@agenticprimitives/orchestration 0.0.0-alpha.1 → 0.0.0-alpha.10

package/dist/types.d.ts

@@ -9,8 +9,52 @@ export interface Intent {
     constraints?: Record<string, unknown>;
     /** Optional context the planner may use (principal handle, locale…). Opaque to the loop. */
     context?: Record<string, unknown>;
+    /** Spec 410 §5 — the versions this intent is acted under: the ontology manifest digest and the compiled
+     *  definition's digest. Set by the runtime before the intent is offered for a mandate; the intent digest
+     *  (RFC 8785 over the whole object) then binds them, and the verifier recomputes under the versions it
+     *  runs with. Opaque to the loop; the shape is `delegation.VersionBindingV1`. */
+    versions?: {
+        ontologyManifestDigest: string;
+        semanticsDigest: string;
+    };
 }
 /** A capability the agent MAY compose. The planner picks from these; the loop refuses any other tool id. */
+export type OutcomeClass = 'lookup' | 'submission' | 'authoritative';
+/**
+ * Spec 410 §2 — the adapter's declaration, on the tool contract. `verificationWindow` is the time between the
+ * harness's check and the provider's commit, as an ISO 8601 duration (`PT30S`) or the word `unbounded` — a
+ * legal and visible answer. `retry` says what a second identical call does; `cancellation` what a cancel can
+ * do — `none` means the word is absent from every projection of this tool.
+ */
+export interface AdapterDeclarationV1 {
+    verificationWindow: string;
+    retry: 'idempotent-by-key' | 'never' | 'compensating';
+    cancellation: 'none' | 'before-commit' | 'compensating';
+}
+/**
+ * Spec 426 — AN EXECUTOR INVOKE DECLARATION: "call executor E's skill S as me, and hand me back its receipt."
+ * A capability carrying this is dispatched by ONE generic invoker (no runtime tool per domain): it resolves
+ * `executor` to a URL + client through OPERATOR CONFIG (never a hardcoded host — `executor` is a NAME, not a
+ * URL), obtains a session for the RUN'S PRINCIPAL, sends one A2A `message/send` carrying `metadata.skill =
+ * intent`, and records the receipt in `run.provenance`. An `invoke` block IMPLIES self-acting (v1): the write
+ * is to the principal's own domain, so the session is the authority and no mandate is minted — the generic
+ * invoker takes the session from the principal structurally, never from an arg (§6; `check:invoke-is-self-acting`).
+ */
+export interface ExecutorInvokeV1 {
+    /** v1's only transport. */
+    transport: 'a2a.message-send';
+    /** A NAME the operator maps to { url, client } — never a URL (ADR-0021: no host in a tool or a package). */
+    executor: string;
+    /** The executor's skill id → `metadata.skill`: which of its skills it runs. */
+    intent: string;
+    /** How the capability's args map onto the message. */
+    args: {
+        /** The arg holding the free-text part ("what happened, in my words") → the message text. */
+        goal: string;
+        /** Args passed through as message metadata. */
+        metadata?: string[];
+    };
+}
 export interface ToolSpec {
     /** Stable tool id (matches the invoker's dispatch key, e.g. an MCP tool name). */
     id: string;
@@ -18,6 +62,137 @@ export interface ToolSpec {
     description: string;
     /** Optional JSON-Schema for the tool's args (the LLM planner uses it as the tool-use input schema). */
     inputSchema?: Record<string, unknown>;
+    /**
+     * Spec 350 §3.1 — the capability this tool EXERCISES (ADR-0051 id). Declared on the TOOL, never on the
+     * plan: a planner that emits a step for this tool cannot describe its way out of needing authority.
+     * Absent ⇒ informational, no mandate needed. `resourceArg` names the arg that holds the resource the
+     * step acts on (the org, the token) so the verifier can bound it.
+     *
+     * `authorityArg` names the arg holding the party whose AUTHORITY the step needs — which is not always
+     * the resource. Chartering a team acts on the workspace and needs the workspace's authority (the same
+     * address); paying acts on a TOKEN and needs the PAYER's authority (a different one). Absent ⇒ the
+     * resource, then whoever was addressed. Getting this wrong asks a person to grant authority as an
+     * ERC-20 contract, which nothing can sign.
