Persist supervisor-owned target containment receipts

src/supervise.rs

@@ -433,6 +433,7 @@ use acceptance::*;
 use researcher::*;
 
 mod reporting;
+mod target_containment;
 #[cfg(all(test, target_os = "linux"))]
 pub(crate) use reporting::append_precreated_worker_execution_journal;
 #[cfg(target_os = "linux")]

src/supervise/assignment_execution.rs

@@ -4041,18 +4041,20 @@ fn dispatch_and_capture_child_attempt_with_release_state<'a>(
             state.store(1, Ordering::Release);
         }
     }
-    // Retain returned continuation bytes before checkpoints, settlement diagnostics,
+    // Retain returned target observations before checkpoints, settlement diagnostics,
     // or envelope validation can return early. This does not authorize or clean scratch.
     let returned_evidence = match &external_run_result {
-        Ok(run) if command.codex_managed_readonly_continuation_enabled() => {
+        Ok(run) => {
             let imported = preserve_returned_parent_evidence(
                 context,
                 &attempt_artifacts,
                 &command,
                 launch_runtime,
                 run,
             );
-            if !run.scratch_quiescence_verified() {
+            if command.codex_managed_readonly_continuation_enabled()
+                && !run.scratch_quiescence_verified()
+            {
                 if release_state.is_some() {
                     // Isolated continuation owns a separate failure disposition.
                     // Keep every real returned resource alive; its controller must
@@ -4213,6 +4215,7 @@ fn preserve_returned_parent_evidence(
     run: &ExternalAgentRun,
 ) -> Result<()> {
     with_supervisor_artifacts(context.artifacts, |writer, _| {
+        super::target_containment::persist(writer, artifacts, command, runtime, run)?;
         let bytes = run.stdout_bytes();
         if bytes.len() > MAX_SUPERVISOR_REPORT_BYTES {
             bail!("descriptor-held parent stdout exceeds its configured byte limit");
@@ -4222,13 +4225,6 @@ fn preserve_returned_parent_evidence(
             bytes,
             ArtifactFileDisposition::PrivateEvidence,
         )?;
-        write_artifact_json(
-            writer,
-            &artifacts.command_record_relative,
-            &command_record_from_external_for_runtime(run, command, runtime),
-            MAX_SUPERVISOR_REPORT_BYTES,
-            ArtifactFileDisposition::PrivateEvidence,
-        )?;
         Ok(())
     })
     .context("managed parent returned evidence import failed")

src/supervise/assignment_execution/managed_parent_controller_tests.rs

@@ -419,6 +419,7 @@ fn exercise_retained_failure(
     use crate::external_agent::{
         CapturedOutput, CodexParentEvidence, CodexParentResolvedField, CodexParentTurnUsage,
     };
+    use std::os::unix::fs::PermissionsExt;
     let checkpoint_failure = case == "managed-cycle-retained-checkpoint-error";
     let continuation_failure = case == "managed-cycle-retained-continuation" || checkpoint_failure;
     let import_failure = case == "managed-cycle-retained-import-error";
@@ -427,7 +428,9 @@ fn exercise_retained_failure(
         .run_dir
         .join(&prepared.attempt_artifacts.raw_stdout_relative);
     if import_failure {
-        fs::create_dir_all(blocked_raw.parent().unwrap())?;
+        let logs = blocked_raw.parent().unwrap();
+        fs::create_dir_all(logs)?;
+        fs::set_permissions(logs, fs::Permissions::from_mode(0o700))?;
         fs::create_dir(&blocked_raw)?;
     }
     let retained = Mutex::new(Vec::<(PathBuf, Vec<u8>)>::new());
@@ -617,6 +620,41 @@ fn exercise_retained_failure(
         Ok(())
     })?;
     assert!(!initial_scratch.exists());
+    for (relative, _) in retained.lock().unwrap().iter() {
+        let summary = relative.with_extension("summary.json");
+        let receipt = relative.with_extension("summary.target-containment.json");
+        with_supervisor_artifacts(context.artifacts, |writer, _| {
+            let summary_bytes = writer.read_authenticated(&summary, MAX_SUPERVISOR_REPORT_BYTES)?;
+            let bytes = writer.read_authenticated(&receipt, 16 * 1024)?;
+            let receipt: serde_json::Value = serde_json::from_slice(&bytes)?;
+            assert_eq!(receipt["version"], 1);
+            assert_eq!(
+                receipt["binding"]["run_id"],
+                context.options.run_id.as_str()
+            );
+            assert_eq!(receipt["binding"]["task_id"], "parent");
+            assert_eq!(receipt["binding"]["runtime"], "codex");
+            assert_eq!(
+                receipt["binding"]["command_summary"],
+                serde_json::to_value(&summary)?
+            );
+            assert_eq!(
+                receipt["command_summary_sha256"],
+                crate::artifacts::state_auth::sha256_hex(&summary_bytes)
+            );
+            assert_eq!(receipt["target_process_tree"]["status"], "observed");
+            assert_eq!(
+                receipt["target_process_tree"]["evidence"]["status"],
+                "verified_empty"
+            );
+            assert_eq!(receipt["target_side_effects"]["status"], "observed");
+            assert_eq!(
+                receipt["target_side_effects"]["evidence"]["status"],
+                "verified"
+            );
+            Ok(())
+        })?;
+    }
     if !import_failure {
         for (relative, raw) in retained.lock().unwrap().iter() {
             let imported = fs::read(context.run_dir.join(relative))?;

src/supervise/reporting.rs

@@ -798,6 +798,13 @@ pub(super) fn import_external_attempt_evidence(
         runtime,
     } = context;
     let import_result = (|| -> Result<()> {
+        super::target_containment::persist(
+            writer,
+            artifacts,
+            external_command,
+            runtime,
+            external_run,
+        )?;
         if raw_report_validated {
             if let Some(contents) = external_run.output_last_message() {
                 if contents.len() > MAX_SUPERVISOR_REPORT_BYTES {
@@ -825,15 +832,6 @@ pub(super) fn import_external_attempt_evidence(
             stdout_bytes,
             ArtifactFileDisposition::PrivateEvidence,
         )?;
-        let command_record =
-            command_record_from_external_for_runtime(external_run, external_command, runtime);
-        write_artifact_json(
-            writer,
-            &artifacts.command_record_relative,
-            &command_record,
-            MAX_SUPERVISOR_REPORT_BYTES,
-            ArtifactFileDisposition::PrivateEvidence,
-        )?;
         Ok(())
     })();