@awebai/oats 0.23.1 → 0.24.0

package/capabilities/oats-okf/bin/oats-okf.mjs

@@ -2,10 +2,12 @@
 import { randomUUID } from 'node:crypto';
 import { fs, join, dirname, resolve, readJSON, save, safePath, cliPath, oats, fail, unlock } from '../lib/io.mjs';
 import { loadBindings, declaration, splitRef } from '../lib/config.mjs';
-import { register, homeSource, loadSource, loadStatus, saveStatus, updateStatus, capture, scheduleSource, service, markerPath, views } from '../lib/sources.mjs';
-import { runSource, complete, retry, readRun } from '../lib/worker.mjs';
+import { register, registerCaptured, loadInvocationSourceReceipt, homeSource, loadSource, loadStatus, saveStatus, updateStatus, capture, scheduleSource, service, markerPath, views } from '../lib/sources.mjs';
+import { runSource, complete, retry, readRun, requireQualifiedHelper } from '../lib/worker.mjs';
 import { initBase, migrate, deliverMigration, cutoverMigration, migrateSource } from '../lib/migration.mjs';
 import { inspect } from '../lib/inspection.mjs';
+import { loadInvocationKnowledgeBinding } from '../lib/binding-wire.mjs';
+import { loadCapturedOkfInvocation, loadOkfSourceReceiptInput, assertOkfInvocationAction, requireOkfAdmittedAction, assertOkfSourceContext, assertOkfRegisteredSourceReplay } from '../lib/invocation-context.mjs';
 const HELP=`oats okf inspect [--home PATH | --source FILE] [--json]
 oats okf harvest [--home PATH] [--no-launch] [--json]
 oats okf run-source --source FILE [--manual] [--no-launch] [--json]
@@ -19,6 +21,10 @@ oats okf migrate --legacy PATH --base ALIAS --node NODE --output PATH [--json]
 oats okf migrate --deliver FILE | --cutover FILE --soul-dir PATH [--json]
 oats okf migrate --source-home PATH [--json]
 oats okf unlock --lock PATH --token TOKEN [--json]
+Captured workers use oats operation run knowledge:harvest with SOURCE --deployment/--resolution/--home,
+--arg native-request=ABS_BACKEND_ONLY_JSON and optional --arg worker-mode=prepare|launch.
+Raw captured harvest/run-source/scheduler/rejudge remain held; completed runs use SOURCE complete/retry.
+Unknown scaffold/native outcomes are retained, never automatically re-scaffolded or redispatched.
 Explicit retry --run ID requires --rejudge; add --launch only for operator-approved launch.
 Closed-PR recovery uses retained evidence and a fresh run; complete its returned ID.
 Settled destinations and old proposals/receipts are preserved; another active run blocks recovery.
@@ -40,7 +46,7 @@ else {
     }
     const accepted={
       spawn:[],retire:['home'], 'soul-scaffold':[],
-      harvest:['home','no-launch'],inspect:['home','source'],
+      harvest:['home','no-launch','native-request','worker-mode'],inspect:['home','source'],
       'run-source':['source','manual','no-launch'],complete:['source','run','judgment'],
       retry:['source','run','rejudge','launch','adopt-home'],read:['home','source','base','path'],refresh:['home','source'],
       setup:['source','enable','disable','install-host'],init:['base','nodes','output','confirm'],
@@ -48,21 +54,75 @@ else {
     };
     for(const k of Object.keys(flags)) if(!['json','soul',...(accepted[event] || [])].includes(k)) fail('E_USAGE',`unknown flag --${k} for ${event}`);
     if(flags.source && flags.home) fail('E_USAGE','choose source descriptor OR home');
-    const home=resolve(flags.home || process.env.OATS_INSTANCE_HOME || process.env.OATS_HOME || process.cwd());
-    const src=()=>flags.source?loadSource(resolve(flags.source)):homeSource(home);
+    const execution=Object.hasOwn(process.env,'OATS_INVOCATION_CONTEXT_FILE')?loadCapturedOkfInvocation():null;
+    const invocation=execution?{kind:'captured',binding:execution.binding}:loadInvocationKnowledgeBinding(),captured=invocation.kind==='captured';
+    if(execution) assertOkfInvocationAction(execution.context,event,readJSON(new URL('../oats.json',import.meta.url)));
+    // Only an actual admitted, instance-scoped kernel operation can create a
+    // captured worker. Raw commands/null intents and legacy ingress stay closed.
+    const capturedHarvest=captured && execution?.context.action.kind==='operation' && execution.context.action.slot==='knowledge' && execution.context.action.name==='harvest';
+    if(captured && event==='harvest') {
+      if(!capturedHarvest)requireQualifiedHelper({providerBinding:invocation.binding});
+      requireOkfAdmittedAction(execution.context);
+      if(!flags['native-request']||!['prepare','launch'].includes(flags['worker-mode']||'launch'))fail('E_CAPTURED_HELPER','captured harvest needs explicit native-request and supported worker-mode');
+    }
+    const unsupportedCaptured=new Set(['setup','init','migrate','unlock']);
+    if(captured && unsupportedCaptured.has(event)) fail('E_MIGRATION',`captured ${event} is not supported; use an explicit operator administration path`);
+    const target=execution?.context.instance;
+    if(target && flags.home && resolve(flags.home)!==target.home) fail('E_INVOCATION','captured invocation target differs from requested home');
+    const home=target?.home || resolve(flags.home || (execution?process.cwd():process.env.OATS_INSTANCE_HOME || process.env.OATS_HOME || process.cwd()));
+    if(execution && ['spawn','retire'].includes(event)) requireOkfAdmittedAction(execution.context);
+    const sourceReceipt=execution?loadOkfSourceReceiptInput(execution):loadInvocationSourceReceipt(home);
+    if(sourceReceipt.mode==='captured' && !['spawn','retire'].includes(event)) fail('E_SOURCE','captured source receipt is valid only for lifecycle hooks');
+    const src=()=>{
+      try {
+        const source=flags.source?loadSource(resolve(flags.source)):homeSource(home);
+        if(execution) assertOkfSourceContext(source,execution.context,execution.binding);
+        else if(captured) assertOkfRegisteredSourceReplay(source,invocation.binding);
+        else if(source.providerBinding && event!=='inspect') fail('E_INVOCATION','captured source execution requires its selected binding');
+        return source;
+      } catch(error) {if(captured && ['ENOENT','ENOTDIR'].includes(error.code)) fail('E_SOURCE','captured command requires its durable registered source descriptor');throw error;}
+    };
+    // Deliberate old registered-source replay is a separate qualified contract,
+    // never a way to create a source or synthesize generic admission. A present
+    // invalid/unadmitted generic invocation cannot enter this compatibility path.