+     */
+    capability?: {
+        id: string;
+        action: string;
+        resourceArg?: string;
+        authorityArg?: string;
+        /** Spec 408 §2.2 — this tool REDEEMS the mandate on chain (a payment, a chartered treasury's transfer):
+         *  every enforcer fires at redemption, so a caveat with no off-chain judge may be recorded as enforced
+         *  there. Absent ⇒ the step is judged strictly off chain. Declared on the tool, never by a plan. */
+        redeemsOnChain?: boolean;
+    };
+    /**
+     * Spec 366 — the argument naming the agent this act is ABOUT and is ANSWERED BY. When it resolves to an
+     * agent other than the one addressed, the step is not run here: it is routed to that agent's own
+     * harness, which verifies the asker's standing itself and answers under its own playbook. Declared on
+     * the tool (from the contract), never inferred from the sentence. Absent ⇒ the addressee answers.
+     */
+    subject?: string;
+    /**
+     * Spec 367 W1 — the IMPERATIVES that name this act ("send", "pay", "create a team"). A sentence that opens
+     * with one is an instruction, and plan admission refuses a plan for it that contains no act. Declared
+     * beside the capability (from the contract's utterances when compiled). A READ may claim a verb too ("ask
+     * <agent> …", spec 379): an instruction opening with a verb a lookup in the plan claims is discharged by
+     * that lookup — the verb names a consultation, not an act.
+     */
+    verbs?: string[];
+    /** Spec 371 — the FACT WORDS a question uses to name what this read answers ("balance", "how much").
+     *  A read's twin of an act's `verbs`: question admission requires the plan to include the tool that
+     *  answers a fact the sentence names. Behaviour, never authority. */
+    answers?: string[];
+    /** Spec 371 — the domain author's sentence for this read's result (`{{field}}`; once per `items[]`
+     *  element when the result carries a list). Rendered instead of composed: the person's unit. */
+    answer?: string;
+    /**
+     * Spec 367 §6 — WHAT A SUCCESSFUL STEP OF THIS TOOL ESTABLISHES about the requested outcome:
+     *   lookup         who or what was meant (a roster, a relationship) — never that anything was done
+     *   submission     acceptance or pending execution (an invitation recorded, a request asked) — not the outcome
+     *   authoritative  the outcome itself, with its evidence (a mined transfer, a written record)
+     * Admission asks whether some step's class CAN discharge an instruction; fulfillment asks what the
+     * evidence DID establish, and the reply may claim only that. Absent ⇒ lookup for a tool with no
+     * capability, authoritative for one with. Declared on the contract; never lowered by a plan.
+     */
+    establishes?: OutcomeClass;
+    /** The tool's risk tier (`tool-policy.RiskTier`). Meaningful only with `capability`; defaults to `low`. */
+    risk?: import('@agenticprimitives/tool-policy').RiskTier;
+    /**
+     * SELF-ACTING: this capability touches ONLY the run's own principal's records, so the SESSION that
+     * proved who is asking is the authority and no mandate is verified.
+     *
+     * WHY THE MODEL NEEDED THIS. Until now every capability step required a presented mandate, so the
+     * only way to express "change your own email" was to demand a signature the Home's own form does not
+     * ask for — teaching people that talking to their agent is the expensive way to do the same thing.
+     * The alternative was worse: declaring such a tool informational, which would have hidden a WRITE
+     * from the authority plane entirely.
+     *
+     * WHAT IT IS NOT. It is not "low risk", and it is not a way to skip a gate. It is a claim about the
+     * TARGET — that there is no second party whose authority could be needed, because the actor, the
+     * owner and the beneficiary are the same principal. An invoker for such a tool MUST take its subject
+     * from the run's principal and never from an argument; the moment it can be pointed at someone else's
+     * record, this flag is a lie and the capability needs a mandate like everything else.
+     *
+     * It is declared on the BUILT-IN tool and never merged from a contract (a contract may describe an
+     * act, never weaken its gate — spec 361 §3), and the receipt records `self` as the basis so a reader
+     * can tell an act authorized by a session from one authorized by a signature.
