@abelxiaoxing/cadence 1.1.0 → 1.2.0

package/src/packet-runtime.ts

@@ -20,7 +20,6 @@ import { runtimeForWorkerRoute } from "./parent-provider.ts";
 import {
   loadRoutePolicy,
   type RoutePolicy,
-  unavailableRoutePolicy,
   type WorkerRole,
 } from "./route-policy.ts";
 import { type BrokerActivityUpdate, RunWorkerBroker } from "./worker-broker.ts";
@@ -319,7 +318,7 @@ export class PacketRuntime {
     if (!agent) {
       throw new Error("packet agent definition is unavailable");
     }
-    const broker = this.#brokerFor(context.cwd);
+    const broker = this.#brokerFor(context);
     const routed = await broker.run({
       runId: `${packet.stage}:${packet.id}`,
       operationId: packet.id,
@@ -405,8 +404,8 @@ export class PacketRuntime {
     return routed.value.child;
   }
 
-  #brokerFor(cwd: string): RunWorkerBroker {
-    const root = path.resolve(cwd);
+  #brokerFor(context: PacketContext): RunWorkerBroker {
+    const root = path.resolve(context.cwd);
     const existing = this.#brokers.get(root);
     let policy = this.#routePolicy;
     if (policy && existing) return existing;
@@ -414,12 +413,13 @@ export class PacketRuntime {
       const resolution = loadRoutePolicy({
         cwd: root,
         ...(this.#routePolicyHome ? { home: this.#routePolicyHome } : {}),
+        ...(context.model ? { parentModel: context.model } : {}),
       });
-      if (!resolution.ok && resolution.source.kind !== "none") {
+      if (!resolution.ok) {
         const code = resolution.diagnostics[0]?.code ?? "policy-invalid";
         throw new Error(`route-policy-unavailable:${code}`);
       }
-      policy = resolution.ok ? resolution.policy : unavailableRoutePolicy();
+      policy = resolution.policy;
     }
     const serializedPolicy = JSON.stringify(policy);
     if (existing && this.#brokerPolicies.get(root) === serializedPolicy) {

package/src/route-policy.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { ROLES } from "./contracts.ts";
@@ -21,6 +21,11 @@ export interface RouteCapabilities {
   maxTokens: number;
 }
 
+export interface ParentModelCapabilities {
+  contextWindow: number;
+  maxTokens: number;
+}
+
 interface RouteBase {
   id: string;
   kind: "inherited" | "custom";
@@ -50,10 +55,9 @@ export interface RoutePolicy {
 
 export type RoutePolicySource =
   | { kind: "project" | "user"; path: string }
-  | { kind: "none" };
+  | { kind: "default" };
 
 export type RoutePolicyDiagnosticCode =
-  | "policy-missing"
   | "policy-unreadable"
   | "policy-invalid-json"
   | "policy-invalid"
@@ -77,7 +81,7 @@ export type ParsedRoutePolicy =
 export type RoutePolicyResolution =
   | {
       ok: true;
-      source: Extract<RoutePolicySource, { kind: "project" | "user" }>;
+      source: RoutePolicySource;
       policy: RoutePolicy;
     }
   | {
@@ -87,8 +91,8 @@ export type RoutePolicyResolution =
     };
 
 /**
- * Internal fail-closed policy used while the selected external policy is
- * missing or invalid. It deliberately contains no inherited-parent route:
+ * Internal fail-closed policy used while a selected explicit policy is
+ * invalid. It deliberately contains no inherited-parent route:
  * the broker therefore reports endpoint-unavailable without making a Worker
  * request, while the local durable control plane remains available.
  *
@@ -351,8 +355,16 @@ export function parseRoutePolicy(value: unknown): ParsedRoutePolicy {
   };
 }
 
