feat: add isolated RVT connection reader runtime

.github/workflows/ci.yml

@@ -303,6 +303,9 @@ jobs:
         working-directory: cli-connection-reader
         run: node --test
 
+      - name: Verify portable private compiler authority
+        run: node --test cli/build-windows-internal-repro.test.mjs cli/create-windows-internal-repro-inputs.test.mjs cli/windows-compiler-closure.test.mjs
+
   # The repo's Python tests. Same hole as `cli-connection-reader` above, as
   # `steel-detailer-lookup`, and as the six .NET suites below — a real regression
   # suite that NO workflow ran. `20-agents/aeco/visualization/blender/tests/`
@@ -365,7 +368,8 @@ jobs:
   bridge-windows-packaged:
     name: connection-reader packaged RVT/IFC harness
     runs-on: windows-latest
-    timeout-minutes: 15
+    # Two fresh compiler/SDK copies plus debug-event audits precede the packaged host build.
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6
 
@@ -375,9 +379,20 @@ jobs:
           cache: npm
           cache-dependency-path: cli-connection-reader/package-lock.json
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.95.0
+
+      - name: Configure the native x64 compiler environment
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
         with:
-          toolchain: 1.88.0
+          arch: x64
+
+      - name: Verify private builder authority
+        run: node --test cli/build-windows-internal-repro.test.mjs cli/create-windows-internal-repro-inputs.test.mjs cli/windows-compiler-closure.test.mjs
+
+      - name: Verify native vendor-path reproducibility
+        run: node cli/windows-vendor-repro.native.mjs
 
       - name: Build source AWARE host
         run: cargo build --manifest-path cli/Cargo.toml --locked

20-agents/aeco/engineering/model-reference-reader/manifest.yaml

@@ -1,5 +1,5 @@
 agent: model-reference-reader
-version: 0.4.0
+version: 0.5.0
 display-name: Authenticated RVT Reference Reader
 description: |
   Convert a local Revit project into deterministic, authenticated reference-model artifacts without
@@ -52,6 +52,10 @@ commands:
         type: string
         required: false
         description: Installer-enrolled absolute authority-store path passed only to a managed-cloud v2 provider.
+      reader-schema-version:
+        type: string
+        required: false
+        description: Exact AWARE reader contract; defaults to model-reference-reader/v1, or opt into model-reference-reader/v2.
     outputs:
       type: single
       schema:
@@ -91,6 +95,14 @@ commands:
         type: string
         required: false
         description: Installer-enrolled absolute authority-store path passed only to a managed-cloud v2 provider.
+      reader-schema-version:
+        type: string
+        required: false
+        description: Exact AWARE reader contract; defaults to model-reference-reader/v1, or opt into model-reference-reader/v2.
+      property-expansion-limits:
+        type: object
+        required: false
+        description: Optional lower ceilings for expanded property rows and canonical property bytes under reader v2.
       expected-signer-sha256:
         type: string
         required: true
@@ -136,6 +148,14 @@ commands:
         type: string
         required: false
         description: Installer-enrolled absolute authority-store path passed only to a managed-cloud v2 provider.
+      reader-schema-version:
+        type: string
+        required: false
+        description: Exact AWARE reader contract; defaults to model-reference-reader/v1, or opt into model-reference-reader/v2.
+      property-expansion-limits:
+        type: object
+        required: false
+        description: Optional lower ceilings for expanded property rows and canonical property bytes under reader v2.
       expected-signer-sha256:
         type: string
         required: true
@@ -182,6 +202,14 @@ commands:
         type: string
         required: false
         description: Installer-enrolled absolute authority-store path passed only to a managed-cloud v2 provider.
+      reader-schema-version:
+        type: string
+        required: false
+        description: Exact AWARE reader contract; defaults to model-reference-reader/v1, or opt into model-reference-reader/v2.
+      property-expansion-limits:
+        type: object
+        required: false
+        description: Optional lower ceilings for expanded property rows and canonical property bytes under reader v2.
       expected-signer-sha256:
         type: string
         required: true