+    if(captured && !execution && Object.hasOwn(accepted,event) && event!=='soul-scaffold') {
+      if(!fs.existsSync(flags.source?resolve(flags.source):markerPath(home))) fail('E_ADMISSION','new captured registration requires generic admitted invocation inputs');
+      src();
+    }
+    if(['spawn','retire'].includes(event)) {
+      // A generic intent authorizes its action, not missing source/role input.
+      // Absence may replay an already qualified source, never create one or
+      // infer a helper skip from an ambient kind/name/knowledge-slot heuristic.
+      if(captured && sourceReceipt.mode!=='captured' && !fs.existsSync(markerPath(home))) fail('E_SOURCE','new captured registration requires SourceReceipt1 input authority');
+      if(execution && fs.existsSync(markerPath(home))) src();
+      if(!captured && fs.existsSync(join(home,'instance.json')) && Object.hasOwn(readJSON(safePath(join(home,'instance.json'))),'executionBinding')) fail('E_INVOCATION','captured home cannot use legacy lifecycle ingress');
+    }
+    // Scope commands have no kernel instance intent. They may finish only
+    // already retained runs under their exact source binding/descriptor, never
+    // allocate a new worker or infer an incarnation for a deleted source.
+    const retainedRun=s=>{
+      const id=event==='complete'?flags.run:loadStatus(s).activeRun;
+      if(!id) {if(event==='complete') fail('E_RUN','complete requires an existing --run');requireQualifiedHelper(s);}
+      readRun(s,id);return s;
+    };
     let result;
     if(event==='soul-scaffold') {
       // Souls are portable declarations, never an implicit knowledge store.
       result={meta:{scaffolded:false},brief:'OKF requires explicit external bindings and soul/okf.json before a working instance can spawn. Use init or migrate; no knowledge was created in this soul.'};
     } else if(event==='spawn') {
-      const s=register(home);
+      const s=sourceReceipt.mode==='captured'?registerCaptured(home,sourceReceipt.receipt):register(home);
       if(s.skipped) result={meta:{memory:'none'},brief:'Service agent: follow your own task; no working-memory upkeep.'};
       else {
         const schedule=loadStatus(s).schedule.result;
         result={meta:{memory:'okf-v2',source:s.file,schedule},brief:`Knowledge is an immutable accepted snapshot at ./knowledge/. Read knowledge/view.json for base paths under knowledge/bases/<alias>/, then the indexes for ${[...new Set([...s.decl.owns,...s.decl.reads])].join(', ')}. Follow only relevant links. All configured bases are available. Use oats okf read for current accepted text; old views stay stable. Keep STATE.md/log.md/notes/ current; never edit knowledge.`};
       }
     } else if(event==='retire') {
-      if(service(home)) result={meta:{retired:true}};
+      if(captured) {
+        let s;
+        if(sourceReceipt.mode==='captured') {s=registerCaptured(home,sourceReceipt.receipt);if(s.skipped) {result={meta:{retired:true,reason:'service'}};s=null;}}
+        else {if(!fs.existsSync(markerPath(home))) fail('E_MIGRATION','captured retire requires a durable registered source or explicit helper receipt');s=src();}
+        if(s) {scheduleSource(s);const r=capture(s,{final:true});result={meta:{retired:r.complete===true,source:s.file,capture:r},brief:'Final input is in durable custody. Delivery remains asynchronous.'};}
+      } else if(service(home)) result={meta:{retired:true}};
       else if(!fs.existsSync(markerPath(home))) {
         if(['STATE.md','log.md','notes','.okf-harvest-record.json','.okf-harvest-record.next.json'].some(p=>fs.existsSync(join(home,p)))) fail('E_MIGRATION','unregistered/legacy source has memory; explicitly migrate/register before retirement');
         result={meta:{retired:true,reason:'nothing-to-delete'}};
@@ -70,11 +130,19 @@ else {
         const s=src();scheduleSource(s);const r=capture(s,{final:true});result={meta:{retired:r.complete===true,source:s.file,capture:r},brief:'Final input is in durable custody. Delivery remains asynchronous.'};
       }
     } else if(event==='harvest') {
-      const s=register(home);
-      result=s.skipped?{status:'skipped',reason:'service'}:runSource(s,{manual:true,noLaunch:!!flags['no-launch']});
+      if(capturedHarvest) {
+        const s=src(); // existing registered descriptor ONLY; never new registration.
+        result=runSource(s,{manual:true,noLaunch:!!flags['no-launch']||flags['worker-mode']==='prepare',capturedInvocation:execution.context,nativeRequest:flags['native-request']});
+      } else {
+        if(flags['native-request']||flags['worker-mode'])fail('E_USAGE','native-request/worker-mode require an admitted captured operation');
+        // Snapshot absence does not turn a persisted captured source into legacy.
