fix(runtime): fail closed on ambiguous sandbox settlement order

Generated-by: OpenAI Codex

Author: testikun

packages/core/src/__tests__/sandbox-boundary.test.ts

@@ -440,6 +440,23 @@ describe('projectSandboxBoundaryNegotiation', () => {
       },
     });
 
+  const durableRequest = (
+    requestId: string,
+    status: SandboxBoundaryRequest['status'],
+  ): SandboxBoundaryRequest => ({
+    sessionId: 'session-1',
+    requestId,
+    status,
+    baseRevision: 0,
+    expansion: { network: { enabled: true } },
+    justification: 'Need network access.',
+    createdAt: 1,
+    settledAt: 2,
+    ...(status === 'approved' ? { appliedRevision: 1 } : {}),
+    turnId: 'turn-1',
+    runId: 'run-1',
+  });
+
   const failurePair = (
     id: string,
     toolName: string,
@@ -665,12 +682,7 @@ describe('projectSandboxBoundaryNegotiation', () => {
     assert.equal(projectSandboxBoundaryNegotiation([call, response]).kind, 'invalid');
 
     const originalRequest = request('request-2', 'boundary-2', 'tool-2');
-    const mismatchedIdentityDecision = decision(
-      'decision-2',
-      'boundary-2',
-      'tool-2',
-      'denied',
-    );
+    const mismatchedIdentityDecision = decision('decision-2', 'boundary-2', 'tool-2', 'denied');
     mismatchedIdentityDecision.invocationId = 'other-invocation';
     assert.equal(
       projectSandboxBoundaryNegotiation([originalRequest, mismatchedIdentityDecision]).kind,
@@ -715,22 +727,11 @@ describe('projectSandboxBoundaryNegotiation', () => {
   });
 
   test('restores a durable denial when the RuntimeEvent ack was lost', () => {
-    const durableRequest: SandboxBoundaryRequest = {
-      sessionId: 'session-1',
-      requestId: 'boundary-1',
-      status: 'denied',
-      baseRevision: 0,
-      expansion: { network: { enabled: true } },
-      justification: 'Need network access.',
-      createdAt: 1,
-      settledAt: 2,
-      turnId: 'turn-1',
-      runId: 'run-1',
-    };
+    const durable = durableRequest('boundary-1', 'denied');
     assert.deepEqual(
       projectSandboxBoundaryNegotiation(
         [base('source-event', { turnId: 'turn-1', runId: 'run-1' })],
-        [durableRequest],
+        [durable],
       ),
       {
         kind: 'valid',
@@ -743,6 +744,38 @@ describe('projectSandboxBoundaryNegotiation', () => {
       },
     );
   });
+
+  test('fails closed when durable settlement order is unavailable', () => {
+    const approved = durableRequest('boundary-1', 'approved');
+    assert.equal(
+      projectSandboxBoundaryNegotiation(
+        [
+          request('request-1', 'boundary-1', 'tool-1'),
+          ...failurePair(
+            'invalid-1',
+            'request_sandbox_boundary',
+            'tool-2',
+            'invalid_boundary_declaration',
+          ),
+        ],
+        [approved],
+      ).kind,
+      'invalid',
+    );
+
+    const denied = durableRequest('boundary-1', 'denied');
+    assert.equal(
+      projectSandboxBoundaryNegotiation(
+        [
+          request('request-1', 'boundary-1', 'tool-1'),
+          request('request-2', 'boundary-2', 'tool-2'),
+          decision('decision-2', 'boundary-2', 'tool-2', 'approved'),
+        ],
+        [denied],
+      ).kind,
+      'invalid',
+    );
+  });
 });
 
