@allocator-one/rcl 4.4.19

package/dist/dispatch/original-launch.d.ts

@@ -0,0 +1,37 @@
+export declare const MAX_ORIGINAL_LAUNCH_LIMIT = 1000000;
+export interface OriginalLaunchInput {
+    runId: string;
+    target: string;
+    originalNativeClaim: {
+        attempt: number;
+        round: number;
+    };
+    capturedInputsSha256: string;
+    planDigest: string;
+    startedAtMs: number;
+    expiresAtMs: number;
+    maxPhysicalCalls: number;
+    maxAttemptsPerCell: number;
+}
+export interface OriginalLaunch extends OriginalLaunchInput {
+    version: 1;
+}
+export interface OriginalRuntimeBounds {
+    maxPhysicalCalls?: number;
+    maxAttemptsPerCell?: number;
+    expiresAtMs?: number;
+}
+export interface OriginalBudget {
+    remainingMs: number;
+    maxPhysicalCalls: number;
+    maxAttemptsPerCell: number;
+    expiresAtMs: number;
+}
+/** Validate effective execution limits before the native attempt is claimed. */
+export declare function assertOriginalLaunchBudget(durationMs: number, maxPhysicalCalls: number, maxAttemptsPerCell: number): void;
+/** Creates a local original-launch descriptor; it does not establish native, provider, or server authority. */
+export declare function createOriginalLaunch(input: OriginalLaunchInput): OriginalLaunch;
+export declare function encodeOriginalLaunch(value: OriginalLaunch): string;
+export declare function decodeOriginalLaunch(bytes: string): OriginalLaunch;
+/** Resume derives time only from the persisted absolute deadline; runtime may tighten but never raise it. */
+export declare function remainingOriginalBudget(value: OriginalLaunch, nowMs: number, runtime?: OriginalRuntimeBounds): OriginalBudget;

