@bevel-software/platform-core-backend 0.22.0 → 0.24.0

package/dist/modules/workflow/session-ontology.policy.d.ts

@@ -1,52 +0,0 @@
-/**
- * Ontology-session boundary — the PURE decision core (no IO, no DB).
- *
- * Model: each run/session accumulates the SET of named ontologies it has
- * touched (via any read or write). The rule is asymmetric:
- *
- *   READS  — always allowed. A read that touches a named ontology RECORDS it
- *            into the session's touched set (so it can poison later writes).
- *   WRITES — allowed only while the session is confined to a SINGLE named
- *            ontology and the write targets that same ontology. The moment a
- *            session has touched two or more named ontologies (typically by
- *            reading across them), EVERY subsequent write is blocked — "read
- *            across ontologies → you can't write anymore at all."
- *
- * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
- * Knowledge, non-KB) never record and never block. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
- * these helpers; this module keeps the rule itself testable in isolation.
- */
-import type { Ontology } from '@bevel-software/platform-shared';
-/** Outcome of a write check against the session's touched-ontology set. */
-export type WriteDecision = {
-    allow: true;
-} | {
-    allow: false;
-    reason: 'multi-ontology' | 'different-ontology';
-    touched: string[];
-    attempted: string;
-};
-/**
- * The set of NAMED ontologies a session has touched after this operation. A
- * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
- * set, never mutates the input.
- */
-export declare function recordTouch(touched: ReadonlySet<string>, ontology: Ontology): Set<string>;
-/**
- * Decide whether a WRITE to `attempted` is allowed given the ontologies the
- * session has already touched (NOT counting this write yet).
- *
- *   - A write to a neutral path (`attempted === null`) is always allowed.
- *   - If the session has already touched two or more named ontologies, the
- *     write is blocked (`multi-ontology`) — reading across ontologies poisoned
- *     the session's write ability.
- *   - If the session has touched exactly one named ontology and it differs from
- *     the write target, the write is blocked (`different-ontology`).
- *   - If the session is unpinned (touched none) or its single touched ontology
- *     equals the target, the write is allowed.
- */
-export declare function decideWrite(touched: ReadonlySet<string>, attempted: Ontology): WriteDecision;
-//# sourceMappingURL=session-ontology.policy.d.ts.map

package/dist/modules/workflow/session-ontology.policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.policy.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAIzF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,aAAa,CAgB5F"}

package/dist/modules/workflow/session-ontology.policy.js

@@ -1,62 +0,0 @@
-/**
- * Ontology-session boundary — the PURE decision core (no IO, no DB).
- *
- * Model: each run/session accumulates the SET of named ontologies it has
- * touched (via any read or write). The rule is asymmetric:
- *
- *   READS  — always allowed. A read that touches a named ontology RECORDS it
- *            into the session's touched set (so it can poison later writes).
- *   WRITES — allowed only while the session is confined to a SINGLE named
- *            ontology and the write targets that same ontology. The moment a
- *            session has touched two or more named ontologies (typically by
- *            reading across them), EVERY subsequent write is blocked — "read
- *            across ontologies → you can't write anymore at all."
- *
- * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
- * Knowledge, non-KB) never record and never block. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
- * these helpers; this module keeps the rule itself testable in isolation.
- */
-/**
- * The set of NAMED ontologies a session has touched after this operation. A
- * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
- * set, never mutates the input.
- */
-export function recordTouch(touched, ontology) {
-    const next = new Set(touched);
-    if (ontology !== null)
-        next.add(ontology);
-    return next;
-}
-/**
- * Decide whether a WRITE to `attempted` is allowed given the ontologies the
- * session has already touched (NOT counting this write yet).
- *
- *   - A write to a neutral path (`attempted === null`) is always allowed.
- *   - If the session has already touched two or more named ontologies, the
- *     write is blocked (`multi-ontology`) — reading across ontologies poisoned
- *     the session's write ability.
- *   - If the session has touched exactly one named ontology and it differs from
- *     the write target, the write is blocked (`different-ontology`).
- *   - If the session is unpinned (touched none) or its single touched ontology
- *     equals the target, the write is allowed.
- */
-export function decideWrite(touched, attempted) {
-    if (attempted === null)
-        return { allow: true };
-    // The set of named ontologies the session would span if this write lands.
-    const spanned = new Set(touched);
-    spanned.add(attempted);
-    if (spanned.size <= 1)
-        return { allow: true };
-    // spanned.size >= 2 — the write would put the session across a boundary.
-    const touchedList = [...touched].sort();
-    if (touched.size >= 2) {
-        return { allow: false, reason: 'multi-ontology', touched: touchedList, attempted };
-    }
-    // Exactly one prior ontology, and it isn't the write target.
-    return { allow: false, reason: 'different-ontology', touched: touchedList, attempted };
-}
-//# sourceMappingURL=session-ontology.policy.js.map