+        if(fs.existsSync(markerPath(home))) requireQualifiedHelper(src());
+        const s=register(home);
+        result=s.skipped?{status:'skipped',reason:'service'}:runSource(s,{manual:true,noLaunch:!!flags['no-launch']});
+      }
     } else if(event==='run-source') result=runSource(src(),{manual:!!flags.manual,noLaunch:!!flags['no-launch']});
-    else if(event==='complete') result=complete(src(),flags.run,flags.judgment && resolve(flags.judgment));
-    else if(event==='retry') result=retry(src(),{run:flags.run,rejudge:!!flags.rejudge,launch:!!flags.launch,adoptHome:flags['adopt-home']});
+    else if(event==='complete') {const s=src();if(captured) retainedRun(s);result=complete(s,flags.run,flags.judgment && resolve(flags.judgment));}
+    else if(event==='retry') {const s=src();if(captured && !flags.run && !flags.rejudge && !flags.launch && !flags['adopt-home']) retainedRun(s);result=retry(s,{run:flags.run,rejudge:!!flags.rejudge,launch:!!flags.launch,adoptHome:flags['adopt-home']});}
     else if(event==='inspect') result=inspect(src());
     else if(event==='setup') {
       const s=src();if(flags.enable && flags.disable) fail('E_USAGE','choose enable or disable');

package/capabilities/oats-okf/lib/binding-wire.mjs

@@ -0,0 +1,268 @@
+import { TextDecoder } from 'node:util';
+import { validateInvocationShape } from './invocation-shape.mjs';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { fs, safePath } from './io.mjs';
+import {
+  KNOWLEDGE_CONTRACT,
+  KNOWLEDGE_CONTRACT_VERSION,
+  bindKnowledgeDomain,
+  checkKnowledgeRuntime,
+  normalizeKnowledgeBindingCandidates,
+  normalizeKnowledgeDeclaration,
+  renderKnowledgeRuntime,
+  sameJson,
+} from './portable-binding.mjs';
+import { validateBindings } from './config.mjs';
+import { stageBase, validateBase } from './stores.mjs';
+
+export const BINDING_WIRE_LIMITS=Object.freeze({bytes:1024*1024,depth:32,entries:16384});
+const CAPABILITY='oats.okf',SLOT='knowledge';
+const phases=new Set(['normalize','bind','check']);
+const unsupportedCapturedCommands=new Set(['setup','init','migrate','unlock']);
+const declarationKinds=new Set(['soul','workspace','adoption','operator']);
+const errorCodes=new Set(['needs-configuration','requirement-conflict','invalid-binding','authorization-required','host-requirement-missing','provider-unavailable','provider-not-qualified']);
+const obj=value=>value!==null && typeof value==='object' && !Array.isArray(value);
+const wireError=code=>{throw Object.assign(new Error(code),{wireCode:code});};
+function keys(value,allowed,required,label) {
+  if(!obj(value)) wireError('invalid-binding');
+  for(const key of Object.keys(value)) if(!allowed.includes(key)) wireError('invalid-binding');
+  for(const key of required) if(!Object.hasOwn(value,key)) wireError('invalid-binding');
+  return value;
+}
+function absolute(value) {return typeof value==='string' && isAbsolute(value) && resolve(value)===value;}
+
+class StrictJsonParser {
+  constructor(text,{depth,entries}) {this.text=text;this.maxDepth=depth;this.maxEntries=entries;this.at=0;this.entries=0;}
+  whitespace() {while(/[\u0009\u000a\u000d\u0020]/.test(this.text[this.at] || '')) this.at++;}
+  count() {if(++this.entries>this.maxEntries) wireError('invalid-binding');}
+  string() {
+    if(this.text[this.at]!=='"') wireError('invalid-binding');
+    const start=this.at++;
+    while(this.at<this.text.length) {
+      const code=this.text.charCodeAt(this.at++);
+      if(code===0x22) {try{return JSON.parse(this.text.slice(start,this.at));}catch{wireError('invalid-binding');}}
+      if(code<0x20) wireError('invalid-binding');
+      if(code===0x5c) {
+        const escaped=this.text[this.at++];
+        if(escaped==='u') {if(!/^[0-9a-fA-F]{4}$/.test(this.text.slice(this.at,this.at+4))) wireError('invalid-binding');this.at+=4;}
+        else if(!'"\\/bfnrt'.includes(escaped || '')) wireError('invalid-binding');
+      }
+    }
+    wireError('invalid-binding');
+  }
+  value(depth=1) {
+    this.whitespace();const char=this.text[this.at];
+    if(char==='"') return this.string();
+    if(char==='{') {
+      if(depth>this.maxDepth) wireError('invalid-binding');this.at++;this.whitespace();
+      const result=Object.create(null),seen=new Set();if(this.text[this.at]==='}') {this.at++;return result;}
+      while(true) {
+        this.whitespace();const key=this.string();if(seen.has(key)) wireError('invalid-binding');seen.add(key);this.count();
+        this.whitespace();if(this.text[this.at++]!==':') wireError('invalid-binding');result[key]=this.value(depth+1);this.whitespace();
+        const next=this.text[this.at++];if(next==='}') return result;if(next!==',') wireError('invalid-binding');
+      }
+    }
+    if(char==='[') {
+      if(depth>this.maxDepth) wireError('invalid-binding');this.at++;this.whitespace();
+      const result=[];if(this.text[this.at]===']') {this.at++;return result;}
+      while(true) {this.count();result.push(this.value(depth+1));this.whitespace();const next=this.text[this.at++];if(next===']') return result;if(next!==',') wireError('invalid-binding');}
+    }
+    for(const [token,value] of [['true',true],['false',false],['null',null]]) if(this.text.startsWith(token,this.at)) {this.at+=token.length;return value;}
+    const match=/^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(this.text.slice(this.at));
+    if(!match) wireError('invalid-binding');this.at+=match[0].length;const number=Number(match[0]);if(!Number.isFinite(number)) wireError('invalid-binding');return number;
+  }
+  parse() {this.whitespace();const value=this.value();this.whitespace();if(this.at!==this.text.length) wireError('invalid-binding');return value;}
+}
+
+export function parseBindingJson(bytes,limits=BINDING_WIRE_LIMITS) {
+  if(!Buffer.isBuffer(bytes)) bytes=Buffer.from(bytes);
+  if(bytes.length>limits.bytes) wireError('invalid-binding');
+  let text;try{text=new TextDecoder('utf-8',{fatal:true}).decode(bytes);}catch{wireError('invalid-binding');}
+  return new StrictJsonParser(text,limits).parse();
+}
+
+function request(value,phase) {
+  keys(value,['schemaVersion','phase','slot','capability','settings','input'],['schemaVersion','phase','slot','capability','settings','input'],'binding request');
+  if(value.schemaVersion!==1 || value.phase!==phase || value.slot!==SLOT || value.capability!==CAPABILITY || !obj(value.settings)) wireError('invalid-binding');
+  return value;
+}
+function declaration(value) {
+  keys(value,['kind','value','origin','origins'],['kind','value','origin','origins'],'provider declaration');
+  if(!declarationKinds.has(value.kind) || !obj(value.value) || !obj(value.origin) || !obj(value.origins)) wireError('invalid-binding');
+  return value;
+}
+function contract(value,{required=false}={}) {
+  if(value===undefined) {if(required) wireError('needs-configuration');return null;}
+  if(!obj(value) || value.contract!==KNOWLEDGE_CONTRACT || value.version!==KNOWLEDGE_CONTRACT_VERSION) wireError('invalid-binding');
+  return value;
+}
+function runtimeSettings(settings) {
+  keys(settings,['bindings-file','state-dir','harvest-runtime','harvest-model'],[], 'OKF settings');
+  const descriptorFile=settings['bindings-file'],stateDir=settings['state-dir'],runtime=settings['harvest-runtime'],model=settings['harvest-model'] ?? null;