package/dist/dispatch/original-launch.js

@@ -0,0 +1,117 @@
+import { MAX_TIMER_DELAY_MS } from '../config/schema.js';
+import { stableStringify } from '../report/run-header.js';
+import { UUID } from '../telemetry/recovery/source.js';
+const VERSION = 1;
+export const MAX_ORIGINAL_LAUNCH_LIMIT = 1_000_000;
+const MAX_BYTES = 64 * 1024;
+const SHA256 = /^[a-f0-9]{64}$/;
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+function exactKeys(value, expected, error) {
+    const keys = Object.keys(value);
+    if (keys.length !== expected.length || keys.some(key => !expected.includes(key)))
+        throw new Error(error);
+}
+function integer(value, error, minimum, maximum = Number.MAX_SAFE_INTEGER) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+        throw new Error(error);
+}
+function digest(value, error) { if (typeof value !== 'string' || !SHA256.test(value))
+    throw new Error(error); }
+/** Validate effective execution limits before the native attempt is claimed. */
+export function assertOriginalLaunchBudget(durationMs, maxPhysicalCalls, maxAttemptsPerCell) {
+    integer(durationMs, 'original_launch_invalid_duration', 1, MAX_TIMER_DELAY_MS);
+    integer(maxPhysicalCalls, 'original_launch_invalid_max_physical_calls', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(maxAttemptsPerCell, 'original_launch_invalid_max_attempts_per_cell', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+}
+function target(value) {
+    if (typeof value !== 'string' || value.length > 512 || !value.trim() || /[\0\r\n]/.test(value))
+        throw new Error('original_launch_invalid_target');
+}
+function runId(value) { if (typeof value !== 'string' || !UUID.test(value))
+    throw new Error('original_launch_invalid_run_id'); }
+function validate(input, withVersion) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('original_launch_invalid_document');
+    exactKeys(input, withVersion
+        ? ['version', 'runId', 'target', 'originalNativeClaim', 'capturedInputsSha256', 'planDigest', 'startedAtMs', 'expiresAtMs', 'maxPhysicalCalls', 'maxAttemptsPerCell']
+        : ['runId', 'target', 'originalNativeClaim', 'capturedInputsSha256', 'planDigest', 'startedAtMs', 'expiresAtMs', 'maxPhysicalCalls', 'maxAttemptsPerCell'], 'original_launch_invalid_document');
+    if (withVersion && input.version !== VERSION)
+        throw new Error('original_launch_invalid_document');
+    runId(input.runId);
+    target(input.target);
+    digest(input.capturedInputsSha256, 'original_launch_invalid_captured_inputs_sha256');
+    digest(input.planDigest, 'original_launch_invalid_plan_digest');
+    const claim = input.originalNativeClaim;
+    if (!claim || typeof claim !== 'object' || Array.isArray(claim))
+        throw new Error('original_launch_invalid_native_claim');
+    exactKeys(claim, ['attempt', 'round'], 'original_launch_invalid_native_claim');
+    integer(claim.attempt, 'original_launch_invalid_native_attempt', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(claim.round, 'original_launch_invalid_native_round', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(input.startedAtMs, 'original_launch_invalid_started_at', 0);
+    integer(input.expiresAtMs, 'original_launch_invalid_deadline', 0);
+    if (input.expiresAtMs < input.startedAtMs || input.expiresAtMs - input.startedAtMs > MAX_TIMER_DELAY_MS)
+        throw new Error('original_launch_invalid_deadline');
+    integer(input.maxPhysicalCalls, 'original_launch_invalid_max_physical_calls', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(input.maxAttemptsPerCell, 'original_launch_invalid_max_attempts_per_cell', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    return deepFreeze({ version: VERSION, runId: input.runId, target: input.target,
+        originalNativeClaim: { attempt: claim.attempt, round: claim.round }, capturedInputsSha256: input.capturedInputsSha256,
+        planDigest: input.planDigest, startedAtMs: input.startedAtMs, expiresAtMs: input.expiresAtMs,
+        maxPhysicalCalls: input.maxPhysicalCalls, maxAttemptsPerCell: input.maxAttemptsPerCell });
+}
+function canonical(launch) {
+    const bytes = stableStringify(launch);
+    if (Buffer.byteLength(bytes, 'utf8') > MAX_BYTES)
+        throw new Error('original_launch_too_large');
+    return bytes;
+}
+/** Creates a local original-launch descriptor; it does not establish native, provider, or server authority. */
+export function createOriginalLaunch(input) {
+    const launch = validate(input, false);
+    canonical(launch);
+    return launch;
+}
+export function encodeOriginalLaunch(value) { return canonical(validate(value, true)); }
+export function decodeOriginalLaunch(bytes) {
+    if (typeof bytes !== 'string' || Buffer.byteLength(bytes, 'utf8') > MAX_BYTES)
+        throw new Error('original_launch_invalid_document');
+    let value;
+    try {
+        value = JSON.parse(bytes);
+    }
+    catch {
+        throw new Error('original_launch_invalid_document');
+    }
+    const launch = validate(value, true);
+    if (bytes !== canonical(launch))
+        throw new Error('original_launch_noncanonical');
+    return launch;
+}
+/** Resume derives time only from the persisted absolute deadline; runtime may tighten but never raise it. */
+export function remainingOriginalBudget(value, nowMs, runtime = {}) {
+    const launch = validate(value, true);
+    if (!runtime || typeof runtime !== 'object' || Array.isArray(runtime))
+        throw new Error('original_launch_invalid_runtime_bounds');
+    exactKeys(runtime, ['maxPhysicalCalls', 'maxAttemptsPerCell', 'expiresAtMs'].filter(key => Object.hasOwn(runtime, key)), 'original_launch_invalid_runtime_bounds');
+    integer(nowMs, 'original_launch_invalid_now', 0);
+    if (nowMs < launch.startedAtMs)
+        throw new Error('original_launch_clock_before_start');
+    const maxPhysicalCalls = runtime.maxPhysicalCalls === undefined ? launch.maxPhysicalCalls : runtime.maxPhysicalCalls;
+    const maxAttemptsPerCell = runtime.maxAttemptsPerCell === undefined ? launch.maxAttemptsPerCell : runtime.maxAttemptsPerCell;
+    const expiresAtMs = runtime.expiresAtMs === undefined ? launch.expiresAtMs : runtime.expiresAtMs;
+    integer(maxPhysicalCalls, 'original_launch_invalid_runtime_cap', 0, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(maxAttemptsPerCell, 'original_launch_invalid_runtime_cap', 1, MAX_ORIGINAL_LAUNCH_LIMIT);
+    integer(expiresAtMs, 'original_launch_invalid_runtime_deadline', launch.startedAtMs);
+    if (maxPhysicalCalls > launch.maxPhysicalCalls || maxAttemptsPerCell > launch.maxAttemptsPerCell)
+        throw new Error('original_launch_runtime_cap_raise');
+    if (expiresAtMs > launch.expiresAtMs)
+        throw new Error('original_launch_runtime_deadline_extend');
+    return { remainingMs: Math.max(0, expiresAtMs - nowMs), maxPhysicalCalls, maxAttemptsPerCell, expiresAtMs };
+}
+//# sourceMappingURL=original-launch.js.map

