer-lived qualification record is required.
+Artifacts remain private repository evidence; they are not npm or public release assets.
+
+## Configure access and a snapshot
+
+A repository administrator and a Daytona account owner must perform this setup.
+Do not put API keys in the Dockerfile, bundle, checked files, command-line arguments or repository variables.
+
+Create the GitHub environment `daytona-behaviors` and configure:
+
+| Setting | Location | Purpose |
+| --- | --- | --- |
+| `DAYTONA_API_KEY` | Environment secret | Local orchestration calls to Daytona; never passed as the sandbox's model credential. |
+| `OPENAI_API_KEY` | Environment secret | Approved, restricted live-provider key; injected only into the live execution step. |
+| `DAYTONA_BEHAVIORS_SNAPSHOT` | Environment variable | Prepared toolchain snapshot name passed explicitly as `--snapshot`. |
+| `DAYTONA_BEHAVIORS_QUALIFIED` | Repository variable | Set to `true` only after reviewing a successful qualification. |
+
+The deterministic job and recovery steps do not receive `OPENAI_API_KEY`.
+The prepare and aggregate jobs receive neither credential.
+Provider credentials must be test-only, revocable and covered by a spending limit; do not use personal login state or production agent configuration.
+Review the current model, request/token/time limits and allowed provider destination in the checked live harness before approval.
+Its application-level guard is not a claim of an account-wide network firewall.
+
+Install the pinned orchestration SDK in a local virtual environment:
+
+```sh
+python3 -m venv /tmp/diffex-daytona-venv
+/tmp/diffex-daytona-venv/bin/python -m pip install -r scripts/daytona-behaviors/requirements.txt
+```
+
+`requirements.txt` pins `daytona==0.226.1`.
+Supply `DAYTONA_API_KEY` through an approved local secret mechanism, then prepare the snapshot from the checked `scripts/daytona-behaviors/Dockerfile`:
+
+```sh
+/tmp/diffex-daytona-venv/bin/python scripts/daytona-behaviors/daytona_runner.py prepare-snapshot \
+  --name diffex-behaviors-toolchain-v1 \
+  --output .artifacts/daytona-snapshot
+```
+
+Inspect the preparation evidence and the resulting snapshot's readiness in Daytona before setting `DAYTONA_BEHAVIORS_SNAPSHOT`.
+Record the checked Dockerfile commit, snapshot name/identity, architecture, actual Node/npm/Bun and helper versions, preparation outcome and owner.
+An existing production snapshot must not be assumed suitable.
+If the toolchain changes, prepare and qualify a new snapshot rather than silently changing an approved baseline.
+Snapshot preparation is an explicit operator action, not part of each push.
+The versioned definition pins Node **22.23.2**, npm **11.16.0** and Bun **1.3.11**, and installs Python, tmux, ripgrep and fd.
+Each sandbox uses **2 vCPU, 4 GiB RAM and 8 GiB disk**; the runner checks snapshot and sandbox resources and verifies installed toolchain versions.
+A **45-minute wall-clock TTL** (`ttl_minutes=45`) destroys the sandbox independently of activity or state; stopped-time auto-delete is not a substitute.
+See [Daytona wall-clock TTL](https://www.daytona.io/docs/en/sandboxes/#wall-clock-ttl).
+The live scenario defaults to `openai/gpt-4.1-mini`, with a shared six-request budget across print/TUI processes, 512 output tokens per request and a three-minute smoke deadline after installation.
+Assertions are never automatically rerun.
+
+Restrict the `daytona-behaviors` environment's deployment branch policy to **branch `main` only**; do not allow other branches or tags to access these secrets.
+Qualification dispatches must therefore run from `main` after the reviewed workflow lands there through the normal review process.
+The implementation does not push or merge itself.
+After qualification, protection rules must permit trusted `main` pushes without required manual approval if fully automatic execution is intended.
+Do not broaden the deployment branch policy or remove security controls without administrator review; a workflow waiting for environment approval has not executed remotely.
+
+## Runner interface and local reproduction
+
+Use retained verified artifacts rather than rebuilding a failing candidate.
+Extract the release artifact and behavior-bundle artifact into the same directory layout used by the workflow, then verify:
+
+```sh
+node scripts/release-artifacts.mjs verify .artifacts/release
+sha256sum -c .artifacts/daytona-bundle/SHA256SUMS
+```
+
+Artifact verification requires a checkout of the matching source commit and its unchanged lockfile and distribution policy.
+`DIFFEX_SOURCE_COMMIT` may be set to enforce the expected commit explicitly.
+
+Run one mode with a fresh output directory and unique run ID:
+
+```sh
+/tmp/diffex-daytona-venv/bin/python scripts/daytona-behaviors/daytona_runner.py run \
+  --artifacts .artifacts/release \
+  --bundle .artifacts/daytona-bundle/bundle.tar.gz \
+  --snapshot diffex-behaviors-toolchain-v1 \
+  --output .artifacts/daytona-deterministic \
+  --mode deterministic \
+  --commit "$(git rev-parse HEAD)" \
+  --run-id "manual-$(date +%s)-$$-deterministic"
+```
+
+`--bundle` accepts a bundle directory or a tar.gz archive.
+For a live run use `--mode live`, a separate output directory/run ID and the approved `OPENAI_API_KEY` environment secret.
+The Daytona API key belongs only on the orchestration machine; it must not be supplied as an in-sandbox environment variable.
+
+Expected local output:
+
+- `state.json`: durable identity written before sandbox creation, used for recovery.
+- `orchestration.json` and `orchestration.xml`: orchestration outcomes and cleanup evidence.
+- `evidence/results.json` and `evidence/results.xml`: incremental installed-suite results.
+- Available per-scenario transcripts, events, terminal captures/baseline comparisons and other diagnostic files produced by the harness.
+- `workflow-job.json`: CI-only record of exact source, run identity, execution and recovery outcomes.
+
+Do not delete or hand-edit `state.json` while a sandbox may exist.
+For interrupted execution, retained output or cleanup failure:
+
+```sh
+/tmp/diffex-daytona-venv/bin/python scripts/daytona-behaviors/daytona_runner.py recover \
+  --output .artifacts/daytona-deterministic
+```
+
+Recovery must not create a replacement sandbox or re-execute tests.
+It must preserve failure evidence and positively confirm deletion; an attempted delete is not enough.
+If credentials, runner termination or service failure prevent confirmation, treat cleanup as failed and use the saved sandbox/run identity with the Daytona owner to reconcile resources.
+CI's always-run step is best effort under cancellation or runner loss, not a guarantee that GitHub will execute cleanup.
+Recover manually and confirm no run-owned sandboxes remain before closing the incident.
+
+## Local executable checks and baseline review
+
+To exercise an already installed executable without creating a Daytona sandbox:
+
+```sh
+python3 scripts/daytona-behaviors/installed.py \
+  --executable /path/to/installed/node_modules/.bin/diffex \
+  --output /tmp/diffex-local-behaviors \
+  --mode deterministic \
+  --commit "$(git rev-parse HEAD)"
+```
+
+Use a fresh output directory and the required local Node, tmux and search-helper toolchain.
+This executable-only mode does not establish reviewed-tarball installation integrity, both package-manager paths or remote qualification.
+For an intentional local baseline refresh, append `--update-baselines` to that command.
+Only a local reviewer may regenerate baselines, inspect the raw and normalized terminal captures, review the baseline diff and submit intentional changes through normal review.
+CI never passes `--update-baselines` and must fail rather than automatically accepting a changed layout.
+
+## Qualification and enabling automatic runs
+
+Qualification requires a user with Daytona access and approved provider spending authority.
+The implementation must remain **unqualified** until that user supplies and reviews real evidence.
+
+1. Leave `DAYTONA_BEHAVIORS_QUALIFIED` unset or `false`; configure the main-only environment and prepare the toolchain snapshot.
+   Wait until the reviewed workflow and harness land on `main`; these instructions do not authorize a push or merge.
+2. Dispatch a passing qualification run from `main`:
+
+   ```sh
+   gh workflow run daytona-behaviors.yml --ref main
+   ```
+
+   Record the resolved 40-character commit and workflow run URL; the workflow checks out that event's SHA, not a later branch tip.
+   Require successful deterministic **and** live results against the same retained candidate hashes, the complete expected behavior inventory and reviewed terminal baselines.
+   Confirm the live path actually reached the approved provider rather than a fixture.
+   Verify provider request/token/time limits and that neither evidence nor logs contain credentials or unrelated user state.
+3. Require an **intentional product-assertion failure**, not just a missing credential or transport error.
+   An operator can copy the retained harness into a separate local bundle, deliberately corrupt one expected terminal baseline and run the deterministic remote CLI against the unchanged retained candidate:
+
+   ```sh
+   bad_bundle="$(mktemp -d /tmp/diffex-daytona-bad-baseline.XXXXXX)"
+   tar -xzf .artifacts/daytona-bundle/bundle.tar.gz -C "$bad_bundle"
+   printf 'intentional qualification mismatch\n' > "$bad_bundle/scripts/daytona-behaviors/baselines/startup-80x24.txt"
+   /tmp/diffex-daytona-venv/bin/python scripts/daytona-behaviors/daytona_runner.py run \
+     --artifacts .artifacts/release --bundle "$bad_bundle" \
+     --snapshot diffex-behaviors-toolchain-v1 \
+     --output .artifacts/daytona-intentional-failure --mode deterministic \
+     --commit "$(git rev-parse HEAD)" --run-id "failure-$(date +%s)-$$"
+   ```
+
+   Expect a nonzero exit and a recorded baseline assertion failure, retained JSON/XML and captures, and confirmed sandbox deletion.
+   Run `recover --output .artifacts/daytona-intentional-failure` if needed; it must not relaunch or turn the failed execution into a pass.
+   Record the deliberately altered bundle identity separately; never replace the original retained bundle, regenerate its approved checksum or commit the bad baseline.
+   Retain the local CLI output directory with the qualification record; this rehearsal needs no new workflow inputs.
+4. Require a **cancellation rehearsal**: dispatch another run from `main`, wait until a sandbox and behavior execution exist, then cancel that workflow run.
+   Retain the run URL, sandbox/run identities and whatever incremental artifacts were uploaded.
+   Recover available saved output without relaunching; if cancellation prevented artifact upload, use the recorded run labels and the Daytona owner to reconcile resources.
+   Confirm deletion of every sandbox created by that run; missing evidence or an attempted delete alone does not satisfy qualification.
+5. Require **two overlapping workflow runs**: dispatch twice from `main` without waiting for the first to finish, and verify that both actually execute concurrently rather than queue behind environment approvals.
+   For each run separately, verify the resolved source commit, unique run/attempt/mode identities, release and bundle artifacts, deterministic/live results, aggregate evidence and confirmed deletion of every owned sandbox.
+   Confirm that neither run cancels the other, overwrites the other's artifacts, mixes evidence or deletes the other's active sandbox.
+6. Also exercise creation/upload/execution/download failures, missing/incomplete result evidence and cleanup failure through operator-controlled remote rehearsals.
+   Retain proof that failures stay failed, recovery does not relaunch and deletion is positively confirmed.
+   Local mock tests are supplementary, not substitutes for these remote rehearsals.
+7. Review all passing, intentional-failure, cancellation and overlapping-run evidence, snapshot/toolchain identities, sandbox IDs and cleanup confirmations.
+   Keep a qualification record with owner, date, commits, workflow run URLs, snapshot, artifact/bundle hashes, provider/model, bounded cost and failure-path evidence.
+   Ensure no orphaned run-owned sandboxes remain.
+8. Only after those checks pass, an administrator enables subsequent pushes:
+
+   ```sh
+   gh variable set DAYTONA_BEHAVIORS_QUALIFIED --body true
+   ```
+
+   Observe the next `main` push and require both modes plus aggregate to execute automatically.
+   Setting the variable does not retroactively execute skipped pushes.
+
+To suspend automatic spending without removing dispatch or evidence:
+
+```sh
+gh variable set DAYTONA_BEHAVIORS_QUALIFIED --body false
+```
+
+Requalify after material snapshot, SDK, credential policy or harness changes.
+Neither a static workflow test nor setting the variable proves remote qualification.
diff --git a/scripts/daytona-behaviors-workflow.test.mjs b/scripts/daytona-behaviors-workflow.test.mjs
new file mode 100644
index 000000000..335696deb
--- /dev/null
+++ b/scripts/daytona-behaviors-workflow.test.mjs
@@ -0,0 +1,179 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { parse } from "yaml";
+
+const workflow = parse(readFileSync(new URL("../.github/workflows/daytona-behaviors.yml", import.meta.url), "utf8"));
+const gate = "github.event_name == 'workflow_dispatch' || vars.DAYTONA_BEHAVIORS_QUALIFIED == 'true'";
+
+test("Daytona triggers every main push, allows qualification dispatch and never cancels overlapping runs", () => {
+	assert.deepEqual(workflow.on.push, { branches: ["main"] });
+	assert.ok(Object.hasOwn(workflow.on, "workflow_dispatch"));
+	assert.equal(workflow.concurrency, undefined);
+	assert.equal(workflow.jobs.prepare.if, "${{ " + gate + " }}");
+	assert.match(workflow.jobs["daytona-behaviors"].if, /always\(\)/);
+	assert.ok(workflow.jobs["daytona-behaviors"].if.includes(gate));
+	assert.equal(workflow.env.DIFFEX_SOURCE_COMMIT, "${{ github.sha }}");
+	for (const job of Object.values(workflow.jobs)) {
+		assert.equal(job.concurrency, undefined);
+		for (const step of job.steps) {
+			if (step.uses?.startsWith("actions/checkout@")) {
+				assert.equal(step.with.ref, "${{ github.sha }}");
+				assert.equal(step.with["persist-credentials"], false);
+			}
+			if (step.uses) assert.match(step.uses, /@[a-f0-9]{40}$/);
+			if (step.uses?.startsWith("actions/upload-artifact@")) {
+				assert.equal(step.with["retention-days"], 30);
+				assert.equal(step.with["if-no-files-found"], "error");
+			}
+			if (step.run) {
+				const parsed = spawnSync("bash", ["-n"], { input: step.run, encoding: "utf8" });
+				assert.equal(parsed.status, 0, `${step.name}: ${parsed.stderr}`);
+			}
+		}
+	}
+});
+
+test("one 35-minute preparation freezes, builds offline, prepares and verifies the reused artifact bytes", () => {
+	const prepare = workflow.jobs.prepare;
+	assert.equal(prepare["timeout-minutes"], 35);
+	const script = prepare.steps.map((step) => step.run ?? "").join("\n");
+	const commands = [
+		"npm run hydrate:model-data",
+		"node scripts/release-artifacts.mjs freeze .artifacts/release",
+		"npm run build:offline",
+		"node scripts/release-artifacts.mjs prepare .artifacts/release",
+		"node scripts/release-artifacts.mjs verify .artifacts/release",
+	];
+	let previous = -1;
+	for (const command of commands) {
+		const position = script.indexOf(command);
+		assert.ok(position > previous, `Missing or reordered command: ${command}`);
+		previous = position;
+	}
+	assert.ok(script.includes("npm ci --ignore-scripts"));
+	assert.ok(script.includes("sha256sum .artifacts/daytona-bundle/bundle.tar.gz"));
+	assert.match(script, /-m unittest discover -s scripts\/daytona-behaviors/);
+	assert.match(script, /node --test .*daytona-behaviors\/fixture\.test\.mjs/);
+	for (const step of prepare.steps) {
+		assert.equal(step.env?.DAYTONA_API_KEY, undefined);
+		assert.equal(step.env?.OPENAI_API_KEY, undefined);
+	}
+	for (const mode of ["deterministic", "live"]) {
+		const job = workflow.jobs[mode];
+		assert.equal(job.needs, "prepare");
+		assert.equal(job.environment, "daytona-behaviors");
+		const commands = job.steps.map((step) => step.run ?? "").join("\n");
+		assert.doesNotMatch(commands, /npm run (build|hydrate)|release-artifacts\.mjs (prepare|freeze)/);
+		assert.match(commands, /release-artifacts\.mjs verify/);
+		assert.match(commands, /sha256sum -c/);
+		assert.ok(job.steps.some((step) => step.with?.name === "daytona-release-${{ github.sha }}-${{ github.run_attempt }}"));
+		assert.ok(job.env.DAYTONA_BEHAVIOR_RUN_ID.endsWith(`-${mode}`));
+		const run = job.steps.find((step) => step.id === "run");
+		const recover = job.steps.find((step) => step.id === "recover");
+		assert.ok(run.run.includes(`--mode ${mode}`));
+		assert.ok(run.run.includes('--snapshot "$DAYTONA_SNAPSHOT"'));
+		assert.ok(recover.if.includes("always()"));
+		assert.ok(recover.if.includes("steps.run.outcome != 'skipped'"));
+		assert.match(recover.run, /daytona_runner\.py recover/);
+		assert.doesNotMatch(recover.run, /--mode|--artifacts/);
+		assert.equal(recover.env.OPENAI_API_KEY, undefined);
+		assert.equal(run.env.OPENAI_API_KEY !== undefined, mode === "live");
+		assert.equal(job.steps.at(-1).if, "always()");
+	}
+	assert.deepEqual(workflow.jobs["daytona-behaviors"].needs, ["prepare", "deterministic", "live"]);
+});
+
+for (const scenario of ["pass", "missing-artifact", "missing-result", "invalid-result", "missing-xml", "failed-job", "cleanup-failed", "wrong-commit", "wrong-run", "orchestration-failed", "cleanup-unconfirmed", "partial-scenarios", "wrong-result-commit", "different-tarballs"]) {
+	test(`aggregate fails closed: ${scenario}`, () => {
+		const root = mkdtempSync(join(tmpdir(), "daytona workflow "));
+		try {
+			const commit = "a".repeat(40);
+			const fixtures = join(root, "fixtures");
+			for (const mode of ["deterministic", "live"]) {
+				const directory = join(fixtures, mode);
+				mkdirSync(join(directory, "evidence"), { recursive: true });
+				writeFileSync(join(directory, "workflow-job.json"), JSON.stringify({
+					commit, mode, runId: `123-2-${mode}`, execution: "success", recovery: "success",
+				}));
+				writeFileSync(join(directory, "orchestration.json"), JSON.stringify({
+					commit, mode, run_id: `123-2-${mode}`, outcome: "passed", execution: "passed",
+					exit_code: 0, installed_outcome: "passed", reports_complete: true, cleanup: "confirmed",
+				}));
+				const identities = mode === "live"
+					? ["artifact-integrity", "npm-package-integrity", "npm-live-openai"]
+					: ["artifact-integrity", "npm-package-integrity", "bun-package-integrity", ...["npm", "bun"].flatMap((manager) =>
+						["installation", "print", "builtin-auth-transport", "terminal-tools-cancel-resume", "artifact-terminal"].map((name) => `${manager}-${name}`))];
+				writeFileSync(join(directory, "evidence/results.json"), JSON.stringify({
+					schemaVersion: 1, commit, mode, outcome: "passed", artifactHashes: { "diffex.tgz": "c".repeat(64) },
+					scenarios: identities.map((id) => ({ id, commit, outcome: "passed" })),
+				}));
+				for (const file of ["orchestration.xml", "evidence/results.xml"]) writeFileSync(join(directory, file), "<testsuites/>");
+			}
+			const live = join(fixtures, "live");
+			if (scenario === "missing-artifact") rmSync(live, { recursive: true });
+			if (scenario === "missing-result") rmSync(join(live, "evidence/results.json"));
+			if (scenario === "invalid-result") writeFileSync(join(live, "evidence/results.json"), "[]");
+			if (scenario === "missing-xml") rmSync(join(live, "orchestration.xml"));
+			if (["orchestration-failed", "cleanup-unconfirmed"].includes(scenario)) {
+				const report = JSON.parse(readFileSync(join(live, "orchestration.json"), "utf8"));
+				if (scenario === "orchestration-failed") report.outcome = "failed";
+				if (scenario === "cleanup-unconfirmed") report.cleanup = "unconfirmed";
+				writeFileSync(join(live, "orchestration.json"), JSON.stringify(report));
+			}
+			if (["partial-scenarios", "wrong-result-commit", "different-tarballs"].includes(scenario)) {
+				const report = JSON.parse(readFileSync(join(live, "evidence/results.json"), "utf8"));
+				if (scenario === "partial-scenarios") report.scenarios.pop();
+				if (scenario === "wrong-result-commit") report.commit = "b".repeat(40);
+				if (scenario === "different-tarballs") report.artifactHashes["diffex.tgz"] = "d".repeat(64);
+				writeFileSync(join(live, "evidence/results.json"), JSON.stringify(report));
+			}
+			if (["cleanup-failed", "wrong-commit", "wrong-run"].includes(scenario)) {
+				const marker = JSON.parse(readFileSync(join(live, "workflow-job.json"), "utf8"));
+				if (scenario === "cleanup-failed") marker.recovery = "failure";
+				if (scenario === "wrong-commit") marker.commit = "b".repeat(40);
+				if (scenario === "wrong-run") marker.runId = "123-1-live";
+				writeFileSync(join(live, "workflow-job.json"), JSON.stringify(marker));
+			}
+			mkdirSync(join(root, "bin"));
+			writeFileSync(join(root, "bin/gh"), `#!/usr/bin/env node
+const { cpSync, existsSync } = require("node:fs");
+const { join } = require("node:path");
+const args = process.argv.slice(2);
+const name = args[args.indexOf("--name") + 1];
+const mode = name.includes("-deterministic-") ? "deterministic" : "live";
+const source = join(process.env.DAYTONA_FIXTURES, mode);
+if (!existsSync(source)) process.exit(1);
+cpSync(source, args[args.indexOf("--dir") + 1], { recursive: true });
+`, { mode: 0o755 });
+			const aggregate = workflow.jobs["daytona-behaviors"].steps[0].run;
+			const result = spawnSync("bash", ["-e", "-o", "pipefail", "-c", aggregate], {
+				cwd: root,
+				encoding: "utf8",
+				env: {
+					...process.env,
+					PATH: `${join(root, "bin")}:${process.env.PATH}`,
+					DAYTONA_FIXTURES: fixtures,
+					DIFFEX_SOURCE_COMMIT: commit,
+					GITHUB_RUN_ID: "123",
+					GITHUB_RUN_ATTEMPT: "2",
+					GITHUB_REPOSITORY: "diffexai/diffex",
+					GITHUB_STEP_SUMMARY: join(root, "summary.md"),
+					PREPARE_RESULT: "success",
+					DETERMINISTIC_RESULT: "success",
+					LIVE_RESULT: scenario === "failed-job" ? "failure" : "success",
+				},
+			});
+			assert.equal(result.status, scenario === "pass" ? 0 : 1, `${result.stdout}\n${result.stderr}`);
+			const summary = JSON.parse(readFileSync(join(root, ".artifacts/daytona-summary/summary.json"), "utf8"));
+			assert.equal(summary.passed, scenario === "pass");
+			// Downloaded evidence remains in the aggregate artifact, including failed cases.
+			if (scenario !== "missing-artifact") assert.ok(readFileSync(join(root, ".artifacts/daytona-summary/live/workflow-job.json")));
+		} finally {
+			rmSync(root, { recursive: true, force: true });
+		}
+	});
+}

