test(cleanroom): add exhaustive Relay and Fleet qualification

.agentworkforce/trajectories/active/traj_uk6h49o2go5d/trajectory.json

@@ -0,0 +1,74 @@
+{
+  "id": "traj_uk6h49o2go5d",
+  "version": 1,
+  "task": {
+    "title": "Finish PR 1665 comprehensive Relay and Fleet cleanroom qualification",
+    "source": {
+      "system": "plain",
+      "id": "relay#1665"
+    }
+  },
+  "status": "active",
+  "startedAt": "2026-09-09T21:47:25.815Z",
+  "agents": [
+    {
+      "name": "default",
+      "role": "lead",
+      "joinedAt": "2026-09-09T21:50:52.599Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_0b6kshczxal7",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-09-09T21:50:52.599Z",
+      "events": [
+        {
+          "ts": 1788990652600,
+          "type": "decision",
+          "content": "Treat a non-symlink current artifact pointer as a retention no-op: Treat a non-symlink current artifact pointer as a retention no-op",
+          "raw": {
+            "question": "Treat a non-symlink current artifact pointer as a retention no-op",
+            "chosen": "Treat a non-symlink current artifact pointer as a retention no-op",
+            "alternatives": [],
+            "reasoning": "Hosted macOS exposed EINVAL during concurrent publication; preserving all runs is fail-closed and avoids deleting an untrusted canonical target."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1788993478961,
+          "type": "decision",
+          "content": "Kept the security fix dependency-delta-only: Kept the security fix dependency-delta-only",
+          "raw": {
+            "question": "Kept the security fix dependency-delta-only",
+            "chosen": "Kept the security fix dependency-delta-only",
+            "alternatives": [],
+            "reasoning": "Regenerating the full lock rewrote hundreds of unrelated records. The exact root override plus the smol-toml 1.8.0 lock entry passes npm ci and removes GHSA-7w5x-hrqm-74c2 without broad candidate dependency churn. The separate Relayfile SDK/Bun incompatibility remains independently tracked."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1789008100532,
+          "type": "decision",
+          "content": "Require validated checkpointed ownership intents before exact-name Daytona recovery and persist each recovered ID before deletion: Require validated checkpointed ownership intents before exact-name Daytona recovery and persist each recovered ID before deletion",
+          "raw": {
+            "question": "Require validated checkpointed ownership intents before exact-name Daytona recovery and persist each recovered ID before deletion",
+            "chosen": "Require validated checkpointed ownership intents before exact-name Daytona recovery and persist each recovered ID before deletion",
+            "alternatives": [],
+            "reasoning": "A lost CLI response can leave a remote sandbox after only the pre-create name intent is durable; exact name/workspace/nonce/newness/baseline validation plus a private checkpoint closes the crash window without ambient scans, while invalid attempt evidence remains fail-closed and independent."
+          },
+          "significance": "high"
+        }
+      ]
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "AgentWorkforce/relay",
+  "tags": [],
+  "_trace": {
+    "startRef": "5bbe9230bfb90cc59da7f96cfc92cf20210096f1",
+    "endRef": "5bbe9230bfb90cc59da7f96cfc92cf20210096f1"
+  }
+}