package/dist/dispatch/original-launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"original-launch.js","sourceRoot":"","sources":["../../src/dispatch/original-launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAEvD,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AACnD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC;AA0BhC,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAe,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,KAAa;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa,EAAE,OAAe,EAAE,OAAO,GAAG,MAAM,CAAC,gBAAgB;IAChG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AAC9H,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzJ,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CAAC,UAAkB,EAAE,gBAAwB,EAAE,kBAA0B;IACjH,OAAO,CAAC,UAAU,EAAE,kCAAkC,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/E,OAAO,CAAC,gBAAgB,EAAE,4CAA4C,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACtG,OAAO,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpJ,CAAC;AACD,SAAS,KAAK,CAAC,KAAc,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC;AAElK,SAAS,QAAQ,CAAC,KAA2C,EAAE,WAAoB;IACjF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrH,SAAS,CAAC,KAA2C,EAAE,WAAW;QAChE,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;QACrK,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,kCAAkC,CAAC,CAAC;IAClM,IAAI,WAAW,IAAK,KAAwB,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzH,SAAS,CAAC,KAAgC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,sCAAsC,CAAC,CAAC;IAC1G,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,sCAAsC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,GAAG,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7J,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,4CAA4C,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC5G,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,+CAA+C,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACjH,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC5E,mBAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QACrH,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC5F,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC9F,CAAC;AACD,SAAS,SAAS,CAAC,MAAsB;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAAqB,IAAY,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnI,IAAI,KAAc,CAAC;IAAC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAAC,CAAC;IACrH,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,uBAAuB,CAAC,KAAqB,EAAE,KAAa,EAAE,UAAiC,EAAE;IAC/G,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACjI,SAAS,CAAC,OAA6C,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;IACzM,OAAO,CAAC,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACrH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC7H,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACjG,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC/F,OAAO,CAAC,kBAAkB,EAAE,qCAAqC,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACjG,OAAO,CAAC,WAAW,EAAE,0CAA0C,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrF,IAAI,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,kBAAkB,GAAG,MAAM,CAAC,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvJ,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACjG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAC9G,CAAC"}

package/dist/dispatch/quorum.d.ts

@@ -0,0 +1,15 @@
+/** Successful blocking-reviewer policy shared by dispatch and admission. */
+export interface QuorumPolicy {
+    readonly version: 1;
+    readonly fraction: number;
+    readonly seatCount: number;
+    readonly minimumSuccessful: number;
+}
+/**
+ * Freeze the minimum for the original blocking roster. A stricter supported
+ * fraction raises the required successes; 1 requires the entire roster.
+ * Fewer than two seats can never produce conclusive reviewer health.
+ */
+export declare function resolveQuorumPolicy(seatCount: number, fraction?: number): QuorumPolicy;
+/** Count only distinct, complete, durably accepted blocking seats. */
+export declare function hasSuccessfulQuorum(policy: QuorumPolicy, successfulSeats: number): boolean;

package/dist/dispatch/quorum.js

@@ -0,0 +1,33 @@
+/**
+ * Freeze the minimum for the original blocking roster. A stricter supported
+ * fraction raises the required successes; 1 requires the entire roster.
+ * Fewer than two seats can never produce conclusive reviewer health.
+ */
+export function resolveQuorumPolicy(seatCount, fraction = 2 / 3) {
+    if (!Number.isSafeInteger(seatCount) || seatCount < 0) {
+        throw new Error('Quorum seat count must be a nonnegative safe integer');
+    }
+    if (!Number.isFinite(fraction) || fraction < 2 / 3 || fraction > 1) {
+        throw new Error('Quorum fraction must be between 2/3 and 1');
+    }
+    // Integer arithmetic preserves the authoritative floor without overflowing
+    // 2 * seatCount.
+    const floor = Math.floor(seatCount / 3) * 2 + Math.ceil((seatCount % 3) * 2 / 3);
+    // Start with the usual product, then decide boundary cases against the
+    // public ratio contract. This corrects multiplication noise such as
+    // 0.8 * 35 without weakening the next representable value above 2/3.
+    let rounded = Math.ceil(fraction * seatCount);
+    while (rounded > 0 && (rounded - 1) / seatCount >= fraction)
+        rounded--;
+    while (rounded < seatCount && rounded / seatCount < fraction)
+        rounded++;
+    return { version: 1, fraction, seatCount, minimumSuccessful: Math.max(2, floor, rounded) };
+}
+/** Count only distinct, complete, durably accepted blocking seats. */
+export function hasSuccessfulQuorum(policy, successfulSeats) {
+    if (!Number.isSafeInteger(successfulSeats) || successfulSeats < 0 || successfulSeats > policy.seatCount) {
+        throw new Error('Successful seat count must be an integer within the frozen roster');
+    }
+    return policy.seatCount >= 2 && successfulSeats >= policy.minimumSuccessful;
+}
+//# sourceMappingURL=quorum.js.map

package/dist/dispatch/quorum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.js","sourceRoot":"","sources":["../../src/dispatch/quorum.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,QAAQ,GAAG,CAAC,GAAG,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC9C,OAAO,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,SAAS,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvE,OAAO,OAAO,GAAG,SAAS,IAAI,OAAO,GAAG,SAAS,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,eAAuB;IAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,eAAe,IAAI,MAAM,CAAC,iBAAiB,CAAC;AAC9E,CAAC"}

