@aiwg/cli 2026.9.19 → 2026.9.21

package/dist/src/decision/graph.js

@@ -0,0 +1,115 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { admitEntry } from './entry.js';
+export class DecisionGraphError extends Error {
+    constructor(message) { super(message); this.name = 'DecisionGraphError'; }
+}
+const here = dirname(fileURLToPath(import.meta.url));
+const schemaDir = [resolve(here, '../../schemas/decision'), resolve(here, '../../../schemas/decision')]
+    .find(path => existsSync(resolve(path, 'DecisionGraph.v1.schema.json')));
+if (!schemaDir)
+    throw new Error('Decision graph schema directory is unavailable');
+const schema = JSON.parse(readFileSync(resolve(schemaDir, 'DecisionGraph.v1.schema.json'), 'utf8'));
+const check = new Ajv2020({ strict: false, allErrors: true }).compile(schema);
+const digest = (value) => `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+const fail = (message) => { throw new DecisionGraphError(message); };
+/** resolvedPins must be supplied by the trusted caller; neither evidence nor model state can supply it. */
+export function planDecisionGraph(value, resolvedPins) {
+    try {
+        admitEntry(value);
+    }
+    catch {
+        return fail('graph admission denied');
+    }
+    if (!check(value))
+        return fail('invalid decision graph schema');
+    const graph = value;
+    const nodes = new Map();
+    for (const node of graph.nodes) {
+        if (nodes.has(node.id))
+            return fail('duplicate graph node');
+        nodes.set(node.id, node);
+        if (!resolvedPins.has(node.definition.digest) || !resolvedPins.has(node.binding.digest))
+            return fail('unresolved graph pin');
+    }
+    const entry = nodes.get(graph.entry);
+    if (!entry || entry.stage !== 0 || entry.input.length !== 0)
+        return fail('invalid graph entry');
+    if (new Set(graph.terminals).size !== graph.terminals.length || graph.terminals.some(id => !nodes.has(id)))
+        return fail('invalid graph terminal');
+    const inputs = new Map();
+    const outgoing = new Map();
+    for (const node of graph.nodes) {
+        inputs.set(node.id, new Set());
+        outgoing.set(node.id, []);
+    }
+    const edgeKeys = new Set();
+    for (const edge of graph.edges) {
+        const from = nodes.get(edge.from);
+        const to = nodes.get(edge.to);
+        if (!from || !to || from.id === to.id || from.stage >= to.stage)
+            return fail('invalid graph dependency or cycle');
+        if (!from.output.includes(edge.source) || !to.input.includes(edge.destination) ||
+            (edge.when && !from.output.includes(edge.when.source)))
+            return fail('illegal evidence projection');
+        const key = canonicalJson(edge);
+        if (edgeKeys.has(key) || inputs.get(to.id).has(edge.destination))
+            return fail('ambiguous evidence projection');
+        edgeKeys.add(key);
+        inputs.get(to.id).add(edge.destination);
+        outgoing.get(from.id).push(to.id);
+    }
+    const reached = new Set([graph.entry]);
+    const queue = [graph.entry];
+    for (let i = 0; i < queue.length; i++) {
+        for (const id of outgoing.get(queue[i]))
+            if (!reached.has(id)) {
+                reached.add(id);
+                queue.push(id);
+            }
+    }
+    for (const node of graph.nodes) {
+        if (!reached.has(node.id) || (node.id !== graph.entry && (!node.input.length || node.input.some(name => !inputs.get(node.id).has(name)))) ||
+            (outgoing.get(node.id).length === 0 ? !graph.terminals.includes(node.id) :
+                graph.terminals.includes(node.id) && graph.edges.some(edge => edge.from === node.id && !edge.when))) {
+            return fail('ambiguous root, input, or terminal');
+        }
+    }
+    const sortedNodes = [...graph.nodes].sort((a, b) => a.stage - b.stage || a.id.localeCompare(b.id));
+    const edges = [...graph.edges].sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)));
+    const stages = [...new Set(sortedNodes.map(node => node.stage))].map(stage => {