From f490b28503ed3d54bf5f0aa5e29cb42f8cb510f1 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:45:08 -0400
Subject: [PATCH 06/12] fix(coding-agent): resolve real Daytona qualification
 incompatibilities

---
 scripts/daytona-behaviors/daytona_runner.py   | 126 ++++++++++++++---
 scripts/daytona-behaviors/installed.py        |  16 ++-
 .../daytona-behaviors/test_daytona_runner.py  | 128 ++++++++++++++++--
 scripts/daytona-behaviors/test_installed.py   |  21 +++
 4 files changed, 256 insertions(+), 35 deletions(-)

diff --git a/scripts/daytona-behaviors/daytona_runner.py b/scripts/daytona-behaviors/daytona_runner.py
index 95b5eb6f1..38555cf6b 100644
--- a/scripts/daytona-behaviors/daytona_runner.py
+++ b/scripts/daytona-behaviors/daytona_runner.py
@@ -173,6 +173,7 @@ class State:
     errors: list[str] = field(default_factory=list)
     downloaded: dict[str, str] = field(default_factory=dict)
     inputs: dict[str, str] = field(default_factory=dict)
+    evidence_manifest: dict[str, str] | None = None
 
     def save(self, output: Path) -> None:
         atomic_json(output / "state.json", asdict(self))
@@ -220,7 +221,7 @@ def lookup(self) -> Sandbox:
     def create(self) -> Sandbox:
         snapshot = self.client.snapshot.get(self.state.snapshot)
         self.check_resources(snapshot)
-        if str(snapshot.state) != "active":
+        if snapshot.state != "active":
             raise OrchestrationError("snapshot must already be active")
         self.state.create_attempted = True
         self.state.save(self.output)  # durable name + labels BEFORE the only create request
@@ -294,17 +295,28 @@ def launch(self, sandbox: Sandbox, live_key: str | None) -> None:
                      "nohup python3 /tmp/diffex-launch.py </dev/null "
                      f">{REMOTE_EVIDENCE}/launcher.log 2>&1 &", env=env)
 
-    def collect(self, sandbox: Sandbox) -> None:
+    def collect(self, sandbox: Sandbox, *, final: bool = False) -> None:
+        # Only a complete, quiescent final collection can qualify retained evidence.
+        self.state.evidence_manifest = None
         manifest = json.loads(self.execute(sandbox, "python3 -c " + shlex.quote(MANIFEST_SCRIPT)))
         if not isinstance(manifest, list):
             raise OrchestrationError("invalid evidence manifest")
         total = 0
         evidence = self.output / "evidence"
         evidence.mkdir(exist_ok=True)
+        manifest_hashes: dict[str, str] = {}
         for entry in manifest:
-            name = entry["path"]
+            if not isinstance(entry, dict):
+                raise OrchestrationError("invalid evidence manifest entry")
+            name, size, digest = entry.get("path"), entry.get("size"), entry.get("sha256")
+            if (not isinstance(name, str) or type(size) is not int
+                    or not isinstance(digest, str) or not re.fullmatch(r"[0-9a-f]{64}", digest)):
+                raise OrchestrationError("invalid evidence manifest entry")
             relative = safe_relative(name)
-            size, digest = entry["size"], entry["sha256"]
+            canonical = relative.as_posix()
+            if canonical in manifest_hashes:
+                raise OrchestrationError("duplicate evidence manifest path")
+            manifest_hashes[canonical] = digest
             total += size
             if size < 0 or size > MAX_FILE_BYTES or total > MAX_EVIDENCE_BYTES:
                 raise OrchestrationError("evidence exceeds download limits")
@@ -319,19 +331,27 @@ def collect(self, sandbox: Sandbox) -> None:
             received = 0
             try:
                 with temporary.open("wb") as stream:
-                    for chunk in sandbox.fs.download_file_stream(f"{REMOTE_EVIDENCE}/{name}", timeout=30):
-                        received += len(chunk)
-                        if received > MAX_FILE_BYTES:
-                            raise OrchestrationError("evidence grew beyond download limit")
-                        stream.write(chunk)
+                    # SDK 0.226.1 rejects an otherwise valid empty-file download.
+                    # Materialize it locally; the same size/SHA256 checks still apply.
+                    if size:
+                        for chunk in sandbox.fs.download_file_stream(f"{REMOTE_EVIDENCE}/{name}", timeout=30):
+                            received += len(chunk)
+                            if received > MAX_FILE_BYTES:
+                                raise OrchestrationError("evidence grew beyond download limit")
+                            stream.write(chunk)
                 if received != size or sha256(temporary) != digest:
-                    # A log may change while downloading. Keep the previous complete copy.
+                    # Polling tolerates evolving logs, but final evidence must be complete.
+                    if final:
+                        raise OrchestrationError("final evidence checksum or size mismatch")
                     continue
                 temporary.replace(target)
                 self.state.downloaded[name] = digest
                 self.state.save(self.output)
             finally:
                 temporary.unlink(missing_ok=True)
+        if final:
+            self.state.evidence_manifest = manifest_hashes
+            self.state.save(self.output)
 
     def poll(self, sandbox: Sandbox, deadline: float) -> None:
         while True:
@@ -399,18 +419,76 @@ def cleanup(self, attempts: int = 6) -> None:
             if attempt + 1 < attempts:
                 time.sleep(self.poll_seconds)
 
+    def validate_reports(self, installed: dict[str, object]) -> None:
+        evidence = self.output / "evidence"
+        manifest = self.state.evidence_manifest
+        if manifest is None or not {"results.json", "results.xml", ".orchestration-exit.json"} <= manifest.keys():
+            raise OrchestrationError("missing complete final evidence manifest")
+        for name, digest in manifest.items():
+            target = evidence.joinpath(*safe_relative(name).parts)
+            if (any(path.is_symlink() for path in [target, *target.parents])
+                    or not target.is_file() or sha256(target) != digest):
+                raise OrchestrationError("retained evidence does not match final manifest")
+        hashes, scenarios = installed.get("artifactHashes"), installed.get("scenarios")
+        if (installed.get("schemaVersion") != 1 or installed.get("commit") != self.state.commit
+                or installed.get("mode") != self.state.mode
+                or installed.get("outcome") not in ("passed", "failed")
+                or not isinstance(hashes, dict) or not hashes
+                or not all(isinstance(value, str) and re.fullmatch(r"[0-9a-f]{64}", value)
+                           for value in hashes.values())
+                or not isinstance(scenarios, list) or not scenarios):
+            raise OrchestrationError("invalid installed report identity or inventory")
+        scenario_outcomes: dict[str, str] = {}
+        for scenario in scenarios:
+            if not isinstance(scenario, dict):
+                raise OrchestrationError("invalid installed scenario")
+            identity, outcome, references = scenario.get("id"), scenario.get("outcome"), scenario.get("evidence")
+            if (not isinstance(identity, str) or not identity or identity in scenario_outcomes
+                    or outcome not in ("passed", "failed") or scenario.get("commit") != self.state.commit
+                    or scenario.get("artifactHashes") != hashes
+                    or not isinstance(references, list) or not references):
+                raise OrchestrationError("invalid installed scenario identity or evidence references")
+            scenario_outcomes[identity] = outcome
+            for reference in references:
+                if not isinstance(reference, str):
+                    raise OrchestrationError("invalid installed evidence reference")
+                relative = safe_relative(reference)
+                prefix = relative.as_posix()
+                target = evidence.joinpath(*relative.parts)
+                if (any(path.is_symlink() for path in [target, *target.parents])
+                        or not target.exists() or not any(
+                            name == prefix or (target.is_dir() and name.startswith(prefix + "/"))
+                            for name in manifest)):
+                    raise OrchestrationError("missing installed scenario evidence")
+        expected_outcome = "passed" if all(value == "passed" for value in scenario_outcomes.values()) else "failed"
+        if installed["outcome"] != expected_outcome:
+            raise OrchestrationError("installed report outcome disagrees with scenarios")
+        suite = ET.parse(evidence / "results.xml").getroot()
+        cases = suite.findall("testcase")
+        failures = sum(value != "passed" for value in scenario_outcomes.values())
+        if (suite.tag != "testsuite" or int(suite.get("tests", "-1")) != len(scenario_outcomes)
+                or int(suite.get("failures", "-1")) != failures or int(suite.get("errors", "0")) != 0
+                or int(suite.get("skipped", "0")) != 0 or len(cases) != len(scenario_outcomes)
+                or {case.get("name") for case in cases} != scenario_outcomes.keys()):
+            raise OrchestrationError("installed JUnit inventory disagrees with JSON report")
+        for case in cases:
+            expected_failures = int(scenario_outcomes[case.get("name")] != "passed")
+            if (len(case.findall("failure")) != expected_failures or case.find("error") is not None
+                    or case.find("skipped") is not None):
+                raise OrchestrationError("installed JUnit outcome disagrees with JSON report")
+
     def report(self) -> int:
-        results_path = self.output / "evidence" / "results.json"
         installed: dict[str, object] = {}
+        reports_complete = False
         try:
-            if results_path.exists():
-                installed = json.loads(results_path.read_text())
-        except (ValueError, OSError):
-            self.state.errors.append("report: invalid installed results.json")
-        reports_complete = (
-            results_path.is_file() and (self.output / "evidence" / "results.xml").is_file()
-            and installed.get("outcome") in ("passed", "failed")
-        )
+            value = json.loads((self.output / "evidence" / "results.json").read_text())
+            if not isinstance(value, dict):
+                raise OrchestrationError("invalid installed results.json")
+            installed = value
+            self.validate_reports(installed)
+            reports_complete = True
+        except (OrchestrationError, ValueError, OSError, TypeError, KeyError, ET.ParseError) as error:
+            self.state.error("report", error)
         success = (self.state.execution == "passed" and self.state.exit_code == 0
                    and installed.get("outcome") == "passed" and reports_complete
                    and self.state.cleanup in ("confirmed", "not-needed"))
@@ -421,7 +499,8 @@ def report(self) -> int:
                   "exit_code": self.state.exit_code, "installed_outcome": installed.get("outcome"),
                   "reports_complete": reports_complete, "cleanup": self.state.cleanup,
                   "duration_seconds": max(0, time.time() - self.state.created_at),
-                  "artifact_hashes": self.state.downloaded, "errors": self.state.errors}
+                  "artifact_hashes": self.state.downloaded, "evidence_manifest": self.state.evidence_manifest,
+                  "errors": self.state.errors}
         atomic_json(self.output / "orchestration.json", report)
         suite = ET.Element("testsuite", name="daytona-orchestration", tests="3", failures=str(sum((
             self.state.execution != "passed", not reports_complete or installed.get("outcome") != "passed",
@@ -450,7 +529,7 @@ def run(self, artifacts: Path, bundle: Path, live_key: str | None) -> int:
         finally:
             if self.state.launch_attempted:
                 try:
-                    self.collect(self.lookup())
+                    self.collect(self.lookup(), final=True)
                 except Exception as error:
                     self.state.error("final-evidence", error)
             try:
@@ -472,6 +551,11 @@ def recover(self, wait_seconds: float) -> int:
         except Exception as error:
             self.state.error("recover-evidence", error)
         finally:
+            if self.state.launch_attempted and self.state.cleanup != "confirmed":
+                try:
+                    self.collect(self.lookup(), final=True)
+                except Exception as error:
+                    self.state.error("recover-final-evidence", error)
             try:
                 self.cleanup()
             except Exception as error:
diff --git a/scripts/daytona-behaviors/installed.py b/scripts/daytona-behaviors/installed.py
index 4e403fd2b..c5607c1d9 100644
--- a/scripts/daytona-behaviors/installed.py
+++ b/scripts/daytona-behaviors/installed.py
@@ -103,10 +103,14 @@ def exit(self):
         end = min(self.deadline, time.monotonic() + 10)
         while time.monotonic() < end:
             self.capture()
-            dead = self.command("display-message", "-p", "#{pane_dead}:#{pane_dead_status}").strip()
+            dead = self.command("display-message", "-p", "#{pane_dead}:#{pane_dead_status}:#{pane_dead_signal}").strip()
             if dead.startswith("1:"):
-                assert dead == "1:0", f"Unclean terminal exit: {dead}"
-                return
+                # Older tmux may observe EOF before waitpid supplies status.
+                # A dead pane alone is not a completed or successful exit.
+                _, status, signal = dead.split(":", 2)
+                if status or signal:
+                    assert status == "0" and not signal, f"Unclean terminal exit: {dead}"
+                    return
             time.sleep(.1)
         raise AssertionError("Terminal failed to exit")
 
@@ -327,17 +331,17 @@ def action(env, root, fixture):
                 args = self.args_for(fixture, self.args.model)
                 marker = "behavior-live-" + uuid.uuid4().hex
                 project = root / "project"
-                (project / "input.txt").write_text(marker + "\n")
+                (project / "input.txt").write_text(marker)
                 output = self.process(executable, args + ["--no-session", "-p", "Reply with exactly: " + marker], env, project, evidence)
                 assert marker in output, "Live print marker absent"
                 terminal = Terminal(executable, args, env, project, evidence, self.deadline)
                 try:
                     terminal.wait("Ask Diffex")
                     event_mark = len(read_events(root / "events.jsonl"))
-                    terminal.send("Use read to read input.txt, then use write to copy its exact contents into output.txt. Do not use bash. Then reply with exactly: completed " + marker)
+                    terminal.send("input.txt contains a marker with no trailing newline. Use read to read input.txt, then use write to copy its exact contents into output.txt. Do not use bash. Then reply with exactly: completed " + marker)
                     terminal.wait("completed " + marker, seconds=120)
                     terminal.settled(root / "events.jsonl", 1, seconds=20)
-                    assert (project / "output.txt").read_text() == marker + "\n"
+                    assert (project / "output.txt").read_text() == marker, "Live output.txt did not contain the exact fixture marker bytes"
                     events = read_events(root / "events.jsonl")
                     assert {"read", "write"} <= {e.get("toolName") for e in events if e["type"] == "tool_result" and not e.get("isError")}
                     assert sum(e["type"] == "request" for e in events) <= 6
diff --git a/scripts/daytona-behaviors/test_daytona_runner.py b/scripts/daytona-behaviors/test_daytona_runner.py
index a2715eb97..ff02a1c4f 100644
--- a/scripts/daytona-behaviors/test_daytona_runner.py
+++ b/scripts/daytona-behaviors/test_daytona_runner.py
@@ -16,7 +16,8 @@
 from unittest.mock import patch
 import xml.etree.ElementTree as ET
 
-from daytona import DaytonaNotFoundError, ExecuteResponse
+from daytona import DaytonaError, DaytonaNotFoundError, ExecuteResponse
+from daytona_api_client import SnapshotState
 
 from daytona_runner import (
     EXTRACT_SCRIPT, INSTALLED, MANIFEST_SCRIPT, REMOTE_EVIDENCE, RESOURCES,
@@ -31,6 +32,7 @@ def __init__(self):
         self.uploads: list[tuple[str, bytes]] = []
         self.downloads: list[str] = []
         self.corrupt = False
+        self.corrupt_paths: set[str] = set()
 
     def upload_file(self, source: str | bytes, destination: str, timeout: int = 0):
         value = Path(source).read_bytes() if isinstance(source, str) else source
@@ -39,14 +41,17 @@ def upload_file(self, source: str | bytes, destination: str, timeout: int = 0):
 
     def download_file_stream(self, source: str, timeout: int = 0):
         self.downloads.append(source)
-        content = self.files[source] + (b"changed" if self.corrupt else b"")
+        if not self.files[source]:
+            raise DaytonaError("No file data received")
+        content = self.files[source] + (b"changed" if self.corrupt or source in self.corrupt_paths else b"")
         yield content[:3]
         yield content[3:]
 
 
 class FakeProcess:
-    def __init__(self, fs: FakeFS):
+    def __init__(self, fs: FakeFS, output: Path):
         self.fs = fs
+        self.output = output
         self.calls: list[tuple[str, dict[str, str] | None]] = []
         self.product_outcome = "passed"
         self.exit_code = 0
@@ -69,10 +74,20 @@ def exec(self, command: str, env: dict[str, str] | None = None, timeout: int = 0
                 os.kill(os.getpid(), signal.SIGTERM)
             if self.raise_on_launch:
                 raise self.raise_on_launch
+            state = json.loads((self.output / "state.json").read_text())
+            hashes = {"candidate.tgz": "a" * 64}
+            scenario = {"id": "terminal", "commit": state["commit"], "artifactHashes": hashes,
+                        "outcome": self.product_outcome, "category": "product", "evidence": ["terminal"]}
+            suite = ET.Element("testsuite", name="installed", tests="1",
+                               failures="0" if self.product_outcome == "passed" else "1")
+            case = ET.SubElement(suite, "testcase", name="terminal", classname="product")
+            if self.product_outcome != "passed":
+                ET.SubElement(case, "failure", message="intentional failure")
             self.fs.files.update({
-                REMOTE_EVIDENCE + "/results.json": json.dumps({"outcome": self.product_outcome,
-                    "scenarios": [{"outcome": self.product_outcome, "category": "product"}]}).encode(),
-                REMOTE_EVIDENCE + "/results.xml": b'<testsuite name="installed"/>',
+                REMOTE_EVIDENCE + "/results.json": json.dumps({"schemaVersion": 1,
+                    "commit": state["commit"], "mode": state["mode"], "artifactHashes": hashes,
+                    "outcome": self.product_outcome, "scenarios": [scenario]}).encode(),
+                REMOTE_EVIDENCE + "/results.xml": ET.tostring(suite),
                 REMOTE_EVIDENCE + "/.orchestration-exit.json": json.dumps({"exit_code": self.exit_code}).encode(),
                 REMOTE_EVIDENCE + "/terminal/evidence.txt": b"terminal evidence\n",
             })
@@ -81,7 +96,7 @@ def exec(self, command: str, env: dict[str, str] | None = None, timeout: int = 0
 
 class FakeSnapshot:
     def __init__(self):
-        self.value = SimpleNamespace(name="toolchain", id="snapshot-id", state="active", cpu=2, mem=4, disk=8)
+        self.value = SimpleNamespace(name="toolchain", id="snapshot-id", state=SnapshotState.ACTIVE, cpu=2, mem=4, disk=8)
         self.params = None
         self.create_error: Exception | None = None
 
@@ -100,7 +115,7 @@ def __init__(self, output: Path):
         self.output = output
         self.snapshot = FakeSnapshot()
         self.fs = FakeFS()
-        self.process = FakeProcess(self.fs)
+        self.process = FakeProcess(self.fs, output)
         self.sandbox = SimpleNamespace(id="sandbox-id", name="", labels={},
                                        cpu=2, memory=4, disk=8, fs=self.fs, process=self.process)
         self.exists = False
@@ -284,6 +299,12 @@ def test_ownership_mismatch_refuses_deletion(self):
         self.assertEqual(self.client.deletes, 0)
         self.assertEqual(self.state.cleanup, "unconfirmed")
 
+    def test_inactive_sdk_snapshot_state_never_creates(self):
+        self.client.snapshot.value.state = SnapshotState.BUILDING
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.client.creates, 0)
+        self.assertEqual(self.state.cleanup, "not-needed")
+
     def test_wrong_snapshot_resources_never_creates(self):
         self.client.snapshot.value.mem = 8
         self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
@@ -319,6 +340,46 @@ def test_changed_during_download_keeps_last_good_copy(self):
         self.runner.collect(self.client.sandbox)
         self.assertEqual((self.output / "evidence/progress.json").read_bytes(), b"two")
 
+    def test_empty_evidence_is_materialized_without_sdk_download(self):
+        remote = REMOTE_EVIDENCE + "/installed.log"
+        self.client.fs.files[remote] = b""
+        with self.assertRaisesRegex(DaytonaError, "No file data received"):
+            list(self.client.fs.download_file_stream(remote))
+        self.client.fs.downloads.clear()
+        self.runner.collect(self.client.sandbox, final=True)
+        self.assertEqual((self.output / "evidence/installed.log").read_bytes(), b"")
+        self.assertEqual(self.state.evidence_manifest, {"installed.log": hashlib.sha256(b"").hexdigest()})
+        self.assertEqual(self.client.fs.downloads, [])
+
+    def test_empty_evidence_still_requires_correct_digest(self):
+        self.client.process.manifest_override = [{"path": "empty.log", "size": 0, "sha256": "0" * 64}]
+        with self.assertRaisesRegex(OrchestrationError, "checksum or size mismatch"):
+            self.runner.collect(self.client.sandbox, final=True)
+        self.assertIsNone(self.state.evidence_manifest)
+        self.assertFalse((self.output / "evidence/empty.log").exists())
+        self.assertFalse(self.client.fs.downloads)
+
+    def test_corrupt_nonreport_download_prevents_success_and_still_cleans(self):
+        self.client.fs.corrupt_paths.add(REMOTE_EVIDENCE + "/terminal/evidence.txt")
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 1)
+        self.assertEqual(self.state.execution, "passed")
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertIsNone(self.state.evidence_manifest)
+        report = json.loads((self.output / "orchestration.json").read_text())
+        self.assertFalse(report["reports_complete"])
+        self.assertTrue(any("final evidence checksum or size mismatch" in error for error in self.state.errors))
+
+    def test_final_collection_rejects_stale_nonreport_copy(self):
+        remote = REMOTE_EVIDENCE + "/progress.log"
+        self.client.fs.files[remote] = b"old"
+        self.runner.collect(self.client.sandbox)
+        self.client.fs.files[remote] = b"new"
+        self.client.fs.corrupt_paths.add(remote)
+        with self.assertRaisesRegex(OrchestrationError, "checksum or size mismatch"):
+            self.runner.collect(self.client.sandbox, final=True)
+        self.assertEqual((self.output / "evidence/progress.log").read_bytes(), b"old")
+        self.assertIsNone(self.state.evidence_manifest)
+
     def test_unsafe_manifest_path_is_rejected(self):
         self.client.process.manifest_override = [{"path": "../../escape", "size": 0, "sha256": "0" * 64}]
         with self.assertRaisesRegex(OrchestrationError, "unsafe"):
@@ -366,6 +427,57 @@ def test_missing_installed_reports_never_passes(self):
         (self.output / "evidence/results.xml").unlink()
         self.assertEqual(self.runner.report(), 1)
 
