# Eve repository execution contract — Task 11.3

**Date:** 2026-09-12

**Contract:** `eve.repository-execution.v1` / frozen `1.0.0` **Scope:**
repository execution inside an already admitted Task 2.6 workspace

## Decision

An execution result is admissible only when one machine-readable receipt proves
all eight Task 11.3 clauses. The receipt must show a distinct Git worktree and
task branch, byte-stable pre-existing operator work, applicable ancestor
instructions and the effective CODEOWNERS rule for every changed path, exact
generator provenance for generated output, the complete narrow verification set,
live resource sampling and process-group supervision, secret-safe capture, and
content-addressed command and artifact evidence.

Unknown is not pass. Each failure has a typed refusal in the frozen contract;
the verifier rejects an incomplete, ambiguous, stale, or self-asserted record.
Task 2.6 remains the checkout/credential/egress admission boundary. This task
adds the repository-operation boundary and does not weaken or duplicate that
earlier gate.

## Executed proof

The retained probe created a real temporary Git repository with a committed
baseline and an uncommitted operator-owned note in its primary worktree. It then
created a separate `eve/task-11-3-probe` worktree, changed a source, invoked its
declared generator, ran only the changed-path test target, and exercised output
redaction with a cryptographically random runtime-only canary. Every child ran
in a new operating-system process group. The probe sampled real `/proc` memory,
root and temporary-filesystem capacity, and competing-process count before spawn
and after completion of every command, then removed the bounded temporary
repository.

The receipt retains executable and argument arrays, a workspace role rather than
a temporary absolute path, environment variable names rather than values,
sanitized output plus its SHA-256 and byte count, resource samples, timestamps,
exit state, changed-file SHA-256 values, instruction digests, effective owners,
generator and verification bindings, cleanup state, and explicit limitations.
The raw child output and the random canary are never written. The probe scans
the fixture artifacts before deletion and re-evaluates the receipt with the
canary still in memory; either residue makes the run fail before publication.

## Resource and test-selection policy

Narrow impacted targets are the default and must exactly cover the changed
paths. A broad gate is refused unless the host has at least 32 GiB RAM, there is
no competing heavy process, and a human explicitly approved it. All commands are
sampled at most 30 seconds apart. Available memory below 2 GiB, free memory
below 512 MiB on a no-swap host, or less than 2 GiB on either required
filesystem refuses the command before spawn or stops the entire child process
group. Runtime breaches first send `SIGTERM`, then escalate to `SIGKILL` after a
bounded grace period so a resistant descendant cannot strand the supervisor.
Captured child output is bounded in memory before redaction and retention.

## Privacy and governance classification

The receipt is repository evidence. It may retain repository-relative paths,
public ownership handles, instruction and artifact digests, command structure,
resource quantities, and sanitized output. Credential values, raw output, the
temporary absolute workspace path, and heavy-process command lines are excluded.
The committed measurement therefore supports audit and deletion by deleting one
known receipt and its evidence manifest; it creates no durable secret store or
new personal-data purpose.

## Exact boundary

This closes Task 11.3 only. It does **not** run a coding model, provide a kernel
sandbox or firewall, implement durable goal/plan entities, lease fleet work,
perform independent review, merge, push, recover from the Task 11.5 fault
matrix, measure unseen benchmark outcomes, or grant `verified`. Tasks 11.4–11.7
and 11.9–11.11 retain those responsibilities. Phase 11 and G12 remain open.