+        const stageNodes = sortedNodes.filter(node => node.stage === stage);
+        const groups = new Map();
+        for (const node of stageNodes) {
+            const projections = edges.filter(edge => edge.to === node.id)
+                .map(edge => [edge.from, edge.source, edge.destination]);
+            const key = canonicalJson([node.subject, node.target, node.model, node.egress, node.stateDigest,
+                node.definition.digest, node.binding.digest, projections]);
+            const group = groups.get(key) ?? [];
+            group.push(node.id);
+            groups.set(key, group);
+        }
+        const batches = [...groups.values()].filter(group => group.length > 1);
+        return { stage, nodes: stageNodes.map(node => node.id), batches,
+            fanOut: [...groups.values()].filter(group => group.length === 1).flat() };
+    });
+    if (stages.some((s, i) => s.stage !== i) || stages.length > graph.budget.depth || stages.some(s => s.nodes.length > graph.budget.fanOut) ||
+        stages.some(s => s.batches.some(group => group.length > graph.budget.beamWidth)))
+        return fail('graph budget exceeded');
+    if (graph.stageBudgets && (new Set(graph.stageBudgets.map(item => item.stage)).size !== graph.stageBudgets.length ||
+        graph.stageBudgets.some(item => {
+            const stage = stages.find(s => s.stage === item.stage);
+            return !stage || stage.nodes.length > item.limits.fanOut ||
+                stage.batches.some(group => group.length > item.limits.beamWidth) || stage.stage >= item.limits.depth;
+        })))
+        return fail('invalid stage budget');
+    const canonicalGraph = { ...graph, ...(graph.stageBudgets ? { stageBudgets: [...graph.stageBudgets].sort((a, b) => a.stage - b.stage) } : {}),
+        terminals: [...graph.terminals].sort(), nodes: sortedNodes.map(node => ({ ...node, input: [...node.input].sort(), output: [...node.output].sort() })), edges };
+    const plan = { schemaVersion: 'decision-graph-plan/v1', graphDigest: digest(canonicalGraph), stages, edges };
+    return { ...plan, planDigest: digest(plan) };
+}
+//# sourceMappingURL=graph.js.map

package/dist/src/decision/index.js

@@ -4,9 +4,44 @@ export * from './entry.js';
 export * from './convert.js';
 export * from './predicates.js';
 export * from './compose.js';
+export * from './acceptance.js';
+export * from './acceptance-rollout.js';
+export * from './batch.js';
+export * from './job-contract.js';
+export * from './job-store.js';
+export * from './job-runtime.js';
+export * from './job-worker.js';
+export * from './job-evaluate.js';
+export * from './job-accounting.js';
+export * from './job-scheduler.js';
+export * from './job-gateway.js';
+export * from './job-quota.js';
+export * from './job-poll-limiter.js';
+export * from './job-service.js';
+export * from './job-payload-store.js';
+export * from './job-http.js';
+export * from './job-effects.js';
+export * from './batch-benchmark.js';
+export * from './scheduler.js';
+export * from './admission.js';
+export * from './batch-receipts/index.js';
+export * from './context-plan.js';
+export * from './context-qualification.js';
+export * from './calibration/index.js';
+export * from './projection.js';
+export * from './lifecycle.js';
+export * from './file-lifecycle-store.js';
 export * from './receipts.js';
+export * from './portable-secrets.js';
 export * from './evaluate.js';
 export * from './export.js';
 export * from './adapters/jev.js';
 export * from './adapters/llm-subagent.js';
+export * from './review/index.js';
+export * from './qualification/index.js';
+export * from './telemetry/index.js';
+export * from './patterns/index.js';
+export * from './compile-cache/index.js';
+export * from './result-cache/index.js';
+export * from './ensemble/index.js';
 //# sourceMappingURL=index.js.map

package/dist/src/decision/job-accounting.js

@@ -0,0 +1,93 @@
+import { artifactDigest } from './validate.js';
+import { batchAccountingTotals } from './batch-receipts/accounting.js';
+import { JobConflictError } from './job-store.js';