+    def test_invalid_remote_junit_never_passes_recovery(self):
+        sandbox = self.runner.create()
+        self.runner.launch(sandbox, None)
+        self.client.fs.files[REMOTE_EVIDENCE + "/results.xml"] = b"not XML"
+        self.assertEqual(self.runner.recover(0), 1)
+        self.assertEqual(self.state.cleanup, "confirmed")
+        self.assertFalse(json.loads((self.output / "orchestration.json").read_text())["reports_complete"])
+        self.assertTrue(any("ParseError" in error for error in self.state.errors))
+
+    def test_junit_structure_must_match_json_inventory_and_outcomes(self):
+        sandbox = self.runner.create()
+        self.runner.launch(sandbox, None)
+        self.runner.poll(sandbox, time.time() + 1)
+        for xml in (
+            b'<not-testsuite tests="1" failures="0"><testcase name="terminal"/></not-testsuite>',
+            b'<testsuite tests="2" failures="0"><testcase name="terminal"/></testsuite>',
+            b'<testsuite tests="1" failures="0"><testcase name="other"/></testsuite>',
+            b'<testsuite tests="1" failures="0"><testcase name="terminal"><failure/></testcase></testsuite>',
+            b'<testsuite tests="1" failures="0"><testcase name="terminal"><skipped/></testcase></testsuite>',
+        ):
+            with self.subTest(xml=xml):
+                self.client.fs.files[REMOTE_EVIDENCE + "/results.xml"] = xml
+                self.runner.collect(sandbox, final=True)
+                self.assertEqual(self.runner.report(), 1)
+                self.assertFalse(json.loads((self.output / "orchestration.json").read_text())["reports_complete"])
+
+    def test_retained_nonreport_tampering_never_passes(self):
+        self.assertEqual(self.runner.run(self.artifacts, self.bundle, None), 0)
+        (self.output / "evidence/terminal/evidence.txt").write_text("tampered")
+        self.assertEqual(self.runner.report(), 1)
+        self.assertTrue(any("does not match final manifest" in error for error in self.state.errors))
+
+    def test_scenario_evidence_reference_requires_current_manifest_file(self):
+        sandbox = self.runner.create()
+        self.runner.launch(sandbox, None)
+        self.runner.collect(sandbox)
+        del self.client.fs.files[REMOTE_EVIDENCE + "/terminal/evidence.txt"]
+        self.assertEqual(self.runner.recover(0), 1)
+        self.assertTrue((self.output / "evidence/terminal/evidence.txt").exists())
+        self.assertTrue(any("missing installed scenario evidence" in error for error in self.state.errors))
+
+    def test_unsafe_scenario_evidence_reference_never_passes(self):
+        sandbox = self.runner.create()
+        self.runner.launch(sandbox, None)
+        path = REMOTE_EVIDENCE + "/results.json"
+        result = json.loads(self.client.fs.files[path])
+        result["scenarios"][0]["evidence"] = ["../outside"]
+        self.client.fs.files[path] = json.dumps(result).encode()
+        self.assertEqual(self.runner.recover(0), 1)
+        self.assertTrue(any("unsafe artifact path" in error for error in self.state.errors))
+
     def test_poll_deadline_retains_partial_evidence(self):
         self.client.fs.files[REMOTE_EVIDENCE + "/partial.log"] = b"partial"
         with self.assertRaisesRegex(OrchestrationError, "deadline"):
diff --git a/scripts/daytona-behaviors/test_installed.py b/scripts/daytona-behaviors/test_installed.py
index 60e560abf..2c69a111c 100644
--- a/scripts/daytona-behaviors/test_installed.py
+++ b/scripts/daytona-behaviors/test_installed.py
@@ -101,6 +101,27 @@ def command(terminal, *args):
             self.assertNotIn(env["OPENAI_API_KEY"], str(commands))
             self.assertEqual((evidence / "terminal.txt").read_text(), "[REDACTED]")
 
+    def test_terminal_waits_for_exit_status_after_dead_pane(self):
+        terminal = object.__new__(installed.Terminal)
+        terminal.deadline = float("inf")
+        statuses = iter(["1::", "1:0:"])
+        terminal.send = lambda text: None
+        terminal.capture = lambda: ""
+        terminal.command = lambda *args: next(statuses)
+        with patch.object(installed.time, "sleep"):
+            terminal.exit()
+
+    def test_terminal_rejects_nonzero_and_signaled_exit(self):
+        for status in ("1:7:", "1::TERM"):
+            with self.subTest(status=status):
+                terminal = object.__new__(installed.Terminal)
+                terminal.deadline = float("inf")
+                terminal.send = lambda text: None
+                terminal.capture = lambda: ""
+                terminal.command = lambda *args: status
+                with self.assertRaisesRegex(AssertionError, "Unclean terminal exit"):
+                    terminal.exit()
+
     def test_empty_results_cannot_pass(self):
         with tempfile.TemporaryDirectory() as temporary:
             runner = self.runner(temporary)

From 6efd24323c7d14bb85e2dfe62a774f85c7643a4a Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:50:40 -0400
Subject: [PATCH 07/12] fix(coding-agent): verify terminal child exit
 independently of tmux status

---
 scripts/daytona-behaviors/installed.py      | 26 +++++++++++-----
 scripts/daytona-behaviors/test_installed.py | 34 +++++++++++++--------
 2 files changed, 40 insertions(+), 20 deletions(-)

diff --git a/scripts/daytona-behaviors/installed.py b/scripts/daytona-behaviors/installed.py
index c5607c1d9..d322db508 100644
--- a/scripts/daytona-behaviors/installed.py
+++ b/scripts/daytona-behaviors/installed.py
@@ -33,9 +33,20 @@ def __init__(self, executable, args, env, project, evidence, deadline):
         self.evidence, self.deadline = evidence, deadline
         self.env = env
         (evidence / "tmux.conf").write_text("set -g extended-keys on\nset -gq extended-keys-format csi-u\n")
+        # Some sandbox init processes reap tmux's pane status. Record the actual
+        # application child's status independently, while retaining its real PTY.
+        launcher = evidence / "terminal-launch.py"
+        launcher.write_text(
+            "import json, pathlib, subprocess\n"
+            f"result = subprocess.run({[executable, *args]!r})\n"
+            f"temporary = pathlib.Path({str(evidence / '.terminal-exit.tmp')!r})\n"
+            "temporary.write_text(json.dumps({'exitCode': result.returncode}))\n"
+            f"temporary.replace({str(evidence / 'terminal-exit.json')!r})\n"
+            "raise SystemExit(0 if result.returncode == 0 else 1)\n"
+        )
         self.command("new-session", "-d", "-s", "behavior", "-x", "80", "-y", "24",
                      "-c", str(project),
-                     " ".join(shlex.quote(a) for a in [executable, *args]))
+                     " ".join(shlex.quote(a) for a in [sys.executable, str(launcher)]))
         self.command("set-option", "-g", "remain-on-exit", "on")
 
     def command(self, *args):
@@ -103,13 +114,12 @@ def exit(self):
         end = min(self.deadline, time.monotonic() + 10)
         while time.monotonic() < end:
             self.capture()
-            dead = self.command("display-message", "-p", "#{pane_dead}:#{pane_dead_status}:#{pane_dead_signal}").strip()
-            if dead.startswith("1:"):
-                # Older tmux may observe EOF before waitpid supplies status.
-                # A dead pane alone is not a completed or successful exit.
-                _, status, signal = dead.split(":", 2)
-                if status or signal:
-                    assert status == "0" and not signal, f"Unclean terminal exit: {dead}"
+            status_file = self.evidence / "terminal-exit.json"
+            if status_file.exists():
+                status = json.loads(status_file.read_text())["exitCode"]
+                assert status == 0, f"Unclean terminal exit: {status}"
+                dead = self.command("display-message", "-p", "#{pane_dead}").strip()
+                if dead == "1":
                     return
             time.sleep(.1)
         raise AssertionError("Terminal failed to exit")
diff --git a/scripts/daytona-behaviors/test_installed.py b/scripts/daytona-behaviors/test_installed.py
index 2c69a111c..3bc77c32a 100644
--- a/scripts/daytona-behaviors/test_installed.py
+++ b/scripts/daytona-behaviors/test_installed.py
@@ -101,24 +101,34 @@ def command(terminal, *args):
             self.assertNotIn(env["OPENAI_API_KEY"], str(commands))
             self.assertEqual((evidence / "terminal.txt").read_text(), "[REDACTED]")
 
-    def test_terminal_waits_for_exit_status_after_dead_pane(self):
-        terminal = object.__new__(installed.Terminal)
-        terminal.deadline = float("inf")
-        statuses = iter(["1::", "1:0:"])
-        terminal.send = lambda text: None
-        terminal.capture = lambda: ""
-        terminal.command = lambda *args: next(statuses)
-        with patch.object(installed.time, "sleep"):
-            terminal.exit()
+    def test_terminal_waits_for_independent_status_after_dead_pane(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            terminal = object.__new__(installed.Terminal)
+            terminal.evidence = Path(temporary)
+            terminal.deadline = float("inf")
+            captures = []
+            def capture():
+                captures.append(True)
+                if len(captures) == 2:
+                    installed.write_json(terminal.evidence / "terminal-exit.json", {"exitCode": 0})
+                return ""
+            terminal.send = lambda text: None
+            terminal.capture = capture
+            terminal.command = lambda *args: "1"
+            with patch.object(installed.time, "sleep"):
+                terminal.exit()
+            self.assertEqual(len(captures), 2)
 
     def test_terminal_rejects_nonzero_and_signaled_exit(self):
-        for status in ("1:7:", "1::TERM"):
-            with self.subTest(status=status):
+        for status in (7, -15):
+            with self.subTest(status=status), tempfile.TemporaryDirectory() as temporary:
                 terminal = object.__new__(installed.Terminal)
+                terminal.evidence = Path(temporary)
+                installed.write_json(terminal.evidence / "terminal-exit.json", {"exitCode": status})
                 terminal.deadline = float("inf")
                 terminal.send = lambda text: None
                 terminal.capture = lambda: ""
-                terminal.command = lambda *args: status
+                terminal.command = lambda *args: "1"
                 with self.assertRaisesRegex(AssertionError, "Unclean terminal exit"):
                     terminal.exit()
 

From 805454eb6089287096d09776e4d5c70e23b82942 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 16:53:32 -0400
Subject: [PATCH 08/12] fix(coding-agent): guard all Daytona evidence before
 public artifact upload

---
 .github/workflows/daytona-behaviors.yml       |  50 +++--
 docs/daytona-behaviors.md                     |  42 +++-
 scripts/daytona-behaviors-workflow.test.mjs   |  68 ++++++-
 .../daytona-behaviors/sanitize_evidence.py    | 141 ++++++++++++++
 .../test_sanitize_evidence.py                 | 180 ++++++++++++++++++
 5 files changed, 459 insertions(+), 22 deletions(-)
 create mode 100644 scripts/daytona-behaviors/sanitize_evidence.py
 create mode 100644 scripts/daytona-behaviors/test_sanitize_evidence.py

diff --git a/.github/workflows/daytona-behaviors.yml b/.github/workflows/daytona-behaviors.yml
index e070e651f..c48688c8d 100644
--- a/.github/workflows/daytona-behaviors.yml
+++ b/.github/workflows/daytona-behaviors.yml
@@ -61,7 +61,7 @@ jobs:
             scripts/daytona-behaviors/live-guard.mjs \
             scripts/daytona-behaviors/baselines
           sha256sum .artifacts/daytona-bundle/bundle.tar.gz > .artifacts/daytona-bundle/SHA256SUMS
-      - name: Retain exact private candidate bytes
+      - name: Retain exact candidate bytes (not confidential)
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: daytona-release-${{ github.sha }}-${{ github.run_attempt }}
@@ -69,7 +69,7 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 30
-      - name: Retain exact private behavior bundle
+      - name: Retain exact behavior bundle (not confidential)
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: daytona-bundle-${{ github.sha }}-${{ github.run_attempt }}
@@ -145,12 +145,22 @@ jobs:
             --arg mode deterministic --arg execution "$EXECUTION" --arg recovery "$RECOVERY" \
             '{commit: $commit, runId: $runId, mode: $mode, execution: $execution, recovery: $recovery}' \
             > .artifacts/daytona-deterministic/workflow-job.json
-      - name: Retain deterministic evidence even on failure
+      - name: Guard all deterministic evidence before publication
+        id: sanitize
         if: always()
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+        run: |
+          python3 scripts/daytona-behaviors/sanitize_evidence.py \
+            --root .artifacts/daytona-deterministic --output .artifacts/daytona-deterministic-sanitized \
+            --mode deterministic
+      - name: Retain sanitized deterministic evidence even on failure
+        if: ${{ always() && steps.sanitize.outputs.safe_to_upload == 'true' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: daytona-evidence-deterministic-${{ github.sha }}-${{ github.run_attempt }}
-          path: .artifacts/daytona-deterministic/
+          path: .artifacts/daytona-deterministic-sanitized/
+          include-hidden-files: true
           if-no-files-found: error
           retention-days: 30
 
@@ -223,12 +233,23 @@ jobs:
             --arg mode live --arg execution "$EXECUTION" --arg recovery "$RECOVERY" \
             '{commit: $commit, runId: $runId, mode: $mode, execution: $execution, recovery: $recovery}' \
             > .artifacts/daytona-live/workflow-job.json
-      - name: Retain live evidence even on failure
+      - name: Guard all live evidence before publication
+        id: sanitize
         if: always()
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          python3 scripts/daytona-behaviors/sanitize_evidence.py \
+            --root .artifacts/daytona-live --output .artifacts/daytona-live-sanitized \
+            --mode live
+      - name: Retain sanitized live evidence even on failure
+        if: ${{ always() && steps.sanitize.outputs.safe_to_upload == 'true' }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: daytona-evidence-live-${{ github.sha }}-${{ github.run_attempt }}
-          path: .artifacts/daytona-live/
+          path: .artifacts/daytona-live-sanitized/
+          include-hidden-files: true
           if-no-files-found: error
           retention-days: 30
 
@@ -258,17 +279,23 @@ jobs:
               failed=1
               continue
             fi
+            if ! jq --exit-status --arg mode "$mode" \
+              '.schemaVersion == 1 and .mode == $mode and .safe_to_upload == true and .outcome == "clean" and .credential_matches == 0' \
+              "$evidence/publication-safety.json" > /dev/null; then
+              echo "::error::Missing or failed $mode credential publication guard"
+              failed=1
+            fi
             if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" \
               --arg runId "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$mode" \
               '.commit == $commit and .mode == $mode and .runId == $runId and .execution == "success" and .recovery == "success"' \
-              "$evidence/workflow-job.json"; then
+              "$evidence/workflow-job.json" > /dev/null; then
               echo "::error::$mode execution or cleanup did not succeed"
               failed=1
             fi
             if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" \
               --arg runId "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$mode" \
               '.commit == $commit and .mode == $mode and .run_id == $runId and .outcome == "passed" and .execution == "passed" and .exit_code == 0 and .installed_outcome == "passed" and .reports_complete == true and .cleanup == "confirmed"' \
-              "$evidence/orchestration.json"; then
+              "$evidence/orchestration.json" > /dev/null; then
               echo "::error::Missing, incomplete or failed $mode orchestration/cleanup result"
               failed=1
             fi
@@ -279,7 +306,7 @@ jobs:
             fi
             if ! jq --exit-status --arg commit "$DIFFEX_SOURCE_COMMIT" --arg mode "$mode" --argjson expected "$expected" \
               '.schemaVersion == 1 and .commit == $commit and .mode == $mode and .outcome == "passed" and (.artifactHashes | type == "object" and length > 0) and ((.scenarios | map(.id) | sort) == ($expected | sort)) and all(.scenarios[]; .commit == $commit and .outcome == "passed")' \
-              "$evidence/evidence/results.json"; then
+              "$evidence/evidence/results.json" > /dev/null; then
               echo "::error::Missing, incomplete or failed $mode installed scenarios"
               failed=1
             fi
@@ -292,7 +319,7 @@ jobs:
           done
           if ! jq --slurp --exit-status '.[0].artifactHashes == .[1].artifactHashes' \
             .artifacts/daytona-summary/deterministic/evidence/results.json \
-            .artifacts/daytona-summary/live/evidence/results.json; then
+            .artifacts/daytona-summary/live/evidence/results.json > /dev/null; then
             echo '::error::Both modes must test the same candidate tarball hashes'
             failed=1
           fi
@@ -307,11 +334,12 @@ jobs:
             echo "Evidence and confirmed cleanup gate: $([[ "$failed" == 0 ]] && echo passed || echo failed)"
           } >> "$GITHUB_STEP_SUMMARY"
           exit "$failed"
-      - name: Retain aggregate evidence even on failure
+      - name: Retain sanitized aggregate evidence even on failure
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: daytona-summary-${{ github.sha }}-${{ github.run_attempt }}
           path: .artifacts/daytona-summary/
+          include-hidden-files: true
           if-no-files-found: error
           retention-days: 30
diff --git a/docs/daytona-behaviors.md b/docs/daytona-behaviors.md
index 0e7e2b6cd..04ad362d3 100644
--- a/docs/daytona-behaviors.md
+++ b/docs/daytona-behaviors.md
@@ -64,17 +64,31 @@ The workflow never sets its own qualification variable.
 
 3. **Recovery and evidence, including failure.** Once execution starts, the always-run recovery step invokes `recover --output DIR`.
    Recovery retrieves available evidence and confirms cleanup; it does not launch or retry behavior execution.
-   The workflow records execution and recovery outcomes separately in `workflow-job.json` and uploads evidence even after a failure.
-   A recovered transcript does not turn a failed run into a pass.
+   The workflow records execution and recovery outcomes separately in `workflow-job.json`, then always runs the final all-files credential publication guard before any per-mode evidence upload.
+   The guard scans the entire local output root, including `installed.log`, `launcher.log`, nested `install.txt` files, binary captures and hidden files; it does not rely on the installed suite's earlier filtering.
+   It reads actual credential bytes only from `DAYTONA_API_KEY` (both modes) and `OPENAI_API_KEY` (live only) in its environment, never from credential files or command-line arguments.
+   Auth files/directories, symlinks and special files are excluded without opening them.
+   Exact credential bytes in file contents and path names are redacted before a separate sanitized publication copy is written; the original local recovery output is never uploaded.
+   `publication-safety.json` records only sanitized paths, credential variable names, counts and hashes of sanitized bytes, not credential values or hashes of original secret-bearing bytes.
+   A credential match fails the guard and producing job even if the sanitized evidence can be retained for diagnosis.
+   Only a fully completed scan, final byte/path verification and safety report set `safe_to_upload=true`; unexpected failures or missing scan credentials block upload rather than falling back to raw evidence.
+   These exact-byte checks are defense in depth, not a general detector for arbitrary credentials or encoded secret transformations: the harness must never write secrets to evidence or logs.
+   A recovered or sanitized transcript does not turn a failed run into a pass.
 
 4. **Aggregate, including missing results.** The final job runs even when dependencies fail or skip on an enabled run.
    It requires successful prepare, deterministic and live jobs; exact commit/mode/run-ID markers; successful execution and recovery; passing orchestration JSON with confirmed deletion; the complete expected installed scenario inventory; matching candidate tarball hashes in both modes; and nonempty orchestration and installed-suite XML reports.
-   Missing artifacts, incomplete results, execution failure or cleanup failure fail the aggregate.
+   Missing artifacts, incomplete results, execution failure, credential-guard failure or cleanup failure fail the aggregate.
+   The aggregate requires a clean publication safety report and checks the producing jobs' outcomes, so a failed sanitizer cannot be hidden by otherwise passing scenario reports.
    Evidence-upload failure also leaves the producing job failed.
+   Aggregate validation does not echo evidence JSON or credential values into job logs or the step summary.
+   Per-mode and aggregate uploads include hidden sanitized files, preserving `.orchestration-exit` and other digest-manifest members; excluded auth files stay excluded.
 
 GitHub artifacts retain the release, bundle, per-mode evidence and aggregate evidence for **30 days**.
 Download evidence before expiry if a longer-lived qualification record is required.
-Artifacts remain private repository evidence; they are not npm or public release assets.
+This repository is public: GitHub Actions artifacts can be downloaded by authenticated users with repository read access and are **not confidential storage**.
+The release and bundle artifacts contain no credentials; per-mode and aggregate evidence must contain only the guarded, sanitized publication copies.
+They are workflow artifacts, not npm or release assets; that distinction does not make them private.
+Never rely on GitHub log masking or artifact access controls to protect keys.
 
 ## Configure access and a snapshot
 
@@ -86,11 +100,12 @@ Create the GitHub environment `daytona-behaviors` and configure:
 | Setting | Location | Purpose |
 | --- | --- | --- |
 | `DAYTONA_API_KEY` | Environment secret | Local orchestration calls to Daytona; never passed as the sandbox's model credential. |
-| `OPENAI_API_KEY` | Environment secret | Approved, restricted live-provider key; injected only into the live execution step. |
+| `OPENAI_API_KEY` | Environment secret | Approved, restricted live-provider key; injected only into live execution and the live publication guard. |
 | `DAYTONA_BEHAVIORS_SNAPSHOT` | Environment variable | Prepared toolchain snapshot name passed explicitly as `--snapshot`. |
 | `DAYTONA_BEHAVIORS_QUALIFIED` | Repository variable | Set to `true` only after reviewing a successful qualification. |
 
 The deterministic job and recovery steps do not receive `OPENAI_API_KEY`.
+Each publication guard receives only its mode's credential whitelist, scoped to that step; credential values never appear in its arguments, report or status output.
 The prepare and aggregate jobs receive neither credential.
 Provider credentials must be test-only, revocable and covered by a spending limit; do not use personal login state or production agent configuration.
 Review the current model, request/token/time limits and allowed provider destination in the checked live harness before approval.
@@ -167,6 +182,7 @@ Expected local output:
 - `evidence/results.json` and `evidence/results.xml`: incremental installed-suite results.
 - Available per-scenario transcripts, events, terminal captures/baseline comparisons and other diagnostic files produced by the harness.
 - `workflow-job.json`: CI-only record of exact source, run identity, execution and recovery outcomes.
+- `publication-safety.json`: final guard report in the separate sanitized publication directory, never an authorization to upload the original output.
 