+     */
+    selfAuthorized?: true;
+    /**
+     * Spec 426 — this tool is an EXECUTOR INVOKE: it has no built-in invoker; the one generic invoker reads this
+     * block, calls the resolved executor as the run's principal, and returns its receipt. Compiled from the
+     * contract's `invoke` declaration (the only place a tool gains a behaviour by declaration, not runtime code).
+     * Its presence IMPLIES `selfAuthorized` (v1 is self-acting); a value-moving or cross-principal invoke is out of
+     * scope and keeps its own mandate-gated tool. The generic invoker, not this field, is the gate.
+     */
+    invoke?: ExecutorInvokeV1;
+    /** Spec 420 — this tool's invoker honours `ctx.dryRun` (checks its preconditions, writes nothing), so a comparison may
+     *  INVOKE it instead of holding it before invocation — its refusal ("nothing I remember contains …") is then testable. */
+    dryRun?: 'invoke';
+    /**
+     * Spec 363 W5 — the DECISION POINTS this capability consults, by id.
+     *
+     * Behaviour, never authority: consulting one lets the substrate answer a question ("which of your
+     * accounts pays?") from a modelled fact instead of interrupting, and every answer cites the rule that
+     * gave it. A capability that names none asks, which is the default and the safe one.
+     *
+     * The loop does not read this — normalisation does, where decisions are made. It rides the ToolSpec
+     * because that is where a CONTRACT's declaration lands (`mergeContractTool`), and a decision a domain
+     * author did not ask for should not happen because some app-side branch remembered a capability id.
+     */
+    decisions?: readonly string[];
+    /** Compensation for a run that fails AFTER this tool executed: the tool to invoke, with args derived
+     *  from the original args (+ the result under `$result`). Declared, never improvised. */
+    compensation?: {
+        toolId: string;
+        args: Record<string, unknown>;
+    };
+    /** Spec 410 §2 — what this tool's ADAPTER declares about the effect it makes. Required of every tool that
+     *  submits or commits (`establishes` ≠ lookup); a generated surface may say "cancel" only when
+     *  `cancellation` is not `none`. Declared, never inferred from a response. */
+    adapter?: AdapterDeclarationV1;
+    /** Spec 410 §7 — WHAT THIS TOOL'S WRITE CARRIES, per argument, as ontology classes (`{ body: ['apvault:ContactEmail'] }`).
+     *  The information-flow caveat on a mandate names what a write may carry; the verifier compares the classes of
+     *  the arguments a step presents against it. Declared by the adapter's author, never inferred from a value. */
+    carries?: Readonly<Record<string, readonly string[]>>;
+    /** An irreversible action: imposes `fresh-authorization` whatever the tier. */
+    irreversible?: boolean;
+    /** Spec 358 W4 — this tool's result ENUMERATES the objects of a domain relation (an ontology IRI,
+     *  e.g. aporg:memberAgent). Declaring it is what makes the result fan-out-able: a `forEach` over a
+     *  result whose tool declares nothing is refused, because an array being array-shaped says nothing
+     *  about whether iterating it is meaningful — a search page is not a payee list. */
+    enumerates?: {
+        relation: string;
+    };
+    /** Spec 361 — the interaction binding a playbook contract declared (editor/review/result names + a
+     *  navigation route key). DATA carried for surfaces to resolve; the loop never reads it. */
+    interaction?: {
+        editor?: string;
+        review?: string;
+        result?: string;
+        navigationTarget?: string;
+    };
 }
 /** One step of a plan: invoke `toolId` with `args`; optionally bind the result under `ref` for later steps. */
 export interface PlanStep {
@@ -25,8 +200,42 @@ export interface PlanStep {
     args: Record<string, unknown>;
     /** Name to store this step's result under; later steps reference it via `{ $ref: name }` in their args. */
     ref?: string;
+    /** Spec 350 — optional stable id (defaults to `s<index>`); the receipt and the idempotency key carry it. */
+    id?: string;
+    /** Spec 376 — the AGENT that runs this step, when it is not this harness: a hand-off. The step runs
+     *  there under a CHILD mandate attenuated from the one this run presented; this run records the
+     *  hand-off and resumes on what comes back. Absent ⇒ this harness. */
+    executor?: string;
+    /** Caller-supplied idempotency key for a retry of THIS step; defaults to `${runRef}:${stepId}`. */
+    idempotencyKey?: string;
+    /** Spec 358 W4 — fan this step out over an ARRAY a prior step produced (`ref` is a `name.path` into
+     *  that step's result). Each element becomes its OWN step — its own receipt, its own idempotency key,
+     *  and its own pass through the verifier: a mandate per item, never one verdict stretched over N.