+const empty = () => ({ inputTokens: 0, outputTokens: 0, knownCostMicros: 0,
+    unknownUsage: false, unknownCost: false, costProvenance: 'client-derived', complete: true });
+function add(target, input, output, costMicros) {
+    if (input === null || output === null)
+        target.unknownUsage = true;
+    if (costMicros === null) {
+        target.unknownCost = true;
+        target.costProvenance = 'unknown';
+    }
+    for (const [field, value] of [['inputTokens', input], ['outputTokens', output], ['knownCostMicros', costMicros]]) {
+        if (value === null)
+            continue;
+        if (!Number.isSafeInteger(value) || value < 0 || !Number.isSafeInteger(target[field] + value))
+            throw new JobConflictError('Invalid job usage total');
+        target[field] += value;
+    }
+}
+/** Read only: receipt ownership is authoritative; per-answer native batch allocations are ignored. */
+export async function accountDecisionJob(job, receipts, batches) {
+    const total = empty();
+    const items = Object.create(null);
+    const seenBatches = new Map();
+    for (const item of job.items) {
+        const usage = empty();
+        items[item.id] = usage;
+        for (const attempt of item.attempts) {
+            if (!attempt.receiptDigest) {
+                usage.complete = false;
+                usage.unknownUsage = true;
+                usage.unknownCost = true;
+                continue;
+            }
+            const receipt = await receipts.read(attempt.id, job.scope.projectId);
+            if (!receipt || receipt.invocationId !== attempt.id || receipt.projectId !== job.scope.projectId ||
+                artifactDigest(receipt) !== attempt.receiptDigest || receipt.state !== 'completed' || !receipt.result ||
+                receipt.result.spec.invocationId !== attempt.id ||
+                Object.values(receipt.result.spec.evaluations).some(evaluation => evaluation.spec.invocationId !== attempt.id)) {
+                throw new JobConflictError('Job receipt unavailable or changed');
+            }
+            for (const evaluation of Object.values(receipt.result.spec.evaluations)) {
+                for (const providerAttempt of evaluation.spec.attempts) {
+                    if (providerAttempt.batch?.mode === 'native') {
+                        const ref = evaluation.spec.batchResult;
+                        if (!ref || !batches) {
+                            usage.complete = false;
+                            usage.unknownUsage = true;
+                            usage.unknownCost = true;
+                            continue;
+                        }
+                        const owningItem = seenBatches.get(ref.batchId);
+                        if (owningItem && owningItem !== item.id)
+                            throw new JobConflictError('Native batch shared across job subjects');
+                        if (owningItem)
+                            continue;
+                        const batch = await batches.read(ref.batchId, job.scope.tenantId, job.scope.projectId);
+                        if (!batch || batch.tenantId !== job.scope.tenantId || batch.projectId !== job.scope.projectId ||
+                            batch.invocationId !== attempt.id || batch.status !== 'completed' ||
+                            batch.revision < ref.receiptRevision || !batch.questionIds.includes(ref.questionId) ||
+                            !batch.answerReferences.some(answer => answer.questionId === ref.questionId && answer.answerId === ref.answerId))
+                            throw new JobConflictError('Native batch receipt unavailable or outside item invocation');
+                        seenBatches.set(ref.batchId, item.id);
+                        const owner = batchAccountingTotals(batch);
+                        add(usage, owner.usage.inputTokens, owner.usage.outputTokens, owner.cost.unknownAttemptCount === 0 ? owner.cost.knownAmountMicros : owner.cost.conservativeUpperBoundMicros);
+                        if (owner.cost.unknownAttemptCount) {
+                            usage.unknownCost = owner.cost.conservativeUpperBoundMicros === null;