-/** Parent-model route used by read-only Design and Diagnose packets. */
-export function parentRoutePolicy(): RoutePolicy {
+/** Default parent-model route used when no explicit policy file exists. */
+export function parentRoutePolicy(
+  parentModel?: ParentModelCapabilities,
+): RoutePolicy {
+  const contextWindow = positiveInteger(parentModel?.contextWindow)
+    ? parentModel.contextWindow
+    : 1;
+  const maxTokens = positiveInteger(parentModel?.maxTokens)
+    ? Math.min(parentModel.maxTokens, contextWindow)
+    : 1;
   const parsed = parseRoutePolicy({
     version: ROUTE_POLICY_VERSION,
     routes: {
@@ -361,8 +373,8 @@ export function parentRoutePolicy(): RoutePolicy {
         capabilities: {
           roles: [...ROLES],
           dialects: [...ROUTE_DIALECTS],
-          contextWindow: 1_000_000,
-          maxTokens: 500_000,
+          contextWindow,
+          maxTokens,
         },
       },
     },
@@ -372,25 +384,41 @@ export function parentRoutePolicy(): RoutePolicy {
   return parsed.policy;
 }
 
-function selectedSource(cwd: string, home: string): RoutePolicySource {
+function selectedSource(
+  cwd: string,
+  home: string,
+): { kind: "project" | "user"; path: string } | { kind: "none" } {
+  const mayExist = (candidate: string): boolean => {
+    try {
+      return lstatSync(candidate, { throwIfNoEntry: false }) !== undefined;
+    } catch {
+      // Permission and path-observation failures are explicit unreadable
+      // policy candidates, not proof that the policy is absent.
+      return true;
+    }
+  };
   const projectPath = path.join(cwd, ".pi", "cadence", "routes.json");
-  if (existsSync(projectPath)) return { kind: "project", path: projectPath };
+  if (mayExist(projectPath)) return { kind: "project", path: projectPath };
   const userPath = path.join(home, ".pi", "agent", "cadence", "routes.json");
-  if (existsSync(userPath)) return { kind: "user", path: userPath };
+  if (mayExist(userPath)) return { kind: "user", path: userPath };
   return { kind: "none" };
 }
 
 export function loadRoutePolicy(
-  options: { cwd?: string; home?: string } = {},
+  options: {
+    cwd?: string;
+    home?: string;
+    parentModel?: ParentModelCapabilities;
+  } = {},
 ): RoutePolicyResolution {
   const cwd = path.resolve(options.cwd ?? process.cwd());
   const home = path.resolve(options.home ?? homedir());
   const source = selectedSource(cwd, home);
   if (source.kind === "none") {
     return {
-      ok: false,
-      source,
-      diagnostics: [{ code: "policy-missing" }],
+      ok: true,
+      source: { kind: "default" },
+      policy: parentRoutePolicy(options.parentModel),
     };
   }
   let bytes: string;

package/src/run-state.ts

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
-import type { ControlStage } from "./control-contracts.ts";
+
+export const RUN_STAGES = ["abel-design", "abel-implement"] as const;
+export type RunStage = (typeof RUN_STAGES)[number];
 
 export const RUN_STATES = [
   "created",
@@ -47,12 +49,17 @@ export interface DeliveryBindingProjection {
   gate: DeliveryGate;
   revision: number;
   receiptHash: string;
+  approvalProof?: {
+    revision: number;
+    contractHash: string;
+    recordHash: string;
+  };
 }
 
