@aiwg/cli 2026.9.20 → 2026.9.21

package/dist/src/decision/job-quota.js

@@ -0,0 +1,158 @@
+import { join } from 'node:path';
+import { lstat, mkdir, readFile, rm } from 'node:fs/promises';
+import { acquireDirectoryLock } from '../artifacts/prebuilt-build-lock.js';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { canonicalizeInitialJob, FileJobStore, JobConflictError } from './job-store.js';
+const quantities = ['queued', 'running', 'retainedItems', 'retainedBytes', 'tokens', 'costMicros', 'calls', 'jobs'];
+/** Explicit operator-gated local recovery; never steal a live or unverified lock. */
+export async function recoverStaleJobQuotaLock(directory, authorize) {
+    if (typeof authorize !== 'function')
+        throw new JobConflictError('Job lock recovery requires authorization');
+    const root = await lstat(directory);
+    if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 0o077) !== 0)
+        throw new JobConflictError('Job storage root must be private');
+    const guard = join(directory, '.quota-recover');
+    try {
+        await mkdir(guard, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            return false;
+        throw error;
+    }
+    try {
+        const lock = join(directory, '.quota-lock');
+        let info;
+        try {
+            info = await lstat(lock);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new JobConflictError('Invalid job lock');
+        const ownerFile = join(lock, 'owner');
+        const ownerInfo = await lstat(ownerFile);
+        if (!ownerInfo.isFile() || (ownerInfo.mode & 0o077) !== 0)
+            throw new JobConflictError('Invalid job lock owner');
+        const token = (await readFile(ownerFile, 'utf8')).trim();
+        const match = /^([1-9][0-9]*):([0-9a-f-]{36})$/.exec(token);
+        if (!match || !Number.isSafeInteger(Number(match[1])))
+            throw new JobConflictError('Invalid job lock owner');
+        const pid = Number(match[1]);
+        const isDead = () => {
+            try {
+                process.kill(pid, 0);
+                return false;
+            }
+            catch (error) {
+                if (error.code === 'ESRCH')
+                    return true;
+                throw error;
+            }
+        };
+        if (!isDead())
+            return false;
+        let approved = false;
+        try {
+            approved = await authorize({ pid, token });
+        }
+        catch { /* deny recovery */ }
+        if (!approved || !isDead() || (await readFile(ownerFile, 'utf8')).trim() !== token)
+            return false;
+        await rm(lock, { recursive: true });
+        return true;
+    }
+    finally {
+        await rm(guard, { recursive: true, force: true });
+    }
+}
+/** Same-host, local-filesystem transactional quota gate. All writers to the store must use this wrapper. */
+export class FileJobQuotaStore {
+    payloadBytes;
+    journal;
+    lockPath;
+    limits;
+    constructor(directory, limits, externallyDeleted, payloadBytes) {
+        this.payloadBytes = payloadBytes;
+        this.journal = new FileJobStore(directory, externallyDeleted);
+        this.lockPath = join(directory, '.quota-lock');
+        this.limits = structuredClone(limits);
+        for (const tier of [this.limits.principal, this.limits.project])
+            for (const quantity of quantities) {
+                if (!Number.isSafeInteger(tier[quantity]) || tier[quantity] < 0)
+                    throw new JobConflictError('Invalid job quota policy');
+            }
+    }
+    read(scope, id) { return this.journal.read(scope, id); }
+    /** Host-only listing; the gateway filters and authenticates every returned object. */
+    listSnapshots() { return this.journal.listSnapshots(); }
+    /** Call only after the independent D10 tombstone and authorized deletion. */
+    async purgeDeleted(scope, id) {
+        await this.journal.read(scope, id);
+        await this.transaction(() => this.journal.purgeDeleted(scope, id));
+    }
+    async acquire(job) {
+        job = canonicalizeInitialJob(job);
+        await this.journal.read(job.scope, job.id);
+        return this.transaction(async () => {
+            const existing = await this.journal.read(job.scope, job.id);
+            if (!existing)
+                await this.check(await this.journal.listSnapshots(), { revision: 1, job, deleted: false });
+            return this.journal.acquire(job);
+        });
+    }
+    async compareAndSwap(previous, next) {
+        await this.journal.read(previous.job.scope, previous.job.id);
+        return this.transaction(async () => {
+            const current = await this.journal.read(previous.job.scope, previous.job.id);
+            if (!current || canonicalJson(current) !== canonicalJson(previous))
+                return false;
+            await this.check(await this.journal.listSnapshots(), next, previous);
+            return this.journal.compareAndSwap(previous, next);
+        });
+    }
+    async transaction(fn) {
+        // Fail closed rather than stealing a stale/slow owner's lock; operator must reconcile a crash.