package/dist/dispatch/recovery-operation.d.ts

@@ -0,0 +1,44 @@
+export interface RecoveryOperationInput {
+    operationId: string;
+    successorRunId: string;
+    sourceRunId: string;
+    sourceReportSha256: string;
+    sourceCheckpointSha256: string;
+    capturedInputsSha256: string;
+    planDigest: string;
+    target: string;
+    originalNativeClaim: {
+        attempt: number;
+        round: number;
+    };
+    /** The separately claimed native attempt that owns this successor. */
+    successorNativeClaim?: {
+        attempt: number;
+        round: number;
+    };
+    startedAtMs: number;
+    expiresAtMs: number;
+    maxAdditionalCalls: number;
+    maxAttemptsPerCell: number;
+}
+export interface RecoveryOperation extends RecoveryOperationInput {
+    version: 1;
+}
+export interface RecoveryRuntimeBounds {
+    maxAdditionalCalls?: number;
+    maxAttemptsPerCell?: number;
+    expiresAtMs?: number;
+}
+export interface RecoveryBudget {
+    remainingMs: number;
+    maxAdditionalCalls: number;
+    maxAttemptsPerCell: number;
+    expiresAtMs: number;
+}
+/** Creates a local immutable descriptor; it does not verify any referenced authority or producer. */
+export declare function createRecoveryOperation(input: RecoveryOperationInput): RecoveryOperation;
+/** Canonical JSON is the persisted descriptor format. */
+export declare function encodeRecoveryOperation(operation: RecoveryOperation): string;
+export declare function decodeRecoveryOperation(encoded: string): RecoveryOperation;
+/** Derives resume bounds from the persisted absolute deadline; it cannot renew the operation. */
+export declare function remainingRecoveryBudget(operation: RecoveryOperation, nowMs: number, runtime?: RecoveryRuntimeBounds): RecoveryBudget;