cli-connection-reader/build-internal-repro.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// Fail-closed entrypoint for the private Windows reproducibility proof. Real machine paths live only
+// in the per-builder locator; the canonical manifest and receipt contain logical IDs and digests.
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildConnectionReader, canonicalJson, READER_BUILD_SETTINGS, sha256File } from './build.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const SHA256 = /^[0-9a-f]{64}$/;
+const POISONED_EXACT = new Set([
+  'RUSTFLAGS', 'CARGO_ENCODED_RUSTFLAGS', 'CC', 'CFLAGS', 'CL', 'LINK', 'LIB', 'INCLUDE',
+  'NODE_OPTIONS', 'ESBUILD_BINARY_PATH', 'GOOGLE_CLIENT_SECRET', 'AWARE_GOOGLE_CLIENT_SECRET',
+]);
+const POISONED_PREFIXES = ['npm_config_', 'DOTNET_', 'COREHOST_'];
+
+const digestText = (text) => createHash('sha256').update(text).digest('hex');
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+
+export function rejectedAmbientKeys(env) {
+  // Windows environment names are case-insensitive, so an ambient
+  // `esbuild_binary_path` still resolves as ESBUILD_BINARY_PATH. Match the outer
+  // builder: fold case before the exact lookup, and reject names that collide
+  // only by case, since which one a child reads is not ours to decide.
+  const counts = Object.keys(env).reduce(
+    (map, key) => map.set(key.toLowerCase(), (map.get(key.toLowerCase()) ?? 0) + 1), new Map());
+  return Object.keys(env).filter((key) => counts.get(key.toLowerCase()) > 1
+    || POISONED_EXACT.has(key.toUpperCase())
+    || POISONED_PREFIXES.some((prefix) => key.toLowerCase().startsWith(prefix.toLowerCase())))
+    .sort();
+}
+
+function verifyRecord(id, record, locator) {
+  if (!record || record.id !== id || !SHA256.test(record.sha256 ?? '')) throw new Error(`invalid tool record ${id}`);
+  const path = locator?.tools?.[id];
+  if (typeof path !== 'string' || !existsSync(path)) throw new Error(`missing local path for tool ${id}`);
+  const actual = sha256File(path);
+  if (actual !== record.sha256) throw new Error(`tool digest mismatch for ${id}: ${actual}`);
+  return resolve(path);
+}
+
+export function verifyInternalInputs({ manifest, locator, env = process.env }) {
+  if (manifest?.schema !== 'aware-windows-repro-builder/v1') throw new Error('unsupported builder manifest schema');
+  if (locator?.schema !== 'aware-windows-repro-locator/v1') throw new Error('unsupported builder locator schema');
+  const poison = rejectedAmbientKeys(env);
+  if (poison.length) throw new Error(`ambient build authority is forbidden: ${poison.join(', ')}`);
+  if (manifest.platform !== 'win32' || manifest.arch !== 'x64' || manifest.nodeVersion !== '24.14.0') {
+    throw new Error('builder manifest must pin Windows x64 and Node 24.14.0');
+  }
+  if (canonicalJson(manifest.settings) !== canonicalJson(READER_BUILD_SETTINGS)) {
+    throw new Error('reader build settings differ from the closed implementation');
+  }