 export interface RunProjection {
   runId: string;
   rootHash: string;
-  stage: ControlStage;
+  stage: RunStage;
   change?: string;
   provisionalKey?: string;
   state: RunState;
@@ -133,6 +140,7 @@ const LEGAL_TRANSITIONS: Readonly<Record<RunState, readonly RunState[]>> = {
     "running",
     "approval-needed",
     "recovering",
+    "completed",
     "discarded",
     "rejected",
   ],
@@ -263,12 +271,31 @@ function applyVerifiedEvent(
       const gate = event.payload.gate;
       const revision = event.payload.revision;
       const receiptHash = event.payload.receiptHash;
+      const approvalProof = event.payload.approvalProof;
       if (
         (gate !== "gate-a" && gate !== "gate-b") ||
         !Number.isSafeInteger(revision) ||
         (revision as number) < 1 ||
         typeof receiptHash !== "string" ||
-        !SHA256.test(receiptHash)
+        !SHA256.test(receiptHash) ||
+        (approvalProof !== undefined &&
+          (!approvalProof ||
+            typeof approvalProof !== "object" ||
+            Array.isArray(approvalProof) ||
+            !Number.isSafeInteger(
+              (approvalProof as Record<string, unknown>).revision,
+            ) ||
+            Number((approvalProof as Record<string, unknown>).revision) < 1 ||
+            typeof (approvalProof as Record<string, unknown>).contractHash !==
+              "string" ||
+            !SHA256.test(
+              String((approvalProof as Record<string, unknown>).contractHash),
+            ) ||
+            typeof (approvalProof as Record<string, unknown>).recordHash !==
+              "string" ||
+            !SHA256.test(
+              String((approvalProof as Record<string, unknown>).recordHash),
+            )))
       ) {
         throw new Error("event-integrity-delivery-binding");
       }
@@ -276,13 +303,25 @@ function applyVerifiedEvent(
         gate: gate as DeliveryGate,
         revision: revision as number,
         receiptHash,
+        ...(approvalProof
+          ? {
+              approvalProof: structuredClone(
+                approvalProof as DeliveryBindingProjection["approvalProof"],
+              ),
+            }
+          : {}),
       };
       const existing = projection.deliveryBindings.find(
         (candidate) =>
           candidate.gate === binding.gate &&
           candidate.revision === binding.revision,
       );
-      if (existing && existing.receiptHash !== binding.receiptHash) {
+      if (
+        existing &&
+        (existing.receiptHash !== binding.receiptHash ||
+          canonicalJson(existing.approvalProof) !==
+            canonicalJson(binding.approvalProof))
+      ) {
         throw new Error("event-integrity-delivery-conflict");
       }
       const deliveryBindings = existing

package/src/run-store.ts

@@ -1,12 +1,12 @@
 import { randomUUID } from "node:crypto";
 import { chmodSync, closeSync, lstatSync, openSync } from "node:fs";
 import { DatabaseSync } from "node:sqlite";
-import type { ControlStage } from "./control-contracts.ts";
 import {
   createRunEvent,
   type DeliveryGate,
   type RunEvent,
   type RunProjection,
+  type RunStage,
   type RunState,
   reduceRunEvents,
   ZERO_EVENT_HASH,
@@ -17,7 +17,7 @@ import {
   StateRootError,
 } from "./state-root.ts";
 
-export const RUN_STORE_SCHEMA_VERSION = 2 as const;
+export const RUN_STORE_SCHEMA_VERSION = 4 as const;
 
 const CHANGE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,126}[a-z0-9])?$/u;
 const IDENTIFIER = /^[a-z0-9](?:[a-z0-9._:-]{0,126}[a-z0-9])?$/iu;
@@ -37,6 +37,7 @@ interface EventRow {
 }
 
 interface OperationRow {
+  kind: string;
   state: string;
   outcome_json: string | null;
   lease_token: string | null;
@@ -49,7 +50,7 @@ export interface RunStoreOptions {
 }
 
 export interface StartRunInput {
-  stage: ControlStage;
+  stage: RunStage;
   change?: string;
   provisionalKey?: string;
   operationId: string;
@@ -60,6 +61,11 @@ export interface BindDeliveryInput {
   gate: DeliveryGate;
   revision: number;
   receiptHash: string;
+  approvalProof?: {
+    revision: number;
+    contractHash: string;
+    recordHash: string;
+  };
   operationId: string;
   lease?: OperationLease;
 }
@@ -79,7 +85,7 @@ export interface OperationLeaseStatus {
 
 const SCHEMA = `
   CREATE TABLE IF NOT EXISTS schema_meta (
-    version INTEGER PRIMARY KEY CHECK (version = 2)
+    version INTEGER PRIMARY KEY CHECK (version = 4)
   ) STRICT;
 