package/dist/modules/workflow/session-ontology.policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.policy.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,QAAkB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAA4B,EAAE,SAAmB;IAC3E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE/C,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE9C,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IACD,6DAA6D;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC"}

package/dist/modules/workflow/session-ontology.service.d.ts

@@ -1,105 +0,0 @@
-/**
- * Ontology-session boundary — the touched-set store (Postgres + cache).
- *
- * Each session accumulates the SET of named ontologies it has touched. The gate
- * calls `checkOperation` for every gated agent tool call:
- *
- *   READ  (isWrite=false) → always allowed; RECORD the touched ontology so it
- *                           can poison later writes.
- *   WRITE (isWrite=true)  → allowed only while the session is confined to a
- *                           single named ontology equal to the target; once the
- *                           session has touched ≥2 ontologies, every write is
- *                           blocked. An allowed write also records its ontology.
- *
- * Neutral operations (`ontologyOf` → null) never record and never block.
- *
- * ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
- * │  ont = ontologyOf(wsPath)                                                │
- * │  ont === null → { allow:true } (neutral; no record)                      │
- * │  touched = loadTouched(sessionId)  (cache, else SELECT)                  │
- * │  WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
- * │  record(sessionId, ont)  (idempotent INSERT; update cache)              │
- * │  return { allow:true }                                                   │
- * └──────────────────────────────────────────────────────────────────────────┘
- *
- * Postgres is the source of truth so the boundary survives a backend restart.
- * The cache holds each session's touched set; a miss re-reads PG. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
- * `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
- * `delete` from its `onEvict` hook.
- */
-import type { KbContext } from '../../shared/kb-context.js';
-import type { Database } from '../database/connection.js';
-export type OperationDecision = {
-    allow: true;
-    touched: string[];
-} | {
-    allow: false;
-    reason: 'multi-ontology' | 'different-ontology';
-    touched: string[];
-    attempted: string;
-};
-export interface ISessionOntologyService {
-    /**
-     * Evaluate and record a gated agent operation. Reads always allow (and
-     * record); writes allow only while confined to a single ontology. Neutral
-     * paths always allow and record nothing.
-     */
-    checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
-    /** Evaluate/record against an already-resolved ontology (used by graph tools). */
-    checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
-    /** The set of ontologies a session has touched. */
-    getTouched(sessionId: string): Promise<string[]>;
-    /** Reclaim a session's touched set (run end / MCP onEvict). */
-    delete(sessionId: string): Promise<void>;
-    /** Backstop: drop touch rows older than `cutoff` (abandoned runs). */
-    sweepOlderThan(cutoff: Date): Promise<number>;
-}
-export declare class SessionOntologyService implements ISessionOntologyService {
-    private readonly db;
-    /** Names the knowledge-base root a path is classified under; read per call. */
-    private readonly kb;
-    /**
-     * Write-through cache of each session's touched-ontology set. A present entry
-     * is authoritative for the session (we only ever add to it in-process); a
-     * miss re-reads Postgres. Keyed by the agent thread / sessionId.
-     */
-    private readonly cache;
-    /**
-     * Serializes each session's read→decide→record path. Without it, two
-     * concurrent same-session writes (parallel tool calls in one turn) could both
-     * observe a singleton/empty touched set and both be allowed to different
-     * ontologies before either INSERT lands — defeating the boundary. Different
-     * sessions never contend.
-     */
-    private readonly locks;
-    constructor(db: Database, 
-    /** Names the knowledge-base root a path is classified under; read per call. */
-    kb: Pick<KbContext, 'layout'>);
-    /**
-     * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
-     * wrapper over {@link checkOntology} for the common path-based call site.
-     */
-    checkOperation(sessionId: string, wsPath: string, isWrite: boolean, kbDirName?: string): Promise<OperationDecision>;
-    /**
-     * Evaluate (and, when allowed, record) an operation against an
-     * already-resolved ontology. Neutral ops always allow and record nothing;
-     * reads always allow and record; writes allow only while the session stays
-     * confined to the single target ontology (see {@link decideWrite}). A blocked
-     * write records nothing.
-     */
-    checkOntology(sessionId: string, ontology: string | null, isWrite: boolean): Promise<OperationDecision>;
-    /** The sorted set of named ontologies this session has touched so far. */
-    getTouched(sessionId: string): Promise<string[]>;
-    /** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
-    delete(sessionId: string): Promise<void>;
-    /** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
-    sweepOlderThan(cutoff: Date): Promise<number>;
-    /** Load a session's touched set from cache, else from Postgres (and cache it). */
-    private loadTouched;
-    /** Record a touched ontology (idempotent) and update the cache. */
-    private record;
-}
-//# sourceMappingURL=session-ontology.service.d.ts.map