+        const release = await acquireDirectoryLock(this.lockPath, { timeoutMs: 5000, pollMs: 20 });
+        try {
+            return await fn();
+        }
+        finally {
+            await release();
+        }
+    }
+    async check(records, proposed, previous) {
+        const scope = proposed.job.scope;
+        const effective = records.filter(record => !previous || canonicalJson(record.job.scope) !== canonicalJson(scope) || record.job.id !== proposed.job.id);
+        effective.push(proposed);
+        const tiers = [
+            ['project', this.limits.project, job => job.scope.tenantId === scope.tenantId && job.scope.projectId === scope.projectId],
+            ['principal', this.limits.principal, job => job.scope.tenantId === scope.tenantId && job.scope.projectId === scope.projectId &&
+                    job.scope.workspaceId === scope.workspaceId && job.scope.principalId === scope.principalId],
+        ];
+        for (const [tier, limits, belongs] of tiers) {
+            const totals = Object.fromEntries(quantities.map(quantity => [quantity, 0]));
+            for (const record of effective) {
+                if (record.deleted || !belongs(record.job))
+                    continue;
+                const job = record.job;
+                totals.jobs++;
+                totals.queued += job.summary.queued + job.summary['retryable-failed'];
+                totals.running += job.summary.running;
+                totals.retainedItems += job.items.length;
+                totals.retainedBytes += Buffer.byteLength(canonicalJson(job), 'utf8');
+                totals.tokens += job.budget.maxTokens;
+                totals.costMicros += job.budget.maxCostMicros;
+                totals.calls += job.items.length * job.budget.maxAttempts;
+            }
+            if (this.payloadBytes)
+                totals.retainedBytes += await this.payloadBytes(scope, tier);
+            if (quantities.some(quantity => !Number.isSafeInteger(totals[quantity]) || totals[quantity] > limits[quantity]))
+                throw new JobConflictError('Job capacity unavailable');
+        }
+    }
+}
+//# sourceMappingURL=job-quota.js.map

package/dist/src/decision/job-runtime.js

@@ -0,0 +1,240 @@
+import { ITEM_STATES, validateDecisionJob } from './job-contract.js';
+import { DecisionTraceBuilder } from './telemetry/trace.js';
+import { accountDecisionJob } from './job-accounting.js';
+import { JobConflictError } from './job-store.js';
+const DIGEST = /^sha256:[a-f0-9]{64}$/;
+const EFFECT_ID = /^eff1_[a-z2-7]{51}[aq]$/;
+function acceptedResolution(value) {
+    return !!value && value.reason === 'digest-match' && ['succeeded', 'abstained', 'review'].includes(value.state) &&
+        typeof value.receiptDigest === 'string' && DIGEST.test(value.receiptDigest) &&
+        typeof value.resultDigest === 'string' && DIGEST.test(value.resultDigest) &&
+        typeof value.effectId === 'string' && EFFECT_ID.test(value.effectId);
+}
+export class DecisionJobRuntime {
+    store;
+    now;
+    telemetry;
+    constructor(store, now = Date.now, telemetry) {
+        this.store = store;
+        this.now = now;
+        this.telemetry = telemetry;
+    }
+    async trace(snapshot, operation) {
+        if (!this.telemetry)
+            return;
+        try {
+            const builder = new DecisionTraceBuilder(undefined, this.now);
+            const safeOperation = ['submit', 'transition', 'retry', 'cancel', 'reconcile', 'expire', 'delete', 'hold', 'release-hold']
+                .includes(operation) ? operation : 'transition';
+            const span = builder.startSpan('decision.job', { attributes: {
+                    'aiwg.job.operation': safeOperation, 'aiwg.job.status': snapshot.job.state,
+                    'aiwg.job.revision': snapshot.revision, 'aiwg.job.item_count': snapshot.job.items.length,
+                    'aiwg.job.unknown_count': snapshot.job.summary['execution-unknown'],
+                }, provenance: {
+                    'aiwg.job.operation': 'client-derived', 'aiwg.job.status': 'client-derived',
+                    'aiwg.job.revision': 'client-derived', 'aiwg.job.item_count': 'client-derived',
+                    'aiwg.job.unknown_count': 'client-derived',
+                } });
+            builder.endSpan(span);