 Do not delete or hand-edit `state.json` while a sandbox may exist.
 For interrupted execution, retained output or cleanup failure:
@@ -182,6 +198,20 @@ If credentials, runner termination or service failure prevent confirmation, trea
 CI's always-run step is best effort under cancellation or runner loss, not a guarantee that GitHub will execute cleanup.
 Recover manually and confirm no run-owned sandboxes remain before closing the incident.
 
+Before sharing any local evidence, run the same publication guard after recovery with the approved credentials available only in the environment:
+
+```sh
+python3 scripts/daytona-behaviors/sanitize_evidence.py \
+  --root .artifacts/daytona-deterministic \
+  --output .artifacts/daytona-deterministic-sanitized \
+  --mode deterministic
+```
+
+Use `--mode live` and a separate fresh publication destination for live evidence.
+A nonzero exit is a security failure, even if a completed sanitized copy and its safety report exist.
+If the scan did not complete, do not publish any evidence; never substitute the raw directory.
+Retain or share only a completed sanitized copy, review it for unrelated sensitive data and treat it as public-readable.
+
 ## Local executable checks and baseline review
 
 To exercise an already installed executable without creating a Daytona sandbox:
@@ -234,7 +264,7 @@ The implementation must remain **unqualified** until that user supplies and revi
    Expect a nonzero exit and a recorded baseline assertion failure, retained JSON/XML and captures, and confirmed sandbox deletion.
    Run `recover --output .artifacts/daytona-intentional-failure` if needed; it must not relaunch or turn the failed execution into a pass.
    Record the deliberately altered bundle identity separately; never replace the original retained bundle, regenerate its approved checksum or commit the bad baseline.
-   Retain the local CLI output directory with the qualification record; this rehearsal needs no new workflow inputs.
+   Run the final publication guard on the local CLI output and retain only its completed sanitized copy with the qualification record; this rehearsal needs no new workflow inputs.
 4. Require a **cancellation rehearsal**: dispatch another run from `main`, wait until a sandbox and behavior execution exist, then cancel that workflow run.
    Retain the run URL, sandbox/run identities and whatever incremental artifacts were uploaded.
    Recover available saved output without relaunching; if cancellation prevented artifact upload, use the recorded run labels and the Daytona owner to reconcile resources.
diff --git a/scripts/daytona-behaviors-workflow.test.mjs b/scripts/daytona-behaviors-workflow.test.mjs
index 335696deb..73ddf01ba 100644
--- a/scripts/daytona-behaviors-workflow.test.mjs
+++ b/scripts/daytona-behaviors-workflow.test.mjs
@@ -82,12 +82,51 @@ test("one 35-minute preparation freezes, builds offline, prepares and verifies t
 		assert.doesNotMatch(recover.run, /--mode|--artifacts/);
 		assert.equal(recover.env.OPENAI_API_KEY, undefined);
 		assert.equal(run.env.OPENAI_API_KEY !== undefined, mode === "live");
-		assert.equal(job.steps.at(-1).if, "always()");
+		assert.equal(job.steps.at(-1).if, "${{ always() && steps.sanitize.outputs.safe_to_upload == 'true' }}");
 	}
 	assert.deepEqual(workflow.jobs["daytona-behaviors"].needs, ["prepare", "deterministic", "live"]);
 });
 
-for (const scenario of ["pass", "missing-artifact", "missing-result", "invalid-result", "missing-xml", "failed-job", "cleanup-failed", "wrong-commit", "wrong-run", "orchestration-failed", "cleanup-unconfirmed", "partial-scenarios", "wrong-result-commit", "different-tarballs"]) {
+test("only a completed all-files credential guard permits sanitized evidence publication", () => {
+	assert.equal(workflow.env.DAYTONA_API_KEY, undefined);
+	assert.equal(workflow.env.OPENAI_API_KEY, undefined);
+	for (const mode of ["deterministic", "live"]) {
+		const job = workflow.jobs[mode];
+		const guard = job.steps.find((step) => step.id === "sanitize");
+		const guardIndex = job.steps.indexOf(guard);
+		const recordIndex = job.steps.findIndex((step) => step.name === "Record execution and cleanup outcomes");
+		assert.equal(guardIndex, recordIndex + 1);
+		assert.equal(guard.if, "always()");
+		assert.equal(guard["continue-on-error"], undefined);
+		assert.deepEqual(guard.env, mode === "live"
+			? { DAYTONA_API_KEY: "${{ secrets.DAYTONA_API_KEY }}", OPENAI_API_KEY: "${{ secrets.OPENAI_API_KEY }}" }
+			: { DAYTONA_API_KEY: "${{ secrets.DAYTONA_API_KEY }}" });
+		assert.match(guard.run, /python3 scripts\/daytona-behaviors\/sanitize_evidence\.py/);
+		assert.ok(guard.run.includes(`--root .artifacts/daytona-${mode} --output .artifacts/daytona-${mode}-sanitized`));
+		assert.ok(guard.run.includes(`--mode ${mode}`));
+		assert.doesNotMatch(guard.run, /\$.*(?:DAYTONA_API_KEY|OPENAI_API_KEY)|continue-on-error|\|\| true/);
+		assert.equal(job.env.DAYTONA_API_KEY, undefined);
+		assert.equal(job.env.OPENAI_API_KEY, undefined);
+		const uploads = job.steps.filter((step) => step.uses?.startsWith("actions/upload-artifact@"));
+		assert.equal(uploads.length, 1);
+		const upload = uploads[0];
+		assert.equal(job.steps.indexOf(upload), guardIndex + 1);
+		assert.equal(upload.if, "${{ always() && steps.sanitize.outputs.safe_to_upload == 'true' }}");
+		assert.equal(upload.with.path, `.artifacts/daytona-${mode}-sanitized/`);
+		assert.equal(upload.with["include-hidden-files"], true);
+	}
+	const aggregate = workflow.jobs["daytona-behaviors"];
+	assert.equal(aggregate.env.DETERMINISTIC_RESULT, "${{ needs.deterministic.result }}");
+	assert.equal(aggregate.env.LIVE_RESULT, "${{ needs.live.result }}");
+	assert.equal(aggregate.env.DAYTONA_API_KEY, undefined);
+	assert.equal(aggregate.env.OPENAI_API_KEY, undefined);
+	assert.equal(aggregate.steps.at(-1).with["include-hidden-files"], true);
+	for (const job of Object.values(workflow.jobs)) {
+		for (const step of job.steps) assert.doesNotMatch(step.name, /private/i);
+	}
+});
+
+for (const scenario of ["pass", "missing-artifact", "missing-result", "invalid-result", "missing-xml", "failed-job", "sanitizer-failed", "missing-safety-report", "unsafe-report", "credential-found", "cleanup-failed", "wrong-commit", "wrong-run", "orchestration-failed", "cleanup-unconfirmed", "partial-scenarios", "wrong-result-commit", "different-tarballs"]) {
 	test(`aggregate fails closed: ${scenario}`, () => {
 		const root = mkdtempSync(join(tmpdir(), "daytona workflow "));
 		try {
@@ -96,6 +135,10 @@ for (const scenario of ["pass", "missing-artifact", "missing-result", "invalid-r
 			for (const mode of ["deterministic", "live"]) {
 				const directory = join(fixtures, mode);
 				mkdirSync(join(directory, "evidence"), { recursive: true });
+				writeFileSync(join(directory, "publication-safety.json"), JSON.stringify({
+					schemaVersion: 1, mode, safe_to_upload: true, outcome: "clean", credential_matches: 0,
+				}));
+				writeFileSync(join(directory, ".orchestration-exit"), "0\n");
 				writeFileSync(join(directory, "workflow-job.json"), JSON.stringify({
 					commit, mode, runId: `123-2-${mode}`, execution: "success", recovery: "success",
 				}));
@@ -115,6 +158,16 @@ for (const scenario of ["pass", "missing-artifact", "missing-result", "invalid-r
 			}
 			const live = join(fixtures, "live");
 			if (scenario === "missing-artifact") rmSync(live, { recursive: true });
+			if (scenario === "missing-safety-report") rmSync(join(live, "publication-safety.json"));
+			if (["unsafe-report", "credential-found"].includes(scenario)) {
+				const report = JSON.parse(readFileSync(join(live, "publication-safety.json"), "utf8"));
+				if (scenario === "unsafe-report") report.safe_to_upload = false;
+				if (scenario === "credential-found") {
+					report.outcome = "credential-found";
+					report.credential_matches = 1;
+				}
+				writeFileSync(join(live, "publication-safety.json"), JSON.stringify(report));
+			}
 			if (scenario === "missing-result") rmSync(join(live, "evidence/results.json"));
 			if (scenario === "invalid-result") writeFileSync(join(live, "evidence/results.json"), "[]");
 			if (scenario === "missing-xml") rmSync(join(live, "orchestration.xml"));
@@ -164,14 +217,19 @@ cpSync(source, args[args.indexOf("--dir") + 1], { recursive: true });
 					GITHUB_STEP_SUMMARY: join(root, "summary.md"),
 					PREPARE_RESULT: "success",
 					DETERMINISTIC_RESULT: "success",
-					LIVE_RESULT: scenario === "failed-job" ? "failure" : "success",
+					LIVE_RESULT: ["failed-job", "sanitizer-failed"].includes(scenario) ? "failure" : "success",
 				},
 			});
 			assert.equal(result.status, scenario === "pass" ? 0 : 1, `${result.stdout}\n${result.stderr}`);
 			const summary = JSON.parse(readFileSync(join(root, ".artifacts/daytona-summary/summary.json"), "utf8"));
 			assert.equal(summary.passed, scenario === "pass");
-			// Downloaded evidence remains in the aggregate artifact, including failed cases.
-			if (scenario !== "missing-artifact") assert.ok(readFileSync(join(root, ".artifacts/daytona-summary/live/workflow-job.json")));
+			// No evidence JSON (including provider response fields) is echoed into job logs.
+			assert.doesNotMatch(result.stdout, /artifactHashes|diffex\.tgz|credential_matches|schemaVersion/);
+			// Downloaded evidence, including hidden digest members, survives failed cases.
+			if (scenario !== "missing-artifact") {
+				assert.ok(readFileSync(join(root, ".artifacts/daytona-summary/live/workflow-job.json")));
+				assert.equal(readFileSync(join(root, ".artifacts/daytona-summary/live/.orchestration-exit"), "utf8"), "0\n");
+			}
 		} finally {
 			rmSync(root, { recursive: true, force: true });
 		}
diff --git a/scripts/daytona-behaviors/sanitize_evidence.py b/scripts/daytona-behaviors/sanitize_evidence.py
new file mode 100644
index 000000000..353ef76d3
--- /dev/null
+++ b/scripts/daytona-behaviors/sanitize_evidence.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+"""Fail-closed publication guard; credentials enter only through mode-whitelisted env."""
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import stat
+import tempfile
+
+
+REPORT = "publication-safety.json"
+AUTH_NAMES = {"auth.json", "auth.jsonl", "credentials", "credentials.json", ".credentials",
+              ".npmrc", ".netrc", "_netrc", ".git-credentials", ".env", ".ssh", ".aws"}
+
+
+def sanitize(root: Path, output: Path, mode: str) -> bool:
+    """Publish only a fully scanned copy. Return False on any credential match.
+
+    No original content digests, exception details or unsanitized names are emitted.
+    Auth entries and symlinks are excluded without opening them. The source is not
+    modified, so recovery can still use its original state before publication.
+    """
+    names = ["DAYTONA_API_KEY"] + (["OPENAI_API_KEY"] if mode == "live" else [])
+    secrets = sorted({os.environ[name].encode() for name in names if os.environ.get(name)}, key=len, reverse=True)
+    # Missing secrets make a complete publication scan impossible, not successful.
+    if len([name for name in names if os.environ.get(name)]) != len(names):
+        raise ValueError("missing scan credential")
+    if root.is_symlink() or not root.is_dir():
+        raise ValueError("invalid evidence root")
+    root = root.resolve()
+    output = output.absolute()
+    if output.is_relative_to(root) or root.is_relative_to(output.resolve()) or output.exists() or output.is_symlink():
+        raise ValueError("invalid publication destination")
+    if output.resolve() != output:
+        raise ValueError("publication destination traverses a symlink")
+    output.parent.mkdir(parents=True, exist_ok=True)
+    replacement = b"[REDACTED]"
+    if any(secret in replacement for secret in secrets):
+        replacement = b""
+    matches = 0
+    excluded = []
+    files = []
+
+    def redact(data: bytes) -> bytes:
+        nonlocal matches
+        for secret in secrets:
+            matches += data.count(secret)
+            data = data.replace(secret, replacement)
+        return data
+
+    def visit(source: Path, target: Path, relative: Path) -> None:
+        for entry in sorted(source.iterdir()):
+            safe_name = os.fsdecode(redact(os.fsencode(entry.name)))
+            if not safe_name or safe_name in {".", ".."}:
+                raise ValueError("invalid sanitized name")
+            safe_relative = relative / safe_name
+            metadata = entry.lstat()
+            lower = entry.name.lower()
+            reason = None
+            if stat.S_ISLNK(metadata.st_mode):
+                reason = "symlink"
+            elif lower in AUTH_NAMES or lower.startswith(".env.") or (lower.startswith("auth.") and lower.endswith(".json")):
+                reason = "auth"
+            elif not stat.S_ISDIR(metadata.st_mode) and not stat.S_ISREG(metadata.st_mode):
+                reason = "special"
+            if reason:
+                excluded.append({"path": safe_relative.as_posix(), "reason": reason})
+                continue
+            destination = target / safe_name
+            if destination.exists() or (relative == Path() and safe_name == REPORT):
+                raise ValueError("publication name collision")
+            if stat.S_ISDIR(metadata.st_mode):
+                destination.mkdir()
+                visit(entry, destination, safe_relative)
+                continue
+            # O_NOFOLLOW rejects a symlink swapped in between lstat and open.
+            descriptor = os.open(entry, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+            with os.fdopen(descriptor, "rb") as stream:
+                opened = os.fstat(stream.fileno())
+                if not stat.S_ISREG(opened.st_mode) or (opened.st_dev, opened.st_ino) != (metadata.st_dev, metadata.st_ino):
+                    raise ValueError("evidence changed during scan")
+                data = redact(stream.read())
+            destination.write_bytes(data)
+            files.append({"path": safe_relative.as_posix(), "size": len(data),
+                          "sha256": hashlib.sha256(data).hexdigest()})
+
+    temporary = Path(tempfile.mkdtemp(prefix=".publication-", dir=output.parent))
+    try:
+        visit(root, temporary, Path())
+        report = {"schemaVersion": 1, "safe_to_upload": True, "mode": mode,
+                  "credential_names": names, "credential_matches": matches,
+                  "outcome": "credential-found" if matches else "clean",
+                  "files_scanned": len(files), "files": files,
+                  "excluded_count": len(excluded), "excluded": excluded}
+        (temporary / REPORT).write_text(json.dumps(report, indent=2) + "\n")
+        # Verify report, path metadata and final bytes too; never expose an unsafe copy.
+        for path in temporary.rglob("*"):
+            if any(secret in os.fsencode(path.relative_to(temporary)) for secret in secrets):
+                raise ValueError("unsafe publication path")
+            if path.is_file() and any(secret in path.read_bytes() for secret in secrets):
+                raise ValueError("unsafe publication bytes")
+        temporary.rename(output)
+    finally:
+        if temporary.exists():
+            shutil.rmtree(temporary)
+    return matches == 0
+
+
+def set_output(safe: bool) -> None:
+    destination = os.environ.get("GITHUB_OUTPUT")
+    if destination:
+        with open(destination, "a", encoding="utf-8") as stream:
+            stream.write(f"safe_to_upload={'true' if safe else 'false'}\n")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--mode", choices=["deterministic", "live"], required=True)
+    args = parser.parse_args()
+    try:
+        set_output(False)
+        clean = sanitize(args.root, args.output, args.mode)
+        set_output(True)
+    except Exception:
+        # Exceptions can embed raw filenames/content, so do not print their details.
+        print("Evidence publication guard failed; upload is blocked.")
+        return 1
+    if not clean:
+        print("Evidence publication guard found credentials; sanitized evidence only, job failed.")
+        return 1
+    print("Evidence publication guard passed; sanitized evidence is safe to upload.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/daytona-behaviors/test_sanitize_evidence.py b/scripts/daytona-behaviors/test_sanitize_evidence.py
new file mode 100644
index 000000000..5bfc09fe9
--- /dev/null
+++ b/scripts/daytona-behaviors/test_sanitize_evidence.py
@@ -0,0 +1,180 @@
+"""Offline publication-guard regressions; all credentials below are synthetic."""
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from sanitize_evidence import REPORT, sanitize
+
+
+DAYTONA = "synthetic-daytona-secret-123456789"
+OPENAI = "synthetic-openai-secret-987654321"
+SCRIPT = Path(__file__).with_name("sanitize_evidence.py")
+
+
+class SanitizeEvidenceTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.base = Path(self.temporary.name).resolve()
+        self.root = self.base / "raw"
+        self.root.mkdir()
+        self.output = self.base / "safe"
+        self.environment = patch.dict(os.environ, {"DAYTONA_API_KEY": DAYTONA, "OPENAI_API_KEY": OPENAI})
+        self.environment.start()
+        self.addCleanup(self.environment.stop)
+
+    def report(self):
+        return json.loads((self.output / REPORT).read_text())
+
+    def assert_no_secret(self):
+        for path in self.output.rglob("*"):
+            self.assertNotIn(DAYTONA, str(path))
+            self.assertNotIn(OPENAI, str(path))
+            if path.is_file():
+                self.assertNotIn(DAYTONA.encode(), path.read_bytes())
+                self.assertNotIn(OPENAI.encode(), path.read_bytes())
+
+    def invoke(self, mode="live"):
+        github_output = self.base / "github-output"
+        environment = {**os.environ, "GITHUB_OUTPUT": str(github_output)}
+        result = subprocess.run([sys.executable, str(SCRIPT), "--root", str(self.root),
+                                 "--output", str(self.output), "--mode", mode],
+                                env=environment, capture_output=True, check=False)
+        # Neither status nor exception diagnostics may echo exact secret values.
+        for key in [DAYTONA, OPENAI]:
+            self.assertNotIn(key.encode(), result.stdout + result.stderr + github_output.read_bytes())
+        return result, github_output.read_text().splitlines()
+
+    def test_clean_preserves_hidden_digest_members_and_safe_hashes(self):
+        (self.root / ".orchestration-exit").write_bytes(b"0\n")
+        (self.root / "state.json").write_text('{"run_id": "safe-run"}')
+        result, outputs = self.invoke()
+        self.assertEqual(result.returncode, 0)
+        self.assertEqual(outputs, ["safe_to_upload=false", "safe_to_upload=true"])
+        self.assertEqual((self.output / ".orchestration-exit").read_bytes(), b"0\n")
+        report = self.report()
+        self.assertTrue(report["safe_to_upload"])
+        self.assertEqual(report["outcome"], "clean")
+        self.assertEqual(report["credential_matches"], 0)
+        self.assertEqual(report["files_scanned"], 2)
+        for record in report["files"]:
+            data = (self.output / record["path"]).read_bytes()
+            self.assertEqual(record["sha256"], hashlib.sha256(data).hexdigest())
+            self.assertEqual(record["size"], len(data))
+        self.assert_no_secret()
+
+    def test_exact_credentials_in_every_raw_log_and_binary_are_redacted_and_fail(self):
+        nested = self.root / "evidence" / "nested"
+        nested.mkdir(parents=True)
+        for directory in [self.root, nested]:
+            for name in ["installed.log", "launcher.log", "install.txt", "capture.bin"]:
+                (directory / name).write_bytes(b"\x00before " + DAYTONA.encode() + b" " + OPENAI.encode() + b" after\xff")
+        result, outputs = self.invoke()
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(outputs[-1], "safe_to_upload=true")
+        self.assertEqual(self.report()["credential_matches"], 16)
+        self.assertEqual(self.report()["outcome"], "credential-found")
+        self.assertEqual(self.report()["files_scanned"], 8)
+        self.assertIn(b"[REDACTED]", (self.output / "installed.log").read_bytes())
+        # Recovery input stays local and is never the upload path.
+        self.assertIn(DAYTONA.encode(), (self.root / "installed.log").read_bytes())
+        self.assert_no_secret()
+
+    def test_nested_auth_files_directories_and_symlinks_are_excluded_without_reading(self):
+        nested = self.root / "evidence" / "nested"
+        nested.mkdir(parents=True)
+        auth_names = ["auth.json", "Auth.Other.json", ".npmrc", ".netrc", ".env", ".env.local", "credentials.json"]
+        for name in auth_names:
+            (nested / name).write_text(DAYTONA + OPENAI)
+        (nested / ".ssh").mkdir()
+        (nested / ".ssh" / "id_rsa").write_text(DAYTONA)
+        (nested / "normal.txt").write_text("retained")
+        outside = self.base / "outside"
+        outside.mkdir()
+        (outside / "private.txt").write_text(DAYTONA)
+        (nested / "linked-directory").symlink_to(outside, target_is_directory=True)
+        (nested / "linked-file").symlink_to(outside / "private.txt")
+        (nested / "dangling").symlink_to(self.base / "missing")
+        original_open = os.open
+
+        def checked_open(path, *args, **kwargs):
+            self.assertEqual(Path(path).name, "normal.txt", "Excluded file was opened")
+            return original_open(path, *args, **kwargs)
+
+        # tempfile also opens a file during mkdtemp only on first use, already initialized.
+        with patch("sanitize_evidence.os.open", side_effect=checked_open):
+            self.assertTrue(sanitize(self.root, self.output, "live"))
+        self.assertEqual(self.report()["excluded_count"], len(auth_names) + 4)
+        self.assertEqual(self.report()["files_scanned"], 1)
+        self.assertFalse(any(path.is_symlink() for path in self.output.rglob("*")))
+        self.assertEqual((self.output / "evidence/nested/normal.txt").read_text(), "retained")
+        self.assert_no_secret()
+
+    def test_secret_path_names_are_redacted_in_files_and_metadata(self):
+        directory = self.root / DAYTONA
+        directory.mkdir()
+        (directory / (OPENAI + ".txt")).write_text("safe")
+        result, outputs = self.invoke()
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(outputs[-1], "safe_to_upload=true")
+        self.assertEqual(self.report()["credential_matches"], 2)
+        self.assert_no_secret()
+
+    def test_unexpected_scan_failure_blocks_upload_and_prints_no_raw_exception(self):
+        (self.root / REPORT).write_text(DAYTONA)
+        result, outputs = self.invoke()
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(outputs, ["safe_to_upload=false"])
+        self.assertFalse(self.output.exists())
+        self.assertFalse(list(self.base.glob(".publication-*")))
+        self.assertNotIn(b"Traceback", result.stderr)
+
+    def test_missing_credential_blocks_upload(self):
+        with patch.dict(os.environ, {"OPENAI_API_KEY": ""}):
+            result, outputs = self.invoke()
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(outputs, ["safe_to_upload=false"])
+        self.assertFalse(self.output.exists())
+
+    def test_deterministic_reads_only_daytona_while_live_reads_both_whitelisted_keys(self):
+        class WhitelistedEnvironment(dict):
+            def get(self, key, default=None):
+                self.assert_key(key)
+                return super().get(key, default)
+
+            def __getitem__(self, key):
+                self.assert_key(key)
+                return super().__getitem__(key)
+
+            @staticmethod
+            def assert_key(key):
+                if key != "DAYTONA_API_KEY":
+                    raise AssertionError("non-whitelisted credential access")
+
+        (self.root / "capture.txt").write_text(OPENAI)
+        with patch("sanitize_evidence.os.environ", WhitelistedEnvironment(DAYTONA_API_KEY=DAYTONA)):
+            self.assertTrue(sanitize(self.root, self.output, "deterministic"))
+        self.assertEqual(self.report()["credential_names"], ["DAYTONA_API_KEY"])
+        self.assertEqual((self.output / "capture.txt").read_text(), OPENAI)
+
+    def test_existing_destination_and_symlink_root_fail_closed(self):
+        self.output.mkdir()
+        with self.assertRaises(ValueError):
+            sanitize(self.root, self.output, "live")
+        self.output.rmdir()
+        linked = self.base / "linked"
+        linked.symlink_to(self.root, target_is_directory=True)
+        with self.assertRaises(ValueError):
+            sanitize(linked, self.output, "live")
+        self.assertFalse(self.output.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

