Promote #1939: verify PTY turn submission (#1891) + review fixes (#1954, #1955)

.github/workflows/publish.yml

@@ -334,7 +334,7 @@ jobs:
   # Build all packages once, version them, and upload
   build:
     name: Build & Version
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.CI_LINUX_RUNNER || 'ubuntu-latest' }}
     outputs:
       new_version: ${{ steps.bump.outputs.new_version }}
       is_prerelease: ${{ steps.bump.outputs.is_prerelease }}

.github/workflows/rust-ci.yml

@@ -26,7 +26,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.rust_changed == 'true')
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && (vars.CI_LINUX_RUNNER || 'ubuntu-latest') || matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -70,7 +70,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.rust_changed == 'true')
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && (vars.CI_LINUX_RUNNER || 'ubuntu-latest') || matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -106,7 +106,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.rust_changed == 'true')
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && (vars.CI_LINUX_RUNNER || 'ubuntu-latest') || matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -127,7 +127,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.rust_changed == 'true')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.CI_LINUX_RUNNER || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable

.github/workflows/test-build.yml

@@ -23,7 +23,7 @@ jobs:
   test-build-script:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Test build-bun.sh
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && (vars.CI_LINUX_RUNNER || 'ubuntu-latest') || matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -33,6 +33,12 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      # StarSling Linux runners (vars.CI_LINUX_RUNNER) preinstall rustc 1.92, older
+      # than GitHub's ubuntu-24.04 image (1.99); 1.92 cannot compile the
+      # broker (stable-only atomic try_update). Install the toolchain explicitly.
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -111,7 +117,7 @@ jobs:
   test-build-edge-cases:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Test edge cases
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.CI_LINUX_RUNNER || 'ubuntu-latest' }}
 
     steps:
       - name: Checkout code

.github/workflows/test.yml

@@ -29,7 +29,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.node_changed == 'true')
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && (vars.CI_LINUX_RUNNER || 'ubuntu-latest') || matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
@@ -40,6 +40,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      # StarSling Linux runners (vars.CI_LINUX_RUNNER) preinstall rustc 1.92, older
+      # than GitHub's ubuntu-24.04 image (1.99); 1.92 cannot compile the
+      # broker (stable-only atomic try_update). Install the toolchain explicitly.
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
@@ -61,6 +67,49 @@ jobs:
       - name: Run tests
         run: npm test
 
+  # The PR-proof Landlock / devpts / no_new_privs sandbox tests skip themselves
+  # (it.skipIf(!HAS_TRUSTED_LANDLOCK_RUNTIME)) on kernels that cannot host the
+  # sandbox, which includes the StarSling runners that `test` above may run on
+  # via vars.CI_LINUX_RUNNER. This job stays pinned to GitHub's ubuntu-latest
+  # (never the runner variable) and fails if any test in the file is skipped,
+  # so those tests can never silently stop running.
+  sandbox-proof:
+    name: PR-proof sandbox tests (Landlock, ubuntu-latest)
+    needs: changes
+    if: >-
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      (needs.changes.outputs.node_changed == 'true')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Ensure rollup optional dependencies are installed
+        run: npm install --no-save rollup || true
+
+      - name: Run PR-proof sandbox tests
+        run: npx vitest run tests/fixtures/pr-proof-contract.test.ts --reporter=default --reporter=json --outputFile.json=pr-proof-results.json
+
+      - name: Require every PR-proof test to have run
+        run: |
+          node -e '
+            const r = require("./pr-proof-results.json");
+            const all = r.testResults.flatMap((f) => f.assertionResults);
+            const notRun = all.filter((t) => t.status !== "passed" && t.status !== "failed");
+            console.log("pr-proof-contract: " + all.length + " tests, " + notRun.length + " not run");
+            for (const t of notRun) console.log("::error::not run (" + t.status + "): " + t.fullName);
+            if (all.length === 0 || notRun.length > 0) process.exit(1);
+          '
+
   windows-credential-acl:
     name: Windows credential ACL validation
     needs: changes
@@ -100,11 +149,17 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.node_changed == 'true')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.CI_LINUX_RUNNER || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      # StarSling Linux runners (vars.CI_LINUX_RUNNER) preinstall rustc 1.92, older
+      # than GitHub's ubuntu-24.04 image (1.99); 1.92 cannot compile the
+      # broker (stable-only atomic try_update). Install the toolchain explicitly.
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -130,7 +185,7 @@ jobs:
     if: >-
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
       (needs.changes.outputs.node_changed == 'true')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.CI_LINUX_RUNNER || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