+                            usage.costProvenance = usage.unknownCost ? 'unknown' : 'estimate';
+                        }
+                    }
+                    else {
+                        const providerUsage = providerAttempt.usage;
+                        const amount = providerUsage.costUsd;
+                        add(usage, providerUsage.inputTokens, providerUsage.outputTokens, amount === null || !Number.isFinite(amount) || amount < 0 ? null : Math.round(amount * 1_000_000));
+                    }
+                }
+            }
+        }
+        add(total, usage.inputTokens, usage.outputTokens, usage.knownCostMicros);
+        total.complete &&= usage.complete;
+        total.unknownCost ||= usage.unknownCost;
+        total.unknownUsage ||= usage.unknownUsage;
+        if (usage.costProvenance === 'estimate' && total.costProvenance !== 'unknown')
+            total.costProvenance = 'estimate';
+    }
+    if (total.unknownCost)
+        total.costProvenance = 'unknown';
+    return { ...total, items,
+        overTokenBudget: total.unknownUsage || total.inputTokens + total.outputTokens > job.budget.maxTokens,
+        overCostBudget: total.unknownCost || total.knownCostMicros > job.budget.maxCostMicros };
+}
+//# sourceMappingURL=job-accounting.js.map

package/dist/src/decision/job-contract.js

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { admitEntry } from './entry.js';
+/** Versioned offline contract. Provider dispatch is not enabled by the job layer. */
+export const ITEM_STATES = [
+    'queued', 'running', 'succeeded', 'abstained', 'review', 'unsupported', 'retryable-failed',
+    'permanent-failed', 'canceled', 'expired', 'execution-unknown',
+];
+export class DecisionJobContractError extends Error {
+    constructor(message) { super(message); this.name = 'DecisionJobContractError'; }
+}
+const here = dirname(fileURLToPath(import.meta.url));
+const dir = [resolve(here, '../../schemas/decision'), resolve(here, '../../../schemas/decision')]
+    .find(path => existsSync(resolve(path, 'DecisionJob.v1.schema.json')));
+if (!dir)
+    throw new Error('Decision job schema directory is unavailable');
+const schema = JSON.parse(readFileSync(resolve(dir, 'DecisionJob.v1.schema.json'), 'utf8'));
+const check = new Ajv2020({ strict: false, allErrors: true }).compile(schema);
+const reject = (message) => { throw new DecisionJobContractError(message); };
+const transitions = {
+    validating: ['queued', 'failed', 'canceled', 'expired'],
+    queued: ['running', 'cancel-requested', 'expired', 'failed'],
+    running: ['running', 'partially-completed', 'completed', 'cancel-requested', 'expired', 'failed'],
+    'partially-completed': ['partially-completed', 'completed', 'cancel-requested', 'expired', 'failed'],
+    'cancel-requested': ['canceled', 'partially-completed', 'failed', 'expired'],
+    completed: [], canceled: [], expired: [], failed: [],
+};
+const itemTransitions = {
+    queued: ['running', 'canceled', 'expired'],
+    running: ['succeeded', 'abstained', 'review', 'unsupported', 'retryable-failed',
+        'permanent-failed', 'execution-unknown', 'canceled', 'expired'],
+    'retryable-failed': ['queued', 'running', 'canceled', 'expired'],
+    succeeded: [], abstained: [], review: [], unsupported: [], 'permanent-failed': [],
+    canceled: [], expired: [], 'execution-unknown': [],
+};
+const RESULT_STATES = ['succeeded', 'abstained', 'review'];
+function validResolution(attempt) {
+    const resolution = attempt.resolution;
+    return !resolution || (resolution.method === 'effect-ledger' && resolution.reason === 'digest-match' &&
+        attempt.outcome === 'succeeded' && !!attempt.receiptDigest && resolution.receiptDigest === attempt.receiptDigest);
+}
+/**
+ * The one gated transition out of `execution-unknown` (D16 opt-in resolver,
+ * #2722): the latest attempt moves from `execution-unknown` to `succeeded`
+ * with a receipt digest bound by a `digest-match` resolution, the item gains
+ * its result digest, and nothing else changes.
