feat(managed-agent): prove Shell process-group stops with a worker le…

…dger (M5c) M5a settled a cancel on the worker's word: a Shell member that ignored SIGTERM survived its leader, and a worker that crashed left the Shell process groups it started unnamed to the child's snapshot-only registry. Each Runtime worker now keeps an incarnated ledger of its Shell process groups, rewritten atomically before any settled step. A settled cancel waits for the whole group to die before the call journals; the host sweeps the ledger of a dead worker, and every new child sweeps older ledgers, neither one trusted. Identity is judged from the live process table with a leader-dated, one-sided start-time proof: a young live leader or a live pid the table cannot name is never signalled, and a group nothing can prove is a quarantine that blocks new Managed sessions until a reaper proves it. Registers and enables nothing; Windows stays on its documented liveness-only shape pending real-machine verification before M6. Refs #12380
wenshao · Oct 7, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
commit 128eeb3c98430c593ca42d48114bbd2458c1128a
diff --git a/docs/design/2026-09-27-ordinary-host-managed-engine.md b/docs/design/2026-09-27-ordinary-host-managed-engine.md
diff --git a/docs/design/2026-09-27-ordinary-host-managed-engine.zh-CN.md b/docs/design/2026-09-27-ordinary-host-managed-engine.zh-CN.md
diff --git a/packages/cli/src/acp-integration/acpAgent.test.ts b/packages/cli/src/acp-integration/acpAgent.test.ts
@@ -4818,6 +4818,72 @@ describe('QwenAgent MCP SSE/HTTP support', () => {
         'A Managed ACP host is available only to a private managed ACP parent.',
       );
     });
+
+    it('quarantines new Managed sessions until the unproven stop is proven', async () => {
+      await setupSessionMocks('managed-host-quarantine');
+      const { agent, agentPromise } = await bootManagedHost();
+      try {
+        await agent.newSession({
+          cwd: '/tmp',
+          mcpServers: [],
+          _meta: { [SESSION_EXECUTION_ENGINE_META_KEY]: 'managed' },
+        });
+        // The session's Config carries the host's quarantine sink.
+        const hostPolicy = vi.mocked(loadCliConfig).mock.calls[0]![9];
+        expect(hostPolicy?.onManagedEngineQuarantine).toBeDefined();
+
+        const reason = new Error('the worker stop could not be proven');
+        hostPolicy!.onManagedEngineQuarantine!(true, reason);
+        // A session already open still closes while the engine is
+        // quarantined: close governs no admission.
+        await agent.extMethod(SERVE_CONTROL_EXT_METHODS.sessionClose, {
+          sessionId: 'managed-host-quarantine',
+        });
+        await expect(
+          agent.newSession({
+            cwd: '/tmp',
+            mcpServers: [],
+            _meta: { [SESSION_EXECUTION_ENGINE_META_KEY]: 'managed' },
+          }),
+        ).rejects.toMatchObject({
+          code: -32024,
+          message: expect.stringContaining('quarantined'),
+          data: { errorKind: 'session_execution_engine_unavailable' },
+        });
+        // A second reason piles on: admission stays refused.
+        const second = new Error('another ledger survived');
+        hostPolicy!.onManagedEngineQuarantine!(true, second);
+        await expect(
+          agent.newSession({
+            cwd: '/tmp',
+            mcpServers: [],
+            _meta: { [SESSION_EXECUTION_ENGINE_META_KEY]: 'managed' },
+          }),
+        ).rejects.toMatchObject({ code: -32024 });
+        expect(loadCliConfig).toHaveBeenCalledTimes(1);
+
+        // Proving one stop lifts only its reason; the other still holds.
+        hostPolicy!.onManagedEngineQuarantine!(false, second);
+        await expect(
+          agent.newSession({
+            cwd: '/tmp',
+            mcpServers: [],
+            _meta: { [SESSION_EXECUTION_ENGINE_META_KEY]: 'managed' },
+          }),
+        ).rejects.toMatchObject({ code: -32024 });
+        // Proving the last one reopens admission.
+        hostPolicy!.onManagedEngineQuarantine!(false, reason);
+        await agent.newSession({
+          cwd: '/tmp',
+          mcpServers: [],
+          _meta: { [SESSION_EXECUTION_ENGINE_META_KEY]: 'managed' },
+        });
+        expect(loadCliConfig).toHaveBeenCalledTimes(2);
+      } finally {
+        mockConnectionState.resolve();
+        await agentPromise;
+      }
+    });
   });
 
