Refactor multiagent authority and coding-agent runtime into Rust

[areshand]

Summary

• move workflow, decision, assignment, snapshot, reviewer evidence, and coding-agent runtime boundaries into the Rust control plane
• enforce fixed Linux role identities: read-only orchestrator/reviewers, scoped writers, and a typed supervisor mutation API
• make workflow completion supervisor-owned and atomic: all lifecycle gates run before the phase can become complete
• bind the immutable original task, registered contract artifact, implementation context, and reviewer evidence to hashes
• require explicit positive/negative structural contract rules and reject implementation plans that contradict registered must-not rules
• give technical reviewers the original task, exact scout artifact, and canonical diff; replacement reviewers may narrow runtime scope but not semantic scope
• keep the authority supervisor alive after a client disconnect or broken pipe
• normalize contract-scout launches to a read-only scout role even if the orchestrator supplies a generic reviewer role
• support Codex, Claude Code, and Qwen Code through a typed Rust backend boundary with durable raw/normalized traces
• keep launch.sh only as the source-checkout compatibility entrypoint and remove obsolete shell/Python workflow implementations
• reduce the SWE adapter to workspace/trace transport; the official SWE-bench verifier remains the only scorer

Security and authority boundary

The orchestrator can read the repository and all worker/reviewer state, but cannot write the target repository or launch an unrestricted coding-agent process. Writers receive only supervisor-authorized owned paths. Reviewers are read-only and their finalized evidence is sealed to the current canonical diff.

The Linux malicious-orchestrator suite verifies that direct repository writes, direct completion transitions, unsafe state mutation, forged reviewer evidence, launch-authorization replay, owned-path breakout, and stale snapshot reuse are denied while valid scoped worker writes and supervisor-gated completion succeed.

Validation

• macOS cargo test — 31 passed
• Linux cargo test --locked — 32 passed, including the broken-pipe supervisor regression
• bash tests/run.sh — passed
• cargo fmt --check — passed
• Linux tests/malicious-orchestrator.sh — passed
• git diff --check — passed

SWE-bench Pro first 10 rows

The earlier official-verifier run remained 7/10: rows 0–6 passed and rows 7–9 did not. There was no regression among the rows that were already solved before the Rust migration.

Row 8 was rerun after the contract and supervisor fixes. The clean one-shot run exercised the complete workflow correctly but scored 0 because the generated patch named a private credential cache credentialCache; the official test patch required Forwarder.clientCredentials, a private identifier not specified by the public task. This is retained as an honest one-shot failure rather than feeding hidden-test data into the generic solver prompt.

An explicitly labeled iterative regression check then applied only that verifier-reported rename and reran the same official run_script.sh and parser. All 48 selected row-8 tests passed. This proves the task behavior and architecture patch are compatible with the official verifier after the one-field correction, but it is not represented as a clean benchmark score.

The row-8 lifecycle reached complete only after the supervisor atomically validated the registered contract, exact diff hash, all review records, and closed todos. The persisted trace archive is available outside the task container.

This is local official-verifier evidence, not an official leaderboard submission.