package/dist/dispatch/recovery-operation.js

@@ -0,0 +1,146 @@
+import { MAX_TIMER_DELAY_MS } from '../config/schema.js';
+import { stableStringify } from '../report/run-header.js';
+import { UUID } from '../telemetry/recovery/source.js';
+const VERSION = 1;
+// Descriptor caps are deliberately finite, independent of provider/native policy.
+const MAX_LIMIT = 1_000_000;
+const SHA256 = /^[a-f0-9]{64}$/;
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            deepFreeze(child);
+    }
+    return value;
+}
+function exactKeys(value, expected, unknownError) {
+    const keys = Object.keys(value);
+    if (keys.length !== expected.length || keys.some(key => !expected.includes(key)))
+        throw new Error(unknownError);
+}
+function safeInteger(value, error, minimum, maximum = Number.MAX_SAFE_INTEGER) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+        throw new Error(error);
+}
+function text(value, error) {
+    if (typeof value !== 'string' || value.length > 512 || !value.trim() || /[\0\r\n]/.test(value))
+        throw new Error(error);
+}
+function digest(value, error) { if (typeof value !== 'string' || !SHA256.test(value))
+    throw new Error(error); }
+function uuid(value, error) { if (typeof value !== 'string' || !UUID.test(value))
+    throw new Error(error); }
+function validate(input, requireVersion) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('recovery_operation_invalid_descriptor');
+    if (Object.hasOwn(input, 'successorNativeClaim') && input.successorNativeClaim === undefined) {
+        const { successorNativeClaim: _ignored, ...normalized } = input;
+        return validate(normalized, requireVersion);
+    }
+    const fields = ['operationId', 'successorRunId', 'sourceRunId', 'sourceReportSha256', 'sourceCheckpointSha256', 'capturedInputsSha256', 'planDigest', 'target', 'originalNativeClaim', 'startedAtMs', 'expiresAtMs', 'maxAdditionalCalls', 'maxAttemptsPerCell'];
+    if (input.successorNativeClaim !== undefined)
+        fields.push('successorNativeClaim');
+    exactKeys(input, requireVersion ? ['version', ...fields] : fields, 'recovery_operation_unknown_field');
+    if (requireVersion && input.version !== VERSION)
+        throw new Error('recovery_operation_invalid_version');
+    uuid(input.operationId, 'recovery_operation_invalid_operation_id');
+    uuid(input.successorRunId, 'recovery_operation_invalid_successor_run_id');
+    uuid(input.sourceRunId, 'recovery_operation_invalid_source_run_id');
+    if (input.sourceRunId.toLowerCase() === input.successorRunId.toLowerCase())
+        throw new Error('recovery_operation_source_successor_reused');
+    digest(input.sourceReportSha256, 'recovery_operation_invalid_source_report_sha256');
+    digest(input.sourceCheckpointSha256, 'recovery_operation_invalid_source_checkpoint_sha256');
+    digest(input.capturedInputsSha256, 'recovery_operation_invalid_captured_inputs_sha256');
+    digest(input.planDigest, 'recovery_operation_invalid_plan_digest');
+    text(input.target, 'recovery_operation_invalid_target');
+    const claim = input.originalNativeClaim;
+    if (!claim || typeof claim !== 'object' || Array.isArray(claim))
+        throw new Error('recovery_operation_invalid_native_claim');
+    exactKeys(claim, ['attempt', 'round'], 'recovery_operation_unknown_field');
+    safeInteger(claim.attempt, 'recovery_operation_invalid_native_attempt', 1, MAX_LIMIT);
+    safeInteger(claim.round, 'recovery_operation_invalid_native_round', 1, MAX_LIMIT);
+    const successor = input.successorNativeClaim;
+    if (successor !== undefined) {
+        if (!successor || typeof successor !== 'object' || Array.isArray(successor))
+            throw new Error('recovery_operation_invalid_successor_native_claim');
+        exactKeys(successor, ['attempt', 'round'], 'recovery_operation_invalid_successor_native_claim');
+        safeInteger(successor.attempt, 'recovery_operation_invalid_successor_native_attempt', 1, MAX_LIMIT);
+        safeInteger(successor.round, 'recovery_operation_invalid_successor_native_round', 1, MAX_LIMIT);
+        if (successor.attempt === claim.attempt && successor.round === claim.round)
+            throw new Error('recovery_operation_successor_native_claim_reused');
+    }
+    safeInteger(input.startedAtMs, 'recovery_operation_invalid_started_at', 0);