+  const paths = Object.fromEntries(['node', 'postject', 'web-ifc-wasm'].map((id) => [id,
+    verifyRecord(id, manifest.tools?.[id], locator),
+  ]));
+  if (process.platform !== 'win32' || process.arch !== 'x64' || process.versions.node !== manifest.nodeVersion) {
+    throw new Error(`running Node must be exactly ${manifest.nodeVersion} on Windows x64`);
+  }
+  if (realpathSync(paths.node) !== realpathSync(process.execPath)) throw new Error('the verified Node is not the running Node');
+  for (const [name, path] of Object.entries({
+    'reader-package-lock': join(here, 'package-lock.json'),
+    'aware-cargo-lock': join(here, '..', 'cli', 'Cargo.lock'),
+  })) {
+    const expected = manifest.inputs?.[name];
+    if (!SHA256.test(expected ?? '') || sha256File(path) !== expected) throw new Error(`input digest mismatch for ${name}`);
+  }
+  if (!SHA256.test(manifest.source?.bundleSha256 ?? '') || !/^[0-9a-f]{40}$/.test(manifest.source?.commit ?? '')
+    || !/^[0-9a-f]{40}$/.test(manifest.source?.tree ?? '')) throw new Error('invalid source identity in builder manifest');
+  return paths;
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!argv[i]?.startsWith('--') || argv[i + 1] == null) throw new Error('arguments are --manifest FILE --locator FILE --output DIR');
+    out[argv[i].slice(2)] = argv[i + 1];
+  }
+  if (!out.manifest || !out.locator || !out.output) throw new Error('arguments are --manifest FILE --locator FILE --output DIR');
+  return out;
+}
+
+export async function runInternalReaderBuild({ manifestPath, locatorPath, outputDir, env = process.env }) {
+  const manifestText = canonicalJson(readJson(manifestPath));
+  const manifest = JSON.parse(manifestText);
+  const locator = readJson(locatorPath);
+  const paths = verifyInternalInputs({ manifest, locator, env });
+  const receipt = {
+    schema: 'aware-connection-reader-build-receipt/v1',
+    buildId: digestText(manifestText),
+    builderManifestSha256: digestText(manifestText),
+    source: manifest.source,
+    inputs: manifest.inputs,
+    settings: manifest.settings,
+    tools: Object.fromEntries(Object.entries(manifest.tools).map(([id, record]) => [id, {
+      id: record.id, sha256: record.sha256,
+    }])),
+    commands: {
+      bundle: '<esbuild> model-dispatcher.mjs -> <output>/bundle.cjs',
+      sea: '<node> --experimental-sea-config sea-config.json [cwd=<output>]',
+      inject: '<node> <postject> aware-connection-reader.exe NODE_SEA_BLOB sea-prep.blob [cwd=<output>]',
+    },
+    rootTokens: ['<source>', '<output>', '<toolchain>', '<cache>', '<profile>'],
+  };
+  return buildConnectionReader({
+    outputDir, nodePath: paths.node, postjectPath: paths.postject,
+    wasmPath: paths['web-ifc-wasm'], receipt, verifiedExternalTools: true,
+  });
+}
+
+if (realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1])) {
+  const args = parseArgs(process.argv.slice(2));
+  await runInternalReaderBuild({ manifestPath: args.manifest, locatorPath: args.locator, outputDir: args.output });
+}