package/dist/modules/workflow/session-ontology.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.service.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAK1D,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpH,kFAAkF;IAClF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxG,mDAAmD;IACnD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,+DAA+D;IAC/D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,sEAAsE;IACtE,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,qBAAa,sBAAuB,YAAW,uBAAuB;IAkBlE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,EAAE;IAnBrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IAExD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAG3B,EAAE,EAAE,QAAQ;IAC7B,+EAA+E;IAC9D,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;IAGhD;;;OAGG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,CAAC;IAI7B;;;;;;OAMG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+B7G,0EAA0E;IACpE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAItD,gGAAgG;IAC1F,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C,6GAA6G;IACvG,cAAc,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnD,kFAAkF;YACpE,WAAW;IAYzB,mEAAmE;YACrD,MAAM;CAQrB"}

package/dist/modules/workflow/session-ontology.service.js

@@ -1,147 +0,0 @@
-/**
- * Ontology-session boundary — the touched-set store (Postgres + cache).
- *
- * Each session accumulates the SET of named ontologies it has touched. The gate
- * calls `checkOperation` for every gated agent tool call:
- *
- *   READ  (isWrite=false) → always allowed; RECORD the touched ontology so it
- *                           can poison later writes.
- *   WRITE (isWrite=true)  → allowed only while the session is confined to a
- *                           single named ontology equal to the target; once the
- *                           session has touched ≥2 ontologies, every write is
- *                           blocked. An allowed write also records its ontology.
- *
- * Neutral operations (`ontologyOf` → null) never record and never block.
- *
- * ┌── checkOperation(sessionId, wsPath, isWrite) ───────────────────────────┐
- * │  ont = ontologyOf(wsPath)                                                │
- * │  ont === null → { allow:true } (neutral; no record)                      │
- * │  touched = loadTouched(sessionId)  (cache, else SELECT)                  │
- * │  WRITE → decideWrite(touched, ont); if blocked, return block (no record) │
- * │  record(sessionId, ont)  (idempotent INSERT; update cache)              │
- * │  return { allow:true }                                                   │
- * └──────────────────────────────────────────────────────────────────────────┘
- *
- * Postgres is the source of truth so the boundary survives a backend restart.
- * The cache holds each session's touched set; a miss re-reads PG. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * Eviction: `delete(sessionId)` at run end is the PRIMARY reclamation;
- * `sweepOlderThan` is the abandoned-run backstop; the MCP layer also calls
- * `delete` from its `onEvict` hook.
- */
-import { eq, lt } from 'drizzle-orm';
-import { ontologyOf } from '../../shared/kb-layout.js';
-import { sessionOntologyTouches } from '../database/schema.js';
-import { recordTouch, decideWrite } from './session-ontology.policy.js';
-import { WorkspaceMutex } from '../kb-fs/mutex.js';
-export class SessionOntologyService {
-    db;
-    kb;
-    /**
-     * Write-through cache of each session's touched-ontology set. A present entry
-     * is authoritative for the session (we only ever add to it in-process); a
-     * miss re-reads Postgres. Keyed by the agent thread / sessionId.
-     */
-    cache = new Map();
-    /**
-     * Serializes each session's read→decide→record path. Without it, two
-     * concurrent same-session writes (parallel tool calls in one turn) could both
-     * observe a singleton/empty touched set and both be allowed to different
-     * ontologies before either INSERT lands — defeating the boundary. Different
-     * sessions never contend.
-     */
-    locks = new WorkspaceMutex();
-    constructor(db, 
-    /** Names the knowledge-base root a path is classified under; read per call. */
-    kb) {
-        this.db = db;
-        this.kb = kb;