+     *  `$item` / `{ $item: 'path' }` placeholders in `args` are substituted per element. Fail-closed: the
+     *  producing step's tool must declare `enumerates`, and the relation must be bound fan-out-able. */
+    forEach?: {
+        ref: string;
+    };
+    /** Spec 370 P3 — run only AFTER these steps (by id) have completed. Steps with no edge between them and
+     *  no `$ref` into each other's results are independent; the loop runs independent INFORMATIONAL steps
+     *  concurrently, each through its own gates. A step that exercises a capability never runs beside
+     *  another: two userOps from one account race on its nonce, and one verdict is one step's. */
+    after?: string[];
+    /** Spec 370 P3 — a DECLARED branch: run this step only when a prior result satisfies the condition.
+     *  `ref` is a `name.path` into a prior step's result; `exists` = present and, for an array, non-empty;
+     *  `equals` = deep-equal to the value. A step whose condition fails is SKIPPED, with a receipt saying so —
+     *  the plan does not need a second planner call to take a branch. Undecidable at admission (a ref no
+     *  earlier step produces) is refused, never guessed. */
+    when?: {
+        ref: string;
+        exists?: boolean;
+        equals?: unknown;
+    };
 }
 /** The ordered tool composition the planner produced for an intent. */
+/** Spec 421 W1 — the reserved continuation step ("show me what these reads return, then I will plan the rest"). A plan
+ *  node, never a tool the loop invokes or a verifier judges. */
+export declare const CONTINUE_STEP_ID = "plan.continue";
 export interface Plan {
     steps: PlanStep[];
     /** Optional one-line reasoning (audit/telemetry only — never trusted as authority). */
@@ -38,8 +247,21 @@ export interface StepObservation {
     ok: boolean;
     result?: unknown;
     error?: string;
+    /** Spec 370 P1 — the step's stable reference (`id` or `s<index>`), so a checkpoint can name what ran. */
+    stepRef?: string;
+    /** Spec 370 P1 — this observation was REPLAYED from a checkpoint on a resume: nothing was invoked and
+     *  nothing re-verified, because there was no new attempt (spec 362 §0.1, gate 4). */
+    replayed?: boolean;
+    /** Spec 370 P3 — the step's `when` did not hold: nothing ran, and the receipt says so. */
+    skipped?: boolean;
 }
-export type RunOutcome = 'completed' | 'failed';
+/** `denied`: an authority decision refused a step (never re-planned around — a denial is not a tool
+ *  failure). `suspended`: an approval is pending OR a tool asked the person for an input (`prompt`);
+ *  resume later, through the verifier again. `authority-required`: the plan needs a mandate the caller did
+ *  not present — nothing was verified, nothing ran; the caller may come back WITH one (opt-in via
+ *  `onMissingMandate: 'report'`; the default is still to throw). It is 401, never 403: no authority was
+ *  judged, so this is not a denial and must never be reported as one. */
+export type RunOutcome = 'completed' | 'failed' | 'denied' | 'suspended' | 'authority-required';
 /** The result of running an intent to completion (or fail-closed). */
 export interface RunResult {
     outcome: RunOutcome;
@@ -49,11 +271,39 @@ export interface RunResult {
     steps: StepObservation[];
     /** The last successful step's result — the composed answer returned to the caller. */
     result?: unknown;
-    /** Set when `outcome === 'failed'`. */
+    /** Set when `outcome === 'failed'` or `'denied'`. */
     error?: string;
+    /** Spec 350 — the run's reference (the A2A taskId when run inside `A2aTaskDO`). */
+    runRef: string;
+    /** Every step's receipt, informational ones included. The sink (if any) has the same list. */
+    receipts: import('./authority.js').StepReceipt[];
+    /** Set when `outcome === 'suspended'`: what to hand back to resume. */
+    resumeToken?: string;
+    /** Set when `outcome === 'suspended'` because a tool asked the person for something (spec 350 §3.4).