From 314e55140c6dba5d07865dd43ce51fd05fdb3401 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 17:01:11 -0400
Subject: [PATCH 09/12] docs(coding-agent): record real Daytona behavior
 qualification and cleanup

---
 docs/daytona-behaviors-qualification.md | 96 +++++++++++++++++++++++++
 docs/daytona-behaviors.md               |  2 +
 2 files changed, 98 insertions(+)
 create mode 100644 docs/daytona-behaviors-qualification.md

diff --git a/docs/daytona-behaviors-qualification.md b/docs/daytona-behaviors-qualification.md
new file mode 100644
index 000000000..ca1a84fe7
--- /dev/null
+++ b/docs/daytona-behaviors-qualification.md
@@ -0,0 +1,96 @@
+# Daytona behavior qualification — 2026-10-27
+
+## Status
+
+**Real-service CLI qualification passed. GitHub Actions qualification remains pending.**
+
+The snapshot, installed package scenarios, live OpenAI transport, intentional assertion failure, overlapping CLI runs, active cancellation and runner-loss recovery were exercised against Daytona. This is not evidence that the GitHub workflow or its 30-day artifact retention has executed successfully.
+
+At qualification time, remote `main` was `c79aa4ccf251507c39cbc132353231cc08ca01fe` and did not contain `daytona-behaviors.yml`. The user's no-push restriction was retained. `DAYTONA_BEHAVIORS_QUALIFIED` remains `false`; automatic spending has not been enabled.
+
+## Inputs
+
+| Input | Identity |
+| --- | --- |
+| Frozen candidate source | `d025b29e554c13c4835a2d592adf47c39d49b752` |
+| Package | `@diffexai/diffex@0.4.0` |
+| Reviewed tarball SHA-256 | `da75c4042adbc0146b213682cb2a2477a5f1c97c6853b7179557648b70b47b92` |
+| Corrected scenario harness | `6efd24323c7d14bb85e2dfe62a774f85c7643a4a` |
+| Corrected harness bundle SHA-256 | `d5b57d1e15f1b39e1c0734747b7080a4c590a8dea6e34461816f02415a4df29e` |
+| Publication guard | `805454eb6` |
+| Snapshot | `diffex-behaviors-v1-e94e1af7cbc7` |
+| Snapshot ID | `2a851315-6915-40e8-9b38-0446b7d329f5` |
+| Dockerfile SHA-256 | `e94e1af7cbc73ce2b1a9b85e79974f73a39d69f9187f58daeb885bed90fa5f3a` |
+
+The candidate was frozen, built offline, packaged and verified once. Corrected harness bundles reused those retained candidate bytes rather than silently rebuilding or replacing a failed candidate. Candidate and harness commits are recorded separately; the corrected harness is not represented as part of the older frozen source commit.
+
+The real sandbox reported Node `22.23.2`, npm `11.16.0`, Bun `1.3.11`, Python `3.11.2`, tmux `3.3a`, ripgrep `13.0.0` and fd `8.6.0`. Snapshot and sandbox resources were checked as 2 vCPU, 4 GiB RAM and 8 GiB disk. Creation requests used the 45-minute wall-clock TTL.
+
+## Successful installed-package runs
+
+Both modes used the same retained tarball and corrected harness bundle.
+
+| Run directory | Result | Evidence |
+| --- | --- | --- |
+| `deterministic-v4/` | All 13 scenarios passed | npm and Bun installation/inventory checks; help/version/models/resolution; print; built-in OpenAI API-key transport fixture; real read/write/edit/bash; cancellation/recovery; clean exit; persisted-session resume; 80×24, 120×40 and resize baselines; existing artifact login/terminal acceptance |
+| `live-v3/` | All 3 scenarios passed | Retained artifact/toolchain integrity, npm installation integrity, real OpenAI print and interactive read/write task |
+
+The live run used `openai/gpt-4.1-mini`, made **4 provider requests**, produced **98 output tokens** total (maximum **38** in one request), and reported approximately **$0.00205** provider usage. The harness capped every request at 512 output tokens and the smoke at three minutes after installation. It observed 41 streamed text events, successful real `read` and `write` tools, exact input/output file bytes and application exit code 0.
+
+The reported cost is for the final passing live run, not an account billing total. Earlier failed or superseded harness runs remain retained separately.
+
+## Failure and lifecycle rehearsals
+
+- **Intentional assertion failure:** `intentional-failure/` used a separately identified bundle with a deliberately wrong 80×24 baseline. Both package-manager terminal scenarios failed with `Layout differs: startup-80x24.txt`; the runner exited nonzero, retained JSON/JUnit/captures, and confirmed deletion. The approved bundle was not modified.
+- **Two overlapping runs:** `overlap-a/` and `overlap-b/` had simultaneous sandbox lifetimes, distinct sandbox IDs and ownership labels, successful complete deterministic results, separate evidence and confirmed deletion. These were overlapping CLI invocations, not GitHub workflow runs.
+- **Active cancellation:** `cancel-active/` received SIGTERM after remote execution began and before completion. It remained failed, explicitly reported incomplete final results, and confirmed deletion. Missing results did not become a pass.
+- **Runner loss and recovery:** the initial `live-v1/` and `deterministic-v2/` supervisors were killed after an evidence-transport incompatibility was diagnosed. `recover` retrieved completed remote reports without relaunching tests, preserved their failed assertions and confirmed deletion.
+- **Independent final audit:** fresh lookups by sandbox ID and name, plus ownership-label queries, confirmed that **all 10 sandboxes created during this qualification were deleted**. The reusable toolchain snapshot is intentionally retained.
+
+Fake-client tests additionally cover ambiguous creation, unavailable lookups, upload/input failures, ownership mismatch, cleanup failures, corrupt or missing evidence, invalid JUnit and interruption. These tests are not represented as real Daytona service-outage rehearsals.
+
+## Issues discovered and fixed
+
+Failures were preserved; assertions were not automatically rerun.
+
+1. The SDK returns a string-backed enum for snapshot state. Stringifying it produced `SnapshotState.ACTIVE` rather than `active`; readiness now compares the actual enum value correctly.
+2. SDK `0.226.1` rejects streaming downloads of empty files. The runner now materializes an empty file locally only after verifying its declared zero size and SHA-256. Nonempty evidence still uses streaming downloads.
+3. Polling tolerated changed log bytes but final collection did not previously require completeness. Final evidence now requires complete size/hash verification, matching JSON identity/evidence references, and parsed JUnit with matching scenarios and outcomes.
+4. The sandbox's tmux could report a dead pane without a usable pane exit status. A PTY-preserving launcher now independently records the actual application child's return code; zero exit and a dead pane are both required. This does not replace the application's terminal, session or UI implementation.
+5. The first live model copied the marker but omitted its trailing newline. The fixture now contains an unambiguous marker with no trailing newline; byte-for-byte output verification remains required.
+6. Actions artifacts in this public repository are not confidential. A fail-closed publication guard now scans every evidence file, including launcher/install logs, before publishing a separate sanitized tree. Credential findings fail the producing job; unexpected guard failures block upload entirely. Authentication files and symlinks are excluded. Hidden evidence files are retained.
+
+## Evidence and secret handling
+
+Local evidence roots, relative to the repository:
+
+```text
+.artifacts/daytona-qualification/
+.artifacts/daytona-qualification-final-sanitized/
+```
+
+Useful records include:
+
+- `qualification-summary.json`
+- `preparation-report.json`, `SHA256SUMS` and `logs/`
+- `snapshot-v1/snapshot.json`
+- `deterministic-v4/{state.json,orchestration.json,orchestration.xml,evidence/}`
+- `live-v3/{state.json,orchestration.json,orchestration.xml,evidence/}`
+- `rehearsals.json` and `interruption-rehearsal.json`
+- `independent-deletion-audit.json`
+- The sanitized root's `publication-safety.json`
+
+The final publication guard scanned **955 files** and found **zero exact matches** for either real credential. Keys were loaded privately from the owner's external credential file, never placed in command arguments, printed or committed. The Daytona key stayed outside sandboxes; only live execution received the OpenAI key. GitHub stores both as encrypted, main-only environment secrets.
+
+These ignored local directories are not a 30-day GitHub retention guarantee. No qualification evidence was uploaded through Actions because the workflow was not present on remote `main`. Treat any future Actions evidence as non-confidential sanitized data, not a secret store.
+
+## Remaining GitHub boundary
+
+After explicit authorization to push the reviewed commits, follow [the operator procedure](daytona-behaviors.md#qualification-and-enabling-automatic-runs):
+
+1. Push through the repository's normal review/protection process; do not bypass branch protection.
+2. Dispatch the workflow on its exact remote `main` commit and require both modes plus aggregate to pass with 30-day artifacts.
+3. Rehearse workflow cancellation and two overlapping workflow runs; confirm per-run evidence retention and sandbox deletion.
+4. Review the retained results before setting `DAYTONA_BEHAVIORS_QUALIFIED=true`.
+
+A successful CLI qualification does not authorize skipping those GitHub checks or enabling the qualification variable early.
diff --git a/docs/daytona-behaviors.md b/docs/daytona-behaviors.md
index 04ad362d3..0503e74fd 100644
--- a/docs/daytona-behaviors.md
+++ b/docs/daytona-behaviors.md
@@ -7,6 +7,8 @@ A maintainer must provision Daytona access, prepare a snapshot, supply an approv
 Local fixture tests, SDK mocks and workflow validation do not establish that Daytona creation, upload, PTY execution, live inference or deletion works against the real service.
 Do not mark the integration qualified until those operations and their failure paths have retained evidence.
 
+The [2026-10-27 qualification record](daytona-behaviors-qualification.md) documents successful real-service CLI runs and lifecycle rehearsals. GitHub Actions execution, retention and workflow-level cancellation/overlap qualification remain pending; automatic execution is still disabled.
+
 This is a standalone acceptance gate for the packaged Diffex CLI, not the hosted product's runtime image, a release publisher or a replacement for native artifact acceptance.
 It installs the exact reviewed candidate tarballs into isolated consumers outside the repository.
 The deterministic mode controls inference while exercising installed behavior; the live mode uses a bounded real OpenAI request path.

From b37002622c10fa90b2d06f481827c8f63da17ad0 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 17:18:52 -0400
Subject: [PATCH 10/12] fix(coding-agent): preserve terminal baseline
 whitespace in diff checks

---
 .gitattributes                    | 3 +++
 scripts/artifact-installation.mjs | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitattributes b/.gitattributes
index d8a52c2ec..30c9e0222 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -9,6 +9,9 @@
 # Shell scripts should keep LF
 *.sh text eol=lf
 
+# Terminal snapshots intentionally retain empty rows to preserve screen height.
+scripts/daytona-behaviors/baselines/*.txt whitespace=-blank-at-eof
+
 # Common binary assets
 *.png binary
 *.jpg binary
diff --git a/scripts/artifact-installation.mjs b/scripts/artifact-installation.mjs
index 5421e7568..406daba80 100644
--- a/scripts/artifact-installation.mjs
+++ b/scripts/artifact-installation.mjs
@@ -116,4 +116,3 @@ export function installConsumer(
 	}
 	return env;
 }
-

From ada7c1506908f1648ec3710ce62a8748e5aabda4 Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 18:58:12 -0400
Subject: [PATCH 11/12] fix(coding-agent): validate artifact paths and pin
 provider recording files

---
 scripts/artifact-installation.mjs             |  51 ++++++--
 scripts/artifact-installation.test.mjs        |  58 +++++++++
 scripts/daytona-behaviors/fixture.mjs         |  61 ++++++++-
 scripts/daytona-behaviors/fixture.test.mjs    | 123 +++++++++++++++++-
 scripts/daytona-behaviors/install.mjs         |  18 +--
 scripts/daytona-behaviors/live-guard.mjs      |  76 ++++++++++-
 scripts/daytona-behaviors/live-guard.test.mjs |  74 +++++++++++
 7 files changed, 433 insertions(+), 28 deletions(-)
 create mode 100644 scripts/artifact-installation.test.mjs

diff --git a/scripts/artifact-installation.mjs b/scripts/artifact-installation.mjs
index 406daba80..ed266bd07 100644
--- a/scripts/artifact-installation.mjs
+++ b/scripts/artifact-installation.mjs
@@ -1,22 +1,43 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
-import { isAbsolute, join, relative } from "node:path";
+import { lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const readJson = (file) => JSON.parse(readFileSync(file, "utf8"));
 
+export function resolveArtifactDirectory(value) {
+	assert(typeof value === "string" && value.length > 0 && !value.includes("\0"), "Invalid artifact directory");
+	const directory = resolve(value);
+	for (const base of [process.cwd(), tmpdir(), homedir(), "/tmp"]) {
+		const root = resolve(base);
+		if (!directory.startsWith(root + sep)) continue;
+		let current = root;
+		for (const component of relative(root, directory).split(sep)) {
+			current = join(current, component);
+			const entry = lstatSync(current, { throwIfNoEntry: false });
+			assert(!entry?.isSymbolicLink(), "Artifact directory must not traverse symlinks");
+			assert(!entry || entry.isDirectory(), "Artifact directory contains a non-directory component");
+		}
+		return directory;
+	}
+	throw new Error("Artifact directory must be inside the workspace, home, or temporary directory");
+}
+
 export function assertContained(file, directory) {
 	const local = relative(realpathSync(directory), realpathSync(file));
 	assert(local === "" || (!local.startsWith("..") && !isAbsolute(local)), `Path escapes isolated consumer: ${file}`);
 }
 
 export function verifyTarballs(directory, records, packages) {
+	directory = resolveArtifactDirectory(directory);
 	assert.equal(records.length, packages.length, "Incomplete tarball inventory");
 	assert.equal(new Set(records.map((pkg) => pkg.name)).size, packages.length, "Duplicate tarball identity");
 	for (const pkg of packages) {
 		const record = records.find((entry) => entry.name === pkg.name);
 		assert(record && record.version === pkg.version, `Missing tarball: ${pkg.name}`);
+		assert(typeof record.filename === "string" && basename(record.filename) === record.filename, "Invalid tarball filename");
 		assert.equal(record.filename, `${pkg.name.replace("@", "").replace("/", "-")}-${pkg.version}.tgz`);
 		assert.equal(
 			digest(readFileSync(join(directory, record.filename))),
@@ -27,12 +48,19 @@ export function verifyTarballs(directory, records, packages) {
 }
 
 export function isolatedEnvironment(directory) {
-	const env = {};
-	for (const key of ["PATH", "SystemRoot", "WINDIR", "COMSPEC", "PATHEXT", "LANG"]) {
-		if (process.env[key]) env[key] = process.env[key];
-	}
+	directory = resolveArtifactDirectory(directory);
+	// Read literal allowlisted names: dynamic environment lookups can accidentally
+	// admit credentials when this helper is reused by installation/lifecycle code.
+	const env = Object.fromEntries(Object.entries({
+		PATH: process.env.PATH,
+		SystemRoot: process.env.SystemRoot,
+		WINDIR: process.env.WINDIR,
+		COMSPEC: process.env.COMSPEC,
+		PATHEXT: process.env.PATHEXT,
+		LANG: process.env.LANG,
+	}).filter(([, value]) => typeof value === "string"));
 	for (const dir of ["home", "config", "cache", "prefix", "project", "agent", "temp"])
-		mkdirSync(join(directory, dir), { recursive: true });
+		mkdirSync(resolveArtifactDirectory(join(directory, dir)), { recursive: true });
 	return {
 		...env,
 		HOME: join(directory, "home"),
@@ -64,6 +92,12 @@ export function installConsumer(
 	tarballDirectory,
 	cacheDirectory = join(directory, "cache"),
 ) {
+	directory = resolveArtifactDirectory(directory);
+	cacheDirectory = resolveArtifactDirectory(cacheDirectory);
+	tarballDirectory = resolveArtifactDirectory(tarballDirectory);
+	assert(manager === "npm" || manager === "bun", "Unsupported package manager");
+	const command = manager === "npm" ? "npm" : "bun";
+	assert(selected.every((pkg) => typeof pkg.name === "string" && /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(pkg.name)), "Invalid package name");
 	mkdirSync(directory, { recursive: true });
 	const env = isolatedEnvironment(directory);
 	mkdirSync(cacheDirectory, { recursive: true });
@@ -81,7 +115,7 @@ export function installConsumer(
 		JSON.stringify({ private: true, type: "module", dependencies, overrides: dependencies }),
 	);
 	execFileSync(
-		manager,
+		command,
 		manager === "npm"
 			? ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"]
 			: ["install", "--production", "--ignore-scripts", "--network-concurrency=8"],
@@ -106,6 +140,7 @@ export function installConsumer(
 			"Installed inventory differs from the checked tarball",
 		);
 		for (const file of inventory.files) {
+			assert(typeof file.path === "string" && !isAbsolute(file.path) && !file.path.split(/[\\/]/).includes(".."), "Invalid inventory path");
 			assertContained(join(installed, file.path), installed);
 			assert.equal(
 				digest(readFileSync(join(installed, file.path))),
diff --git a/scripts/artifact-installation.test.mjs b/scripts/artifact-installation.test.mjs
new file mode 100644
index 000000000..5f51d416b
--- /dev/null
+++ b/scripts/artifact-installation.test.mjs
@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import test from "node:test";
+import { installConsumer, isolatedEnvironment, resolveArtifactDirectory, verifyTarballs } from "./artifact-installation.mjs";
+
+test("artifact directories stay within trusted roots and reject symlink components", () => {
+	const root = mkdtempSync(join(tmpdir(), "diffex-artifact-paths-"));
+	try {
+		assert.equal(resolveArtifactDirectory(join(root, "new", "consumer")), join(root, "new", "consumer"));
+		assert.throws(() => resolveArtifactDirectory("/etc/diffex-artifacts"), /workspace, home, or temporary/);
+		assert.throws(() => resolveArtifactDirectory(""), /Invalid artifact/);
+		assert.throws(() => resolveArtifactDirectory("bad\0path"), /Invalid artifact/);
+		const target = join(root, "target");
+		mkdirSync(target);
+		symlinkSync(target, join(root, "linked"));
+		assert.throws(() => resolveArtifactDirectory(join(root, "linked", "consumer")), /symlinks/);
+		symlinkSync(join(root, "missing"), join(root, "dangling"));
+		assert.throws(() => resolveArtifactDirectory(join(root, "dangling", "consumer")), /symlinks/);
+		writeFileSync(join(root, "file"), "not a directory");
+		assert.throws(() => resolveArtifactDirectory(join(root, "file", "consumer")), /non-directory/);
+	} finally {
+		rmSync(root, { recursive: true, force: true });
+	}
+});
+
+test("isolated installation environment copies literal non-secret allowlisted fields only", () => {
+	const root = mkdtempSync(join(tmpdir(), "diffex-artifact-env-"));
+	const original = { ...process.env };
+	try {
+		process.env.OPENAI_API_KEY = "synthetic-private-openai-value";
+		process.env.DAYTONA_API_KEY = "synthetic-private-daytona-value";
+		process.env.NODE_OPTIONS = "synthetic-private-node-options";
+		const environment = isolatedEnvironment(root);
+		assert.equal(environment.PATH, original.PATH);
+		assert.equal(environment.OPENAI_API_KEY, undefined);
+		assert.equal(environment.DAYTONA_API_KEY, undefined);
+		assert.equal(environment.NODE_OPTIONS, undefined);
+		assert.equal(environment.HOME, join(root, "home"));
+	} finally {
+		process.env = original;
+		rmSync(root, { recursive: true, force: true });
+	}
+});
+
+test("package manager selection is a fixed allowlist and invalid package paths fail before execution", () => {
+	const root = mkdtempSync(join(tmpdir(), "diffex-artifact-install-"));
+	try {
+		assert.throws(() => installConsumer(join(root, "consumer"), "node --eval malicious", [], [], root), /Unsupported package manager/);
+		assert.throws(() => installConsumer(join(root, "consumer"), "npm", [{ name: "../../outside" }], [], root), /Invalid package name/);
+		const pkg = { name: "@diffexai/example", version: "1.0.0" };
+		assert.throws(() => verifyTarballs(root, [{ ...pkg, filename: "../outside.tgz" }], [pkg]), /Invalid tarball filename/);
+		assert.equal(resolveArtifactDirectory(resolve(root, "consumer")), join(root, "consumer"));
+	} finally {
+		rmSync(root, { recursive: true, force: true });
+	}
+});
diff --git a/scripts/daytona-behaviors/fixture.mjs b/scripts/daytona-behaviors/fixture.mjs
index b15bc767f..dd7c4da57 100644
--- a/scripts/daytona-behaviors/fixture.mjs
+++ b/scripts/daytona-behaviors/fixture.mjs
@@ -1,8 +1,9 @@
 // Installed acceptance extension: only provider inference/HTTP are synthetic.
 // Sessions, built-in tools, auth resolution, agent orchestration and UI remain real.
-import { appendFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
 import { syncBuiltinESMExports } from "node:module";
 import { Socket } from "node:net";
+import { basename, dirname, resolve, sep } from "node:path";
 import { createAssistantMessageEventStream } from "@diffexai/diffex-ai";
 
 const toolSteps = [
@@ -85,10 +86,62 @@ function authResponse() {
 	}), { headers: { "content-type": "text/event-stream", "x-request-id": "req_behavior_auth" } });
 }
 