-    }
-    /**
-     * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
-     * wrapper over {@link checkOntology} for the common path-based call site.
-     */
-    async checkOperation(sessionId, wsPath, isWrite, kbDirName) {
-        return this.checkOntology(sessionId, ontologyOf(wsPath, this.kb.layout, kbDirName), isWrite);
-    }
-    /**
-     * Evaluate (and, when allowed, record) an operation against an
-     * already-resolved ontology. Neutral ops always allow and record nothing;
-     * reads always allow and record; writes allow only while the session stays
-     * confined to the single target ontology (see {@link decideWrite}). A blocked
-     * write records nothing.
-     */
-    async checkOntology(sessionId, ontology, isWrite) {
-        // Neutral operation: always allowed, records nothing. No state mutation, so
-        // it needs no per-session serialization.
-        if (ontology === null) {
-            const touched = await this.loadTouched(sessionId);
-            return { allow: true, touched: [...touched].sort() };
-        }
-        // Serialize the decide+record path per session so concurrent same-session
-        // operations can't both pass the boundary on a stale touched set.
-        return this.locks.run(sessionId, async () => {
-            const touched = await this.loadTouched(sessionId);
-            if (isWrite) {
-                const decision = decideWrite(touched, ontology);
-                if (!decision.allow) {
-                    return {
-                        allow: false,
-                        reason: decision.reason,
-                        touched: decision.touched,
-                        attempted: decision.attempted,
-                    };
-                }
-            }
-            // Allowed (read, or a write confined to one ontology): record the touch.
-            await this.record(sessionId, ontology, touched);
-            return { allow: true, touched: [...recordTouch(touched, ontology)].sort() };
-        });
-    }
-    /** The sorted set of named ontologies this session has touched so far. */
-    async getTouched(sessionId) {
-        return [...(await this.loadTouched(sessionId))].sort();
-    }
-    /** Reclaim a session's touched set from both the cache and Postgres (run end / MCP onEvict). */
-    async delete(sessionId) {
-        this.cache.delete(sessionId);
-        await this.db.delete(sessionOntologyTouches).where(eq(sessionOntologyTouches.sessionId, sessionId));
-    }
-    /** Backstop sweep: drop touch rows older than `cutoff` (abandoned runs) and return how many were removed. */
-    async sweepOlderThan(cutoff) {
-        const removed = await this.db
-            .delete(sessionOntologyTouches)
-            .where(lt(sessionOntologyTouches.touchedAt, cutoff))
-            .returning({ sessionId: sessionOntologyTouches.sessionId });
-        // A swept session may have other (newer) rows; drop its cache entry so the
-        // next op re-reads the authoritative remaining set from Postgres.
-        for (const r of removed)
-            this.cache.delete(r.sessionId);
-        return removed.length;
-    }
-    /** Load a session's touched set from cache, else from Postgres (and cache it). */
-    async loadTouched(sessionId) {
-        const cached = this.cache.get(sessionId);
-        if (cached)
-            return cached;
-        const rows = await this.db
-            .select({ ontology: sessionOntologyTouches.ontology })
-            .from(sessionOntologyTouches)
-            .where(eq(sessionOntologyTouches.sessionId, sessionId));
-        const set = new Set(rows.map((r) => r.ontology));
-        this.cache.set(sessionId, set);
-        return set;
-    }
-    /** Record a touched ontology (idempotent) and update the cache. */
-    async record(sessionId, ontology, current) {
-        if (current.has(ontology))
-            return; // already recorded; no DB write needed
-        await this.db
-            .insert(sessionOntologyTouches)
-            .values({ sessionId, ontology })
-            .onConflictDoNothing({ target: [sessionOntologyTouches.sessionId, sessionOntologyTouches.ontology] });
-        current.add(ontology);
-    }
-}
-//# sourceMappingURL=session-ontology.service.js.map