.agentworkforce/trajectories/completed/2026-09/traj_1by387iu092c.trace.json

@@ -0,0 +1,101 @@
+{
+  "version": "1.0.0",
+  "id": "75779746-66ad-4591-9434-e86aec5d1092",
+  "timestamp": "2026-09-08T19:25:26.970Z",
+  "trajectory": "traj_1by387iu092c",
+  "files": [
+    {
+      "path": "tests/fixtures/strict-workflow-yaml.test.ts",
+      "conversations": [
+        {
+          "contributor": {
+            "type": "ai"
+          },
+          "ranges": [
+            {
+              "start_line": 1,
+              "end_line": 6,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "path": "tests/relayflows/cases/1665-immutable-fleet-snapshot/run.mjs",
+      "conversations": [
+        {
+          "contributor": {
+            "type": "ai"
+          },
+          "ranges": [
+            {
+              "start_line": 225,
+              "end_line": 273,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            },
+            {
+              "start_line": 404,
+              "end_line": 410,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            },
+            {
+              "start_line": 499,
+              "end_line": 505,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "path": "tests/relayflows/cases/1665-immutable-fleet-snapshot/strict-yaml-subset.mjs",
+      "conversations": [
+        {
+          "contributor": {
+            "type": "ai"
+          },
+          "ranges": []
+        }
+      ]
+    },
+    {
+      "path": "tests/relayflows/cases/1665-immutable-fleet-snapshot/trusted-cleanroom-runner.mjs",
+      "conversations": [
+        {
+          "contributor": {
+            "type": "ai"
+          },
+          "ranges": [
+            {
+              "start_line": 1,
+              "end_line": 4,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            },
+            {
+              "start_line": 176,
+              "end_line": 182,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            },
+            {
+              "start_line": 192,
+              "end_line": 198,
+              "revision": "be9cbeaf88075f06837c28631cacf654d5b756e6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "path": "tests/relayflows/cases/1682-trusted-cleanroom-runner/case.json",
+      "conversations": [
+        {
+          "contributor": {
+            "type": "ai"
+          },
+          "ranges": []
+        }
+      ]
+    }
+  ]
+}

.agentworkforce/trajectories/completed/2026-09/traj_1by387iu092c/summary.md

@@ -0,0 +1,40 @@
+# Trajectory: Consolidate trusted cleanroom proof into PR 1665 single RelayFlow case
+
+> **Status:** ✅ Completed
+> **Task:** relay#1665
+> **Confidence:** 93%
+> **Started:** September 8, 2026 at 09:13 PM
+> **Completed:** September 8, 2026 at 09:25 PM
+
+---
+
+## Summary
+
+Consolidated the trusted cleanroom runner security regression into PR 1665's immutable Fleet snapshot RelayFlow and proved exact base absent/head fixed in clean detached checkouts.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it
+- **Chose:** Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it
+- **Reasoning:** The PR proof dispatcher fails closed when more than one case directory changes; issue 1682 is a security correction to the still-unmerged 1665 feature, so both behaviors must be proven atomically without weakening the one-case contract.
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it: Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it
+- PR 1665 now carries both immutable Fleet snapshot and trusted cleanroom security proof in one declared RelayFlow case; exact clean base/head red-green passed.
+
+---
+
+## Artifacts
+
+**Commits:** be9cbeaf8
+**Files changed:** 5