+// Kept self-contained: installed.py copies this extension beside installed node_modules.
+function openRecording() {
+	const requested = process.env.DIFFEX_BEHAVIOR_RECORD;
+	if (!requested) throw new Error("DIFFEX_BEHAVIOR_RECORD is required");
+	if (requested.includes("\0") || requested.split(/[\\/]/).includes("..")) {
+		throw new Error("Invalid behavior recording path");
+	}
+	const absolute = resolve(requested);
+	// These are filesystem boundaries, not env-controlled TMPDIR or record dirname.
+	const roots = [realpathSync(process.cwd()), realpathSync("/tmp")];
+	const lexicalRoots = [...roots, process.cwd(), "/tmp"];
+	if (process.platform === "darwin") {
+		roots.push(realpathSync("/private/var/folders"));
+		lexicalRoots.push("/var/folders", "/private/var/folders");
+	}
+	const lexicalRoot = lexicalRoots.find((entry) => absolute.startsWith(`${entry}${sep}`));
+	if (!lexicalRoot || !absolute.startsWith(`${lexicalRoot}${sep}`)) {
+		throw new Error("Unauthorized behavior recording destination");
+	}
+	const parent = realpathSync(dirname(absolute));
+	const recordPath = resolve(parent, basename(absolute));
+	const root = roots.find((entry) => recordPath.startsWith(`${entry}${sep}`));
+	if (!root || !recordPath.startsWith(`${root}${sep}`)) {
+		throw new Error("Unauthorized behavior recording destination");
+	}
+	const uid = process.getuid();
+	for (let directory = parent; ; directory = dirname(directory)) {
+		const info = lstatSync(directory);
+		// Permit OS-owned sticky temp roots, but not writable/shared intermediate dirs.
+		if (!info.isDirectory() || (info.uid !== uid && info.uid !== 0) ||
+			((info.mode & 0o022) !== 0 && !(info.uid === 0 && (info.mode & 0o1000) !== 0))) {
+			throw new Error("Unsafe behavior recording directory");
+		}
+		if (directory === root) break;
+	}
+	// Open without truncation before inspecting the file; never trust a path precheck.
+	const fd = openSync(recordPath, constants.O_RDWR | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+	try {
+		const opened = fstatSync(fd);
+		const current = lstatSync(recordPath);
+		if (
+			!opened.isFile() || opened.nlink !== 1 || opened.uid !== uid || (opened.mode & 0o022) !== 0 || !current.isFile() ||
+			opened.dev !== current.dev || opened.ino !== current.ino ||
+			realpathSync(parent) !== parent
+		) throw new Error("Behavior recording changed while opening");
+		return fd;
+	} catch (error) {
+		closeSync(fd);
+		throw error;
+	}
+}
+
 export default function (diffex) {
-	const recordPath = process.env.DIFFEX_BEHAVIOR_RECORD;
-	if (!recordPath) throw new Error("DIFFEX_BEHAVIOR_RECORD is required");
-	const record = (value) => appendFileSync(recordPath, `${JSON.stringify(value)}\n`);
+	const recordFd = openRecording();
+	diffex.on("session_shutdown", () => closeSync(recordFd));
+	const record = (value) => appendFileSync(recordFd, `${JSON.stringify(value)}\n`);
 	diffex.on("agent_settled", () => { record({ type: "settled" }); });
 	diffex.on("tool_result", (event) => { record({ ...event, type: "tool_result" }); });
 	const transport = process.env.DIFFEX_BEHAVIOR_TRANSPORT === "1";
diff --git a/scripts/daytona-behaviors/fixture.test.mjs b/scripts/daytona-behaviors/fixture.test.mjs
index 11c837d0d..08833a2d1 100644
--- a/scripts/daytona-behaviors/fixture.test.mjs
+++ b/scripts/daytona-behaviors/fixture.test.mjs
@@ -1,12 +1,13 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, linkSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { Socket } from "node:net";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, relative, resolve } from "node:path";
 import { test } from "node:test";
 import { fileURLToPath } from "node:url";
 import fixture from "./fixture.mjs";
+import guard from "./live-guard.mjs";
 
 const cli = fileURLToPath(new URL("../../packages/coding-agent/dist/cli.js", import.meta.url));
 const extension = fileURLToPath(new URL("./fixture.mjs", import.meta.url));
@@ -142,3 +143,121 @@ test("transport rejects unexpected hosts, credentials and custom headers without
 		rmSync(directory, { recursive: true, force: true });
 	}
 });
+
+for (const [name, extension] of [["fixture", fixture], ["live guard", guard]]) {
+	test(`${name} rejects traversal, unauthorized paths, symlinks, hardlinks and nonregular recordings`, () => {
+		const directory = mkdtempSync(join(tmpdir(), "behavior-record-boundary-"));
+		const outside = mkdtempSync("/var/tmp/behavior-record-outside-");
+		const originalEnv = { ...process.env };
+		try {
+			const target = join(directory, "untouched.jsonl");
+			writeFileSync(target, "fixture-owned marker\n");
+			const symlink = join(directory, "symlink.jsonl");
+			symlinkSync(target, symlink);
+			const hardlink = join(directory, "hardlink.jsonl");
+			linkSync(target, hardlink);
+			const nonregular = join(directory, "directory.jsonl");
+			mkdirSync(nonregular);
+			const fifo = join(directory, "fifo.jsonl");
+			assert.equal(spawnSync("mkfifo", [fifo]).status, 0);
+			const escaped = join(directory, "escaped");
+			symlinkSync(outside, escaped);
+			writeFileSync(join(outside, "events.jsonl"), "fixture-owned marker\n");
+			const shared = join(directory, "shared");
+			mkdirSync(shared);
+			chmodSync(shared, 0o777);
+			const writable = join(directory, "shared.jsonl");
+			writeFileSync(writable, "fixture-owned marker\n");
+			chmodSync(writable, 0o666);
+			for (const path of [
+				`${directory}/../escape.jsonl`,
+				"/not-a-behavior-record-root/events.jsonl",
+				`${process.cwd()}-not-the-workspace/events.jsonl`,
+				`${directory}/nul\0.jsonl`,
+				symlink, hardlink, nonregular, fifo, writable, join(shared, "events.jsonl"), join(escaped, "events.jsonl"),
+			]) {
+				process.env.DIFFEX_BEHAVIOR_RECORD = path;
+				// Neither TMPDIR nor isolated config vars may grant arbitrary filesystem access.
+				process.env.TMPDIR = "/not-a-behavior-record-root";
+				process.env.DIFFEX_CODING_AGENT_DIR = "/not-a-behavior-record-root/agent";
+				assert.throws(() => extension({ on() { assert.fail("Unsafe recording accepted"); } }), /recording (path|destination|directory|must|changed)|ELOOP|EISDIR/);
+			}
+			delete process.env.DIFFEX_BEHAVIOR_RECORD;
+			assert.throws(() => extension({}), /DIFFEX_BEHAVIOR_RECORD is required/);
+			assert.equal(readFileSync(target, "utf8"), "fixture-owned marker\n");
+			assert.equal(readFileSync(join(outside, "events.jsonl"), "utf8"), "fixture-owned marker\n");
+		} finally {
+			process.env = originalEnv;
+			rmSync(directory, { recursive: true, force: true });
+			rmSync(outside, { recursive: true, force: true });
+		}
+	});
+
+	test(`${name} pins the validated file descriptor across path and environment replacement`, () => {
+		const directory = mkdtempSync(join(tmpdir(), "behavior-record-fd-"));
+		const originalEnv = { ...process.env };
+		const originalFetch = globalThis.fetch;
+		const originalConnect = Socket.prototype.connect;
+		const callbacks = new Map();
+		try {
+			const path = join(directory, "events.jsonl");
+			const pinned = join(directory, "pinned.jsonl");
+			const target = join(directory, "untouched.jsonl");
+			writeFileSync(target, "fixture-owned marker\n");
+			process.env.DIFFEX_BEHAVIOR_RECORD = path;
+			process.env.DIFFEX_BEHAVIOR_TRANSPORT = "0";
+			extension({ on(name, callback) { callbacks.set(name, callback); }, registerProvider() {} });
+			renameSync(path, pinned);
+			symlinkSync(target, path);
+			process.env.DIFFEX_BEHAVIOR_RECORD = target;
+			callbacks.get("agent_settled")();
+			assert.deepEqual(records(pinned), [{ type: "settled" }]);
+			assert.equal(readFileSync(target, "utf8"), "fixture-owned marker\n");
+		} finally {
+			callbacks.get("session_shutdown")?.();
+			globalThis.fetch = originalFetch;
+			Socket.prototype.connect = originalConnect;
+			process.env = originalEnv;
+			rmSync(directory, { recursive: true, force: true });
+		}
+	});
+
+	test(`${name} permits cwd-relative and isolated sandbox recordings with variable filenames`, () => {
+		const directory = mkdtempSync(join(tmpdir(), "behavior-record-local-"));
+		const local = mkdtempSync(join(process.cwd(), ".behavior-record-local-"));
+		const originalEnv = { ...process.env };
+		const originalCwd = process.cwd();
+		const originalFetch = globalThis.fetch;
+		const originalConnect = Socket.prototype.connect;
+		try {
+			for (const name of ["project", "agent", "home", "temp"]) mkdirSync(join(directory, name));
+			process.env.HOME = join(directory, "home");
+			process.env.TMPDIR = join(directory, "temp");
+			process.env.DIFFEX_CODING_AGENT_DIR = join(directory, "agent");
+			process.env.DIFFEX_BEHAVIOR_TRANSPORT = "0";
+			for (const [cwd, path] of [
+				[originalCwd, relative(originalCwd, join(local, "local-events.jsonl"))],
+				[join(directory, "project"), join(directory, "different-name.jsonl")],
+			]) {
+				process.chdir(cwd);
+				process.env.DIFFEX_BEHAVIOR_RECORD = path;
+				const callbacks = new Map();
+				try {
+					extension({ on(name, callback) { callbacks.set(name, callback); }, registerProvider() {} });
+					callbacks.get("agent_settled")();
+					assert.deepEqual(records(path), [{ type: "settled" }]);
+				} finally {
+					callbacks.get("session_shutdown")?.();
+					rmSync(resolve(path), { force: true });
+					globalThis.fetch = originalFetch;
+					Socket.prototype.connect = originalConnect;
+				}
+			}
+		} finally {
+			process.chdir(originalCwd);
+			process.env = originalEnv;
+			rmSync(directory, { recursive: true, force: true });
+			rmSync(local, { recursive: true, force: true });
+		}
+	});
+}
diff --git a/scripts/daytona-behaviors/install.mjs b/scripts/daytona-behaviors/install.mjs
index 10f221cee..16f96b728 100644
--- a/scripts/daytona-behaviors/install.mjs
+++ b/scripts/daytona-behaviors/install.mjs
@@ -1,22 +1,24 @@
 import assert from "node:assert/strict";
 import { readFileSync, realpathSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { installConsumer, verifyTarballs } from "../artifact-installation.mjs";
+import { join } from "node:path";
+import { installConsumer, resolveArtifactDirectory, verifyTarballs } from "../artifact-installation.mjs";
 
 const [artifacts, consumer, manager, commit] = process.argv.slice(2);
 assert(artifacts && consumer && ["npm", "bun"].includes(manager) && /^[a-f0-9]{40}$/.test(commit),
 	"Usage: node install.mjs ARTIFACTS CONSUMER npm|bun COMMIT");
-const manifest = JSON.parse(readFileSync(join(artifacts, "manifest.json"), "utf8"));
+const artifactDirectory = resolveArtifactDirectory(artifacts);
+const consumerDirectory = resolveArtifactDirectory(consumer);
+const manifest = JSON.parse(readFileSync(join(artifactDirectory, "manifest.json"), "utf8"));
 assert.equal(manifest.source.commit, commit, "Retained source does not match triggering commit");
 assert.equal(manifest.schemaVersion, 1);
 const packages = manifest.packages;
 assert.equal(packages.length, 1, "Expected the standalone CLI distribution");
 assert.equal(packages[0].name, "@diffexai/diffex");
-verifyTarballs(artifacts, packages, packages);
-installConsumer(resolve(consumer), manager, packages, packages, resolve(artifacts));
-const executable = join(resolve(consumer), "node_modules/.bin/diffex");
-assert(realpathSync(executable).startsWith(`${resolve(consumer)}/node_modules/`));
-writeFileSync(join(consumer, "installation.json"), `${JSON.stringify({
+verifyTarballs(artifactDirectory, packages, packages);
+installConsumer(consumerDirectory, manager, packages, packages, artifactDirectory);
+const executable = join(consumerDirectory, "node_modules/.bin/diffex");
+assert(realpathSync(executable).startsWith(`${consumerDirectory}/node_modules/`));
+writeFileSync(join(consumerDirectory, "installation.json"), `${JSON.stringify({
 	manager, executable, resolved: realpathSync(executable), commit,
 	artifacts: packages.map(({ name, sha256 }) => ({ name, sha256 })), integrity: "passed",
 }, null, 2)}\n`);
diff --git a/scripts/daytona-behaviors/live-guard.mjs b/scripts/daytona-behaviors/live-guard.mjs
index dcea8a01a..3fd35a603 100644
--- a/scripts/daytona-behaviors/live-guard.mjs
+++ b/scripts/daytona-behaviors/live-guard.mjs
@@ -1,17 +1,76 @@
-import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, resolve, sep } from "node:path";
+
+// Kept self-contained: installed.py copies this extension beside installed node_modules.
+function openRecording() {
+	const requested = process.env.DIFFEX_BEHAVIOR_RECORD;
+	if (!requested) throw new Error("DIFFEX_BEHAVIOR_RECORD is required");
+	if (requested.includes("\0") || requested.split(/[\\/]/).includes("..")) {
+		throw new Error("Invalid behavior recording path");
+	}
+	const absolute = resolve(requested);
+	// These are filesystem boundaries, not env-controlled TMPDIR or record dirname.
+	const roots = [realpathSync(process.cwd()), realpathSync("/tmp")];
+	const lexicalRoots = [...roots, process.cwd(), "/tmp"];
+	if (process.platform === "darwin") {
+		roots.push(realpathSync("/private/var/folders"));
+		lexicalRoots.push("/var/folders", "/private/var/folders");
+	}
+	const lexicalRoot = lexicalRoots.find((entry) => absolute.startsWith(`${entry}${sep}`));
+	if (!lexicalRoot || !absolute.startsWith(`${lexicalRoot}${sep}`)) {
+		throw new Error("Unauthorized behavior recording destination");
+	}
+	const parent = realpathSync(dirname(absolute));
+	const recordPath = resolve(parent, basename(absolute));
+	const root = roots.find((entry) => recordPath.startsWith(`${entry}${sep}`));
+	if (!root || !recordPath.startsWith(`${root}${sep}`)) {
+		throw new Error("Unauthorized behavior recording destination");
+	}
+	const uid = process.getuid();
+	for (let directory = parent; ; directory = dirname(directory)) {
+		const info = lstatSync(directory);
+		// Permit OS-owned sticky temp roots, but not writable/shared intermediate dirs.
+		if (!info.isDirectory() || (info.uid !== uid && info.uid !== 0) ||
+			((info.mode & 0o022) !== 0 && !(info.uid === 0 && (info.mode & 0o1000) !== 0))) {
+			throw new Error("Unsafe behavior recording directory");
+		}
+		if (directory === root) break;
+	}
+	// Open without truncation before inspecting the file; never trust a path precheck.
+	const fd = openSync(recordPath, constants.O_RDWR | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+	try {
+		const opened = fstatSync(fd);
+		const current = lstatSync(recordPath);
+		if (
+			!opened.isFile() || opened.nlink !== 1 || opened.uid !== uid || (opened.mode & 0o022) !== 0 || !current.isFile() ||
+			opened.dev !== current.dev || opened.ino !== current.ino ||
+			realpathSync(parent) !== parent
+		) throw new Error("Behavior recording changed while opening");
+		return fd;
+	} catch (error) {
+		closeSync(fd);
+		throw error;
+	}
+}
 
 // Observes the installed provider transport; never supplies a model response.
 export default function (diffex) {
+	const recordFd = openRecording();
+	let requests;
+	try {
+		requests = readFileSync(recordFd, "utf8").trim().split("\n").filter((line) => line && JSON.parse(line).type === "request").length;
+	} catch (error) {
+		closeSync(recordFd);
+		throw error;
+	}
+	diffex.on("session_shutdown", () => closeSync(recordFd));
 	const record = (event) => {
 		const serialized = JSON.stringify(event);
 		const key = process.env.OPENAI_API_KEY;
-		appendFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, `${key ? serialized.replaceAll(key, "[REDACTED]") : serialized}\n`);
+		appendFileSync(recordFd, `${key ? serialized.replaceAll(key, "[REDACTED]") : serialized}\n`);
 	};
 	const originalFetch = globalThis.fetch;
 	const started = Number(process.env.DIFFEX_BEHAVIOR_STARTED);
-	let requests = existsSync(process.env.DIFFEX_BEHAVIOR_RECORD)
-		? readFileSync(process.env.DIFFEX_BEHAVIOR_RECORD, "utf8").trim().split("\n").filter((line) => line && JSON.parse(line).type === "request").length
-		: 0;
 	globalThis.fetch = async (input, init) => {
 		const request = new Request(input, init);
 		const url = new URL(request.url);
@@ -28,7 +87,12 @@ export default function (diffex) {
 			const response = await originalFetch(new Request(request, {
 				body: JSON.stringify(body), signal: AbortSignal.any([request.signal, AbortSignal.timeout(180_000 - (Date.now() - started))]),
 			}));
-			record({ type: "response", status: response.status });
+			const actualStatus = response.status;
+			const status = Number(actualStatus);
+			if (typeof actualStatus !== "number" || !Number.isInteger(status) || status < 100 || status > 599) {
+				throw new Error("Invalid live HTTP response status");
+			}
+			record({ type: "response", status });
 			return response;
 		} catch (error) {
 			record({ type: "provider-error", error: error instanceof Error ? error.name : "UnknownError" });
diff --git a/scripts/daytona-behaviors/live-guard.test.mjs b/scripts/daytona-behaviors/live-guard.test.mjs
index ff382881b..60c66cfd3 100644
--- a/scripts/daytona-behaviors/live-guard.test.mjs
+++ b/scripts/daytona-behaviors/live-guard.test.mjs
@@ -28,6 +28,7 @@ test("live transport shares six-request budget across CLI and TUI and caps outpu
 		await call();
 		await assert.rejects(call, /budget exceeded/);
 		assert.equal(sent, 1);
+		assert.equal(readFileSync(record, "utf8").split("\n").filter(Boolean).map(JSON.parse).find((event) => event.type === "response").status, 200);
 		assert.equal(readFileSync(record, "utf8").split("\n").filter((line) => line && JSON.parse(line).type === "request").length, 6);
 		await assert.rejects(() => globalThis.fetch("https://unexpected.invalid"), /destination/);
 	} finally {
@@ -39,3 +40,76 @@ test("live transport shares six-request budget across CLI and TUI and caps outpu
 		rmSync(root, { recursive: true, force: true });
 	}
 });
+
+test("live guard records exact HTTP diagnostics and preserves usage, tools and streamed evidence", async () => {
+	const root = mkdtempSync(join(tmpdir(), "behavior-live-status-"));
+	const original = globalThis.fetch;
+	const originalEnv = { ...process.env };
+	const callbacks = new Map();
+	try {
+		const record = join(root, "events.jsonl");
+		process.env.DIFFEX_BEHAVIOR_RECORD = record;
+		process.env.DIFFEX_BEHAVIOR_STARTED = String(Date.now());
+		process.env.OPENAI_API_KEY = "fixture-only-secret";
+		const statuses = [200, 401, 429, 500, 503, 599];
+		const responses = statuses.map((status) => new Response("fixture-only response", { status }));
+		let sent = 0;
+		globalThis.fetch = async () => responses[sent++];
+		guard({ on(name, callback) { callbacks.set(name, callback); } });
+		for (const response of responses) {
+			assert.equal(await globalThis.fetch("https://api.openai.com/v1/responses", {
+				method: "POST", body: "{}",
+			}), response);
+		}
+		const tool = { toolName: "read", content: [{ type: "text", text: "fixture-only-secret" }], isError: false };
+		callbacks.get("tool_result")(tool);
+		callbacks.get("message_update")({ assistantMessageEvent: { type: "text_delta", delta: "fixture-only-secret streamed" } });
+		const usage = { input: 17, output: 23, totalTokens: 40, cost: { total: 0.001 } };
+		callbacks.get("agent_end")({ messages: [{ role: "assistant", content: [{ type: "text", text: "done" }], usage }] });
+		callbacks.get("agent_settled")();
+		const text = readFileSync(record, "utf8");
+		const events = text.trim().split("\n").map(JSON.parse);
+		assert.deepEqual(events.filter((event) => event.type === "response").map((event) => event.status), statuses);
+		assert.deepEqual(events.find((event) => event.type === "tool_result"), { type: "tool_result", ...tool, content: [{ type: "text", text: "[REDACTED]" }] });
+		assert.deepEqual(events.find((event) => event.type === "streamed-text"), { type: "streamed-text", delta: "[REDACTED] streamed" });
+		assert.deepEqual(events.find((event) => event.type === "agent_end").messages[0].usage, usage);
+		assert.equal(events.at(-1).type, "settled");
+		assert.equal(text.includes("fixture-only-secret"), false);
+	} finally {
+		callbacks.get("session_shutdown")?.();
+		globalThis.fetch = original;
+		process.env = originalEnv;
+		rmSync(root, { recursive: true, force: true });
+	}
+});
+
+test("live guard rejects nonnumeric, injected and out-of-range response statuses without logging payloads", async () => {
+	const root = mkdtempSync(join(tmpdir(), "behavior-live-status-injection-"));
+	const original = globalThis.fetch;
+	const originalEnv = { ...process.env };
+	const invalid = ["401\n{\"type\":\"forged\"}", "429", NaN, Infinity, 200.5, 600];
+	try {
+		for (const [index, status] of invalid.entries()) {
+			const record = join(root, `events-${index}.jsonl`);
+			process.env.DIFFEX_BEHAVIOR_RECORD = record;
+			process.env.DIFFEX_BEHAVIOR_STARTED = String(Date.now());
+			globalThis.fetch = async () => ({ status });
+			const callbacks = new Map();
+			try {
+				guard({ on(name, callback) { callbacks.set(name, callback); } });
+				await assert.rejects(() => globalThis.fetch("https://api.openai.com/v1/responses", {
+					method: "POST", body: "{}",
+				}), /Invalid live HTTP response status/);
+				const events = readFileSync(record, "utf8").trim().split("\n").map(JSON.parse);
+				assert.deepEqual(events.map((event) => event.type), ["request", "provider-error"]);
+				assert.equal(events[1].error, "Error");
+			} finally {
+				callbacks.get("session_shutdown")?.();
+			}
+		}
+	} finally {
+		globalThis.fetch = original;
+		process.env = originalEnv;
+		rmSync(root, { recursive: true, force: true });
+	}
+});