+     *  The surface renders it; the answers come back as `RunIntentOpts.supplied` on the resume. */
+    prompt?: import('./input.js').InputRequestV1;
+    /** Set when `outcome === 'authority-required'`: the step the plan reached that needs a mandate. The
+     *  caller turns it into a requirement in ITS vocabulary (`harness.mandateRequirementForStep`) — this
+     *  layer names the step, never the grant. */
+    required?: {
+        stepRef: string;
+        toolId: string;
+        capability: {
+            id: string;
+            action: string;
+            resource?: string;
+            authority?: string;
+        };
+        risk: import('./authority.js').ResolvedStep['risk'];
+        args: Record<string, unknown>;
+        /** Spec 410 §7 — what the tool declares its inputs carry, so the requirement can name what the write may carry. */
+        carries?: ToolSpec['carries'];
+        /** Spec 421 W2 — whose words each argument came from (the planner's raw values, before resolution). */
+        derivation?: Record<string, import('./derivation.js').ArgDerivationV1>;
+    };
 }
 /** Stable error codes the loop / planners raise (fail-closed; never a silent empty success). */
-export type OrchestrationErrorCode = 'no_plan' | 'unknown_tool' | 'empty_plan' | 'max_steps' | 'planner_failed';
+export type OrchestrationErrorCode = 'no_plan' | 'reconcile_indeterminate' | 'unknown_tool' | 'empty_plan' | 'max_steps' | 'planner_failed' | 'no_authority_port' | 'no_approval_port' | 'no_mandate_presented' | 'keyring_needs_selector' | 'fan_out_unbound' | 'fan_out_not_array' | 'fan_out_refused' | 'resume_integrity' | 'fan_out_over_limit';
 export declare class OrchestrationError extends Error {
     readonly code: OrchestrationErrorCode;
     constructor(code: OrchestrationErrorCode, message: string);

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,EAAG,kCAA2C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,eAAO,MAAM,QAAQ,EAAG,gCAAyC,CAAC;AAElE,sGAAsG;AACtG,MAAM,WAAW,MAAM;IACrB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,4GAA4G;AAC5G,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,uGAAuG;IACvG,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,2GAA2G;IAC3G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,uEAAuE;AACvE,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEhD,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,mEAAmE;IACnE,IAAI,EAAE,IAAI,CAAC;IACX,yEAAyE;IACzE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gGAAgG;AAChG,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,cAAc,GACd,YAAY,GACZ,WAAW,GACX,gBAAgB,CAAC;AAErB,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EAC5C,OAAO,EAAE,MAAM;CAKlB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY,EAAG,kCAA2C,CAAC;AACxE,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,eAAO,MAAM,QAAQ,EAAG,gCAAyC,CAAC;AAElE,sGAAsG;AACtG,MAAM,WAAW,MAAM;IACrB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;qFAGiF;IACjF,QAAQ,CAAC,EAAE;QAAE,sBAAsB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAED,4GAA4G;AAC5G,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,YAAY,GAAG,eAAe,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,mBAAmB,GAAG,OAAO,GAAG,cAAc,CAAC;IACtD,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,4GAA4G;IAC5G,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,IAAI,EAAE;QACJ,4FAA4F;QAC5F,IAAI,EAAE,MAAM,CAAC;QACb,+CAA+C;QAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,uGAAuG;IACvG,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QACxE;;4GAEoG;QACpG,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;yEAEqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;oGACgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,2GAA2G;IAC3G,IAAI,CAAC,EAAE,OAAO,gCAAgC,EAAE,QAAQ,CAAC;IACzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;8HAC0H;IAC1H,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;6FACyF;IACzF,YAAY,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACjE;;kFAE8E;IAC9E,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B;;mHAE+G;IAC/G,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;wFAGoF;IACpF,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC;gGAC4F;IAC5F,WAAW,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChG;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,2GAA2G;IAC3G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;0EAEsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;wGAIoG;IACpG,