.agentworkforce/trajectories/completed/2026-09/traj_1by387iu092c/trajectory.json

@@ -0,0 +1,87 @@
+{
+  "id": "traj_1by387iu092c",
+  "version": 1,
+  "task": {
+    "title": "Consolidate trusted cleanroom proof into PR 1665 single RelayFlow case",
+    "source": {
+      "system": "plain",
+      "id": "relay#1665"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-09-08T19:13:18.436Z",
+  "completedAt": "2026-09-08T19:25:26.898Z",
+  "agents": [
+    {
+      "name": "default",
+      "role": "lead",
+      "joinedAt": "2026-09-08T19:13:18.979Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_3l3t6ky2v8jx",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-09-08T19:13:18.979Z",
+      "endedAt": "2026-09-08T19:25:26.898Z",
+      "events": [
+        {
+          "ts": 1788894798980,
+          "type": "decision",
+          "content": "Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it: Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it",
+          "raw": {
+            "question": "Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it",
+            "chosen": "Keep one declared RelayFlow case and run issue 1682 trust assertions as auxiliary checks inside it",
+            "alternatives": [],
+            "reasoning": "The PR proof dispatcher fails closed when more than one case directory changes; issue 1682 is a security correction to the still-unmerged 1665 feature, so both behaviors must be proven atomically without weakening the one-case contract."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1788895526388,
+          "type": "reflection",
+          "content": "PR 1665 now carries both immutable Fleet snapshot and trusted cleanroom security proof in one declared RelayFlow case; exact clean base/head red-green passed.",
+          "raw": {
+            "focalPoints": [
+              "single-case proof",
+              "exact SHA",
+              "clean checkout"
+            ],
+            "adjustments": "Retained auxiliary adversarial assertions under case 1665 so the dispatcher remains fail-closed.",
+            "confidence": 0.93
+          },
+          "significance": "high",
+          "tags": [
+            "focal:single-case proof",
+            "focal:exact SHA",
+            "focal:clean checkout",
+            "confidence:0.93"
+          ]
+        }
+      ]
+    }
+  ],
+  "retrospective": {
+    "summary": "Consolidated the trusted cleanroom runner security regression into PR 1665's immutable Fleet snapshot RelayFlow and proved exact base absent/head fixed in clean detached checkouts.",
+    "approach": "Standard approach",
+    "confidence": 0.93
+  },
+  "commits": [
+    "be9cbeaf8"
+  ],
+  "filesChanged": [
+    "tests/fixtures/strict-workflow-yaml.test.ts",
+    "tests/relayflows/cases/1665-immutable-fleet-snapshot/run.mjs",
+    "tests/relayflows/cases/1665-immutable-fleet-snapshot/strict-yaml-subset.mjs",
+    "tests/relayflows/cases/1665-immutable-fleet-snapshot/trusted-cleanroom-runner.mjs",
+    "tests/relayflows/cases/1682-trusted-cleanroom-runner/case.json"
+  ],
+  "projectId": "AgentWorkforce/relay",
+  "tags": [],
+  "_trace": {
+    "startRef": "e5aba4f6c19a32a2474146ac09a5e754af2b10f4",
+    "endRef": "be9cbeaf88075f06837c28631cacf654d5b756e6",
+    "traceId": "75779746-66ad-4591-9434-e86aec5d1092"
+  }
+}

.agentworkforce/trajectories/completed/2026-09/traj_6vev6idu2zur/summary.md

@@ -0,0 +1,38 @@
+# Trajectory: Repair PR #1665 cleanroom qualification security and review findings
+
+> **Status:** ✅ Completed
+> **Task:** PR1665/1683 security repair
+> **Confidence:** 90%
+> **Started:** September 8, 2026 at 05:17 PM
+> **Completed:** September 8, 2026 at 05:27 PM
+
+---
+
+## Summary
+
+Repaired PR #1665 cleanroom qualification security and PR #1683 review findings: brokered candidate credentials through an unprivileged isolated process, materialized bounded evidence snapshots into trusted read-only inputs, added name-bound crash-safe workspace reconciliation, descriptor-bound artifact reads, rooted workflow paths, strict cloud host validation, behavioral no-candidate regression proof, and quality-test hardening. Node 22 full suite and static gates passed.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Isolated candidate Fleet behind a trusted loopback credential broker and dedicated unprivileged UID
+- **Chose:** Isolated candidate Fleet behind a trusted loopback credential broker and dedicated unprivileged UID
+- **Reasoning:** The candidate needs live Fleet API behavior, but its process must not inherit workspace, Cloud, Daytona, or provider secrets; brokered forwarding preserves the behavior while read-only trusted inputs and an external evidence root prevent candidate mutation.
+
+### Made cleanup reconcile deterministic idempotency keys before deleting
+- **Chose:** Made cleanup reconcile deterministic idempotency keys before deleting
+- **Reasoning:** A runner can die after remote creation and before GitHub output publication, so cleanup must produce explicit present-or-absent reconciliation proof rather than skip missing IDs.
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Isolated candidate Fleet behind a trusted loopback credential broker and dedicated unprivileged UID: Isolated candidate Fleet behind a trusted loopback credential broker and dedicated unprivileged UID
+- Made cleanup reconcile deterministic idempotency keys before deleting: Made cleanup reconcile deterministic idempotency keys before deleting
+- Security repairs are implemented and verified: candidate credentials are brokered from an unprivileged isolated process, trusted evidence is materialized from a bounded snapshot, cleanup reconciles run-scoped creates, and all Node 22/static gates are green.