CHANGELOG.md

@@ -10,11 +10,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - `agent-relay integration subscribe --to self` routes provider events to the broker worker's registered identity, allowing fleet workers to subscribe without desktop session detection.
+- Broker events report PTY submit recovery: `delivery_unconfirmed` (no acceptance evidence for a write, with `attempts` / `max_attempts`; `terminal: true` when the delivery ends unconfirmed) and `delivery_resubmitted` (a submit-only retry, with `attempt` and `strategy`); `delivery_verified` adds `evidence` and `attempts`. `@agent-relay/harness-driver` and the Python and Swift SDK protocol types include both new events.
+
+### Changed
+
+- A PTY delivery the broker can neither confirm nor see still parked in the agent's input box is now delivered as unconfirmed (a terminal `delivery_unconfirmed` with `outcome: "unconfirmed"`) instead of failing, and later messages to that agent are no longer held behind it. Agents whose terminal shows no acceptance signal keep receiving messages.
+- A confirmed `fleet spawn --task` whose task was written but never visibly accepted now succeeds (`spawned: true`) with `warning.code: "spawn_task_unconfirmed"`, instead of failing with `spawn_task_unconfirmed` and exit 8. Only a task that could not be delivered fails the spawn, with `spawn_task_failed`.
 
 ### Fixed
 
 - `agent-relay fleet spawn` explains how to reuse a retained agent name with `fleet release <name> --delete-agent --wait` when registration fails with `agent_already_exists`.
 - The installer's Quick Start now prints `agent-relay node up --background` and `agent-relay node down`, which exist, instead of the removed `agent-relay up` form that failed with "unknown command 'up'". An install pinned with `AGENT_RELAY_VERSION` to a release older than 9.2.2 still prints the top-level `up`/`down` forms that release has.
+- A PTY message still visible in the agent's input box after submit is retried by pressing submit only, never by resending the body, for up to three total attempts. Later messages queue behind it instead of being typed on top of it, and if it is still stuck after 60 seconds the broker reports a terminal `agent_blocked_on_send` with reason `failed_draft_latched`.
+- Typing into an agent's terminal while a delivery is being retried takes over the terminal and cancels the retries.
 
 ## [13.3.0] - 2026-10-10
 

crates/broker/src/attachments.rs

@@ -1347,9 +1347,23 @@ mod tests {
         std::fs::create_dir_all(&primary).unwrap();
         std::fs::set_permissions(&primary, std::fs::Permissions::from_mode(0o555)).unwrap();
         let fallback = temp.path().join("fallback");
+        // Some CI runners bypass directory permission bits (root, a granted
+        // CAP_DAC_OVERRIDE, or a filesystem that ignores modes). There the
+        // 0o555 directory really is writable, so accepting it is correct and
+        // refusal must be exercised with a root that cannot be written at all.
+        let mode_enforced = std::fs::write(primary.join(".mode-probe"), b"").is_err();
         let refused = prepare_root(&primary).await.is_err();
         std::fs::set_permissions(&primary, std::fs::Permissions::from_mode(0o755)).unwrap();
-        assert!(refused, "a read-only attachments root must be refused");
+        if mode_enforced {
+            assert!(refused, "a read-only attachments root must be refused");
+        } else {
+            let not_a_directory = temp.path().join("not-a-directory");
+            std::fs::write(&not_a_directory, b"").unwrap();
+            assert!(
+                prepare_root(&not_a_directory).await.is_err(),
+                "an unwritable attachments root must be refused"
+            );
+        }
         assert!(prepare_root(&fallback).await.is_ok());
     }