Date: 2026-09-12
Contract: eve.repository-execution.v1 / frozen 1.0.0 Scope:
repository execution inside an already admitted Task 2.6 workspace
Decision#
An execution result is admissible only when one machine-readable receipt proves all eight Task 11.3 clauses. The receipt must show a distinct Git worktree and task branch, byte-stable pre-existing operator work, applicable ancestor instructions and the effective CODEOWNERS rule for every changed path, exact generator provenance for generated output, the complete narrow verification set, live resource sampling and process-group supervision, secret-safe capture, and content-addressed command and artifact evidence.
Unknown is not pass. Each failure has a typed refusal in the frozen contract; the verifier rejects an incomplete, ambiguous, stale, or self-asserted record. Task 2.6 remains the checkout/credential/egress admission boundary. This task adds the repository-operation boundary and does not weaken or duplicate that earlier gate.
Executed proof#
The retained probe created a real temporary Git repository with a committed
baseline and an uncommitted operator-owned note in its primary worktree. It then
created a separate eve/task-11-3-probe worktree, changed a source, invoked its
declared generator, ran only the changed-path test target, and exercised output
redaction with a cryptographically random runtime-only canary. Every child ran
in a new operating-system process group. The probe sampled real /proc memory,
root and temporary-filesystem capacity, and competing-process count before spawn
and after completion of every command, then removed the bounded temporary
repository.
The receipt retains executable and argument arrays, a workspace role rather than a temporary absolute path, environment variable names rather than values, sanitized output plus its SHA-256 and byte count, resource samples, timestamps, exit state, changed-file SHA-256 values, instruction digests, effective owners, generator and verification bindings, cleanup state, and explicit limitations. The raw child output and the random canary are never written. The probe scans the fixture artifacts before deletion and re-evaluates the receipt with the canary still in memory; either residue makes the run fail before publication.
Resource and test-selection policy#
Narrow impacted targets are the default and must exactly cover the changed
paths. A broad gate is refused unless the host has at least 32 GiB RAM, there is
no competing heavy process, and a human explicitly approved it. All commands are
sampled at most 30 seconds apart. Available memory below 2 GiB, free memory
below 512 MiB on a no-swap host, or less than 2 GiB on either required
filesystem refuses the command before spawn or stops the entire child process
group. Runtime breaches first send SIGTERM, then escalate to SIGKILL after a
bounded grace period so a resistant descendant cannot strand the supervisor.
Captured child output is bounded in memory before redaction and retention.
Privacy and governance classification#
The receipt is repository evidence. It may retain repository-relative paths, public ownership handles, instruction and artifact digests, command structure, resource quantities, and sanitized output. Credential values, raw output, the temporary absolute workspace path, and heavy-process command lines are excluded. The committed measurement therefore supports audit and deletion by deleting one known receipt and its evidence manifest; it creates no durable secret store or new personal-data purpose.
Exact boundary#
This closes Task 11.3 only. It does not run a coding model, provide a kernel
sandbox or firewall, implement durable goal/plan entities, lease fleet work,
perform independent review, merge, push, recover from the Task 11.5 fault
matrix, measure unseen benchmark outcomes, or grant verified. Tasks 11.4–11.7
and 11.9–11.11 retain those responsibilities. Phase 11 and G12 remain open.