cli-connection-reader/build-internal-repro.test.mjs

@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { buildConnectionReader, canonicalJson, READER_BUILD_SETTINGS } from './build.mjs';
+import { rejectedAmbientKeys, verifyInternalInputs } from './build-internal-repro.mjs';
+
+const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+test('SEA configuration is path-independent and every injection operand is relative to output cwd', () => {
+  const text = readFileSync(new URL('./build.mjs', import.meta.url), 'utf8');
+  assert.match(text, /main: 'bundle\.cjs'/);
+  assert.match(text, /output: 'sea-prep\.blob'/);
+  assert.match(text, /cwd: outputDir/);
+  assert.match(text, /EXE_NAME, READER_BUILD_SETTINGS\.sea\.section, 'sea-prep\.blob'/);
+  assert.match(text, /'--sentinel-fuse', READER_BUILD_SETTINGS\.sea\.sentinelFuse/);
+  assert.doesNotMatch(text, /main:\s*join\(outputDir/);
+  assert.doesNotMatch(text, /output:\s*join\(outputDir/);
+});
+
+test('canonical receipt JSON is independent of insertion order', () => {
+  assert.equal(canonicalJson({ z: 1, a: { y: 2, x: 3 } }), canonicalJson({ a: { x: 3, y: 2 }, z: 1 }));
+});
+
+test('build cleanup refuses to own the reader source root', async () => {
+  const readerRoot = new URL('.', import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/, (value) => value.slice(1));
+  await assert.rejects(() => buildConnectionReader({ outputDir: readerRoot }), /must not be the reader source root/);
+});
+
+test('ambient compiler, Node, npm, dotnet, and credential authority is rejected', () => {
+  assert.deepEqual(rejectedAmbientKeys({ Path: 'ok', RUSTFLAGS: 'poison', npm_config_cache: 'x', DOTNET_ROOT: 'x' }),
+    ['DOTNET_ROOT', 'RUSTFLAGS', 'npm_config_cache']);
+  assert.deepEqual(rejectedAmbientKeys({ NODE_OPTIONS: '--require evil', AWARE_GOOGLE_CLIENT_SECRET: 'secret' }),
+    ['AWARE_GOOGLE_CLIENT_SECRET', 'NODE_OPTIONS']);
+});
+
+test('ambient authority is rejected by folded case and by case-only collisions', () => {
+  // Windows resolves process.env.ESBUILD_BINARY_PATH from an ambient
+  // `esbuild_binary_path`, so a case-sensitive exact match let esbuild run an
+  // undeclared binary inside a supposedly closed build.
+  assert.deepEqual(rejectedAmbientKeys({ esbuild_binary_path: 'C:\evil.exe' }), ['esbuild_binary_path']);
+  assert.deepEqual(rejectedAmbientKeys({ NoDe_OpTiOnS: '--require evil' }), ['NoDe_OpTiOnS']);
+  // Two spellings of one name: which one a child reads is not ours to decide.
+  assert.deepEqual(rejectedAmbientKeys({ Path: 'a', PATH: 'b' }), ['PATH', 'Path']);
+  // A single ordinary Path is still authority the reader needs.
+  assert.deepEqual(rejectedAmbientKeys({ Path: 'ok' }), []);
+});
+
+test('tool verification goes red when a declared tool byte changes', () => {
+  const root = mkdtempSync(join(tmpdir(), 'aware-repro-test-'));
+  const tool = join(root, 'tool.bin'); writeFileSync(tool, 'one');
+  const manifest = {
+    schema: 'aware-windows-repro-builder/v1', platform: 'win32', arch: 'x64', nodeVersion: '24.14.0',
+    settings: READER_BUILD_SETTINGS,
+    source: { bundleSha256: 'a'.repeat(64), commit: 'b'.repeat(40), tree: 'c'.repeat(40) },
+    tools: {
+      node: { id: 'node', sha256: sha('one') },
+      postject: { id: 'postject', sha256: sha('one') },
+      'web-ifc-wasm': { id: 'web-ifc-wasm', sha256: sha('one') },
+    },
+    inputs: { 'reader-package-lock': 'd'.repeat(64), 'aware-cargo-lock': 'e'.repeat(64) },
+  };
+  const locator = { schema: 'aware-windows-repro-locator/v1', tools: { node: tool, postject: tool, 'web-ifc-wasm': tool } };
+  writeFileSync(tool, 'two');
+  assert.throws(() => verifyInternalInputs({ manifest, locator, env: {} }), /tool digest mismatch/);
+});
+
+test('controlled reader rejects omitted or changed byte-affecting settings', () => {
+  const root = mkdtempSync(join(tmpdir(), 'aware-repro-settings-'));
+  const tool = join(root, 'tool.bin'); writeFileSync(tool, 'one');
+  const manifest = {
+    schema: 'aware-windows-repro-builder/v1', platform: 'win32', arch: 'x64', nodeVersion: '24.14.0',
+    source: { bundleSha256: 'a'.repeat(64), commit: 'b'.repeat(40), tree: 'c'.repeat(40) },
+    tools: Object.fromEntries(['node', 'postject', 'web-ifc-wasm'].map((id) => [id, { id, sha256: sha('one') }])),
+    inputs: { 'reader-package-lock': 'd'.repeat(64), 'aware-cargo-lock': 'e'.repeat(64) },
+  };
+  const locator = { schema: 'aware-windows-repro-locator/v1', tools: { node: tool, postject: tool, 'web-ifc-wasm': tool } };
+  assert.throws(() => verifyInternalInputs({ manifest, locator, env: {} }), /reader build settings differ/);
+  assert.throws(() => verifyInternalInputs({
+    manifest: { ...manifest, settings: { ...READER_BUILD_SETTINGS, sea: { ...READER_BUILD_SETTINGS.sea, section: 'evil' } } },
+    locator, env: {},
+  }), /reader build settings differ/);
+});