 describe('ExecutionBoundary', () => {

packages/core/src/sandbox-boundary.ts

@@ -205,6 +205,11 @@ export function projectSandboxBoundaryNegotiation(
   let invalidRounds = 0;
   let unresolvedRounds = 0;
   let finalizationRequested = false;
+  // RuntimeEvent order is authoritative inside the immutable ledger, but the
+  // durable interaction rows live in a separate append/settlement path. When
+  // a settlement has no matching decision ack, there is no shared sequence
+  // number that can place it relative to later failures or decisions.
+  let hasStatefulEvent = false;
   const invalidSteps = new Set<string>();
   const unresolvedSteps = new Set<string>();
   const requests = new Set<string>();
@@ -225,6 +230,7 @@ export function projectSandboxBoundaryNegotiation(
     reason,
   });
   const addFailure = (kind: 'invalid' | 'unresolved', step: string): void => {
+    hasStatefulEvent = true;
     const steps = kind === 'invalid' ? invalidSteps : unresolvedSteps;
     if (steps.has(step)) return;
     steps.add(step);
@@ -315,6 +321,7 @@ export function projectSandboxBoundaryNegotiation(
       }
       settledRequests.add(decision.requestId);
       decisionEvents.set(decision.requestId, { status: decision.status });
+      hasStatefulEvent = true;
       if (decision.status === 'denied') {
         denied = true;
       } else if (decision.status === 'approved') {
@@ -413,6 +420,7 @@ export function projectSandboxBoundaryNegotiation(
   }
 
   const durableById = new Map<string, SandboxBoundaryRequest>();
+  const durableSettlementsWithoutDecision: SandboxBoundaryRequest[] = [];
   for (const request of durableRequests) {
     const hasProvenance = request.turnId !== undefined || request.runId !== undefined;
     const attributable = hasProvenance
@@ -449,6 +457,7 @@ export function projectSandboxBoundaryNegotiation(
       return invalid(`sandbox boundary durable request ${request.requestId} is unresolved`);
     }
     if (!eventDecision) {
+      durableSettlementsWithoutDecision.push(request);
       settledRequests.add(request.requestId);
       if (request.status === 'denied') {
         denied = true;
@@ -470,6 +479,19 @@ export function projectSandboxBoundaryNegotiation(
     }
   }
 
+  // Do not guess at the order between an interaction-row settlement and
+  // RuntimeEvent facts from the same source run. An approved durable row
+  // applied after the event projection could erase later failure budget, and
+  // a denied row could overwrite a later approval. The only safe exception is
+  // the ack-loss recovery case where the durable row is the sole stateful fact
+  // and can be applied without crossing another state transition.
+  if (
+    durableSettlementsWithoutDecision.length > 1 ||
+    (durableSettlementsWithoutDecision.length > 0 && hasStatefulEvent)
+  ) {
+    return invalid('sandbox boundary durable settlement ordering is unavailable');
+  }
+
   for (const requestId of requests) {
     if (!settledRequests.has(requestId)) {
       return invalid(`sandbox boundary request ${requestId} has no durable decision`);

packages/runtime-host/src/protocol/index.ts

@@ -100,11 +100,13 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 93 as const;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 94 as const;
 // 93: Configuration credential transfer binds proxy destinations and
 // Connection credentials to exact Host-owned targets before secret access.
 // Proxy policy and credentials commit through one recoverable Host command;
 // older peers can split the writes and violate the shared credential basis.
+// 94: Session continuity carries authenticated sandbox-boundary negotiation
+// facts; older Clients cannot safely preserve the new fail-closed contract.
 // 92: Owners can query their complete pending Session Turn-request inbox.
 // 91: Host status publishes the live Direct peer endpoint so newly issued
 // connection invitations do not preserve stale startup routes.

packages/runtime/src/runtime-resume.ts

@@ -34,9 +34,7 @@ import type {
 } from '@maka/core/runtime-boundary';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import type { ContinuationClaimStateV1 } from '@maka/core/runtime-event-store';
-import {
-  type SandboxBoundaryRequest,
-} from '@maka/core/sandbox-boundary';
+import { type SandboxBoundaryRequest } from '@maka/core/sandbox-boundary';
 import { isDeepStrictEqual } from 'node:util';
 import {
   buildContinuationReplayPlan,