+  if(!absolute(descriptorFile) || !absolute(stateDir) || !['pi','claude','codex'].includes(runtime) || (model!==null && (typeof model!=='string' || !model.trim()))) wireError('needs-configuration');
+  return {descriptorFile,stateDir,execution:{runtime,model}};
+}
+function normalizePhase(req) {
+  keys(req.input,['declarations','context'],['declarations','context'],'normalize input');
+  if(!Array.isArray(req.input.declarations) || !obj(req.input.context)) wireError('invalid-binding');
+  const requirements=[],candidates=[];let domain=null;
+  for(const raw of req.input.declarations) {
+    const item=declaration(raw);
+    if(item.kind==='soul') {
+      const envelope=contract(item.value.knowledge,{required:true});
+      if(domain) wireError('requirement-conflict');
+      domain=normalizeKnowledgeDeclaration(envelope,{origin:item.origin,origins:item.origins,pointer:'/knowledge/payload'});
+      continue;
+    }
+    if(item.kind==='workspace') {
+      const stores=item.value.knowledge?.stores;
+      if(stores===undefined) continue;
+      if(!Array.isArray(stores)) wireError('invalid-binding');
+      stores.forEach((rawStore,index)=>{
+        if(!obj(rawStore)) wireError('invalid-binding');
+        if(rawStore.contract!==KNOWLEDGE_CONTRACT) return;
+        const store=contract(rawStore);
+        keys(store.payload,['bindings'],['bindings'],'workspace OKF payload');
+        candidates.push(...normalizeKnowledgeBindingCandidates({bindings:store.payload.bindings,kind:'workspace-default',origin:item.origin,origins:item.origins,pointer:`/knowledge/stores/${index}/payload/bindings`}));
+      });
+      continue;
+    }
+    if(item.value.bindings===undefined) continue;
+    candidates.push(...normalizeKnowledgeBindingCandidates({bindings:item.value.bindings,kind:item.kind==='adoption'?'import-adoption':'operator',origin:item.origin,origins:item.origins,pointer:'/bindings'}));
+  }
+  if(!domain) wireError('needs-configuration');
+  requirements.push(...domain.requirements);candidates.unshift(...domain.candidates);
+  return {requirements,candidates,model:{domain,runtime:runtimeSettings(req.settings)}};
+}
+function choiceMap(value) {
+  if(!obj(value)) wireError('invalid-binding');
+  for(const [key,choice] of Object.entries(value)) {
+    if(!key.startsWith('/bindings/knowledge/') || key.includes('//') || /~(?![01])/.test(key)) wireError('invalid-binding');
+    keys(choice,['value','selectedBy','constraints','considered'],['value','selectedBy','constraints','considered'],'knowledge choice');
+    if(!Array.isArray(choice.constraints) || !Array.isArray(choice.considered) || (choice.selectedBy!==null && !obj(choice.selectedBy))) wireError('invalid-binding');
+  }
+  return value;
+}
+function bindPhase(req) {
+  keys(req.input,['model','choices','context'],['model','choices','context'],'bind input');if(!obj(req.input.context)) wireError('invalid-binding');
+  keys(req.input.model,['domain','runtime'],['domain','runtime'],'OKF binding model');
+  keys(req.input.model.runtime,['stateDir','descriptorFile','execution'],['stateDir','descriptorFile','execution'],'OKF runtime model');
+  let bound;try{bound=bindKnowledgeDomain({model:req.input.model.domain,choices:choiceMap(req.input.choices)});}catch(error){if(/unresolved knowledge binding/.test(error.message)) wireError('needs-configuration');throw error;}
+  const runtime=renderKnowledgeRuntime({domain:bound.payload,...req.input.model.runtime});
+  return {payloadContract:bound.contract,payloadVersion:bound.version,payload:{...bound.payload,runtime,execution:req.input.model.runtime.execution},credentialRefs:bound.credentialRefs,provenance:bound.provenance};
+}
+function bindingPayload(binding) {
+  keys(binding,['schemaVersion','capability','payloadContract','payloadVersion','payload','credentialRefs','provenance'],['schemaVersion','capability','payloadContract','payloadVersion','payload','credentialRefs','provenance'],'provider binding');
+  if(binding.schemaVersion!==1 || binding.capability!==CAPABILITY || binding.payloadContract!==KNOWLEDGE_CONTRACT || binding.payloadVersion!==KNOWLEDGE_CONTRACT_VERSION || !Array.isArray(binding.provenance)) wireError('invalid-binding');
+  if(!obj(binding.credentialRefs) || Object.keys(binding.credentialRefs).length) wireError('invalid-binding');
+  keys(binding.payload,['owner','stores','reads','owns','runtime','execution'],['owner','stores','reads','owns','runtime','execution'],'OKF binding payload');
+  const domain={owner:binding.payload.owner,stores:binding.payload.stores,reads:binding.payload.reads,owns:binding.payload.owns};
+  const runtime=renderKnowledgeRuntime({domain,stateDir:binding.payload.runtime?.bindings?.stateDir,descriptorFile:binding.payload.runtime?.descriptorFile});
+  if(!sameJson(runtime,binding.payload.runtime)) wireError('invalid-binding');
+  keys(binding.payload.execution,['runtime','model'],['runtime','model'],'OKF worker execution');
+  if(!['pi','claude','codex'].includes(binding.payload.execution.runtime) || (binding.payload.execution.model!==null && (typeof binding.payload.execution.model!=='string' || !binding.payload.execution.model.trim()))) wireError('invalid-binding');
+  return {domain,runtime,execution:binding.payload.execution};
+}
+
+/** Pure projection for durable source registration and later source-free work. */
+export function sourceRuntimeFromKnowledgeBinding(binding) {
+  const {domain,runtime,execution}=bindingPayload(binding);
+  return {owner:domain.owner,bindings:{file:runtime.descriptorFile,...runtime.bindings},decl:runtime.declaration,execution:{...execution}};
+}
+
+const invocationError=()=>{throw Object.assign(new Error('invalid captured provider binding snapshot'),{code:'E_BINDING'});};
+export function readPrivateInvocationJson(file) {
+  if(!absolute(file)) invocationError();
+  let fd;
+  try {
+    if(safePath(file)!==file) invocationError();
+    const before=fs.lstatSync(file),uid=typeof process.getuid==='function'?process.getuid():null;
+    if(!before.isFile() || before.nlink!==1 || before.size>BINDING_WIRE_LIMITS.bytes || (before.mode&0o077)!==0 || (uid!==null && before.uid!==uid)) invocationError();
+    fd=fs.openSync(file,fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW|fs.constants.O_NONBLOCK);
+    const opened=fs.fstatSync(fd);
+    if(!opened.isFile() || opened.nlink!==1 || opened.dev!==before.dev || opened.ino!==before.ino || opened.size>BINDING_WIRE_LIMITS.bytes || (opened.mode&0o077)!==0 || (uid!==null && opened.uid!==uid)) invocationError();
+    const bytes=Buffer.alloc(Math.min(BINDING_WIRE_LIMITS.bytes+1,opened.size+1));let length=0;
+    while(length<bytes.length) {const count=fs.readSync(fd,bytes,length,bytes.length-length,null);if(!count) break;length+=count;}
+    const after=fs.fstatSync(fd);
+    if(length>BINDING_WIRE_LIMITS.bytes || after.size!==opened.size || after.mtimeMs!==opened.mtimeMs) invocationError();
+    return parseBindingJson(bytes.subarray(0,length));
+  } catch(error) {if(error?.code==='E_BINDING') throw error;invocationError();}
+  finally {if(fd!==undefined) fs.closeSync(fd);}
+}
+
+/** Load only the parent-owned transient ProviderBinding1 snapshot when present.