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B;;;kGAG8F;IAC9F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;4DAIwD;IACxD,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5D;AAED,uEAAuE;AACvE;gEACgE;AAChE,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;yFACqF;IACrF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;yEAKyE;AACzE,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,oBAAoB,CAAC;AAEhG,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,mEAAmE;IACnE,IAAI,EAAE,IAAI,CAAC;IACX,yEAAyE;IACzE,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,QAAQ,EAAE,OAAO,gBAAgB,EAAE,WAAW,EAAE,CAAC;IACjD,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;mGAC+F;IAC/F,MAAM,CAAC,EAAE,OAAO,YAAY,EAAE,cAAc,CAAC;IAC7C;;iDAE6C;IAC7C,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,IAAI,EAAE,OAAO,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,mHAAmH;QACnH,OAAO,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9B,uGAAuG;QACvG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,iBAAiB,EAAE,eAAe,CAAC,CAAC;KACxE,CAAC;CACH;AAED,gGAAgG;AAChG,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,yBAAyB,GACzB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,sBAAsB,GACtB,wBAAwB,GACxB,iBAAiB,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,CAAC;AAEzB,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EAC5C,OAAO,EAAE,MAAM;CAKlB"}

package/dist/types.js

@@ -8,6 +8,10 @@
 export const PACKAGE_NAME = '@agenticprimitives/orchestration';
 export const PACKAGE_STATUS = 'w1-core';
 export const SPEC_REF = 'packages/orchestration/spec.md';
+/** The ordered tool composition the planner produced for an intent. */
+/** Spec 421 W1 — the reserved continuation step ("show me what these reads return, then I will plan the rest"). A plan
+ *  node, never a tool the loop invokes or a verifier judges. */
+export const CONTINUE_STEP_ID = 'plan.continue';
 export class OrchestrationError extends Error {
     code;
     constructor(code, message) {

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,EAAE;AACF,+FAA+F;AAC/F,2GAA2G;AAC3G,6GAA6G;AAC7G,6GAA6G;AAC7G,+GAA+G;AAE/G,MAAM,CAAC,MAAM,YAAY,GAAG,kCAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,SAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAyC,CAAC;AAoElE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IADlB,YACkB,IAA4B,EAC5C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAwB;QAI5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,EAAE;AACF,+FAA+F;AAC/F,2GAA2G;AAC3G,6GAA6G;AAC7G,6GAA6G;AAC7G,+GAA+G;AAE/G,MAAM,CAAC,MAAM,YAAY,GAAG,kCAA2C,CAAC;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,SAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAyC,CAAC;AAyNlE,uEAAuE;AACvE;gEACgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAqFhD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEzB;IADlB,YACkB,IAA4B,EAC5C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAwB;QAI5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@agenticprimitives/orchestration",
-  "version": "0.0.0-alpha.1",
+  "version": "0.0.0-alpha.10",
   "description": "The Ring-0 agentic orchestration core (ADR-0044): the intent→plan→execute→observe loop, the Planner + ToolInvoker ports, and a deterministic rule-based planner. A first-party app expresses a goal; the loop plans which tools compose to satisfy it and runs them through an injected invoker. Pure leaf — no transport, no LLM SDK, no chain; the concrete LLM binding lives behind the Planner port in orchestration-anthropic.",
+  "homepage": "https://agenticprimitives.dev",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "author": {
+    "name": "Agentic Trust Labs",
+    "url": "https://agenticprimitives.dev"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
     "directory": "packages/orchestration"
   },
-  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/orchestration",
-  "bugs": {
-    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
-  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -31,7 +35,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "agentic",
@@ -39,8 +43,16 @@
     "orchestration",
     "planner",
     "intent",
-    "agentic-loop"
+    "agentic-loop",
+    "agentic-primitives",
+    "agenticprimitives",
+    "ai-agents",
+    "agent-authority",
+    "agentic-trust"
   ],
+  "dependencies": {
+    "@agenticprimitives/tool-policy": "1.0.0-alpha.31"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",