+    safeInteger(input.expiresAtMs, 'recovery_operation_invalid_deadline', 0);
+    if (input.expiresAtMs < input.startedAtMs || input.expiresAtMs - input.startedAtMs > MAX_TIMER_DELAY_MS)
+        throw new Error('recovery_operation_invalid_deadline');
+    safeInteger(input.maxAdditionalCalls, 'recovery_operation_invalid_max_additional_calls', 1, MAX_LIMIT);
+    safeInteger(input.maxAttemptsPerCell, 'recovery_operation_invalid_max_attempts_per_cell', 1, MAX_LIMIT);
+    return deepFreeze({
+        version: VERSION,
+        operationId: input.operationId,
+        successorRunId: input.successorRunId,
+        sourceRunId: input.sourceRunId,
+        sourceReportSha256: input.sourceReportSha256,
+        sourceCheckpointSha256: input.sourceCheckpointSha256,
+        capturedInputsSha256: input.capturedInputsSha256,
+        planDigest: input.planDigest,
+        target: input.target,
+        originalNativeClaim: { attempt: claim.attempt, round: claim.round },
+        ...(successor === undefined ? {} : { successorNativeClaim: { attempt: successor.attempt, round: successor.round } }),
+        startedAtMs: input.startedAtMs,
+        expiresAtMs: input.expiresAtMs,
+        maxAdditionalCalls: input.maxAdditionalCalls,
+        maxAttemptsPerCell: input.maxAttemptsPerCell,
+    });
+}
+/** Creates a local immutable descriptor; it does not verify any referenced authority or producer. */
+export function createRecoveryOperation(input) {
+    const operation = validate(input, false);
+    canonicalDescriptor(operation);
+    return operation;
+}
+function canonicalDescriptor(operation) {
+    const encoded = stableStringify(operation);
+    if (Buffer.byteLength(encoded, 'utf8') > 64 * 1024)
+        throw new Error('recovery_operation_too_large');
+    return encoded;
+}
+/** Canonical JSON is the persisted descriptor format. */
+export function encodeRecoveryOperation(operation) { return canonicalDescriptor(validate(operation, true)); }
+export function decodeRecoveryOperation(encoded) {
+    if (typeof encoded !== 'string' || Buffer.byteLength(encoded, 'utf8') > 64 * 1024)
+        throw new Error('recovery_operation_invalid_json');
+    let value;
+    try {
+        value = JSON.parse(encoded);
+    }
+    catch {
+        throw new Error('recovery_operation_invalid_json');
+    }
+    const operation = validate(value, true);
+    if (encoded !== canonicalDescriptor(operation))
+        throw new Error('recovery_operation_noncanonical_json');
+    return operation;
+}
+/** Derives resume bounds from the persisted absolute deadline; it cannot renew the operation. */
+export function remainingRecoveryBudget(operation, nowMs, runtime = {}) {
+    const saved = validate(operation, true);
+    if (!runtime || typeof runtime !== 'object' || Array.isArray(runtime))
+        throw new Error('recovery_operation_invalid_runtime_bounds');
+    exactKeys(runtime, ['maxAdditionalCalls', 'maxAttemptsPerCell', 'expiresAtMs'].filter(key => Object.hasOwn(runtime, key)), 'recovery_operation_unknown_runtime_field');
+    safeInteger(nowMs, 'recovery_operation_invalid_now', 0);
+    if (nowMs < saved.startedAtMs)
+        throw new Error('recovery_operation_clock_before_start');
+    const maxAdditionalCalls = runtime.maxAdditionalCalls === undefined ? saved.maxAdditionalCalls : runtime.maxAdditionalCalls;
+    const maxAttemptsPerCell = runtime.maxAttemptsPerCell === undefined ? saved.maxAttemptsPerCell : runtime.maxAttemptsPerCell;
+    const expiresAtMs = runtime.expiresAtMs === undefined ? saved.expiresAtMs : runtime.expiresAtMs;
+    safeInteger(maxAdditionalCalls, 'recovery_operation_invalid_runtime_cap', 0, MAX_LIMIT);
+    safeInteger(maxAttemptsPerCell, 'recovery_operation_invalid_runtime_cap', 1, MAX_LIMIT);
+    safeInteger(expiresAtMs, 'recovery_operation_invalid_runtime_deadline', saved.startedAtMs);
+    if (maxAdditionalCalls > saved.maxAdditionalCalls || maxAttemptsPerCell > saved.maxAttemptsPerCell)
+        throw new Error('recovery_operation_runtime_cap_raise');
+    if (expiresAtMs > saved.expiresAtMs)
+        throw new Error('recovery_operation_runtime_deadline_extend');
+    return { remainingMs: Math.max(0, expiresAtMs - nowMs), maxAdditionalCalls, maxAttemptsPerCell, expiresAtMs };
+}
+//# sourceMappingURL=recovery-operation.js.map