+            await this.telemetry.emit(builder.build().spans[0]);
+        }
+        catch { /* observability must never change durable state or authorize actions */ }
+    }
+    async submit(job, actor) {
+        this.authorize(actor, job.scope);
+        if (this.now() >= job.expiresAtEpochMs)
+            throw new JobConflictError('Expired job');
+        const acquired = await this.store.acquire(job);
+        if (acquired.owner)
+            await this.trace(acquired.snapshot, 'submit');
+        return acquired.snapshot;
+    }
+    async poll(actor, id) {
+        const snapshot = await this.store.read(actor, id);
+        return snapshot && !snapshot.deleted ? snapshot : null;
+    }
+    async accounting(actor, id, receipts, batches) {
+        const snapshot = await this.poll(actor, id);
+        return snapshot ? accountDecisionJob(snapshot.job, receipts, batches) : null;
+    }
+    async items(actor, id, offset = 0, limit = 100) {
+        if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+            throw new JobConflictError('Invalid page');
+        const snapshot = await this.poll(actor, id);
+        return snapshot ? structuredClone(snapshot.job.items.slice(offset, offset + limit)) : null;
+    }
+    async advance(actor, id, expected, next, operation = 'transition') {
+        this.authorize(actor, expected.job.scope);
+        if (expected.job.id !== id || this.now() >= expected.job.expiresAtEpochMs)
+            throw new JobConflictError('Job expired or mismatched');
+        const proposed = { revision: expected.revision + 1, job: structuredClone(next), deleted: false, legalHold: expected.legalHold ?? false };
+        if (!await this.store.compareAndSwap(expected, proposed))
+            throw new JobConflictError('Concurrent job update');
+        await this.trace(proposed, operation);
+        return proposed;
+    }
+    /** Requeue one eligible failure only; no dispatch occurs here. Previous attempts remain immutable. */
+    async retry(actor, id, itemId) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        const item = previous.job.items.find(candidate => candidate.id === itemId);
+        if (!item || item.state !== 'retryable-failed' || item.attempts.length >= previous.job.budget.maxAttempts ||
+            !['running', 'partially-completed'].includes(previous.job.state))
+            throw new JobConflictError('Item not retryable');
+        const next = structuredClone(previous.job);
+        next.items.find(candidate => candidate.id === itemId).state = 'queued';
+        recount(next);
+        return this.advance(actor, id, previous, next, 'retry');
+    }
+    async cancel(actor, id) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        if (['completed', 'canceled', 'expired', 'failed', 'cancel-requested'].includes(previous.job.state))
+            return previous;
+        const next = structuredClone(previous.job);
+        next.state = previous.job.state === 'validating' ? 'canceled' : 'cancel-requested';
+        // Running items remain in-flight; they must be reconciled rather than falsely marked canceled.
+        next.items.forEach(item => { if (item.state === 'queued' || item.state === 'retryable-failed')
+            item.state = 'canceled'; });
+        recount(next);
+        return this.advance(actor, id, previous, next, 'cancel');
+    }
+    /**
+     * Explicit offline restart reconciliation. Never re-dispatch an attempt whose transport may have started.
+     * With `resolveUnknown` (opt-in, D16), the reconciled `execution-unknown` items are then offered to the
+     * resolver; without it the result is exactly the default reconciliation.
+     */
+    async reconcile(actor, id, options = {}) {
+        const reconciled = await this.reconcileDispatches(actor, id);
+        if (!reconciled || !options.resolveUnknown)
+            return reconciled;
+        return this.resolveUnknown(actor, id, options.resolveUnknown);
+    }
+    /**
+     * D16 opt-in resolver (#2722): promote `execution-unknown` items whose resolver returns a verified
+     * `digest-match` resolution, through the one gated contract transition out of `execution-unknown`.
+     * The job state is kept; absent, unknown, `state-match` or a failing resolver leave the item as it is.
+     * Never dispatches.
