@amaster.ai/employee-runtime-connector 0.1.1-beta.39 → 0.1.1-beta.40

package/dist/amaster-runtime-daemon.mjs

@@ -2,7 +2,7 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { chmodSync as chmodSync4, copyFileSync as copyFileSync2, existsSync as existsSync11, lstatSync as lstatSync5, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync9, readdirSync as readdirSync8, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync5, statSync as statSync8, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
 import { basename as basename6, delimiter as delimiter3, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute6, join as join12, relative as relative6, resolve as resolve9 } from "node:path";
@@ -4436,6 +4436,9 @@ function retainedSourceExecutorEntry(entry, executorKind) {
   };
 }
 
+// src/amaster-runtime-daemon/prompt-compiler.mjs
+import { createHash as createHash5 } from "node:crypto";
+
 // src/amaster-runtime-daemon/current-run-contract.mjs
 import { createHash as createHash4 } from "node:crypto";
 var CONTRACT_VERSION = "mirrorx.current-run-contract.v1";
@@ -4699,6 +4702,9 @@ function formalTaskAcceptanceContractRequired(context) {
 function sameCanonicalJson(left, right) {
   return JSON.stringify(canonicalJsonValue(left)) === JSON.stringify(canonicalJsonValue(right));
 }
+function canonicalSha256(value) {
+  return `sha256:${createHash5("sha256").update(JSON.stringify(canonicalJsonValue(value))).digest("hex")}`;
+}
 function taskAcceptanceContractSection(context, input) {
   const required = formalTaskAcceptanceContractRequired(context);
   const contract = asRecord(context.taskAcceptanceContract);
@@ -4720,36 +4726,49 @@ function taskAcceptanceContractSection(context, input) {
     );
   }
   const enrollment = asRecord(contract.enrollment);
+  const authority = asRecord(contract.authority);
+  const requirements = asRecord(asRecord(context.paperclipIssue).taskRequirements);
+  const requirementIntent = asRecord(requirements.taskIntent);
+  const requirementOutcome = asRecord(requirements.businessOutcome);
+  const requirementCompletion = asRecord(requirements.completion);
   const delivery = asRecord(contract.delivery);
   const acceptance = asRecord(contract.acceptance);
   const criteria = Array.isArray(contract.acceptance_criteria) ? contract.acceptance_criteria.map(asRecord) : [];
   const allowedKinds = Array.isArray(delivery.allowed_kinds) ? delivery.allowed_kinds.map(readString).filter(Boolean) : [];
   const acceptanceContracts = Array.isArray(delivery.acceptance_contracts) ? delivery.acceptance_contracts : [];
-  const requirementRevision = readString(enrollment.requirement_revision);
+  const schemaVersion = readString(contract.schema_version);
+  const enrollmentRequirementRevision = readString(enrollment.requirement_revision);
+  const parentRequirementRevision = readString(authority.requirement_revision);
+  const requirementRevision = enrollmentRequirementRevision || parentRequirementRevision;
   const sourceRef = readString(contract.source_ref);
   const validCriteria = criteria.length > 0 && criteria.every((criterion) => readString(criterion.ref) && readString(criterion.text));
-  const validIdentity = readString(contract.schema_version) === "mirrorx.task-acceptance-contract.v1" && readString(contract.company_id) && readString(contract.issue_id) && Number.isInteger(contract.execution_epoch) && readString(contract.observed_at) && readString(enrollment.id) && Number.isInteger(enrollment.revision) && requirementRevision && readString(enrollment.request_hash) && sourceRef === `business_task_enrollment:${readString(enrollment.id)}@${requirementRevision}`;
+  const validEnrollmentIdentity = schemaVersion === "mirrorx.task-acceptance-contract.v1" && readString(enrollment.id) && Number.isInteger(enrollment.revision) && enrollmentRequirementRevision && readString(enrollment.request_hash) && sourceRef === `business_task_enrollment:${readString(enrollment.id)}@${enrollmentRequirementRevision}`;
+  const validParentGovernedChildIdentity = schemaVersion === "mirrorx.task-acceptance-contract.v2" && Object.keys(enrollment).length === 0 && readString(authority.kind) === "parent_governed_child" && parentRequirementRevision && readString(authority.requirements_hash) === canonicalSha256(requirements) && ["required_execution", "final_aggregation"].includes(readString(authority.completion_role)) && ["none", "package", "own_deliverable"].includes(readString(authority.review_authority)) && sourceRef === `parent_governed_child:${readString(contract.issue_id)}@${parentRequirementRevision}`;
+  const validIdentity = readString(contract.company_id) && readString(contract.issue_id) && Number.isInteger(contract.execution_epoch) && readString(contract.observed_at) && requirementRevision && Boolean(validEnrollmentIdentity || validParentGovernedChildIdentity);