package/dist/dispatch/recovery-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-operation.js","sourceRoot":"","sources":["../../src/dispatch/recovery-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAEvD,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,kFAAkF;AAClF,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAiChC,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAe,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,YAAoB;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;AAClH,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa,EAAE,OAAe,EAAE,OAAO,GAAG,MAAM,CAAC,gBAAgB;IACpG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO,IAAI,KAAK,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AAC9H,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AACzH,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzJ,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa,IAA6B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAErJ,SAAS,QAAQ,CAAC,KAAiD,EAAE,cAAuB;IAC1F,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC7F,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC;QAChE,OAAO,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACjQ,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAClF,SAAS,CAAC,KAA2C,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAC7I,IAAI,cAAc,IAAK,KAA2B,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC9H,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,6CAA6C,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC1I,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,qDAAqD,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,mDAAmD,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,wCAAwC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5H,SAAS,CAAC,KAAgC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACtG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,2CAA2C,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACtF,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,yCAAyC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClJ,SAAS,CAAC,SAAoC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,mDAAmD,CAAC,CAAC;QAC3H,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,qDAAqD,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QACpG,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,mDAAmD,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAChG,IAAI,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClJ,CAAC;IACD,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;IAC3E,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,GAAG,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChK,WAAW,CAAC,KAAK,CAAC,kBAAkB,EAAE,iDAAiD,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACvG,WAAW,CAAC,KAAK,CAAC,kBAAkB,EAAE,kDAAkD,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACxG,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QACnE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QACpH,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA4B;IACvD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,uBAAuB,CAAC,SAA4B,IAAY,OAAO,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAExI,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtI,IAAI,KAAc,CAAC;IAAC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IACtH,MAAM,SAAS,GAAG,QAAQ,CAAC,KAA0B,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,mBAAmB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,SAA4B,EAAE,KAAa,EAAE,UAAiC,EAAE;IACtH,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpI,SAAS,CAAC,OAA6C,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAC;IAC7M,WAAW,CAAC,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,GAAG,KAAK,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxF,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5H,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5H,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAChG,WAAW,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,WAAW,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,WAAW,CAAC,WAAW,EAAE,6CAA6C,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3F,IAAI,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,kBAAkB,GAAG,KAAK,CAAC,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5J,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACnG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAChH,CAAC"}

package/dist/dispatch/recovery-policy.d.ts

@@ -0,0 +1,54 @@
+import type { ModelReview } from '../consensus/types.js';
+import type { CheckpointCell } from './checkpoint.js';
+import { type QuorumPolicy } from './quorum.js';
+export type RecoveryCell = Pick<CheckpointCell, 'id' | 'seat' | 'model' | 'role' | 'route'> & {
+    lane?: 'blocking' | 'secondary';
+};
+/** An owned, durably recorded call intent; no outcome means possibly billed. */
+export interface RecoveryAttempt {
+    id: string;
+    cell: string;
+    outcome?: ModelReview;
+}
+/** Persisted spend and the remaining monotonic deadline, never renewed by preview. */
+export interface RecoveryLimits {
+    maxAttemptsPerCell: number;
+    maxAdditionalCalls: number;
+    additionalCallsUsed: number;
+    remainingMs: number;
+}
+export type RecoveryReason = 'retained_success' | 'unstarted' | 'transient_failure' | 'parse_failure' | 'canceled' | 'permanent_failure' | 'unclassified_failure' | 'uncertain_outcome' | 'attempt_limit' | 'setup_failure';
+export interface RecoveryPreview {
+    policy: QuorumPolicy;
+    successfulSeats: number;
+    successesNeeded: number;
+    potentialSuccessfulSeats: number;
+    retainedCallIndices: number[];
+    /** Original matrix indices ordered by the fewest missing chunks per seat. */
+    eligibleCallIndices: number[];
+    blockedCells: Array<{
+        cell: string;
+        reason: RecoveryReason;
+    }>;
+    recordedAttempts: number;
+    additionalCallsUsed: number;
+    remainingCalls: number;
+    nextAction: 'build_report' | 'retry_missing_assignments' | 'inspect_blocked_assignments' | 'call_limit' | 'time_limit';
+}
+/**
+ * Conservative eligibility for a terminal unsuccessful call. Unknown adapter
+ * errors require a diagnosis; repeated unchanged authentication, quota or input
+ * failures never spend another call automatically. This does not authorize a
+ * launch or change a native attempt cap.
+ */
+export declare function classifyMissingReview(review?: ModelReview): {
+    eligible: boolean;
+    reason: RecoveryReason;
+};
+/**
+ * Plan missing calls from a validated, frozen checkpoint. This pure read leaves
+ * all original outcomes intact. The executor must recheck limits and persist an
+ * intent under target ownership before EVERY provider call; the eligible list
+ * is not a reservation and does not bypass the guarded launch budget.
+ */
+export declare function previewReviewerRecovery(cells: readonly RecoveryCell[], attempts: readonly RecoveryAttempt[], policy: QuorumPolicy, limits: RecoveryLimits, unavailableCells?: readonly string[], includeSecondary?: boolean): RecoveryPreview;

