RSI proof 4/6: Run later mutations with the selected parent harness

[w4ffl35]

Goal

Close the recursive loop: generation N+1 must be produced by the selected generation N headlesscode agent harness, while the coordinator, evaluator, budgets, and promotion decision remain immutable and outside the guest. Provide a fixed-worker control arm to measure whether self-hosting helps.

Depends on

Independent benchmark tasks (#15), parent-relative selection (#16), and bounded OpenRouter inference (#17).

Current gap (v1.3.0)

src/rsi/openshell.ts:531-569 runs /opt/headlesscode/src/cli.ts for every mutation. It mounts the candidate's sanitized source under /workspace, but that source is the object being edited, not the running agent. src/rsi/controller.ts:488-503 can pass an accepted candidate's commit to a later generation. Thus code ancestry exists, but the changed agent loop does not yet drive the next mutation.

Architecture and work

1. Introduce a run-manifest worker mode: fixed-control executes the immutable release harness; self-hosted executes the selected parent's src/cli.ts from the one-commit sanitized /workspace snapshot. The generation-zero worker uses the pinned release harness in both arms. The selected parent commit, sanitized snapshot digest, runtime image digest, dependency-lock digest, mode, and actual executed CLI path must be recorded in every mutation job and result.
2. Keep /opt/headlesscode as the trusted launcher and immutable fallback, not the code loaded by a self-hosted agent. Provide pinned dependencies read-only to /workspace; package metadata/lockfile changes remain protected. Verify that module resolution actually loads mutable agent modules from /workspace, not /opt/headlesscode. Candidate changes to src/rsi/, tests, evaluator inputs, scripts, package metadata, and policy remain excluded by the existing snapshot/patch checks.
3. Enforce authority outside the mutable harness: OpenShell filesystem/network boundaries, broker job capability, model/call/token/time budgets, allowed task workspace, result-size limit, and patch validation must remain in supervisor/provider code. A candidate-modified CLI may fail or refuse to run; it must not gain evaluator files, archive access, arbitrary credentials, unrestricted network, or more budget.
4. Validate a parent's full protected tree against the trusted root before launching its child. Accept a worker patch only after guest teardown and the existing supervisor-side path/mode checks. Record failures as failed attempts, never as zero-score accepted candidates. Keep the fixed-control arm on the same tasks, model, seeds, candidate counts, and budgets as self-hosted mode.
5. Add a deterministic sentinel test: a permitted change to an agent module in generation one alters the observed behavior of the generation-two self-hosted worker but does not alter the fixed-control worker. Also test rejected parents, corrupted/missing CLI, dependency escape, attempt to read verifier data, and patch laundering through ancestry.

Acceptance criteria

• A two-generation fake-model/OpenShell integration run proves the second mutation executes the selected parent's mutable harness commit, with its identity captured in the archive and report.
• The fixed-control arm demonstrably continues to execute the pinned release harness. Both arms use otherwise identical experiment configuration.
• Candidate code cannot change coordinator selection, verifier contents, broker policy, or root resource ceilings. Failure of the self-hosted CLI is contained to its job.
• npm run typecheck, full npm test, and the relevant OpenShell/e2e suites pass. Update documentation with the exact trust boundary and a diagram of code/data flow.

Scope

This concerns harness-code recursion with a fixed DeepSeek model. It does not require model-weight training or autonomous edits to RSI policy code.