+ * Absence is an explicit legacy mode; every present-file defect fails closed. */
+export function loadInvocationKnowledgeBinding(env=process.env) {
+  if(!Object.hasOwn(env,'OATS_BINDING_FILE')) return {kind:'legacy'};
+  const file=env.OATS_BINDING_FILE,binding=readPrivateInvocationJson(file);
+  let runtime;try{runtime=sourceRuntimeFromKnowledgeBinding(binding);}catch{invocationError();}
+  return {kind:'captured',file,binding,runtime};
+}
+function problem(code) {return {code};}
+function providerActionName(action) {
+  if(action.kind==='operation' && action.slot===SLOT) return action.name;
+  if(action.kind!=='command') return null;
+  if(action.namespace==='okf' || action.capability===CAPABILITY) return action.name;
+  if(typeof action.name==='string' && action.name.startsWith('okf:')) return action.name.slice(4);
+  return null;
+}
+function checkPhase(req) {
+  keys(req.input,['binding','context','action','invocation'],['binding','context','action'],'check input');
+  if(!obj(req.input.context) || !obj(req.input.action)) wireError('invalid-binding');
+  if(Object.hasOwn(req.input,'invocation')) validateInvocationShape(req.input.invocation,{capability:CAPABILITY,context:req.input.context,action:req.input.action});
+  const {runtime}=bindingPayload(req.input.binding),action=req.input.action,name=providerActionName(action);
+  const harvestInvocation=req.input.invocation;
+  const admittedHarvest=name==='harvest' && action.kind==='operation' && action.slot==='knowledge' && action.name==='harvest'
+    && harvestInvocation?.subject.kind==='persistent' && harvestInvocation.instance!==null && !!harvestInvocation.intent;
+  if(name && (unsupportedCapturedCommands.has(name) || name==='run-source' || (name==='harvest' && !admittedHarvest))) return {status:'needs-configuration',problems:[problem('provider-not-qualified')]};
+  if(action.kind==='hook' && action.name==='soul-scaffold') return {status:'ready',problems:[]};
+  let bindings;try{bindings=validateBindings(runtime.bindings,runtime.descriptorFile);}catch{return {status:'needs-configuration',problems:[problem('needs-configuration')]};}
+  const accepted={},gitBases=Object.entries(bindings.bases).filter(([,base])=>base.kind==='git');
+  if(gitBases.length>64) return {status:'unavailable',problems:[problem('provider-not-qualified')]};
+  let scratch=null;
+  try {
+    if(gitBases.length) scratch=fs.mkdtempSync(join(fs.realpathSync(tmpdir()),'oats-okf-binding-check-'));
+    for(const [alias,base] of Object.entries(bindings.bases)) accepted[alias]=(base.kind==='directory'?validateBase(base.path,base):stageBase(base,join(scratch,alias))).meta;
+    checkKnowledgeRuntime({rendered:runtime,accepted});
+  } catch(error) {
+    if(error.code==='E_COMMAND') return {status:'unavailable',problems:[problem('provider-unavailable')]};
+    if(['E_OWNER','E_BASE','E_VALIDATION','E_DIRECTORY_GIT','E_CONFIRM'].includes(error.code)) return {status:'needs-configuration',problems:[problem('provider-not-qualified')]};
+    return {status:'unavailable',problems:[problem('provider-unavailable')]};
+  } finally {
+    if(scratch) fs.rmSync(scratch,{recursive:true,force:true});
+  }
+  return {status:'ready',problems:[]};
+}
+
+export function handleBindingRequest(phase,value) {
+  if(!phases.has(phase)) wireError('invalid-binding');
+  const req=request(value,phase);
+  if(phase==='normalize') return normalizePhase(req);
+  if(phase==='bind') return bindPhase(req);
+  return checkPhase(req);
+}
+function response(phase,body) {return {schemaVersion:1,phase,slot:SLOT,capability:CAPABILITY,...body};}
+function errorCode(error) {if(errorCodes.has(error?.wireCode)) return error.wireCode;if(error?.code==='E_OWNER') return 'requirement-conflict';return 'invalid-binding';}
+function enforceOutputLimits(value,depth=1,state={entries:0}) {
+  if(depth>BINDING_WIRE_LIMITS.depth) wireError('provider-not-qualified');
+  if(value===null || typeof value!=='object') return;
+  for(const child of Array.isArray(value)?value:Object.values(value)) {
+    if(++state.entries>BINDING_WIRE_LIMITS.entries) wireError('provider-not-qualified');
+    enforceOutputLimits(child,depth+1,state);
+  }
+}
+export async function runBindingWire(phase,input=process.stdin,output=process.stdout) {
+  let answer;
+  try {
+    const chunks=[];let length=0;
+    for await(const chunk of input) {const bytes=Buffer.from(chunk);length+=bytes.length;if(length>BINDING_WIRE_LIMITS.bytes) wireError('invalid-binding');chunks.push(bytes);}
+    const result=handleBindingRequest(phase,parseBindingJson(Buffer.concat(chunks,length)));
+    answer=response(phase,{ok:true,result});
+  } catch(error) {answer=response(phases.has(phase)?phase:'check',{ok:false,error:{code:errorCode(error)}});}
+  let bytes;
+  try {enforceOutputLimits(answer);bytes=Buffer.from(JSON.stringify(answer)+'\n');if(bytes.length>BINDING_WIRE_LIMITS.bytes) wireError('provider-not-qualified');}
+  catch {bytes=Buffer.from(JSON.stringify(response(phases.has(phase)?phase:'check',{ok:false,error:{code:'provider-not-qualified'}}))+'\n');}
+  output.write(bytes);
+  return answer.ok;
+}

package/capabilities/oats-okf/lib/captured-worker.mjs

@@ -0,0 +1,101 @@
+// Captured worker PUBLIC consumer. No kernel imports/index reads, legacy source
+// discovery, fake admission, auth handling, backend defaults or history repair.