+     */
+    async resolveUnknown(actor, id, resolver) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        this.authorize(actor, previous.job.scope);
+        const next = structuredClone(previous.job);
+        let resolved = 0;
+        for (const item of next.items) {
+            const attempt = item.attempts.at(-1);
+            if (item.state !== 'execution-unknown' || !attempt || attempt.outcome !== 'execution-unknown')
+                continue;
+            let resolution = null;
+            try {
+                resolution = await resolver({ job: structuredClone(previous.job), item: structuredClone(item), attempt: structuredClone(attempt) });
+            }
+            catch {
+                resolution = null;
+            }
+            if (!acceptedResolution(resolution))
+                continue;
+            attempt.outcome = 'succeeded';
+            attempt.receiptDigest = resolution.receiptDigest;
+            attempt.resolution = { method: 'effect-ledger', effectId: resolution.effectId, reason: 'digest-match', receiptDigest: resolution.receiptDigest };
+            item.state = resolution.state;
+            item.resultDigest = resolution.resultDigest;
+            resolved++;
+        }
+        if (!resolved)
+            return previous;
+        recount(next);
+        validateDecisionJob(next);
+        const proposed = { revision: previous.revision + 1, job: next, deleted: false, legalHold: previous.legalHold ?? false };
+        if (!await this.store.compareAndSwap(previous, proposed))
+            throw new JobConflictError('Concurrent job update');
+        await this.trace(proposed, 'reconcile');
+        return proposed;
+    }
+    async reconcileDispatches(actor, id) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        if (!['running', 'partially-completed', 'cancel-requested'].includes(previous.job.state))
+            return previous;
+        const next = structuredClone(previous.job);
+        next.state = 'failed';
+        next.items.forEach(item => {
+            if (item.state === 'queued' || item.state === 'retryable-failed')
+                item.state = 'canceled';
+            if (item.state === 'running') {
+                const attempt = item.attempts.at(-1);
+                item.state = attempt?.outcome === 'dispatched' ? 'execution-unknown' : 'canceled';
+                if (attempt?.outcome === 'dispatched')
+                    attempt.outcome = 'execution-unknown';
+            }
+        });
+        recount(next);
+        return this.advance(actor, id, previous, next, 'reconcile');
+    }
+    async expire(actor, id) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        if (this.now() < previous.job.expiresAtEpochMs || ['expired', 'canceled', 'completed', 'failed'].includes(previous.job.state))
+            return previous;
+        // Expiration must not erase the evidence of an in-flight request.
+        const next = structuredClone(previous.job);
+        next.state = 'expired';
+        next.items.forEach(item => {
+            if (item.state === 'queued' || item.state === 'retryable-failed')
+                item.state = 'expired';
+            if (item.state === 'running') {
+                const attempt = item.attempts.at(-1);
+                item.state = attempt?.outcome === 'dispatched' ? 'execution-unknown' : 'expired';
+                if (attempt?.outcome === 'dispatched')
+                    attempt.outcome = 'execution-unknown';
+            }
+        });
+        recount(next);
+        const proposed = { revision: previous.revision + 1, job: next, deleted: false, legalHold: previous.legalHold ?? false };
+        if (!await this.store.compareAndSwap(previous, proposed))
+            throw new JobConflictError('Concurrent job update');
+        await this.trace(proposed, 'expire');
+        return proposed;
+    }
+    async setLegalHold(actor, id, enabled) {
+        if (typeof enabled !== 'boolean')
+            throw new JobConflictError('Invalid legal hold');
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return null;
+        if (Boolean(previous.legalHold) === enabled)
+            return previous;
+        const next = { ...previous, revision: previous.revision + 1, legalHold: enabled };
+        if (!await this.store.compareAndSwap(previous, next))
+            throw new JobConflictError('Concurrent job update');
+        await this.trace(next, enabled ? 'hold' : 'release-hold');
+        return next;
+    }
+    async remove(actor, id) {
+        const previous = await this.poll(actor, id);
+        if (!previous)
+            return false;
+        if (previous.legalHold)
+            throw new JobConflictError('Legal hold prohibits deletion');
+        const next = { ...previous, revision: previous.revision + 1, deleted: true, legalHold: false };
+        if (!await this.store.compareAndSwap(previous, next))