   const validDelivery = allowedKinds.length > 0 && new Set(allowedKinds).size === allowedKinds.length && (delivery.contract_state === "explicit_typed" || delivery.contract_state === "acceptance_refs_only") && (delivery.contract_state !== "explicit_typed" || acceptanceContracts.length > 0);
-  const validAcceptance = readString(acceptance.owner_agent_id) && Object.keys(asRecord(acceptance.policy)).length > 0 && readString(acceptance.expected_outcome_at);
+  const validOwnedAcceptance = readString(acceptance.owner_agent_id) && Object.keys(asRecord(acceptance.policy)).length > 0 && readString(acceptance.expected_outcome_at);
+  const validParentDelegatedAcceptance = validParentGovernedChildIdentity && readString(requirementIntent.reason) === "parent_governed_child" && ["required_execution", "final_aggregation"].includes(readString(requirementCompletion.role)) && readString(requirementOutcome.mode) === "none" && readString(acceptance.delegated_to) === "parent" && acceptance.owner_agent_id === null && acceptance.policy === null && acceptance.expected_outcome_at === null;
+  const validAcceptance = validOwnedAcceptance || validParentDelegatedAcceptance;
   if (!validIdentity || !validCriteria || !validDelivery || !validAcceptance) {
     throw taskAcceptanceContractError(
       "task_acceptance_contract_invalid",
       "Task Acceptance Contract is incomplete or internally inconsistent"
     );
   }
-  const requirements = asRecord(asRecord(context.paperclipIssue).taskRequirements);
   if (required) {
     const requirementDelivery = asRecord(requirements.delivery);
-    const requirementOutcome = asRecord(requirements.businessOutcome);
     const criterionRefs = criteria.map((criterion) => readString(criterion.ref));
     const requirementAcceptanceRefs = Array.isArray(requirementDelivery.acceptanceRefs) ? requirementDelivery.acceptanceRefs.map(readString).filter(Boolean) : [];
     const requirementAllowedKinds = Array.isArray(requirementDelivery.allowedKinds) ? requirementDelivery.allowedKinds.map(readString).filter(Boolean) : [];
     const requirementContracts = Array.isArray(requirementDelivery.acceptanceContracts) ? requirementDelivery.acceptanceContracts : [];
+    const requirementCriteria = Array.isArray(requirementDelivery.acceptanceCriteria) ? requirementDelivery.acceptanceCriteria : [];
     const revisionsMatch = [
       asRecord(requirementDelivery.source),
-      asRecord(requirementOutcome.source)
+      asRecord(requirementOutcome.source),
+      ...validParentGovernedChildIdentity ? [asRecord(requirementIntent.source), asRecord(requirementCompletion.source)] : []
     ].every((source) => readString(source.revision) === requirementRevision);
-    if (!revisionsMatch || !sameCanonicalJson(criterionRefs, requirementAcceptanceRefs) || !sameCanonicalJson(allowedKinds, requirementAllowedKinds) || !sameCanonicalJson(acceptanceContracts, requirementContracts) || readString(requirementOutcome.acceptanceOwnerAgentId) !== readString(acceptance.owner_agent_id) || readString(requirementOutcome.expectedOutcomeAt) !== readString(acceptance.expected_outcome_at) || !sameCanonicalJson(requirementOutcome.acceptancePolicy, acceptance.policy)) {
+    const parentAuthorityMatches = !validParentGovernedChildIdentity || readString(authority.completion_role) === readString(requirementCompletion.role) && readString(authority.review_authority) === readString(requirementCompletion.reviewAuthority);
+    if (!revisionsMatch || !parentAuthorityMatches || !sameCanonicalJson(criterionRefs, requirementAcceptanceRefs) || validParentGovernedChildIdentity && !sameCanonicalJson(criteria, requirementCriteria) || !sameCanonicalJson(allowedKinds, requirementAllowedKinds) || !sameCanonicalJson(acceptanceContracts, requirementContracts) || !validParentDelegatedAcceptance && (readString(requirementOutcome.acceptanceOwnerAgentId) !== readString(acceptance.owner_agent_id) || readString(requirementOutcome.expectedOutcomeAt) !== readString(acceptance.expected_outcome_at) || !sameCanonicalJson(requirementOutcome.acceptancePolicy, acceptance.policy))) {
       throw taskAcceptanceContractError(
         "task_acceptance_contract_invalid",
         "Task Acceptance Contract does not match the active Task requirement projection"
@@ -4766,7 +4785,7 @@ function taskAcceptanceContractSection(context, input) {
     sourceRef,
     observedAt: readString(contract.observed_at),
     freshness: {
-      kind: "immutable_enrollment",
+      kind: validParentGovernedChildIdentity ? "parent_governed_child_requirements" : "immutable_enrollment",
       requirementRevision,
       executionEpoch: contract.execution_epoch
     },
@@ -6082,7 +6101,7 @@ function agentInstructionDeliveryAudit(bundle, delivery) {
 }
 