package/dist/dispatch/recovery-policy.js

@@ -0,0 +1,157 @@
+import { hasSuccessfulQuorum, resolveQuorumPolicy } from './quorum.js';
+/**
+ * Conservative eligibility for a terminal unsuccessful call. Unknown adapter
+ * errors require a diagnosis; repeated unchanged authentication, quota or input
+ * failures never spend another call automatically. This does not authorize a
+ * launch or change a native attempt cap.
+ */
+export function classifyMissingReview(review) {
+    if (!review)
+        return { eligible: true, reason: 'unstarted' };
+    if (review.status === 'success')
+        return { eligible: false, reason: 'retained_success' };
+    const error = review.error ?? '';
+    if (review.status === 'parse_failed')
+        return { eligible: true, reason: 'parse_failure' };
+    if (review.status === 'canceled')
+        return { eligible: true, reason: 'canceled' };
+    if (review.status === 'timeout')
+        return { eligible: true, reason: 'transient_failure' };
+    if (/\b(?:http(?: status)?|status|code)[ _:=.-]*(?:400|401|403|404|413)\b|invalid[ _-]?(?:api[ _-]?)?key|api[ _-]?key.*(?:missing|not set)|authentication|unauthori[sz]ed|forbidden|insufficient[_ -]quota|quota.*(?:exceed|exhaust)|(?:exceed|exhaust).*quota|billing[_ -]hard[_ -]limit|credits?.*(?:exhaust|insufficient)|(?:unknown|unsupported|not found).*model|model.*(?:not found|unsupported)|context.{0,20}(?:length|window)|prompt too (?:long|large)|invalid request/i.test(error)) {
+        return { eligible: false, reason: 'permanent_failure' };
+    }
+    if (/\b(?:429|5\d\d)\b|rate.?limit|temporar|overload|timed? ?out|timeout|retry(?:ing)?\s+after|ECONNRESET|ECONNREFUSED|ETIMEDOUT|connection|network|socket|fetch failed/i.test(error)) {
+        return { eligible: true, reason: 'transient_failure' };
+    }
+    return { eligible: false, reason: 'unclassified_failure' };
+}
+/**
+ * Plan missing calls from a validated, frozen checkpoint. This pure read leaves
+ * all original outcomes intact. The executor must recheck limits and persist an
+ * intent under target ownership before EVERY provider call; the eligible list
+ * is not a reservation and does not bypass the guarded launch budget.
+ */
+export function previewReviewerRecovery(cells, attempts, policy, limits, unavailableCells = [], includeSecondary = false) {
+    if (![limits.maxAttemptsPerCell, limits.maxAdditionalCalls, limits.additionalCallsUsed]
+        .every(value => Number.isSafeInteger(value) && value >= 0) || limits.maxAttemptsPerCell < 1 ||
+        !Number.isFinite(limits.remainingMs))
+        throw new Error('recovery_invalid_limits');
+    const byId = new Map();
+    const seats = new Map();
+    for (const [index, cell] of cells.entries()) {
+        if (cell.lane !== undefined && cell.lane !== 'blocking' && cell.lane !== 'secondary')
+            throw new Error('recovery_invalid_lane');
+        if (!cell.id || !cell.seat || byId.has(cell.id))
+            throw new Error('recovery_invalid_matrix');
+        byId.set(cell.id, { cell, index, attempts: [] });
+        const indices = seats.get(cell.seat) ?? [];
+        const first = indices.length ? cells[indices[0]] : undefined;
+        if (first && (first.model !== cell.model || first.route !== cell.route || first.role !== cell.role || (first.lane ?? 'blocking') !== (cell.lane ?? 'blocking'))) {
+            throw new Error('recovery_invalid_matrix');
+        }
+        indices.push(index);
+        seats.set(cell.seat, indices);
+    }
+    const blockingSeats = [...seats.values()].filter(indices => cells[indices[0]].lane !== 'secondary');
+    if (blockingSeats.length !== policy.seatCount)
+        throw new Error('recovery_roster_mismatch');
+    const resolved = resolveQuorumPolicy(blockingSeats.length, policy.fraction);
+    if (policy.version !== resolved.version || policy.minimumSuccessful !== resolved.minimumSuccessful) {
+        throw new Error('recovery_policy_mismatch');
+    }
+    const seenAttempts = new Set();
+    for (const attempt of attempts) {
+        if (!attempt.id || seenAttempts.has(attempt.id))
+            throw new Error('recovery_duplicate_attempt');
+        seenAttempts.add(attempt.id);
+        const entry = byId.get(attempt.cell);
+        if (!entry)
+            throw new Error('recovery_unknown_cell');
+        if (entry.attempts.some(previous => previous.outcome?.status === 'success'))
+            throw new Error('recovery_successful_cell_retried');
+        if (entry.attempts.some(previous => previous.outcome === undefined))
+            throw new Error('recovery_uncertain_cell_retried');
+        if (attempt.outcome) {
+            const { outcome } = attempt;
+            if (outcome.model !== entry.cell.model || outcome.role !== entry.cell.role || outcome.provider !== entry.cell.route) {
+                throw new Error('recovery_result_identity');
+            }
+            if (outcome.async === true)
+                throw new Error('recovery_async_result');
+            if (!['success', 'error', 'timeout', 'parse_failed', 'canceled'].includes(outcome.status)) {
+                throw new Error('recovery_invalid_outcome');
+            }
+        }
+        entry.attempts.push(attempt);
+    }
+    const retainedCallIndices = [];
+    const eligible = new Set();
+    const blockedCells = [];
+    const unavailable = new Set(unavailableCells);
+    if (unavailable.size !== unavailableCells.length || unavailableCells.some(cell => !byId.has(cell))) {
+        throw new Error('recovery_invalid_unavailable_cells');
+    }
+    for (const entry of byId.values()) {
+        const last = entry.attempts.at(-1);
+        if (last?.outcome?.status === 'success') {
+            retainedCallIndices.push(entry.index);
+            continue;
+        }
+        let decision;
+        if (unavailable.has(entry.cell.id))
+            decision = { eligible: false, reason: 'setup_failure' };
+        else if (last && !last.outcome)
+            decision = { eligible: false, reason: 'uncertain_outcome' };
+        else if (entry.attempts.length >= limits.maxAttemptsPerCell)
+            decision = { eligible: false, reason: 'attempt_limit' };
+        else
+            decision = classifyMissingReview(last?.outcome);
+        if (decision.eligible)
+            eligible.add(entry.index);
+        else
+            blockedCells.push({ cell: entry.cell.id, reason: decision.reason });
+    }
+    const retained = new Set(retainedCallIndices);
+    let successfulSeats = 0;
+    const recoverable = [];
+    for (const indices of blockingSeats) {
+        const missing = indices.filter(index => !retained.has(index));
+        if (!missing.length)
+            successfulSeats++;
+        else if (missing.every(index => eligible.has(index)))
+            recoverable.push(missing);
+    }
+    recoverable.sort((left, right) => left.length - right.length || left[0] - right[0]);
+    const remainingCalls = Math.max(0, limits.maxAdditionalCalls - limits.additionalCallsUsed);
+    const successesNeeded = Math.max(0, resolved.minimumSuccessful - successfulSeats);
+    const budgetReachable = [];
+    let reachableCallCost = 0;
+    for (const missing of recoverable) {
+        if (budgetReachable.length >= successesNeeded)
+            break;
+        if (reachableCallCost + missing.length > remainingCalls)
+            break;
+        budgetReachable.push(missing);
+        reachableCallCost += missing.length;
+    }
+    const potentialSuccessfulSeats = successfulSeats + budgetReachable.length;
+    const recoverableSuccessfulSeats = successfulSeats + recoverable.length;
+    const conclusive = hasSuccessfulQuorum(resolved, successfulSeats);
+    const nextAction = conclusive ? 'build_report'
+        : limits.remainingMs <= 0 ? 'time_limit'
+            : remainingCalls === 0 ? 'call_limit'
+                : potentialSuccessfulSeats < resolved.minimumSuccessful &&
+                    recoverableSuccessfulSeats >= resolved.minimumSuccessful ? 'call_limit'
+                    : potentialSuccessfulSeats < resolved.minimumSuccessful ? 'inspect_blocked_assignments'
+                        : 'retry_missing_assignments';
+    return {
+        policy: resolved, successfulSeats, successesNeeded,
+        potentialSuccessfulSeats, retainedCallIndices,
+        eligibleCallIndices: nextAction === 'retry_missing_assignments' ? [...budgetReachable.flat(),
+            ...(includeSecondary ? [...eligible].filter(index => cells[index].lane === 'secondary')
+                .slice(0, Math.max(0, remainingCalls - reachableCallCost)) : [])] : [],
+        blockedCells, recordedAttempts: attempts.length, additionalCallsUsed: limits.additionalCallsUsed,
+        remainingCalls, nextAction,
+    };
+}
+//# sourceMappingURL=recovery-policy.js.map