+ */
+export function isExecutionUnknownResolution(previous, item) {
+    const before = previous.attempts.at(-1);
+    const after = item.attempts.at(-1);
+    if (previous.state !== 'execution-unknown' || !RESULT_STATES.includes(item.state) || !before || !after ||
+        item.attempts.length !== previous.attempts.length || before.outcome !== 'execution-unknown' ||
+        before.receiptDigest !== undefined || before.resolution !== undefined ||
+        previous.resultDigest !== undefined || !item.resultDigest || item.errorCode !== previous.errorCode)
+        return false;
+    if (previous.attempts.slice(0, -1).some((attempt, index) => canonicalJson(attempt) !== canonicalJson(item.attempts[index])))
+        return false;
+    const { receiptDigest, resolution, outcome, ...rest } = after;
+    const { outcome: _previousOutcome, ...previousRest } = before;
+    return outcome === 'succeeded' && !!receiptDigest && !!resolution && validResolution(after) &&
+        canonicalJson(rest) === canonicalJson(previousRest);
+}
+function sameItem(previous, item) {
+    return !!item && canonicalJson(previous) === canonicalJson(item);
+}
+export function validateDecisionJob(value) {
+    try {
+        admitEntry(value);
+    }
+    catch {
+        return reject('job admission denied');
+    }
+    if (!check(value))
+        return reject('invalid decision job schema');
+    const job = value;
+    if (job.expiresAtEpochMs <= job.createdAtEpochMs)
+        return reject('invalid job expiry');
+    const ids = new Set();
+    let reservedTokens = 0;
+    let reservedCostMicros = 0;
+    const actual = Object.fromEntries(ITEM_STATES.map(state => [state, 0]));
+    for (const item of job.items) {
+        if (ids.has(item.id))
+            return reject('duplicate job item ID');
+        ids.add(item.id);
+        actual[item.state]++;
+        if (item.attempts.length > job.budget.maxAttempts ||
+            new Set(item.attempts.map(attempt => attempt.id)).size !== item.attempts.length)
+            return reject('invalid item attempts');
+        if (['succeeded', 'abstained', 'review'].includes(item.state) &&
+            (!item.resultDigest || !item.attempts.some(attempt => attempt.outcome === 'succeeded' && attempt.receiptDigest)))
+            return reject('result item lacks validated receipt');
+        if (item.resultDigest && !['succeeded', 'abstained', 'review'].includes(item.state))
+            return reject('invalid item result');
+        if (item.state === 'execution-unknown' && !item.attempts.some(attempt => attempt.outcome === 'execution-unknown'))
+            return reject('unreconciled item missing attempt');
+        for (const attempt of item.attempts) {
+            if ((attempt.reservedTokens === undefined) !== (attempt.reservedCostMicros === undefined))
+                return reject('incomplete job reservation');
+            reservedTokens += attempt.reservedTokens ?? 0;
+            reservedCostMicros += attempt.reservedCostMicros ?? 0;
+            if (!Number.isSafeInteger(reservedTokens) || !Number.isSafeInteger(reservedCostMicros))
+                return reject('job reservation overflow');
+            if (!validResolution(attempt))
+                return reject('unbound execution-unknown resolution');
+        }
+    }
+    if (reservedTokens > job.budget.maxTokens || reservedCostMicros > job.budget.maxCostMicros)
+        return reject('job budget reservation exceeded');
+    if (Object.keys(job.summary).length !== ITEM_STATES.length ||
+        ITEM_STATES.some(state => job.summary[state] !== actual[state]))
+        return reject('job summary mismatch');
+    if (['validating', 'queued'].includes(job.state) && (actual.running || actual.succeeded || actual['execution-unknown']))
+        return reject('unstarted job contains dispatched items');
+    if (job.state === 'canceled' && (actual.running || actual.queued || actual['execution-unknown']))
+        return reject('canceled job conceals in-flight ambiguity');
+    if (job.state === 'completed' && (actual.running || actual.queued || actual['retryable-failed'] || actual['execution-unknown']))
+        return reject('completed job conceals unfinished items');
+}
+/** A same-state job revision whose only changes are gated `execution-unknown` resolutions. */
+function resolutionOnly(before, after) {
+    if (before.state !== after.state || before.items.length !== after.items.length)
+        return false;
+    let resolved = 0;
+    for (const [index, previous] of before.items.entries()) {
+        const item = after.items[index];
+        if (!item || item.id !== previous.id)
+            return false;
+        if (isExecutionUnknownResolution(previous, item))
+            resolved++;
+        else if (!sameItem(previous, item))
+            return false;
+    }
+    return resolved > 0;
+}
+export function assertJobTransition(before, after) {
+    validateDecisionJob(before);