package/dist/modules/workflow/session-ontology.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.service.js","sourceRoot":"","sources":["../../../src/modules/workflow/session-ontology.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAIvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuBnD,MAAM,OAAO,sBAAsB;IAkBd;IAEA;IAnBnB;;;;OAIG;IACc,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExD;;;;;;OAMG;IACc,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;IAE9C,YACmB,EAAY;IAC7B,+EAA+E;IAC9D,EAA6B;QAF7B,OAAE,GAAF,EAAE,CAAU;QAEZ,OAAE,GAAF,EAAE,CAA2B;IAC7C,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,MAAc,EACd,OAAgB,EAChB,SAAkB;QAElB,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAuB,EAAE,OAAgB;QAC9E,4EAA4E;QAC5E,yCAAyC;QACzC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAElD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAkB,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACpB,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,cAAc,CAAC,MAAY;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,MAAM,CAAC,sBAAsB,CAAC;aAC9B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aACnD,SAAS,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,2EAA2E;QAC3E,kEAAkE;QAClE,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,WAAW,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,QAAQ,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;aACrD,IAAI,CAAC,sBAAsB,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAAgB,EAAE,OAAoB;QAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,uCAAuC;QAC1E,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC/B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/modules/workspace/session-ontology.gate.d.ts

@@ -1,114 +0,0 @@
-/**
- * Ontology-session boundary — the per-call gate used by the agent tool handlers.
- *
- * One decision fn, called by every gated file/graph handler:
- *   READS  (isWrite=false) record the touched ontology and always allow.
- *   WRITES (isWrite=true)  run the registered BLOCKING `preWrite` hooks
- *                          (`WorkflowHooks`), then record. The core registers
- *                          no hook, so core alone only TRACKS; the enterprise
- *                          overlay registers the ontology block (see
- *                          `modules/kb/ontology-block.hook.ts`), restoring
- *                          "allowed only while the session is confined to a
- *                          single ontology; once it has touched ≥2, all
- *                          writes are blocked".
- *
- * Skips entirely when: the flag is off, the path is neutral (`ontologyOf` →
- * null), the caller is not an agent, or the caller is the recovery bot. Fails
- * CLOSED for an agent named-path operation that carries no `sessionId`.
- *
- * Lives beside `assertCanRead` in the workspace tools — it does NOT touch
- * `acquireLock` (that gate is protected-branch-only; this boundary applies on
- * all branches and to reads). See `docs/rp4-ontology-boundary-plan-v2.md`.
- */
-import type { KbContext } from '../../shared/kb-context.js';
-import type { JsonSchema } from '../tool-registry/tool.contract.js';
-import { ToolError, type ToolContext } from '../tool-helpers/tool.contract.js';
-import type { ISessionOntologyService } from '../workflow/session-ontology.service.js';
-import type { WorkflowHooks } from '../workflow/workflow-hooks.js';
-/**
- * The `sessionId` input the ontology-session boundary reads: the agent run /
- * conversation id. The in-process agent supplies its thread id automatically
- * (via its per-run internal token); an external agent has no ambient run id,
- * so it must first mint one with the `start_session` tool and then pass it
- * EXPLICITLY on every gated call — the MCP proxy is a pure passthrough and
- * never injects args.
- */
-export declare const SESSION_ID_INPUT: JsonSchema;
-/**
- * Boundary warning appended to ontology-gated tool descriptions so the agent
- * knows the restriction before it calls one. Action-then-why phrasing per
- * docs/glossary.md.
- */
-export declare const ONTOLOGY_BOUNDARY_NOTE = " Stay within one KnowledgeBase ontology per conversation: once this run has read or written files in two different ontologies, every later content write (write_file/edit_file/mkdir/unzip, and both endpoints of move_file/copy_file) is blocked with a 403 and no override. Reads, delete_file and delete_folder never block \u2014 but each one records the ontology it touched and can poison a later content write, so do broad cross-ontology exploration only when you do not intend to write. Note move_file/copy_file are blocked outright when source and destination are different ontologies, since they would carry content across.";
-/** Thrown when a write is refused because the session has crossed ontologies. */