   CREATE TABLE IF NOT EXISTS runs (
@@ -103,6 +109,9 @@ const SCHEMA = `
     gate TEXT NOT NULL,
     revision INTEGER NOT NULL,
     receipt_hash TEXT NOT NULL,
+    approval_revision INTEGER,
+    contract_hash TEXT,
+    record_hash TEXT,
     operation_id TEXT NOT NULL,
     PRIMARY KEY (run_id, gate, revision),
     UNIQUE (run_id, operation_id)
@@ -330,7 +339,7 @@ export class RunStore {
   #operation(runId: string, operationId: string): OperationRow | undefined {
     return this.#database
       .prepare(
-        `SELECT state, outcome_json, lease_token, lease_expires_at
+        `SELECT kind, state, outcome_json, lease_token, lease_expires_at
          FROM operations WHERE run_id = ? AND operation_id = ?`,
       )
       .get(runId, operationId) as OperationRow | undefined;
@@ -339,8 +348,10 @@ export class RunStore {
   #operationOutcome(
     runId: string,
     operationId: string,
+    kind: string,
   ): RunProjection | undefined {
     const row = this.#operation(runId, operationId);
+    if (row && row.kind !== kind) throw new Error("operation-id-conflict");
     if (row?.state !== "committed" || row.outcome_json === null)
       return undefined;
     return parseProjection(row.outcome_json);
@@ -433,7 +444,7 @@ export class RunStore {
     }
     const key = lookupKey(input);
     return this.#transaction(() => {
-      const existing = this.#database
+      let existing = this.#database
         .prepare(
           `SELECT run_id, projection_json FROM runs
            WHERE root_hash = ? AND stage = ? AND lookup_key = ?`,
@@ -441,10 +452,23 @@ export class RunStore {
         .get(this.stateRoot.consumerRootHash, input.stage, key) as
         | RunRow
         | undefined;
+      if (existing) {
+        const projection = parseProjection(existing.projection_json);
+        if (
+          input.stage === "abel-design" &&
+          ["completed", "discarded", "rejected"].includes(projection.state)
+        ) {
+          this.#database
+            .prepare("UPDATE runs SET lookup_key = ? WHERE run_id = ?")
+            .run(`terminal:${existing.run_id}`, existing.run_id);
+          existing = undefined;
+        }
+      }
       if (existing) {
         const replay = this.#operationOutcome(
           existing.run_id,
           input.operationId,
+          "start",
         );
         if (replay) return replay;
         const projection = parseProjection(existing.projection_json);
@@ -519,7 +543,11 @@ export class RunStore {
     requireIdentifier(input.operationId, "operation-id");
     if (!CHANGE_NAME.test(input.change)) throw new Error("invalid-change");
     return this.#transaction(() => {
-      const replay = this.#operationOutcome(input.runId, input.operationId);
+      const replay = this.#operationOutcome(
+        input.runId,
+        input.operationId,
+        "change-bound",
+      );
       if (replay) return replay;
       const current = this.status(input.runId);
       if (current.stage !== "abel-design" || !current.provisionalKey) {
@@ -561,7 +589,12 @@ export class RunStore {
       (input.gate !== "gate-a" && input.gate !== "gate-b") ||
       !Number.isSafeInteger(input.revision) ||
       input.revision < 1 ||
-      !SHA256.test(input.receiptHash)
+      !SHA256.test(input.receiptHash) ||
+      (input.approvalProof !== undefined &&
+        (!Number.isSafeInteger(input.approvalProof.revision) ||
+          input.approvalProof.revision < 1 ||
+          !SHA256.test(input.approvalProof.contractHash) ||
+          !SHA256.test(input.approvalProof.recordHash)))
     ) {
       throw new Error("invalid-delivery-binding");
     }
@@ -572,18 +605,35 @@ export class RunStore {
       if (input.lease.runId !== input.runId) throw new Error("lease-fenced");
       this.#assertLease(input.lease);
     }
-    const replay = this.#operationOutcome(input.runId, input.operationId);
+    const replay = this.#operationOutcome(
+      input.runId,
+      input.operationId,
+      "delivery-bound",
+    );
     if (replay) return replay;
     const existing = this.#database
       .prepare(
-        `SELECT receipt_hash FROM delivery_bindings
+        `SELECT receipt_hash, approval_revision, contract_hash, record_hash
+         FROM delivery_bindings
          WHERE run_id = ? AND gate = ? AND revision = ?`,
       )
       .get(input.runId, input.gate, input.revision) as
-      | { receipt_hash: string }
+      | {
+          receipt_hash: string;
+          approval_revision: number | null;
+          contract_hash: string | null;
+          record_hash: string | null;
+        }
       | undefined;
     if (existing) {
-      if (existing.receipt_hash !== input.receiptHash) {
+      if (
+        existing.receipt_hash !== input.receiptHash ||
+        existing.approval_revision !==
+          (input.approvalProof?.revision ?? null) ||
+        existing.contract_hash !==
+          (input.approvalProof?.contractHash ?? null) ||
+        existing.record_hash !== (input.approvalProof?.recordHash ?? null)
+      ) {
         throw new Error("delivery-revision-conflict");
       }
       const projection = this.status(input.runId);
@@ -599,20 +649,27 @@ export class RunStore {
     this.#database
       .prepare(
         `INSERT INTO delivery_bindings(
-           run_id, gate, revision, receipt_hash, operation_id
-         ) VALUES (?, ?, ?, ?, ?)`,
+           run_id, gate, revision, receipt_hash, approval_revision,
+           contract_hash, record_hash, operation_id
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
       )
       .run(
         input.runId,
         input.gate,
         input.revision,
         input.receiptHash,
+        input.approvalProof?.revision ?? null,
+        input.approvalProof?.contractHash ?? null,
+        input.approvalProof?.recordHash ?? null,
         input.operationId,
       );
     const projection = this.#appendEvent(input.runId, "delivery-bound", {
       gate: input.gate,
       revision: input.revision,
       receiptHash: input.receiptHash,
+      ...(input.approvalProof
+        ? { approvalProof: structuredClone(input.approvalProof) }
+        : {}),
     });
     this.#recordOperation(
       input.runId,
@@ -643,6 +700,33 @@ export class RunStore {
     });
   }
 