From 7b43324b2f479a24e73522947dded67dd304e53d Mon Sep 17 00:00:00 2001
From: Jay Yu <yibai14651@gmail.com>
Date: Tue, 27 Oct 2026 18:58:12 -0400
Subject: [PATCH 12/12] fix(coding-agent): confine evidence paths and verify
 installed CLI execution

---
 .github/workflows/daytona-behaviors.yml       |   3 +-
 scripts/daytona-behaviors-workflow.test.mjs   |   2 +
 .../daytona-behaviors/sanitize_evidence.py    |  90 +++++--
 .../test_sanitize_evidence.py                 | 131 ++++++++-
 scripts/test_verify_candidate_artifacts.py    | 249 ++++++++++++++++++
 scripts/verify-candidate-artifacts.py         | 128 ++++++++-
 6 files changed, 574 insertions(+), 29 deletions(-)
 create mode 100644 scripts/test_verify_candidate_artifacts.py

diff --git a/.github/workflows/daytona-behaviors.yml b/.github/workflows/daytona-behaviors.yml
index c48688c8d..45d196fbd 100644
--- a/.github/workflows/daytona-behaviors.yml
+++ b/.github/workflows/daytona-behaviors.yml
@@ -47,7 +47,8 @@ jobs:
           python3 -m venv "$RUNNER_TEMP/behavior-test-venv"
           "$RUNNER_TEMP/behavior-test-venv/bin/python" -m pip install -r scripts/daytona-behaviors/requirements.txt
           "$RUNNER_TEMP/behavior-test-venv/bin/python" -m unittest discover -s scripts/daytona-behaviors -p 'test_*.py'
-          node --test scripts/artifact-acceptance.test.mjs scripts/daytona-behaviors-workflow.test.mjs scripts/daytona-behaviors/fixture.test.mjs scripts/daytona-behaviors/live-guard.test.mjs
+          "$RUNNER_TEMP/behavior-test-venv/bin/python" -m unittest discover -s scripts -p 'test_verify_candidate_artifacts.py'
+          node --test scripts/artifact-installation.test.mjs scripts/artifact-acceptance.test.mjs scripts/daytona-behaviors-workflow.test.mjs scripts/daytona-behaviors/fixture.test.mjs scripts/daytona-behaviors/live-guard.test.mjs
       - name: Bundle checked behavior harness without rebuilding the candidate
         run: |
           mkdir -p .artifacts/daytona-bundle
diff --git a/scripts/daytona-behaviors-workflow.test.mjs b/scripts/daytona-behaviors-workflow.test.mjs
index 73ddf01ba..9283ccf3a 100644
--- a/scripts/daytona-behaviors-workflow.test.mjs
+++ b/scripts/daytona-behaviors-workflow.test.mjs
@@ -57,6 +57,8 @@ test("one 35-minute preparation freezes, builds offline, prepares and verifies t
 	assert.ok(script.includes("npm ci --ignore-scripts"));
 	assert.ok(script.includes("sha256sum .artifacts/daytona-bundle/bundle.tar.gz"));
 	assert.match(script, /-m unittest discover -s scripts\/daytona-behaviors/);
+	assert.match(script, /-m unittest discover -s scripts -p 'test_verify_candidate_artifacts\.py'/);
+	assert.match(script, /node --test scripts\/artifact-installation\.test\.mjs/);
 	assert.match(script, /node --test .*daytona-behaviors\/fixture\.test\.mjs/);
 	for (const step of prepare.steps) {
 		assert.equal(step.env?.DAYTONA_API_KEY, undefined);
diff --git a/scripts/daytona-behaviors/sanitize_evidence.py b/scripts/daytona-behaviors/sanitize_evidence.py
index 353ef76d3..ad96423b5 100644
--- a/scripts/daytona-behaviors/sanitize_evidence.py
+++ b/scripts/daytona-behaviors/sanitize_evidence.py
@@ -6,8 +6,10 @@
 import json
 import os
 from pathlib import Path
+import pwd
 import shutil
 import stat
+import sys
 import tempfile
 
 
@@ -16,6 +18,45 @@
               ".npmrc", ".netrc", "_netrc", ".git-credentials", ".env", ".ssh", ".aws"}
 
 
+def local_path(value: Path) -> Path:
+    """Confine local evidence to the workspace, owner home, or system temp.
+
+    Normalize before checking a separator-terminated prefix and common ancestor.
+    System temp aliases (e.g. /tmp on macOS) are trusted only at the root; no
+    symlink below the selected root may redirect a read or publication write.
+    """
+    if ".." in value.parts:
+        raise ValueError("path traversal is not permitted")
+    roots = {os.path.abspath(root) for root in
+             (os.getcwd(), pwd.getpwuid(os.getuid()).pw_dir, tempfile.gettempdir(), "/tmp")}
+    if sys.platform == "darwin":
+        # Darwin's _CS_DARWIN_USER_TEMP_DIR (<unistd.h>) is independent of the
+        # nested TMPDIR assigned by an isolated consumer's environment.
+        native = os.confstr(65537)
+        if not native:
+            raise ValueError("missing OS user temporary directory")
+        metadata = os.stat(os.path.realpath(native))
+        if (not stat.S_ISDIR(metadata.st_mode) or metadata.st_uid != os.getuid() or
+                stat.S_IMODE(metadata.st_mode) & 0o077):
+            raise ValueError("OS user temporary directory is not owner-private")
+        roots.add(os.path.abspath(native))
+    roots.discard(os.path.sep)
+    roots.update(os.path.realpath(root) for root in tuple(roots))
+    absolute = os.path.abspath(value)
+    if not absolute.startswith(tuple(root + os.path.sep for root in roots)):
+        raise ValueError("path outside local evidence roots")
+    scopes = [root for root in roots if os.path.commonpath([root, absolute]) == root and absolute != root]
+    scope = max(scopes, key=len)
+    canonical = os.path.realpath(absolute)
+    canonical_scope = os.path.realpath(scope)
+    if not canonical.startswith(canonical_scope + os.path.sep):
+        raise ValueError("path outside local evidence root")
+    if (os.path.commonpath([canonical_scope, canonical]) != canonical_scope or
+            canonical != os.path.join(canonical_scope, os.path.relpath(absolute, scope))):
+        raise ValueError("local evidence path traverses a symlink")
+    return Path(canonical)
+
+
 def sanitize(root: Path, output: Path, mode: str) -> bool:
     """Publish only a fully scanned copy. Return False on any credential match.
 
@@ -23,6 +64,10 @@ def sanitize(root: Path, output: Path, mode: str) -> bool:
     Auth entries and symlinks are excluded without opening them. The source is not
     modified, so recovery can still use its original state before publication.
     """
+    if mode not in {"deterministic", "live"}:
+        raise ValueError("invalid scan mode")
+    root = local_path(root)
+    output = local_path(output)
     names = ["DAYTONA_API_KEY"] + (["OPENAI_API_KEY"] if mode == "live" else [])
     secrets = sorted({os.environ[name].encode() for name in names if os.environ.get(name)}, key=len, reverse=True)
     # Missing secrets make a complete publication scan impossible, not successful.
@@ -30,12 +75,8 @@ def sanitize(root: Path, output: Path, mode: str) -> bool:
         raise ValueError("missing scan credential")
     if root.is_symlink() or not root.is_dir():
         raise ValueError("invalid evidence root")
-    root = root.resolve()
-    output = output.absolute()
-    if output.is_relative_to(root) or root.is_relative_to(output.resolve()) or output.exists() or output.is_symlink():
+    if output.is_relative_to(root) or root.is_relative_to(output) or output.exists() or output.is_symlink():
         raise ValueError("invalid publication destination")
-    if output.resolve() != output:
-        raise ValueError("publication destination traverses a symlink")
     output.parent.mkdir(parents=True, exist_ok=True)
     replacement = b"[REDACTED]"
     if any(secret in replacement for secret in secrets):
@@ -51,14 +92,14 @@ def redact(data: bytes) -> bytes:
             data = data.replace(secret, replacement)
         return data
 
-    def visit(source: Path, target: Path, relative: Path) -> None:
-        for entry in sorted(source.iterdir()):
-            safe_name = os.fsdecode(redact(os.fsencode(entry.name)))
+    def visit(source: int, target: Path, relative: Path) -> None:
+        for name in sorted(os.listdir(source)):
+            safe_name = os.fsdecode(redact(os.fsencode(name)))
             if not safe_name or safe_name in {".", ".."}:
                 raise ValueError("invalid sanitized name")
             safe_relative = relative / safe_name
-            metadata = entry.lstat()
-            lower = entry.name.lower()
+            metadata = os.stat(name, dir_fd=source, follow_symlinks=False)
+            lower = name.lower()
             reason = None
             if stat.S_ISLNK(metadata.st_mode):
                 reason = "symlink"
@@ -73,11 +114,19 @@ def visit(source: Path, target: Path, relative: Path) -> None:
             if destination.exists() or (relative == Path() and safe_name == REPORT):
                 raise ValueError("publication name collision")
             if stat.S_ISDIR(metadata.st_mode):
-                destination.mkdir()
-                visit(entry, destination, safe_relative)
+                descriptor = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_DIRECTORY, dir_fd=source)
+                try:
+                    opened = os.fstat(descriptor)
+                    if (opened.st_dev, opened.st_ino) != (metadata.st_dev, metadata.st_ino):
+                        raise ValueError("evidence changed during scan")
+                    destination.mkdir()
+                    visit(descriptor, destination, safe_relative)
+                finally:
+                    os.close(descriptor)
                 continue
-            # O_NOFOLLOW rejects a symlink swapped in between lstat and open.
-            descriptor = os.open(entry, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+            # Descriptor-relative access pins every parent; O_NOFOLLOW also
+            # rejects a final symlink swapped in between stat and open.
+            descriptor = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=source)
             with os.fdopen(descriptor, "rb") as stream:
                 opened = os.fstat(stream.fileno())
                 if not stat.S_ISREG(opened.st_mode) or (opened.st_dev, opened.st_ino) != (metadata.st_dev, metadata.st_ino):
@@ -89,7 +138,11 @@ def visit(source: Path, target: Path, relative: Path) -> None:
 
     temporary = Path(tempfile.mkdtemp(prefix=".publication-", dir=output.parent))
     try:
-        visit(root, temporary, Path())
+        descriptor = os.open(root, os.O_RDONLY | os.O_NOFOLLOW | os.O_DIRECTORY)
+        try:
+            visit(descriptor, temporary, Path())
+        finally:
+            os.close(descriptor)
         report = {"schemaVersion": 1, "safe_to_upload": True, "mode": mode,
                   "credential_names": names, "credential_matches": matches,
                   "outcome": "credential-found" if matches else "clean",
@@ -112,7 +165,12 @@ def visit(source: Path, target: Path, relative: Path) -> None:
 def set_output(safe: bool) -> None:
     destination = os.environ.get("GITHUB_OUTPUT")
     if destination:
-        with open(destination, "a", encoding="utf-8") as stream:
+        path = local_path(Path(destination))
+        descriptor = os.open(path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+        with os.fdopen(descriptor, "a", encoding="utf-8") as stream:
+            metadata = os.fstat(stream.fileno())
+            if not stat.S_ISREG(metadata.st_mode) or metadata.st_nlink != 1:
+                raise ValueError("invalid workflow output file")
             stream.write(f"safe_to_upload={'true' if safe else 'false'}\n")
 
 
diff --git a/scripts/daytona-behaviors/test_sanitize_evidence.py b/scripts/daytona-behaviors/test_sanitize_evidence.py
index 5bfc09fe9..7cfa9925e 100644
--- a/scripts/daytona-behaviors/test_sanitize_evidence.py
+++ b/scripts/daytona-behaviors/test_sanitize_evidence.py
@@ -10,7 +10,7 @@
 import unittest
 from unittest.mock import patch
 
-from sanitize_evidence import REPORT, sanitize
+from sanitize_evidence import REPORT, local_path, sanitize
 
 
 DAYTONA = "synthetic-daytona-secret-123456789"
@@ -105,7 +105,7 @@ def test_nested_auth_files_directories_and_symlinks_are_excluded_without_reading
         original_open = os.open
 
         def checked_open(path, *args, **kwargs):
-            self.assertEqual(Path(path).name, "normal.txt", "Excluded file was opened")
+            self.assertIn(Path(path).name, {"raw", "evidence", "nested", "normal.txt"}, "Excluded file was opened")
             return original_open(path, *args, **kwargs)
 
         # tempfile also opens a file during mkdtemp only on first use, already initialized.
@@ -164,6 +164,133 @@ def assert_key(key):
         self.assertEqual(self.report()["credential_names"], ["DAYTONA_API_KEY"])
         self.assertEqual((self.output / "capture.txt").read_text(), OPENAI)
 