-export declare class OntologyWriteBlockedError extends ToolError {
-    constructor(touched: string[], attempted: string, reason: 'multi-ontology' | 'different-ontology');
-}
-/** Thrown when an agent op on a named ontology carries no session id (fail closed). */
-export declare class MissingSessionError extends ToolError {
-    constructor();
-}
-export interface SessionOntologyGate {
-    service: ISessionOntologyService;
-    enabled: boolean;
-    /** The checkout folder and the layout a path is classified under. */
-    kb: Pick<KbContext, 'kbDirName' | 'layout'>;
-    /** Lowercased email of the recovery/merge bot, which is exempt. */
-    recoveryBotEmail: string;
-    /**
-     * The workflow lifecycle-hook registry whose BLOCKING `preWrite` hooks
-     * decide whether a gated write/shell op proceeds. Core registers none (the
-     * gate then only tracks); the enterprise composition root registers the
-     * ontology block against `workflowService.hooks` — pass that same instance
-     * here.
-     */
-    hooks: WorkflowHooks;
-}
-/**
- * Record a read of `wsPath`'s ontology into the session's touched set. Reads are
- * always allowed — recording is the only effect — but each one widens the
- * touched set and so can poison a later write (see {@link assertOntologyWriteAllowed}).
- * Fails closed (`MissingSessionError`) for an agent read of a named ontology
- * with no session id.
- */
-export declare function recordOntologyRead(gate: SessionOntologyGate, ctx: ToolContext, wsPath: string): Promise<void>;
-/**
- * Assert a write to `wsPath` is allowed, then record it. A write that would
- * carry information into a second ontology is the thing the boundary blocks:
- * permitted only while the session stays confined to the target ontology, and
- * refused with `OntologyWriteBlockedError` once it has touched ≥2. Note `delete`
- * is NOT a write here — removing a node propagates no cross-ontology
- * information, so it goes through {@link recordOntologyRead}.
- *
- * The BLOCKING decision itself lives behind the `preWrite` hooks: the
- * enterprise-registered ontology block evaluates-and-records atomically via
- * `checkOperation(isWrite=true)` and throws to refuse (identical behavior to
- * the previous in-gate decision). Core registers no hook, so with none the
- * write is allowed and only the touch is recorded (tracking stays core). The
- * follow-up read-record after the hooks is idempotent — a no-op when a hook
- * already recorded the allowed write.
- */
-export declare function assertOntologyWriteAllowed(gate: SessionOntologyGate, ctx: ToolContext, wsPath: string): Promise<void>;
-/**
- * Session-level write-eligibility gate for write-capable tools that have no
- * single resolvable target path to check per-call — currently `execute_command`
- * (arbitrary shell). Such a tool cannot be path-confined, so we enforce the
- * boundary at the coarser session level: once the run has crossed into ≥2
- * ontologies (the point at which EVERY path-checked write is already refused),
- * we refuse the tool outright, so shell can't become a write path around the
- * boundary. A fresh or single-ontology session is still allowed; a residual gap
- * remains (a single-ontology session could shell-write a *different* ontology),
- * accepted because arbitrary shell cannot be path-confined and blocking all
- * shell after one KB read would gut its read-style diagnostic use (git/grep/ls).
- *
- * Skips when: the flag is off, the caller is not an agent, the caller is the
- * recovery bot, or there is no session id — there is no named path here to fail
- * closed on, and with no session there is no touched set to evaluate.
- *
- * Like {@link assertOntologyWriteAllowed}, the refusal itself is the
- * enterprise-registered `preWrite` hook's (it evaluates the touched set and
- * throws); core registers none, so shell is never refused in a core-only
- * deployment.
- */
-export declare function assertShellAllowedWithinOntology(gate: SessionOntologyGate, ctx: ToolContext): Promise<void>;
-//# sourceMappingURL=session-ontology.gate.d.ts.map

package/dist/modules/workspace/session-ontology.gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ontology.gate.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/session-ontology.gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAI9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qnBAC4kB,CAAC;AAEhnB,iFAAiF;AACjF,qBAAa,yBAA0B,SAAQ,SAAS;gBAC1C,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,oBAAoB;CAQlG;AAED,uFAAuF;AACvF,qBAAa,mBAAoB,SAAQ,SAAS;;CAQjD;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;IAC5C,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,EAAE,aAAa,CAAC;CACtB;AA4BD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjH"}