+            throw new JobConflictError('Concurrent job update');
+        await this.trace(next, 'delete');
+        return true;
+    }
+    authorize(actor, scope) {
+        if (actor.tenantId !== scope.tenantId || actor.projectId !== scope.projectId ||
+            actor.workspaceId !== scope.workspaceId || actor.principalId !== scope.principalId)
+            throw new JobConflictError('Job unavailable');
+    }
+}
+export function recount(job) {
+    job.summary = Object.fromEntries(ITEM_STATES.map(state => [state, job.items.filter(item => item.state === state).length]));
+}
+//# sourceMappingURL=job-runtime.js.map

package/dist/src/decision/job-scheduler.js

@@ -0,0 +1,26 @@
+import { runBoundedFair } from './scheduler.js';
+import { JobConflictError } from './job-store.js';
+/** Offline round-robin across authenticated principal/project lanes; not a distributed admission authority. */
+export class OfflineJobScheduler {
+    worker;
+    concurrency;
+    maxQueuedItems;
+    constructor(worker, concurrency, maxQueuedItems) {
+        this.worker = worker;
+        this.concurrency = concurrency;
+        this.maxQueuedItems = maxQueuedItems;
+        if (!Number.isSafeInteger(concurrency) || concurrency < 1 ||
+            !Number.isSafeInteger(maxQueuedItems) || maxQueuedItems < concurrency)
+            throw new JobConflictError('Invalid job scheduler limits');
+    }
+    async run(work, options = {}) {
+        if (work.length > this.maxQueuedItems)
+            throw new JobConflictError('Job queue capacity exceeded');
+        const keys = work.map(item => JSON.stringify([item.actor, item.jobId, item.itemId]));
+        if (new Set(keys).size !== keys.length)
+            throw new JobConflictError('Duplicate scheduled job item');
+        return runBoundedFair(work.map(item => ({ value: item,
+            lane: JSON.stringify([item.actor.tenantId, item.actor.projectId, item.actor.principalId]) })), this.concurrency, item => this.worker.run(item.actor, item.jobId, item.itemId, item.executor, item.reservation), options);
+    }
+}
+//# sourceMappingURL=job-scheduler.js.map

package/dist/src/decision/job-service.js

@@ -0,0 +1,117 @@
+import { DecisionJobGateway } from './job-gateway.js';
+import { admittedJobItemExecutor } from './job-evaluate.js';
+import { artifactDigest } from './validate.js';
+import { FileJobPollLimiter } from './job-poll-limiter.js';
+import { FileJobPayloadStore } from './job-payload-store.js';
+import { FileJobQuotaStore } from './job-quota.js';
+import { DecisionJobRuntime } from './job-runtime.js';
+import { OfflineJobScheduler } from './job-scheduler.js';
+import { OfflineJobWorker } from './job-worker.js';
+import { FileJobStore, JobConflictError } from './job-store.js';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { validateDecisionLifecyclePolicy } from './lifecycle.js';
+/** Disabled-by-default offline assembly. Host must supply authenticated actors and admitted item executors. */
+export function createOfflineDecisionJobService(config) {
+    if (typeof config.externallyDeleted !== 'function' || typeof config.authorizeExport !== 'function')
+        throw new Error('Independent lifecycle and export authorization required');
+    validateDecisionLifecyclePolicy(config.lifecyclePolicy);
+    if (config.lifecyclePolicy.surfaces.job.backup !== 'expire-with-primary' ||
+        config.lifecyclePolicy.surfaces.job.deletion !== 'erase')
+        throw new JobConflictError('Persisted job requires erasure and backup expiry policy');
+    const now = config.now ?? Date.now;
+    let payloads;
+    const store = new FileJobQuotaStore(config.directory, config.quota, config.externallyDeleted, (scope, tier) => payloads.usage(scope, tier));
+    const metadataBytes = async (scope, tier) => {
+        const records = await store.listSnapshots();
+        return records.filter(record => !record.deleted && record.job.scope.tenantId === scope.tenantId &&
+            record.job.scope.projectId === scope.projectId && (tier === 'project' ||
+            record.job.scope.workspaceId === scope.workspaceId && record.job.scope.principalId === scope.principalId))
+            .reduce((sum, record) => sum + Buffer.byteLength(canonicalJson(record.job), 'utf8'), 0);
+    };
+    payloads = new FileJobPayloadStore(config.directory, config.payloadKey, new FileJobStore(config.directory, config.externallyDeleted), config.externallyDeleted, { itemBytes: config.payloadMaxItemBytes, principalBytes: config.quota.principal.retainedBytes,
+        projectBytes: config.quota.project.retainedBytes }, now, metadataBytes);
+    const runtime = new DecisionJobRuntime(store, now, config.telemetry);
+    const worker = new OfflineJobWorker(runtime);
+    const scheduler = new OfflineJobScheduler(worker, config.scheduler.concurrency, config.scheduler.maxQueuedItems);