+    def test_local_scope_accepts_canonical_workspace_home_and_temp_descendants(self):
+        with patch("sanitize_evidence.os.getcwd", return_value=str(self.base / "workspace")), \
+                patch("sanitize_evidence.pwd.getpwuid") as owner, \
+                patch("sanitize_evidence.tempfile.gettempdir", return_value=str(self.base / "temp")):
+            owner.return_value.pw_dir = str(self.base / "home")
+            for root in ["workspace", "home", "temp"]:
+                path = self.base / root / "evidence" / "nested"
+                self.assertEqual(local_path(path), path)
+            with self.assertRaises(ValueError):
+                local_path(Path("/etc/diffex-publication"))
+
+    @unittest.skipUnless(sys.platform == "darwin", "Darwin OS user temp boundary")
+    def test_native_user_temp_evidence_survives_isolated_tmpdir_and_cwd(self):
+        consumer = self.base / "npm/process acceptance"
+        isolated_temp = consumer / "temp"
+        isolated_temp.mkdir(parents=True)
+        with patch.dict(os.environ, {"TMPDIR": str(isolated_temp)}), \
+                patch("sanitize_evidence.tempfile.tempdir", None), \
+                patch("sanitize_evidence.os.getcwd", return_value=str(consumer)), \
+                patch("sanitize_evidence.pwd.getpwuid") as owner:
+            owner.return_value.pw_dir = "/unrelated-owner-home"
+            self.assertEqual(tempfile.gettempdir(), str(isolated_temp))
+            self.assertTrue(sanitize(self.root, self.output, "live"))
+        self.assertTrue(self.report()["safe_to_upload"])
+
+    def test_traversal_rejected_before_filesystem_access_even_when_it_lands_inside_scope(self):
+        for path in [self.base / "nested/../safe", Path("../safe"), self.root / "../raw"]:
+            with self.subTest(path=path), patch("sanitize_evidence.os.path.realpath") as resolve:
+                with self.assertRaises(ValueError):
+                    local_path(path)
+                resolve.assert_not_called()
+
+    def test_ancestor_symlinks_and_dangling_publication_links_fail_closed(self):
+        outside = self.base / "outside"
+        outside.mkdir()
+        linked = self.base / "linked"
+        linked.symlink_to(outside, target_is_directory=True)
+        for destination in [linked / "safe", self.base / "dangling"]:
+            if destination.name == "dangling":
+                destination.symlink_to(self.base / "missing")
+            with self.subTest(destination=destination), self.assertRaises(ValueError):
+                sanitize(self.root, destination, "live")
+        (outside / "raw").mkdir()
+        with self.assertRaises(ValueError):
+            sanitize(linked / "raw", self.output, "live")
+        self.assertFalse((outside / "safe").exists())
+        self.assertFalse(self.output.exists())
+
+    def test_overlapping_output_scopes_fail_closed(self):
+        for destination in [self.root, self.root / "published", self.base]:
+            with self.subTest(destination=destination), self.assertRaises(ValueError):
+                sanitize(self.root, destination, "live")
+        self.assertFalse((self.root / "published").exists())
+
+    def test_scope_prefix_sibling_is_not_an_ancestor(self):
+        with patch("sanitize_evidence.os.getcwd", return_value="/scoped"), \
+                patch("sanitize_evidence.pwd.getpwuid") as owner, \
+                patch("sanitize_evidence.tempfile.gettempdir", return_value="/system-temp"):
+            owner.return_value.pw_dir = "/owner-home"
+            for path in ["/scoped-foreign/log", "/owner-home-foreign/log", "/system-temp-foreign/log"]:
+                with self.subTest(path=path), self.assertRaises(ValueError):
+                    local_path(Path(path))
+
+    def test_os_temp_alias_is_allowed_but_user_directory_links_are_not(self):
+        actual = self.base / "actual-temp"
+        actual.mkdir()
+        alias = self.base / "system-temp"
+        alias.symlink_to(actual, target_is_directory=True)
+        with patch("sanitize_evidence.tempfile.gettempdir", return_value=str(alias)):
+            self.assertEqual(local_path(alias / "output"), actual / "output")
+            (actual / "redirect").symlink_to(self.root, target_is_directory=True)
+            with self.assertRaises(ValueError):
+                local_path(alias / "redirect" / "output")
+
+    def test_child_directory_swap_cannot_redirect_evidence_reads(self):
+        nested = self.root / "nested"
+        nested.mkdir()
+        (nested / "visible.txt").write_text("original")
+        outside = self.base / "outside"
+        outside.mkdir()
+        (outside / "private.txt").write_text("must not be published")
+        original_open = os.open
+
+        def swapped_open(path, *args, **kwargs):
+            if path == "nested":
+                nested.rename(self.root / "original")
+                nested.symlink_to(outside, target_is_directory=True)
+            return original_open(path, *args, **kwargs)
+
+        with patch("sanitize_evidence.os.open", side_effect=swapped_open):
+            with self.assertRaises(OSError):
+                sanitize(self.root, self.output, "live")
+        self.assertFalse(self.output.exists())
+        self.assertFalse(list(self.base.glob(".publication-*")))
+
+    def test_invalid_workflow_output_symlink_blocks_upload_without_touching_target(self):
+        target = self.base / "private"
+        target.write_text("unchanged")
+        github_output = self.base / "github-output"
+        github_output.symlink_to(target)
+        with patch.dict(os.environ, {"GITHUB_OUTPUT": str(github_output)}):
+            result = subprocess.run([sys.executable, str(SCRIPT), "--root", str(self.root),
+                                     "--output", str(self.output), "--mode", "live"],
+                                    capture_output=True, check=False)
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(target.read_text(), "unchanged")
+        self.assertFalse(self.output.exists())
+        self.assertNotIn(b"Traceback", result.stderr)
+
+    def test_workflow_output_hardlink_cannot_append_outside_selected_path(self):
+        target = self.base / "private"
+        target.write_text("unchanged")
+        github_output = self.base / "github-output"
+        os.link(target, github_output)
+        with patch.dict(os.environ, {"GITHUB_OUTPUT": str(github_output)}):
+            result = subprocess.run([sys.executable, str(SCRIPT), "--root", str(self.root),
+                                     "--output", str(self.output), "--mode", "live"],
+                                    capture_output=True, check=False)
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(target.read_text(), "unchanged")
+        self.assertFalse(self.output.exists())
+
+    def test_unknown_api_mode_cannot_skip_live_credential_scan(self):
+        with self.assertRaises(ValueError):
+            sanitize(self.root, self.output, "LIVE")
+        self.assertFalse(self.output.exists())
+
     def test_existing_destination_and_symlink_root_fail_closed(self):
         self.output.mkdir()
         with self.assertRaises(ValueError):
diff --git a/scripts/test_verify_candidate_artifacts.py b/scripts/test_verify_candidate_artifacts.py
new file mode 100644
index 000000000..ff1154512
--- /dev/null
+++ b/scripts/test_verify_candidate_artifacts.py
@@ -0,0 +1,249 @@
+"""Offline trust-boundary and PTY-flow regressions; no installed/live provider calls."""
+
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+
+SPEC = importlib.util.spec_from_file_location("artifact_terminal", Path(__file__).with_name("verify-candidate-artifacts.py"))
+verifier = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(verifier)
+
+
+class VerifyCandidateArtifactsTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.base = Path(self.temporary.name).resolve()
+        self.consumer = self.base / "consumer with spaces"
+        self.package = self.consumer / "node_modules/@diffexai/diffex"
+        self.package.mkdir(parents=True)
+        self.metadata = self.package / "package.json"
+        self.metadata.write_text(json.dumps({"name": "@diffexai/diffex", "bin": {"diffex": "dist/cli.js"}}))
+        self.cli = self.package / "dist/cli.js"
+        self.cli.parent.mkdir()
+        self.cli.write_text("#!/usr/bin/env node\n// Synthetic installed package; never executed.\n")
+        self.cli.chmod(0o755)
+        self.executable = self.consumer / "node_modules/.bin/diffex"
+        self.executable.parent.mkdir()
+        self.executable.symlink_to("../@diffexai/diffex/dist/cli.js")
+        self.output = self.base / "evidence"
+
+    def test_installed_package_bin_is_validated_without_limiting_consumer_to_output_roots(self):
+        # Installed executables are explicitly selected, not restricted to cwd,
+        # HOME or temp. The output-root helper must not govern consumer lookup.
+        with patch.object(verifier, "local_path", side_effect=AssertionError("output-only guard")):
+            self.assertEqual(verifier.installed_executable(self.executable), (str(self.cli), self.consumer))
+
+    def test_consumer_symlink_and_parent_traversal_are_rejected(self):
+        linked = self.base / "linked-consumer"
+        linked.symlink_to(self.consumer, target_is_directory=True)
+        for executable in [linked / "node_modules/.bin/diffex", self.consumer / "nested/../node_modules/.bin/diffex"]:
+            with self.subTest(executable=executable), self.assertRaises(ValueError):
+                verifier.installed_executable(executable)
+
+    def test_os_temp_alias_consumer_remains_supported(self):
+        alias = self.base / "system-temp"
+        alias.symlink_to(self.base, target_is_directory=True)
+        with patch.object(verifier.tempfile, "gettempdir", return_value=str(alias)):
+            selected = alias / self.consumer.name / "node_modules/.bin/diffex"
+            self.assertEqual(verifier.installed_executable(selected), (str(self.cli), self.consumer))
+
+    def test_foreign_package_and_bin_mapping_mismatch_are_rejected(self):
+        for metadata in [
+            {"name": "foreign", "bin": {"diffex": "dist/cli.js"}},
+            {"name": "@diffexai/diffex", "bin": {"diffex": "../foreign.js"}},
+            {"name": "@diffexai/diffex", "bin": "dist/cli.js"},
+        ]:
+            with self.subTest(metadata=metadata):
+                self.metadata.write_text(json.dumps(metadata))
+                with self.assertRaises(ValueError):
+                    verifier.installed_executable(self.executable)
+
+    def test_bin_link_cannot_escape_to_foreign_consumer_or_prefix_sibling(self):
+        for outside in [self.base / "foreign", Path(str(self.consumer) + "-foreign")]:
+            outside.mkdir()
+            foreign = outside / "cli.js"
+            foreign.write_text("not the selected package")
+            self.executable.unlink()
+            self.executable.symlink_to(foreign)
+            with self.subTest(outside=outside), self.assertRaises(ValueError):
+                verifier.installed_executable(self.executable)
+
+    def test_linked_package_metadata_or_package_directory_is_rejected(self):
+        foreign = self.base / "foreign.json"
+        foreign.write_bytes(self.metadata.read_bytes())
+        self.metadata.unlink()
+        self.metadata.symlink_to(foreign)
+        with self.assertRaises(OSError):
+            verifier.installed_executable(self.executable)
+        self.metadata.unlink()
+        self.metadata.write_bytes(foreign.read_bytes())
+        moved = self.base / "moved-package"
+        self.package.rename(moved)
+        self.package.symlink_to(moved, target_is_directory=True)
+        with self.assertRaises(ValueError):
+            verifier.installed_executable(self.executable)
+
+    def test_cli_target_must_be_expected_regular_executable(self):
+        self.cli.chmod(0o644)
+        with self.assertRaises(ValueError):
+            verifier.installed_executable(self.executable)
+        self.cli.unlink()
+        self.cli.mkdir()
+        with self.assertRaises(ValueError):
+            verifier.installed_executable(self.executable)
+
+    def test_output_root_scope_checks_precede_creating_directories_or_running_commands(self):
+        redirect = self.base / "redirect"
+        redirect.symlink_to(self.consumer, target_is_directory=True)
+        for out in ["/etc/diffex-evidence", self.base / "nested/../evidence", redirect / "evidence"]:
+            with self.subTest(out=out), patch.object(verifier.subprocess, "run") as run:
+                with self.assertRaises(ValueError):
+                    verifier.verify(out, {"local": str(self.executable)})
+                run.assert_not_called()
+        self.assertFalse((self.consumer / "evidence").exists())
+
+    def test_output_root_prefix_siblings_and_noncanonical_links_are_rejected(self):
+        with patch.object(verifier.os, "getcwd", return_value="/scoped"), \
+                patch.object(verifier.pwd, "getpwuid") as owner, \
+                patch.object(verifier.tempfile, "gettempdir", return_value="/system-temp"):
+            owner.return_value.pw_dir = "/owner-home"
+            for value in ["/scoped-foreign/out", "/owner-home-foreign/out", "/system-temp-foreign/out"]:
+                with self.subTest(value=value), self.assertRaises(ValueError):
+                    verifier.local_path(value)
+
+    @unittest.skipUnless(sys.platform == "darwin", "Darwin OS user temp boundary")
+    def test_native_user_temp_sibling_output_survives_isolated_tmpdir_and_cwd(self):
+        consumer = self.base / "npm/process acceptance"
+        isolated_temp = consumer / "temp"
+        isolated_temp.mkdir(parents=True)
+        output = self.base / "npm/terminal"
+        with patch.dict(os.environ, {"TMPDIR": str(isolated_temp)}), \
+                patch.object(verifier.tempfile, "tempdir", None), \
+                patch.object(verifier.os, "getcwd", return_value=str(consumer)), \
+                patch.object(verifier.pwd, "getpwuid") as owner:
+            owner.return_value.pw_dir = "/unrelated-owner-home"
+            self.assertEqual(verifier.tempfile.gettempdir(), str(isolated_temp))
+            self.assertEqual(verifier.local_path(output), output)
+            native_alias = Path(os.confstr(65537)) / output.relative_to(Path(os.confstr(65537)).resolve())
+            self.assertEqual(verifier.local_path(native_alias), output)
+            self.assertEqual(verifier.installed_executable(self.executable), (str(self.cli), self.consumer))
+
+    def test_native_temp_discovery_rejects_other_owner_and_nonprivate_directories(self):
+        native = self.base / "native-user-temp"
+        native.mkdir(mode=0o700)
+        actual = native.stat()
+        for uid, mode in [(os.getuid() + 1, 0o40700), (os.getuid(), 0o40777), (os.getuid(), 0o100600)]:
+            metadata = os.stat_result((mode, actual.st_ino, actual.st_dev, actual.st_nlink,
+                                       uid, actual.st_gid, actual.st_size,
+                                       actual.st_atime, actual.st_mtime, actual.st_ctime))
+            with self.subTest(uid=uid, mode=oct(mode)), \
+                    patch.object(verifier.sys, "platform", "darwin"), \
+                    patch.object(verifier.os, "confstr", return_value=str(native)), \
+                    patch.object(verifier.os, "stat", return_value=metadata):
+                with self.assertRaisesRegex(ValueError, "owner-private"):
+                    verifier.system_temp_roots()
+
+    def test_runtime_names_cannot_escape_output_directory(self):
+        for runtime in ["../other", "/absolute", "local/subdir", ""]:
+            with self.subTest(runtime=runtime), self.assertRaises(ValueError):
+                verifier.verify(self.output, {runtime: str(self.executable)})
+        self.assertFalse(self.output.exists())
+
+    def test_atomic_evidence_write_rejects_symlinks_and_does_not_truncate_hardlinks(self):
+        self.output.mkdir()
+        private = self.base / "private"
+        private.write_text("unchanged")
+        target = self.output / "smoke.json"
+        target.symlink_to(private)
+        with self.assertRaises(ValueError):
+            verifier.write_evidence(self.output, "smoke.json", "new")
+        self.assertEqual(private.read_text(), "unchanged")
+        target.unlink()
+        os.link(private, target)
+        verifier.write_evidence(self.output, "smoke.json", "new")
+        self.assertEqual(private.read_text(), "unchanged")
+        self.assertEqual(target.read_text(), "new")
+        self.assertFalse(list(self.output.glob(".artifact-evidence-*")))
+
+    def test_verified_package_uses_literal_node_lookup_and_actual_cli_in_child(self):
+        class ChildExec(Exception):
+            pass
+
+        def run(args, **kwargs):
+            stdout = "fixture handoff-fixture-ok"
+            return subprocess.CompletedProcess(args, 0, stdout, "")
+
+        with patch.object(verifier.shutil, "which", return_value="/trusted/node") as which, \
+                patch.object(verifier.subprocess, "run", side_effect=run) as processes, \
+                patch.object(verifier.pty, "fork", return_value=(0, 98765)), \
+                patch.object(verifier.os, "chdir"), patch.object(verifier.fcntl, "ioctl"), \
+                patch.object(verifier.os, "execve", side_effect=ChildExec) as execute:
+            with self.assertRaises(ChildExec):
+                verifier.verify(self.output, {"local": str(self.executable)})
+        which.assert_called_once_with("node")
+        program, args, env = execute.call_args.args
+        self.assertEqual(program, "/trusted/node")
+        self.assertEqual(args[:2], ["/trusted/node", str(self.cli)])
+        self.assertEqual(args[-2:], ["--model", "handoff/fixture"])
+        for process in processes.call_args_list:
+            self.assertEqual(process.args[0][:2], ["/trusted/node", str(self.cli)])
+        self.assertNotIn("OPENAI_API_KEY", env)
+        self.assertNotIn("DAYTONA_API_KEY", env)
+        self.assertFalse(list(self.consumer.glob("artifact-fixture-*.mjs")))
+        self.assertFalse(Path(env["HOME"]).parent.exists())
+
+    def test_missing_node_fails_before_process_execution(self):
+        with patch.object(verifier.shutil, "which", return_value=None), \
+                patch.object(verifier.subprocess, "run") as run:
+            with self.assertRaisesRegex(ValueError, "Node interpreter"):
+                verifier.verify(self.output, {"local": str(self.executable)})
+            run.assert_not_called()
+        self.assertFalse(self.output.exists())
+
+    def test_terminal_flow_keeps_prompt_both_login_menus_search_back_and_exit(self):
+        roots = []
+
+        def run(args, **kwargs):
+            root = Path(kwargs["env"]["HOME"]).parent
+            roots.append(root)
+            events = [{"type": "inference"}, {"type": "inference"},
+                      {"type": "request", "url": "https://api.diffex.ai/api/latest-version"}]
+            (root / "events.jsonl").write_text("\n".join(json.dumps(event) for event in events))
+            return subprocess.CompletedProcess(args, 0, "fixture handoff-fixture-ok", "")
+
+        chunks = iter([b"Diffex v0.0.0", b"handoff-fixture-ok", b"Select authentication method:",
+                       b"ChatGPT OpenRouter xAI", b"No matching providers", b"Select authentication method:",
+                       b"Select provider to configure:", b"No matching providers", b"Select authentication method:",
+                       b"Select authentication method:", b"Ask Diffex", b""])
+        original_close = os.close
+        with patch.object(verifier.subprocess, "run", side_effect=run), \
+                patch.object(verifier.shutil, "which", return_value="/trusted/node"), \
+                patch.object(verifier.pty, "fork", return_value=(12345, 98765)), \
+                patch.object(verifier.select, "select", return_value=([98765], [], [])), \
+                patch.object(verifier.os, "read", side_effect=lambda *args: next(chunks)), \
+                patch.object(verifier.os, "write") as send, \
+                patch.object(verifier.os, "waitpid", return_value=(12345, 0)), \
+                patch.object(verifier.os, "close", side_effect=lambda fd: None if fd == 98765 else original_close(fd)), \
+                patch("builtins.print"):
+            results = verifier.verify(self.output, {"local": str(self.executable)})
+        self.assertEqual([call.args[1] for call in send.call_args_list],
+                         [b"Reply with the fixture confirmation.\r", b"/login\r", b"\r", b"radius", b"\x03",
+                          b"\x1b[B\r", b"radius", b"\x03", b"\x03", b"/exit\r"])
+        self.assertEqual(len(results), 6)
+        self.assertEqual(results[-1]["accounts"], ["ChatGPT", "OpenRouter", "xAI"])
+        self.assertEqual(json.loads((self.output / "smoke.json").read_text()), results)
+        self.assertTrue((self.output / "local-terminal.txt").is_file())
+        self.assertTrue(all(not root.exists() for root in roots))
+        self.assertFalse(list(self.consumer.glob("artifact-fixture-*.mjs")))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/verify-candidate-artifacts.py b/scripts/verify-candidate-artifacts.py
index 6db297145..55b5255f2 100644
--- a/scripts/verify-candidate-artifacts.py
+++ b/scripts/verify-candidate-artifacts.py
@@ -1,12 +1,119 @@
 import os, sys, json, subprocess, tempfile, shutil, pathlib, pty, select, time, re, fcntl, termios, struct
+import pwd
+import stat
+
+
+def system_temp_roots():
+    """Retain the OS-owned user-temp boundary when isolation overrides TMPDIR."""
+    roots = [tempfile.gettempdir(), "/tmp"]
+    if sys.platform == "darwin":
+        # Darwin's _CS_DARWIN_USER_TEMP_DIR from <unistd.h>. Python does not
+        # expose its symbolic name, but confstr accepts the native constant.
+        native = os.confstr(65537)
+        if not native:
+            raise ValueError("missing OS user temporary directory")
+        metadata = os.stat(os.path.realpath(native))
+        if (not stat.S_ISDIR(metadata.st_mode) or metadata.st_uid != os.getuid() or
+                stat.S_IMODE(metadata.st_mode) & 0o077):
+            raise ValueError("OS user temporary directory is not owner-private")
+        roots.append(native)
+    return roots
+
+
+def local_path(value):
+    """Validate a local artifact/evidence path before any filesystem access."""
+    value = pathlib.Path(value)
+    if ".." in value.parts:
+        raise ValueError("path traversal is not permitted")
+    roots = {os.path.abspath(root) for root in
+             (os.getcwd(), pwd.getpwuid(os.getuid()).pw_dir, *system_temp_roots())}
+    roots.discard(os.path.sep)
+    roots.update(os.path.realpath(root) for root in tuple(roots))
+    absolute = os.path.abspath(value)
+    if not absolute.startswith(tuple(root + os.path.sep for root in roots)):
+        raise ValueError("path outside local artifact roots")
+    scopes = [root for root in roots if os.path.commonpath([root, absolute]) == root and absolute != root]
+    scope = max(scopes, key=len)
+    canonical = os.path.realpath(absolute)
+    canonical_scope = os.path.realpath(scope)
+    if not canonical.startswith(canonical_scope + os.path.sep):
+        raise ValueError("path outside local artifact root")
+    if (os.path.commonpath([canonical_scope, canonical]) != canonical_scope or
+            canonical != os.path.join(canonical_scope, os.path.relpath(absolute, scope))):
+        raise ValueError("local artifact path traverses a symlink")
+    return pathlib.Path(canonical)
+
+
+def installed_executable(value):
+    """Validate the operator-selected npm/Bun consumer before executing its bin.
+
+    Consumers may be anywhere, independently of local evidence output roots.
+    Their intentional .bin symlink must resolve to the declared Diffex package
+    entrypoint, with no package/directory links redirecting code or fixture I/O.
+    """
+    value = pathlib.Path(value)
+    if ".." in value.parts or value.parts[-3:] != ("node_modules", ".bin", "diffex"):
+        raise ValueError("expected an installed Diffex executable")
+    absolute = os.path.abspath(value)
+    requested_consumer = os.path.dirname(os.path.dirname(os.path.dirname(absolute)))
+    consumer = os.path.realpath(requested_consumer)
+    # Permit OS-provided temp aliases, not an operator-created consumer link.
+    aliases = {os.path.abspath(root) for root in system_temp_roots()}
+    alias_match = any(requested_consumer.startswith(root + os.path.sep) and
+                      consumer == os.path.join(os.path.realpath(root), os.path.relpath(requested_consumer, root))
+                      for root in aliases)
+    if requested_consumer != consumer and not alias_match:
+        raise ValueError("consumer path traverses a symlink")
+    resolved = os.path.realpath(absolute)
+    if not resolved.startswith(consumer + os.path.sep):
+        raise ValueError("executable escapes its installed consumer")
+    if os.path.commonpath([consumer, resolved]) != consumer:
+        raise ValueError("executable escapes its installed consumer")
+    package = pathlib.Path(consumer) / "node_modules/@diffexai/diffex"
+    expected = package / "dist/cli.js"
+    if resolved != str(expected) or os.path.realpath(package) != str(package):
+        raise ValueError("unexpected installed executable target")
+    package = pathlib.Path(resolved).parent.parent
+    metadata_path = package / "package.json"
+    descriptor = os.open(metadata_path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(descriptor) as stream:
+        if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode):
+            raise ValueError("invalid installed package metadata")
+        metadata = json.load(stream)
+    if metadata.get("name") != "@diffexai/diffex" or metadata.get("bin") != {"diffex": "dist/cli.js"}:
+        raise ValueError("installed package executable identity mismatch")
+    if not pathlib.Path(resolved).is_file() or not os.access(resolved, os.X_OK):
+        raise ValueError("installed executable is not executable")
+    return resolved, pathlib.Path(resolved).parents[4]
+
+
+def write_evidence(out, name, text):
+    """Replace evidence atomically, never truncate a linked destination."""
+    destination = local_path(out / name)
+    descriptor, filename = tempfile.mkstemp(prefix=".artifact-evidence-", dir=out)
+    temporary = pathlib.Path(filename)
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+            stream.write(text)
+        temporary.replace(destination)
+    finally:
+        temporary.unlink(missing_ok=True)
 
 
 def verify(out, executables, fixture_source=None):
-    out = pathlib.Path(out).resolve()
+    out = local_path(out)
+    validated = {}
+    for runtime, executable in executables.items():
+        if not re.fullmatch(r"[a-z][a-z0-9-]*", runtime):
+            raise ValueError("invalid runtime evidence name")
+        validated[runtime] = installed_executable(executable)
+    node = shutil.which("node")
+    if node is None:
+        raise ValueError("Node interpreter is required")
     out.mkdir(parents=True, exist_ok=True)
     fixture_source = fixture_source or pathlib.Path(__file__).resolve().parent / "fixtures/artifact-handoff.mjs"
     results = []
-    for runtime, exe in executables.items():
+    for runtime, (exe, consumer) in validated.items():
         root = pathlib.Path(tempfile.mkdtemp(prefix="diffex artifact terminal "))
         fixture = None
         try:
@@ -29,11 +136,12 @@ def verify(out, executables, fixture_source=None):
                 json.dumps({"theme": "dark", "packages": []})
             )
             (root / "events.jsonl").write_text("")
-            fixture_fd, fixture_path = tempfile.mkstemp(prefix="artifact-fixture-", suffix=".mjs", dir=pathlib.Path(exe).parent.parent.parent)
+            fixture_fd, fixture_path = tempfile.mkstemp(prefix="artifact-fixture-", suffix=".mjs", dir=consumer)
             os.close(fixture_fd)
             fixture = pathlib.Path(fixture_path)
             shutil.copyfile(fixture_source, fixture)
             args = [
+                node,
                 exe,
                 "--no-session",
                 "--no-extensions",
@@ -47,7 +155,7 @@ def verify(out, executables, fixture_source=None):
             ]
             for command in [["--version"], ["--help"], ["auth", "--help"]]:
                 p = subprocess.run(
-                    [exe] + command,
+                    [node, exe] + command,
                     cwd=root / "project",
                     env={**env, "DIFFEX_OFFLINE": "1"},
                     capture_output=True,
@@ -84,7 +192,7 @@ def verify(out, executables, fixture_source=None):
             if pid == 0:
                 os.chdir(root / "project")
                 fcntl.ioctl(1, termios.TIOCSWINSZ, struct.pack("HHHH", 30, 100, 0, 0))
-                os.execve(exe, args, env)
+                os.execve(node, args, env)
             raw = b""
             text = ""
             stage = "startup"
@@ -143,7 +251,7 @@ def verify(out, executables, fixture_source=None):
                     elif stage == "editor" and b"Ask Diffex" in raw[mark:]:
                         os.write(fd, b"/exit\r")
                         stage = "exit"
-                (out / f"{runtime}-terminal.txt").write_text(text)
+                write_evidence(out, f"{runtime}-terminal.txt", text)
                 assert stage == "exit", (stage, text[-4000:])
                 ended, status = os.waitpid(pid, os.WNOHANG)
                 reap_deadline = time.monotonic() + 2
@@ -153,7 +261,7 @@ def verify(out, executables, fixture_source=None):
                 assert ended == pid, "Terminal did not exit within its bounded deadline"
                 pid = None
                 assert os.waitstatus_to_exitcode(status) == 0
-                (out / f"{runtime}-terminal.txt").write_text(text)
+                write_evidence(out, f"{runtime}-terminal.txt", text)
                 events = [
                     json.loads(l) for l in (root / "events.jsonl").read_text().splitlines()
                 ]
@@ -186,7 +294,7 @@ def verify(out, executables, fixture_source=None):
                 fixture.unlink(missing_ok=True)
             shutil.rmtree(root)
             assert not root.exists()
-    (out / "smoke.json").write_text(json.dumps(results, indent=2) + "\n")
+    write_evidence(out, "smoke.json", json.dumps(results, indent=2) + "\n")
     print(json.dumps(results, indent=2))
     return results
 
@@ -195,7 +303,7 @@ def verify(out, executables, fixture_source=None):
         raise SystemExit(
             "Usage: python3 scripts/verify-candidate-artifacts.py ARTIFACT_DIRECTORY"
         )
-    out = pathlib.Path(sys.argv[1]).resolve()
+    out = local_path(sys.argv[1])
     fixture_source = (
         pathlib.Path(__file__).resolve().parent / "fixtures/artifact-handoff.mjs"
     )
@@ -204,5 +312,5 @@ def verify(out, executables, fixture_source=None):
         "bun-install": str(out / "bun-install/node_modules/.bin/diffex"),
     }
     if len(sys.argv) == 3:
-        executables = {"consumer": str(pathlib.Path(sys.argv[2]).resolve() / "node_modules/.bin/diffex")}
+        executables = {"consumer": str(pathlib.Path(sys.argv[2]) / "node_modules/.bin/diffex")}
     verify(out, executables, fixture_source)