 // src/amaster-runtime-daemon/agent-instruction-system-kernel-shadow.mjs
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var SHADOW_VERSION = 2;
 var TARGET_CHARS = 16e3;
 var FULL_HANDBOOK_PATH = ".amaster/instructions/AGENTS.full.md";
@@ -6101,7 +6120,7 @@ var ROLE_KERNEL_SECTIONS = /* @__PURE__ */ new Set([
   "When you finish"
 ]);
 function sha256(value) {
-  return createHash5("sha256").update(value, "utf8").digest("hex");
+  return createHash6("sha256").update(value, "utf8").digest("hex");
 }
 function normalizedText(value) {
   return typeof value === "string" ? value.trim() : "";
@@ -8293,7 +8312,7 @@ var postJsonWithRetry = postRuntimeConnectorJsonWithRetry;
 var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync as lstatSync4, openSync, readFileSync as readFileSync6, realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve4 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -8383,7 +8402,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
       `Runtime Artifact ${intentId}`,
       { expectedByteSize }
     );
-    const actualSha256 = createHash6("sha256").update(body).digest("hex");
+    const actualSha256 = createHash7("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Artifact ${intentId} bytes do not match the governed ownership manifest`);
     }
@@ -8400,7 +8419,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
 }
 
 // src/amaster-runtime-daemon/runtime-document-upload.mjs
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 
 // src/amaster-runtime-daemon/workspace-sensitive-path.mjs
 var SENSITIVE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
@@ -8475,7 +8494,7 @@ function prepareRuntimeDocumentUploads(cwd, mcpToolResults) {
         maxByteSize: MAX_WORKSPACE_DOCUMENT_BYTES
       }
     );
-    const actualSha256 = createHash7("sha256").update(body).digest("hex");
+    const actualSha256 = createHash8("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Document ${callId} bytes do not match the governed ownership manifest`);
     }
@@ -8601,7 +8620,7 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 }
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync6, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { basename as basename4, join as join8, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "node:path";
 
@@ -8727,7 +8746,7 @@ function resolveWorkspaceCwd(config, command) {
   return cwd;
 }
 function shortHash(value, length = 12) {
-  return createHash8("sha256").update(String(value)).digest("hex").slice(0, length);
+  return createHash9("sha256").update(String(value)).digest("hex").slice(0, length);
 }
 function safeSegment(value, fallback) {
   const raw = String(value ?? "").trim();
@@ -9172,7 +9191,7 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
 
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync7 } from "node:fs";
 import { basename as basename5, extname, isAbsolute as isAbsolute5, join as join11, relative as relative5, resolve as resolve8 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
@@ -9243,7 +9262,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File(filePath) {
-  return createHash9("sha256").update(readFileSync8(filePath)).digest("hex");
+  return createHash10("sha256").update(readFileSync8(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -9603,7 +9622,7 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 }
 
 // src/amaster-runtime-daemon/source-acquisition-invocation.mjs
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 var SOURCE_ACQUISITION_PUBLIC_TOOLS = Object.freeze([
   "source_open",
   "source_snapshot",
@@ -9640,7 +9659,7 @@ function serializeSourceAcquisitionProfile(profile) {
   const input = Buffer.from(JSON.stringify(profile), "utf8");
   return {
     input,
-    sha256: createHash10("sha256").update(input).digest("hex")
+    sha256: createHash11("sha256").update(input).digest("hex")
   };
 }
 function sourceAcquisitionManagedInputs(options) {
@@ -9689,7 +9708,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.39";
+var CONNECTOR_VERSION = "0.1.1-beta.40";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var SOURCE_ACQUISITION_PROFILE_VERSION = source_acquisition_compatibility_default.profileVersion;
@@ -10911,7 +10930,7 @@ function sourceAcquisitionRuntimeProfile(config, command) {
   if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "")) {
     throw new Error("source_acquisition_profile_invalid");
   }
-  const profileName = createHash11("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
+  const profileName = createHash12("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
   const stateRoot = resolve9(config.browserSessionStateRoot);
   const userDataDir = resolve9(stateRoot, profileName);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
@@ -13759,7 +13778,7 @@ async function materializeIssueAttachments(config, command, workspace) {
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
     writeFileSync7(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash11("sha256").update(body).digest("hex");
+    const actualSha256 = createHash12("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -13851,7 +13870,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash11("sha256").update(body).digest("hex");
+    const actualSha256 = createHash12("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha2562) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha2562} actualSha256=${actualSha256}`
@@ -13921,7 +13940,7 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash11("sha256").update(readFileSync9(filePath)).digest("hex");
+  return createHash12("sha256").update(readFileSync9(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.39";
+const CONNECTOR_VERSION = "0.1.1-beta.40";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.39",
+  "version": "0.1.1-beta.40",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",