+    validateDecisionJob(after);
+    if (before.id !== after.id || before.fingerprint !== after.fingerprint ||
+        canonicalJson(before.scope) !== canonicalJson(after.scope) ||
+        before.createdAtEpochMs !== after.createdAtEpochMs || before.expiresAtEpochMs !== after.expiresAtEpochMs ||
+        canonicalJson(before.budget) !== canonicalJson(after.budget) ||
+        !(transitions[before.state].includes(after.state) || resolutionOnly(before, after)))
+        return reject('illegal job transition or changed identity');
+    const next = new Map(after.items.map(item => [item.id, item]));
+    if (next.size !== before.items.length || after.items.length !== before.items.length)
+        return reject('job items changed');
+    for (const [index, previous] of before.items.entries()) {
+        const item = after.items[index];
+        if (item?.id !== previous.id)
+            return reject('job item order changed');
+        if (!item || previous.fingerprint !== item.fingerprint || previous.subjectDigest !== item.subjectDigest ||
+            previous.definitionDigest !== item.definitionDigest || previous.bindingDigest !== item.bindingDigest ||
+            previous.rulesetDigest !== item.rulesetDigest)
+            return reject('illegal item transition, mutated pins or attempt history');
+        if (isExecutionUnknownResolution(previous, item))
+            continue;
+        if ((previous.state !== item.state && !itemTransitions[previous.state].includes(item.state)) ||
+            item.attempts.length < previous.attempts.length || item.attempts.length > previous.attempts.length + 1 ||
+            (item.attempts.length > previous.attempts.length &&
+                !(item.state === 'running' && ['queued', 'retryable-failed'].includes(previous.state) &&
+                    item.attempts.at(-1)?.outcome === 'dispatched')) ||
+            (['succeeded', 'abstained', 'review', 'unsupported', 'permanent-failed', 'canceled', 'expired', 'execution-unknown'].includes(previous.state) &&
+                item.attempts.length !== previous.attempts.length) ||
+            (previous.state === 'running' && item.state === 'canceled' && previous.attempts.some(attempt => attempt.outcome === 'dispatched')) ||
+            (previous.resultDigest !== undefined && item.resultDigest !== previous.resultDigest) ||
+            (previous.errorCode !== undefined && item.errorCode !== previous.errorCode) ||
+            (previous.state === item.state &&
+                (previous.resultDigest !== item.resultDigest || previous.errorCode !== item.errorCode)) ||
+            previous.attempts.some((attempt, index) => canonicalJson(attempt) !== canonicalJson(item.attempts[index]) &&
+                !(previous.state === 'running' && index === previous.attempts.length - 1 &&
+                    attempt.outcome === 'dispatched' &&
+                    (item.attempts[index]?.outcome === 'execution-unknown' && item.state === 'execution-unknown' ||
+                        item.attempts[index]?.outcome === 'succeeded' && ['succeeded', 'abstained', 'review'].includes(item.state) && !!item.attempts[index]?.receiptDigest ||
+                        item.attempts[index]?.outcome === 'failed' && ['retryable-failed', 'permanent-failed', 'unsupported'].includes(item.state)) &&
+                    attempt.id === item.attempts[index]?.id && attempt.requestDigest === item.attempts[index]?.requestDigest &&
+                    attempt.reservedTokens === item.attempts[index]?.reservedTokens &&
+                    attempt.reservedCostMicros === item.attempts[index]?.reservedCostMicros &&
+                    (item.attempts[index]?.outcome === 'execution-unknown' ? !item.attempts[index]?.receiptDigest : true))))
+            return reject('illegal item transition, mutated pins or attempt history');
+    }
+}
+//# sourceMappingURL=job-contract.js.map

package/dist/src/decision/job-effects.js

@@ -0,0 +1,95 @@
+/**
+ * D16 adoption of the AIWG effect ledger (#2722).
+ *
+ * - `ledgerJobEffectRecorder` records a `decision.receipt` effect for a job
+ *   item attempt once the admitted evaluator has written its D03 receipt and
+ *   before the job record is updated. The effect's payload digest is the D03
+ *   receipt digest, so the ledger holds digest references only.
+ * - `ledgerExecutionUnknownResolver` is the opt-in resolver for
+ *   `DecisionJobRuntime.reconcile(..., { resolveUnknown })`. It resolves an
+ *   `execution-unknown` item only when the `decision.receipt` verifier reports
+ *   `present` / `digest-match` against the digest the ledger recorded, and the
+ *   D03 receipt still has that digest. `state-match`, `absent` and `unknown`
+ *   never resolve, and nothing is ever dispatched or replayed.
+ *
+ * Effect identity: kind `decision.receipt`, target
+ * `decision:job/<jobId>/<itemId>`, context the job scope plus `attemptId`,
+ * subsystem `job`. The ledger's tenant and project are the job's.