+import {fs,join,resolve,safePath,exec,cliPath,hash,fail} from './io.mjs';
+import {isAbsolute} from 'node:path';
+import {parseBindingJson,BINDING_WIRE_LIMITS} from './binding-wire.mjs';
+import {assertOkfSourceContext,requireOkfAdmittedAction} from './invocation-context.mjs';
+import {sameInvocationJson as same} from './invocation-shape.mjs';
+export const CAPTURED_WORKER_KEY='oats.okf:memory-harvest';
+const obj=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
+const abs=v=>typeof v==='string'&&isAbsolute(v)&&resolve(v)===v&&!v.includes('\0');
+const uuid=v=>typeof v==='string'&&/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(v);
+export const capturedSource=s=>['providerBinding','executionBinding','registration'].some(k=>Object.hasOwn(s,k));
+function binding(v){if(!obj(v)||v.schemaVersion!==1||!abs(v.deployment)||v.resolution?.schemaVersion!==1||!/^sha256-[a-f0-9]{64}$/.test(v.resolution.id))fail('E_CAPTURED_HELPER','invalid public execution binding');return v;}
+export function workerCallEnvironment(inherited){
+  // Preserve native HOME/profile/auth/Git helpers and the active OATS data
+  // scope, not invoking instance selectors (including legacy PI_AGENT aliases).
+  const env={...inherited};for(const key of Object.keys(env))if(/^(OATS_(?!HOME_DIR$)|OAS_|PI_AGENT_)/.test(key)||key==='PI_AGENTS_ROOT')delete env[key];
+  return env;
+}
+export function publicWorkerCall(source,args){
+  let text,status=0;
+  const env=workerCallEnvironment(process.env);
+  try{text=exec(cliPath(),args,{cwd:source.context,env,timeout:90000});}
+  catch(error){text=error.stdout;status=error.status??null;}
+  let envelope;try{envelope=parseBindingJson(Buffer.from(text||''),BINDING_WIRE_LIMITS);}catch{fail('E_CAPTURED_HELPER_UNKNOWN','public helper outcome is unknown; retain run/home, never re-scaffold');}
+  if(envelope.schemaVersion!==1||typeof envelope.ok!=='boolean')fail('E_CAPTURED_HELPER_UNKNOWN','invalid public helper response');
+  if(status!==0||!envelope.ok){const error=Object.assign(new Error('public captured helper action refused or is uncertain; retain custody'),{code:'E_CAPTURED_HELPER_UNKNOWN',publicObservation:{status,envelope}});throw error;}
+  if(!obj(envelope.result))fail('E_CAPTURED_HELPER_UNKNOWN','public helper result missing');return envelope.result;
+}
+export function readWorkerEndpoint(file){
+  if(!abs(file))fail('E_CAPTURED_HELPER','captured harvest needs an explicit absolute native-request');safePath(file);let fd;
+  try{
+    fd=fs.openSync(file,fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW|fs.constants.O_NONBLOCK);
+    const before=fs.fstatSync(fd);if(!before.isFile()||before.size>BINDING_WIRE_LIMITS.bytes)fail('E_CAPTURED_HELPER','invalid bounded native request');
+    const buffer=Buffer.alloc(before.size+1);let n=0,k;while(n<buffer.length&&(k=fs.readSync(fd,buffer,n,buffer.length-n,null)))n+=k;
+    const after=fs.fstatSync(fd);if(n!==before.size||before.size!==after.size||before.mtimeMs!==after.mtimeMs||before.ctimeMs!==after.ctimeMs)fail('E_CAPTURED_HELPER','native request changed');
+    const value=parseBindingJson(buffer.subarray(0,n),BINDING_WIRE_LIMITS);
+    if(!obj(value)||value.schemaVersion!==1||!obj(value.backend)||Object.keys(value).some(k=>!['schemaVersion','backend','stopGraceMs'].includes(k)))fail('E_CAPTURED_HELPER','worker native-request allows backend/stopGraceMs only; provider owns task');
+    const b=value.backend,allowed=b.backend==='tmux'?['backend','binary','socket','session']:b.backend==='herdr'?['backend','binary','socket','protocol']:[];
+    if(!allowed.length||Object.keys(b).length!==allowed.length||!allowed.every(k=>Object.hasOwn(b,k))||!abs(b.binary)||!abs(b.socket))fail('E_CAPTURED_HELPER','unsupported exact backend request');
+    if(b.backend==='tmux'&&(typeof b.session!=='string'||!b.session||/[\r\n\0]/.test(b.session)))fail('E_CAPTURED_HELPER','invalid tmux endpoint');
+    if(b.backend==='herdr'&&![20,22].includes(b.protocol))fail('E_CAPTURED_HELPER','unknown Herdr protocol');
+    if(value.stopGraceMs!==undefined&&(!Number.isSafeInteger(value.stopGraceMs)||value.stopGraceMs<1||value.stopGraceMs>300000))fail('E_CAPTURED_HELPER','invalid stop grace');
+    return JSON.parse(JSON.stringify(value));
+  }finally{if(fd!==undefined)fs.closeSync(fd);}
+}
+export function qualifyCapturedWorker(source,{context,nativeRequest}={},call=publicWorkerCall){
+  if(!context||source.registration?.schemaVersion!==1||source.registration.kind!=='captured')fail('E_CAPTURED_HELPER','captured worker needs registered SOURCE and current admitted operation');
+  requireOkfAdmittedAction(context);assertOkfSourceContext(source,context,source.providerBinding);
+  if(context.action.kind!=='operation'||context.action.slot!=='knowledge'||context.action.name!=='harvest'||context.subject.kind!=='persistent')fail('E_CAPTURED_HELPER','only admitted SOURCE knowledge:harvest may create a captured worker');
+  const manifest=JSON.parse(fs.readFileSync(new URL('../oats.json',import.meta.url),'utf8'));