+  bindDeliveriesAtomically(
+    inputs: readonly BindDeliveryInput[],
+    write: (database: DatabaseSync) => void,
+  ): RunProjection {
+    if (inputs.length === 0) throw new Error("delivery-binding-empty");
+    for (const input of inputs) this.#requireDeliveryBinding(input);
+    const runId = inputs[0]?.runId;
+    if (
+      !runId ||
+      inputs.some(
+        (input) =>
+          input.runId !== runId ||
+          (input.lease?.token ?? null) !== (inputs[0]?.lease?.token ?? null),
+      ) ||
+      typeof write !== "function"
+    ) {
+      throw new Error("delivery-binding-write-invalid");
+    }
+    return this.#transaction(() => {
+      let projection: RunProjection | undefined;
+      for (const input of inputs) projection = this.#bindDelivery(input);
+      write(this.#database);
+      if (!projection) throw new Error("delivery-binding-empty");
+      return projection;
+    });
+  }
+
   acquireLease(input: {
     runId: string;
     operationId: string;
@@ -839,7 +923,11 @@ export class RunStore {
         if (input.lease.runId !== input.runId) throw new Error("lease-fenced");
         this.#assertLease(input.lease);
       }
-      const replay = this.#operationOutcome(input.runId, input.operationId);
+      const replay = this.#operationOutcome(
+        input.runId,
+        input.operationId,
+        "state-transitioned",
+      );
       if (replay) return replay;
       const current = this.status(input.runId);
       const projection = this.#appendEvent(input.runId, "state-transitioned", {

package/src/subagent-activity.ts

@@ -1320,7 +1320,7 @@ export function renderActivityCall(
   context?: ActivityRenderContext,
 ): Component {
   const value = asRecord(args);
-  if (typeof value?.command === "string" && value.version === 2) {
+  if (typeof value?.command === "string") {
     if (context?.executionStarted || context?.isError) return new Text("");
     const projected = projectWorkflowActivity(value, { state: "queued" }, 0);
     const display: ActivitySnapshot = {