+ *
+ * @see docs/decision/async-jobs.md "Resolving execution-unknown"
+ * @see docs/contracts/effect-ledger.v1.md "Composition"
+ */
+import { createVerifierRegistry, decisionReceiptVerifier, effectId as deriveEffectId, lookupEffect, reconcileEffect, recordIntent, } from '../effects/index.js';
+import { decisionResultJobState } from './job-evaluate.js';
+import { artifactDigest } from './validate.js';
+export const JOB_EFFECT_KIND = 'decision.receipt';
+/** The ledger identity (kind, target, context) of one job item attempt. */
+export function jobItemEffectIdentity(scope, jobId, itemId, attemptId) {
+    return {
+        kind: JOB_EFFECT_KIND,
+        target: `decision:job/${jobId}/${itemId}`,
+        context: { tenantId: scope.tenantId, projectId: scope.projectId, workspaceId: scope.workspaceId, principalId: scope.principalId, attemptId },
+    };
+}
+/** The effect ID of one job item attempt in a `job` ledger for the job's tenant and project. */
+export function jobItemEffectId(scope, jobId, itemId, attemptId) {
+    const identity = jobItemEffectIdentity(scope, jobId, itemId, attemptId);
+    return deriveEffectId({ scope: { tenant: scope.tenantId, project: scope.projectId, subsystem: 'job' }, ...identity });
+}
+function assertJobLedger(options) {
+    if (options.ledger.scope.subsystem !== 'job')
+        throw new Error('Job effect ledger must use the job subsystem');
+}
+const inScope = (options, scope) => options.ledger.scope.tenant === scope.tenantId && options.ledger.scope.project === scope.projectId;
+function registry(options) {
+    return createVerifierRegistry([decisionReceiptVerifier({ receipts: options.receipts, jobs: options.jobs })]);
+}
+/** Records the D03 receipt of a finished attempt: a signed intent carrying the receipt digest, then a verified `completed`. */
+export function ledgerJobEffectRecorder(options) {
+    assertJobLedger(options);
+    return {
+        async recordReceipt({ scope, jobId, itemId, attemptId, receiptDigest }) {
+            if (!inScope(options, scope))
+                throw new Error('Job effect ledger scope mismatch');
+            const identity = jobItemEffectIdentity(scope, jobId, itemId, attemptId);
+            const intent = await recordIntent(options.ledger, { ...identity, payloadDigest: receiptDigest, links: options.links });
+            await reconcileEffect(options.ledger, intent.effectId, {
+                verifiers: registry(options), expected: { digest: receiptDigest }, links: options.links,
+                ...(options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}),
+            });
+        },
+    };
+}
+/** The opt-in D16 resolver backed by the effect ledger. Resolves only on `digest-match`. */
+export function ledgerExecutionUnknownResolver(options) {
+    assertJobLedger(options);
+    return async ({ job, item, attempt }) => {
+        if (!inScope(options, job.scope) || item.state !== 'execution-unknown' || attempt.outcome !== 'execution-unknown')
+            return null;
+        const id = jobItemEffectId(job.scope, job.id, item.id, attempt.id);
+        const lookup = await lookupEffect(options.ledger, id);
+        const intent = lookup.records.find(record => record.phase === 'intent');
+        // Without a recorded digest there is nothing to match: the item stays execution-unknown.
+        if (!intent || lookup.tombstoned)
+            return null;
+        const recorded = intent.payloadDigest;
+        const outcome = await reconcileEffect(options.ledger, id, {
+            verifiers: registry(options), expected: { digest: recorded }, links: options.links,
+            ...(options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}),
+        });
+        const verification = outcome.result.verification;
+        if (verification.result !== 'present' || verification.reason !== 'digest-match')
+            return null;
+        const receipt = await options.receipts.read(attempt.id, job.scope.projectId);
+        if (!receipt || receipt.state !== 'completed' || !receipt.result || artifactDigest(receipt) !== recorded)
+            return null;
+        const state = decisionResultJobState(receipt.result);
+        if (state !== 'succeeded' && state !== 'review')
+            return null;
+        return {
+            state, effectId: id, reason: 'digest-match',
+            receiptDigest: recorded, resultDigest: artifactDigest(receipt.result),
+        };
+    };
+}
+//# sourceMappingURL=job-effects.js.map

package/dist/src/decision/job-evaluate.js

@@ -0,0 +1,80 @@
+import { canonicalJson } from '../security/artifact-trust.js';
+import { artifactDigest } from './validate.js';
+import { evaluateDecisionRuleset } from './evaluate.js';
+import { JobConflictError } from './job-store.js';
+/** Job item state for a completed D03 decision result; `null` for an unsupported status. */
+export function decisionResultJobState(result) {
+    const status = result?.spec?.status;
+    if (status === 'review')
+        return 'review';
+    if (status === 'completed' || status === 'defaulted')
+        return 'succeeded';
+    if (status === 'error' || status === 'cancelled')
+        return 'permanent-failed';
+    return null;
+}
+/**
+ * Host-only bridge to the synchronous evaluator. Never pass model-authored scope or adapters.