+    const polling = new FileJobPollLimiter(config.directory, config.polls.windowMs, config.polls.perPrincipal, config.polls.perProject, config.polls.maxLanes, now);
+    const admitJob = (job) => {
+        const duration = job.expiresAtEpochMs - job.createdAtEpochMs;
+        if (!Number.isSafeInteger(duration) || duration <= 0 || duration > config.lifecyclePolicy.surfaces.job.retentionMs)
+            throw new JobConflictError('Job exceeds D10 retention policy');
+    };
+    const gateway = new DecisionJobGateway(runtime, config.handleKey, now, actor => polling.check(actor), {
+        listSnapshots: () => store.listSnapshots(), authorizeExport: async (actor, snapshot) => config.lifecyclePolicy.surfaces.job.export === 'sanitized' && await config.authorizeExport(actor, snapshot),
+    }, admitJob);
+    /** Host maintenance: bound queued dwell by the pinned expiry even after a restart. */
+    const sweepExpired = async () => {
+        let expired = 0;
+        for (const record of await store.listSnapshots()) {
+            if (record.deleted || now() < record.job.expiresAtEpochMs ||
+                ['expired', 'canceled', 'completed', 'failed'].includes(record.job.state))
+                continue;
+            try {
+                if ((await runtime.expire(record.job.scope, record.job.id))?.job.state === 'expired')
+                    expired++;
+            }
+            catch (error) {
+                if (!(error instanceof JobConflictError) || error.message !== 'Concurrent job update')
+                    throw error;
+                // Another process owns the winning revision. Do not retry or dispatch here.
+            }
+        }
+        return expired;
+    };
+    /** D10 eraser callback: publish D10 tombstone first, then call this; retries are safe after partial erasure. */
+    const eraseJob = async (scope, id) => {
+        if (!await config.externallyDeleted(scope, id))
+            throw new JobConflictError('Independent job tombstone required');
+        const raw = await new FileJobStore(config.directory).read(scope, id);
+        if (raw && (!raw.deleted || raw.legalHold))
+            throw new JobConflictError('Authorized job deletion required');
+        await payloads.purgeDeleted(scope, id);
+        await store.purgeDeleted(scope, id);
+    };
+    /** Recover a completed result from its durable D03 receipt, never by replaying the provider. */
+    const materializeResult = async (actor, id, itemId, receipts) => {
+        const snapshot = await runtime.poll(actor, id);
+        const item = snapshot?.job.items.find(entry => entry.id === itemId);
+        const attempt = item?.attempts.at(-1);
+        if (!snapshot || !item || !['succeeded', 'review', 'abstained'].includes(item.state) ||
+            !item.resultDigest || !attempt?.receiptDigest || attempt.outcome !== 'succeeded')
+            throw new JobConflictError('Validated job result unavailable');
+        const receipt = await receipts.read(attempt.id, actor.projectId);
+        if (!receipt || receipt.state !== 'completed' || !receipt.result ||
+            artifactDigest(receipt) !== attempt.receiptDigest || artifactDigest(receipt.result) !== item.resultDigest)
+            throw new JobConflictError('Validated job receipt unavailable');
+        await payloads.put(actor, id, itemId, 'result', receipt.result);
+        return true;
+    };
+    /** Dispatches only the already admitted synchronous evaluator using protected pinned input. */
+    const runAdmittedItem = async (actor, id, itemId, requestFor, reservation) => {
+        const snapshot = await runtime.poll(actor, id);
+        if (!snapshot)
+            throw new JobConflictError('Job unavailable');
+        let receipts;
+        const execute = async (item, signal) => {
+            const input = await payloads.get(actor, id, item.id, 'input');
+            if (input === null)
+                throw new JobConflictError('Protected job input unavailable');
+            return admittedJobItemExecutor(snapshot.job, (candidate, active) => {
+                const request = requestFor(candidate, input, active);
+                receipts = request.receiptStore;
+                return request;
+            })(item, signal);
+        };
+        execute.requiresReservation = true;
+        const finished = await worker.run(actor, id, itemId, execute, reservation);
+        const item = finished.job.items.find(candidate => candidate.id === itemId);
+        if (item && ['succeeded', 'review', 'abstained'].includes(item.state)) {
+            if (!receipts)
+                throw new JobConflictError('Durable decision receipts required');
+            await materializeResult(actor, id, itemId, receipts);
+        }
+        return finished;
+    };
+    return { gateway, runtime, worker, scheduler, payloads, eraseJob, sweepExpired, runAdmittedItem, materializeResult };
+}
+//# sourceMappingURL=job-service.js.map