Install repair authority and receipt prerequisite

A trusted Bot operator may declare a repository's fixed dependency-install policy, but the declaration does not permit the Bot to install anything. A post-install receipt can be considered only when every field matches the original parsed preservation owner and the exact target head; this pure check does not prove that an install ran.

• Code: src/execution/installRepairPolicy.ts, src/execution/installRepairEffect.ts, src/execution/dependencyInspection.ts, src/execution/factory.ts, src/execution/seedPlan.ts, src/execution/cloudflareSandbox.ts, src/core/dispatch/provision.ts, deploy/cloudflare-sandbox/worker.ts, deploy/cloudflare-resident/worker.ts, deploy/cloudflare-resident/Dockerfile, src/config/validate.ts
• Tests: src/execution/installRepairPolicy.test.ts, src/execution/installRepairEffect.test.ts, src/execution/dependencyInspection.test.ts, deploy/cloudflare-resident/dependencyInspection.test.ts, src/execution/factory.test.ts, src/config.test.ts

Criterion	Proof
The resident admin diagnostic inspects only the exact existing terminal owner and fence, UID claimant, named ref and head on an already-running runtime. It performs one bounded native read without waking, reattaching, installing or changing ownership; missing, live, changed or foreign evidence returns unknown before granting readiness.	[unit] deploy/cloudflare-resident/dependencyInspection.test.ts::retained resident dependency inspection::uses one native no-wake process and returns its exact retained owner without writes, ::refuses…, ::refuses a changed fence after native execution and withholds raw process errors
A fixed dependency inspection checks the exact checkout head and the same installed layout as readiness, reports only typed failures, and preserves source and dependency bytes. Scoped package and executable permission failures are distinguishable; partial or malformed output never proves readiness, and a workspace manifest failure never inherits an earlier package's label.	[unit] src/execution/dependencyInspection.test.ts::dependency inspection::identifies a scoped executable permission failure without changing private work, ::refuses partial, private or malformed process output, ::attributes malformed workspace manifests without a prior package label
The operator's optional execution.installRepairRepos map defaults off. Its keys are lower-case owner/name, and its only policy is exactly { policyVersion: "npm-ci-v1" }; malformed names, maps, versions and any additional command, environment or path fields fail config load.	[unit] src/config.test.ts::install repair policy config::accepts only an explicit fixed policy for a lower-case repository
A v1 receipt is valid only for the original parsed preservation owner (including its admission head), an exact target head, the fixed npm-ci-v1 policy and the trusted SHA-256 key of root lockfile entries committed at that target head. The original admission head need not equal the target head; a filename alone is not a dependency key.	[unit] src/execution/installRepairPolicy.test.ts::install repair receipt::accepts an exact target head distinct from the owner's admission head
Missing or extra receipt or owner fields, mismatches in each binding or committed lockfile key, unsupported versions, malformed heads, and command, env or path injection all fail closed.	[unit] src/execution/installRepairPolicy.test.ts::install repair receipt::rejects malformed or mismatched receipt bindings and injectable fields
A paused seeded coding run repairs dependencies only with the trusted operator's opt-in npm-ci-v1 policy and its original tracked preservation owner; missing ownership, a different backend, an invalid binding or an unready condition unrelated to dependencies cannot authorize repair. A successful repair records its receipt on the original workspace binding, rechecks readiness and continues the same run, while failure keeps the original run paused.	[unit] src/execution/factory.test.ts::makeExecutor pilot ready environment::repairs only an opted-in resumed owner before rechecking readiness
A missing original preservation owner field refuses repair even with the operator policy enabled.	[unit] src/execution/factory.test.ts::makeExecutor pilot ready environment::refuses repair when a saved preservation owner field is missing
The Worker rejects a stopped container without waking it and fences the checkout against competing operations for the entire native install. The fixed command requires the exact checkout HEAD, one committed clean root lockfile, no ignored alternate root npm inputs and a matching committed lockfile key, and returns a receipt bound to the original owner, container, head and lockfile key; uncertain completion is not success.	[unit] src/execution/installRepairEffect.test.ts::paused seeded checkout repair::builds only the fixed npm-ci-v1 command with an exact HEAD and a committed, clean root lockfile, ::refuses ignored root npm inputs before invoking the installer
The exclusive fence refuses a repair while another checkout operation is in flight and refuses checkout access while repair is in progress; no model command, environment or path can ride the repair request.	[unit] src/execution/installRepairEffect.test.ts::paused seeded checkout repair::excludes other checkout operations during the entire repair and refuses a repair while a command is in flight
The Bot sends an owner-bound request without model environment or transport retry and refuses a missing or mismatched receipt. Before native execution the Worker durably records the original run and seed's uncertain attempt. A later seeded coding attach inspects that record even when dependencies now appear ready; only a verified stored receipt and fresh readiness can continue, and an unknown attempt cannot execute again.	[unit] src/execution/installRepairEffect.test.ts::paused seeded checkout repair::sends one owner-bound request with no model environment and refuses an unbound receipt, ::routes only a parsed owner to a native no-wake effect; ordinary checkout routes share the fence, src/execution/factory.test.ts::makeExecutor pilot ready environment::holds a ready reattach when an earlier native repair has no durable receipt
The repair route uses the raw Durable Object stub and the native container execution API rather than a sandbox SDK call that could start a stopped container.	[unit] src/execution/installRepairEffect.test.ts::paused seeded checkout repair::routes only a parsed owner to a native no-wake effect; ordinary checkout routes share the fence

| Diagnostic output is bounded at the producer and each native stream before decoding; oversized labels are omitted, overflow returns unknown. Competing thread operations are excluded until the native process and streams settle. The image proves a FIFO-blocked probe leaves no UID descendants after timeout. | [unit] src/execution/dependencyInspection.test.ts::dependency inspection::bounds producer labels…, ::collects both streams…; deploy/cloudflare-resident/dependencyInspection.test.ts::retained resident dependency inspection::excludes completed competing writes…; [agent] CI resident image build executes its blocked-FIFO timeout proof |