+  if((manifest.requires||[]).some(r=>obj(r)&&r.runtime==='pi')||manifest.hooks?.launch)fail('E_CAPTURED_HELPER','required Pi plugin/launch behavior is not qualified by this captured slice');
+  const request=readWorkerEndpoint(nativeRequest),sourceBinding=binding(source.executionBinding);
+  const inspected=call(source,['inspect','--deployment',sourceBinding.deployment,'--resolution',sourceBinding.resolution.id,'--helper',CAPTURED_WORKER_KEY,'--json']);
+  return validateWorkerSelection(source,context,request,inspected);
+}
+export function validateWorkerSelection(source,context,request,inspected){
+  const selected=inspected?.helperSelection;
+  if(selected?.schemaVersion!==1||!same(selected.sourceExecutionBinding,source.executionBinding)||selected.workMode!=='directory'||!same(selected.context,context.context)||!same(selected.responsibleHuman,source.responsibleHuman))fail('E_CAPTURED_HELPER','helper SOURCE/context/human/work correspondence is unqualified');
+  const h=selected.helper,subject=h?.subject;
+  if(h?.key!==CAPTURED_WORKER_KEY||h.name!=='memory-harvest'||subject?.kind!=='helper'||subject.name!==h.name||subject.provider?.kind!=='capability'||subject.provider.capability!=='oats.okf'||!same(subject.provider,subject.definition?.owner))fail('E_CAPTURED_HELPER','wrong qualified helper identity');
+  const api={schemaVersion:1,api:{contract:'oats.captured-session',version:2,available:true,backends:['tmux','herdr']},readiness:{status:'not-checked'}};
+  if(!same(selected.launch,api)||!same(inspected.nativeSession,api))fail('E_CAPTURED_HELPER','unknown captured native public API');
+  // Exact retained model/runtime data is required; API availability alone is
+  // never qualification. Missing public selection stays closed, no private read.
+  const launch=selected.launchSelection;
+  if(!obj(launch)||launch.runtime!==source.execution.runtime||launch.runtime!=='pi'||typeof launch.model!=='string'||!launch.model.trim()||(source.execution.model!==null&&launch.model!==source.execution.model))fail('E_CAPTURED_HELPER','retained helper launch runtime/model missing or mismatched');
+  if(!Array.isArray(inspected.capabilities)||inspected.capabilities.length!==1||inspected.capabilities[0].id!=='oats.okf'||inspected.capabilities[0].approval!=='approved')fail('E_CAPTURED_HELPER','only the exact approved default-OKF helper profile is qualified in this slice');
+  if(binding(selected.executionBinding).deployment!==source.executionBinding.deployment||!same(inspected.resolution,selected.executionBinding.resolution))fail('E_CAPTURED_HELPER','helper inspection resolution/deployment differs');
+  return {schemaVersion:1,sourceBinding:JSON.parse(JSON.stringify(source.executionBinding)),helperBinding:JSON.parse(JSON.stringify(selected.executionBinding)),helper:JSON.parse(JSON.stringify(h)),request,requestHash:hash(request),sourceIntent:JSON.parse(JSON.stringify(context.intent)),sourceIncarnationId:context.instance.incarnationId,launchSelection:JSON.parse(JSON.stringify(launch))};
+}
+export function assertCapturedRun(source,run,plan){
+  const prior=run.capturedWorker;
+  if(!prior||prior.schemaVersion!==1||!same(prior.sourceBinding,source.executionBinding)||!same(prior.helperBinding,plan.helperBinding)||!same(prior.helper,plan.helper)||prior.sourceIncarnationId!==plan.sourceIncarnationId||prior.requestHash!==plan.requestHash||hash(prior.request)!==prior.requestHash||!same(prior.request,plan.request)||!same(prior.launchSelection,plan.launchSelection))fail('E_CAPTURED_HELPER','existing run authority/endpoint changed; no replacement worker');
+  if(['spawn-intent','scaffold-unknown','scaffolded','launch-intent','launch-unknown'].includes(run.status))fail('E_CAPTURED_HELPER_UNKNOWN','existing worker outcome requires explicit custody recovery; no duplicate dispatch');
+}
+export function capturedScaffold(source,run,home,call=publicWorkerCall){
+  const p=run.capturedWorker,b=p.helperBinding;
+  const result=call(source,['spawn',p.helper.name,'--deployment',b.deployment,'--resolution',b.resolution.id,'--home',home,'--no-launch','--json']);
+  if(result.home!==home||!uuid(result.incarnationId)||!same(result.executionBinding,b)||result.launchPending!==true||result.hooksPending!==false||result.cleanupRequired!==false||result.agent!==p.helper.name||result.work!=='directory'||typeof result.instance!=='string')fail('E_CAPTURED_HELPER_UNKNOWN','scaffold receipt lacks exact completed helper custody');
+  return result;
+}
+function directoryCustody(home){
+  const result={};for(const [key,path] of [['home',home],['work',join(home,'work')]]){safePath(path);const s=fs.lstatSync(path);if(!s.isDirectory()||!Number.isSafeInteger(s.dev)||!Number.isSafeInteger(s.ino))fail('E_WORKER','original worker directories unavailable');result[key]={dev:s.dev,ino:s.ino};}return result;
+}
+export function retainCapturedWorkerCustody(run,meta){
+  // Observe the EXISTING kernel home/work proof after the real public scaffold;
+  // do not mint a new incarnation or read/modify its private kernel index.