   it.each([false, true])(

diff --git a/packages/cli/src/acp-integration/acpAgent.ts b/packages/cli/src/acp-integration/acpAgent.ts
@@ -3963,6 +3963,29 @@ class QwenAgent implements Agent {
     ApprovalMode
   >();
   private managedShuttingDown = false;
+  /**
+   * The reasons this Managed engine admits no new work: one per Runtime
+   * worker stop nobody could prove, lifted by the same reason once the
+   * group's death is proven.
+   */
+  private readonly managedEngineQuarantineReasons = new Set<Error>();
+
+  private setManagedEngineQuarantine(
+    quarantined: boolean,
+    reason: Error,
+  ): void {
+    if (quarantined) {
+      this.managedEngineQuarantineReasons.add(reason);
+      debugLogger.error(
+        '[ACP] Managed engine quarantined; no new Managed sessions:',
+        reason,
+      );
+    } else if (this.managedEngineQuarantineReasons.delete(reason)) {
+      debugLogger.debug(
+        `[ACP] Managed engine quarantine lifted: ${reason.message}`,
+      );
+    }
+  }
   private clientCapabilities: ClientCapabilities | undefined;
   /** Set once the daemon negotiates active-work reporting; one per channel. */
   private activeWorkReporter: ActiveWorkReporter | undefined;
@@ -4037,6 +4060,16 @@ class QwenAgent implements Agent {
     if (this.managedShuttingDown) {
       throw new SessionWriterUnavailableError();
     }
+    const quarantine = this.managedEngineQuarantineReasons
+      .values()
+      .next().value;
+    if (quarantine !== undefined) {
+      throw new RequestError(
+        -32024,
+        `The Managed engine is quarantined: a Runtime worker's stop could not be proven (${quarantine.message}).`,
+        { errorKind: 'session_execution_engine_unavailable' },
+      );
+    }
   }
 
   private async runExclusiveHistoryMutation<T>(
@@ -15375,7 +15408,13 @@ class QwenAgent implements Agent {
             // Only the Managed host accepts `managed`: its tools run in the
             // session's Runtime worker.
             ...(executionEngine === 'managed' && this.managedRuntimeEnvironment
-              ? { managedRuntimeEnvironment: this.managedRuntimeEnvironment }
+              ? {
+                  managedRuntimeEnvironment: this.managedRuntimeEnvironment,
+                  onManagedEngineQuarantine: (
+                    quarantined: boolean,
+                    reason: Error,
+                  ) => this.setManagedEngineQuarantine(quarantined, reason),
+                }
               : {}),
             ...(this.managedToolInvocationGuard
               ? { toolInvocationGuard: this.managedToolInvocationGuard }

diff --git a/packages/cli/src/config/config.ts b/packages/cli/src/config/config.ts
@@ -1710,6 +1710,8 @@ export async function loadCliConfig(
     executionEngine?: SessionExecutionEngine;
     /** Where a Managed session's tools execute; see `ConfigParameters`. */
     managedRuntimeEnvironment?: ConfigParameters['managedRuntimeEnvironment'];
+    /** How the host learns an unproven worker stop; see `ConfigParameters`. */
+    onManagedEngineQuarantine?: ConfigParameters['onManagedEngineQuarantine'];
   },
   enabledSkillNamesProvider?: () => ReadonlySet<string>,
 ): Promise<Config> {
@@ -2489,6 +2491,7 @@ export async function loadCliConfig(
     sessionRestoreProjectionSource: boundSessionRestoreProjectionSource,
     sessionExecutionEngine: hostPolicy?.executionEngine,
     managedRuntimeEnvironment: hostPolicy?.managedRuntimeEnvironment,
+    onManagedEngineQuarantine: hostPolicy?.onManagedEngineQuarantine,
     embeddingModel: DEFAULT_QWEN_EMBEDDING_MODEL,
     sandbox: sandboxConfig,
     targetDir: cwd,

diff --git a/packages/cli/src/serve/managed-runtime-attestation-worker.ts b/packages/cli/src/serve/managed-runtime-attestation-worker.ts
@@ -30,6 +30,7 @@ import {
   ManagedToolExecutor,
   type ManagedShellCapturePublisher,
 } from './managed-runtime-tool-executor.js';
+import { managedRuntimeLedgerFromEnvironment } from './managed-runtime-ledger.js';
 import { PUBLICATION_INSTALL_ROUTE } from './remote-shell-result-publication.js';
 import { WORKSPACE_CAPABILITY_DIGEST } from './managed-workspace-activation.js';
 import {
@@ -166,9 +167,15 @@ export async function startManagedRuntimeAttestationWorker(
     );
   } else {
     registerManagedRuntimeAttestationRoute(app, boot);
+    // A Managed session's host names one ledger per worker incarnation and
+    // sweeps it if the worker dies; a worker that cannot keep it must not
+    // answer a Shell, so a failure here fails the boot.
+    const ledger = managedRuntimeLedgerFromEnvironment(boot.runtimeIncarnation);
+    ledger?.watch();
     executor = ManagedToolExecutor.forWorkspace(
       boot.workspaceCwd,
       boot.runtimeInstanceId,
+      { ledger },
     );
     registerManagedRuntimeToolRoutes(app, boot, executor);
     const mount = new ManagedContextMount(boot.workspaceCwd);