+ * Each job item receives an independent invocation/receipt; native same-state batches remain
+ * inside that invocation, never across two subjects.
+ */
+export function admittedJobItemExecutor(job, requestFor) {
+    const execute = async (item, signal) => {
+        const attempt = item.attempts.at(-1);
+        if (!attempt || attempt.outcome !== 'dispatched')
+            throw new JobConflictError('Missing durable dispatch fence');
+        const request = requestFor(item, signal);
+        const scheduler = request.scheduler;
+        if (!scheduler?.enabled || scheduler.workspace.id !== job.scope.workspaceId ||
+            scheduler.principal.id !== job.scope.principalId || !request.receiptStore ||
+            request.receiptProjectId !== job.scope.projectId || request.invocationId !== attempt.id ||
+            request.signal !== signal || scheduler.principal.limits.allowUnknownCost !== false ||
+            scheduler.principal.limits.maxCostUsd === undefined ||
+            scheduler.principal.limits.maxCostUsd > job.budget.maxCostMicros / 1_000_000 ||
+            scheduler.principal.limits.maxAttempts === undefined ||
+            scheduler.principal.limits.maxAttempts > job.budget.maxAttempts ||
+            !scheduler.estimate || request.binding.spec.maxAttempts > job.budget.maxAttempts)
+            throw new JobConflictError('Job evaluation requires authenticated bounded admission and durable receipts');
+        let plannedTokens = 0;
+        let plannedCostMicros = 0;
+        try {
+            for (const [alias, plan] of Object.entries(request.binding.spec.evaluations)) {
+                for (const target of plan.targets) {
+                    const estimate = scheduler.estimate(alias, target, request.input);
+                    if (!Number.isSafeInteger(estimate.tokens) || estimate.tokens < 0 ||
+                        !Number.isFinite(estimate.costUsd) || estimate.costUsd < 0)
+                        throw new JobConflictError('Unknown job estimate');
+                    plannedTokens += estimate.tokens;
+                    plannedCostMicros += Math.ceil(estimate.costUsd * 1_000_000);
+                }
+            }
+            if (!Number.isSafeInteger(plannedTokens) || !Number.isSafeInteger(plannedCostMicros) ||
+                attempt.reservedTokens === undefined || attempt.reservedCostMicros === undefined ||
+                plannedTokens > attempt.reservedTokens || plannedCostMicros > attempt.reservedCostMicros)
+                throw new JobConflictError('Item admission exceeds durable reservation');
+            if (!item.rulesetDigest || artifactDigest(request.ruleset) !== item.rulesetDigest ||
+                artifactDigest(request.input) !== item.subjectDigest ||
+                artifactDigest(request.definitions) !== item.definitionDigest ||
+                artifactDigest(request.binding) !== item.bindingDigest)
+                throw new JobConflictError('Job item pins changed');
+        }
+        catch {
+            throw new JobConflictError('Job item pins changed');
+        }
+        const result = await evaluateDecisionRuleset(request);
+        const receipt = await request.receiptStore.read(request.invocationId, job.scope.projectId);
+        if (!receipt || receipt.state !== 'completed' || canonicalJson(receipt.result) !== canonicalJson(result))
+            throw new JobConflictError('Unvalidated or incomplete decision receipt');
+        const receiptDigest = artifactDigest(receipt);
+        const resultDigest = artifactDigest(result);
+        const state = decisionResultJobState(result);
+        if (state === 'review' || state === 'succeeded')
+            return { state, receiptDigest, resultDigest };
+        if (state === 'permanent-failed')
+            return { state, errorCode: 'decision-failed' };
+        throw new JobConflictError('Unsupported decision outcome');
+    };
+    execute.requiresReservation = true;
+    return execute;
+}
+//# sourceMappingURL=job-evaluate.js.map