+  const actual=directoryCustody(run.worker.home);
+  if(!same(meta.captured?.custody,actual)||meta.incarnationId!==run.worker.incarnationId||!same(meta.executionBinding,run.capturedWorker.helperBinding))fail('E_WORKER','scaffold metadata/directory proof mismatch');
+  return JSON.parse(JSON.stringify(meta.captured.custody));
+}
+export function assertCapturedWorkerHome(source,run,meta,home){
+  const p=run.capturedWorker;if(!p||home!==run.worker.home||!same(p.sourceBinding,source.executionBinding)||!same(meta.executionBinding,p.helperBinding)||meta.incarnationId!==run.worker.incarnationId||meta.kind!=='helper'||meta.agent!==p.helper.name||!same(meta.captured?.custody,p.workerDirectoryCustody)||!same(directoryCustody(home),p.workerDirectoryCustody))fail('E_WORKER','captured worker incarnation/binding/subject/directory mismatch');
+}
+export function capturedStart(source,run,requestFile,call=publicWorkerCall){
+  const p=run.capturedWorker,b=p.sourceBinding;
+  const result=call(source,['session','start','--deployment',b.deployment,'--resolution',b.resolution.id,'--helper',p.helper.key,'--home',run.worker.home,'--request',requestFile,'--json']);
+  if(result.home!==run.worker.home||result.incarnationId!==run.worker.incarnationId||!same(result.executionBinding,p.helperBinding)||!same(result.sourceExecutionBinding,b)||!same(result.helper,p.helper)||result.dispatchAccepted!==true||result.intent?.incarnationId!==run.worker.incarnationId||typeof result.intent?.executionId!=='string'||result.runtime!==p.launchSelection.runtime||result.model!==p.launchSelection.model)fail('E_CAPTURED_HELPER_UNKNOWN','native result lacks exact helper dispatch custody');
+  return result;
+}

package/capabilities/oats-okf/lib/config.mjs

@@ -7,7 +7,8 @@ function keys(value, allowed, label, code='E_CONFIG') {
 }
 export function settings() {
   const s = JSON.parse(process.env.OATS_SETTINGS || '{}');
-  keys(s,['bindings-file','harvest-runtime','harvest-model'],'OATS_SETTINGS');
+  keys(s,['bindings-file','state-dir','harvest-runtime','harvest-model'],'OATS_SETTINGS');
+  if(s['state-dir']!==undefined && (typeof s['state-dir']!=='string' || !isAbsolute(s['state-dir']) || resolve(s['state-dir'])!==s['state-dir'])) fail('E_CONFIG','state-dir must be a normalized absolute path');
   if(s['harvest-runtime']!==undefined && !['pi','claude','codex'].includes(s['harvest-runtime'])) fail('E_CONFIG','invalid harvest-runtime');
   if(s['harvest-model']!==undefined && (typeof s['harvest-model']!=='string' || !s['harvest-model'].trim())) fail('E_CONFIG','harvest-model must be a nonempty string');
   return s;

package/capabilities/oats-okf/lib/inspection.mjs

@@ -1,5 +1,6 @@
 import { fs, join, dirname, safePath, fail, oats } from './io.mjs';
 import { markerPath, loadStatus } from './sources.mjs';
+import { qualifiedSoulIdentity } from './source-contract.mjs';
 
 // Keep the v1 labeled-document contract, including its explicit per-document
 // preview cap. The JSON envelope itself must drain in full through stdout.
@@ -84,13 +85,27 @@ export function workingDocuments(source,status=loadStatus(source)) {
   if(error) fail(error.code==='E_PATH'?'E_PATH':'E_INSPECT_FAILED',error.message);
   return {liveMemory:{available:true,reason:'live',observedAt},documents};
 }
+export function capturedAuthority(source) {
+  const fields=['registration','providerBinding','sourceIdentity','executionBinding','responsibleHuman'],present=fields.filter(key=>Object.hasOwn(source,key));
+  const base={schemaVersion:1};
+  if(!present.length) return {...base,registration:'legacy',capture:'unknown',migrationRequired:true,responsibleHuman:{status:'unknown'}};
+  const binding=source.executionBinding,identity=source.sourceIdentity,complete=source.registration?.schemaVersion===1 && source.registration.kind==='captured'
+    && source.providerBinding && typeof source.providerBinding==='object' && identity && typeof identity==='object' && !Array.isArray(identity)
+    && binding?.schemaVersion===1 && typeof binding.deployment==='string' && binding.resolution?.schemaVersion===1 && typeof binding.resolution.id==='string'
+    && Object.hasOwn(source,'responsibleHuman');
+  const invalid={...base,registration:'invalid',capture:'invalid',migrationRequired:true,responsibleHuman:{status:'unknown'}};
+  if(!complete) return invalid;
+  try {if(Buffer.byteLength(JSON.stringify({identity,binding}))>64*1024) return invalid;qualifiedSoulIdentity(identity);} catch {return invalid;}
+  return {...base,registration:'captured',capture:'recorded',migrationRequired:false,sourceIdentity:JSON.parse(JSON.stringify(identity)),executionBinding:JSON.parse(JSON.stringify(binding)),
+    responsibleHuman:{status:source.responsibleHuman===null?'disabled':'specified'}};
+}
 export function inspect(source) {
   const status=loadStatus(source),working=workingDocuments(source,status);
   let health;try {health=oats(['schedule','list','--dir',source.context,'--json'],source.context).scheduler;} catch(e) {health={active:false,error:e.message};}
   const documents=[...working.documents,{label:'Durable processing receipts',kind:'text',path:join(dirname(source.file),'status.json'),text:JSON.stringify(status,null,2)}];
   return {
     summary:`OKF ${source.id}: ${status.captured.inputs.length-status.processed.length} unprocessed inputs; ${status.retired?'source retired':'source not retired'}; ${working.liveMemory.available?`${working.documents.length} working-memory documents`:`live memory unavailable (${working.liveMemory.reason})`}`,
-    source:source.file,owns:source.decl.owns,reads:source.decl.reads,bases:source.bindings.bases,
+    source:source.file,owns:source.decl.owns,reads:source.decl.reads,bases:source.bindings.bases,authority:capturedAuthority(source),
     acceptedView:source.acceptedView,status,scheduler:health,liveMemory:working.liveMemory,documents
   };
 }