@brainervirus/workit-core 5.0.0 → 6.0.1

package/src/core/task-evaluation.ts

@@ -6,7 +6,6 @@ import {
   POLICY_VERSION,
   candidateDigest,
   candidateSchema,
-  decisionDigest,
   failure,
   scopeCovers as contractScopeCovers,
   success,
@@ -25,7 +24,6 @@ import {
   type TaskView,
   type WorkspaceRecord,
 } from "./task-contract";
-import { verifyDecisionContentAtRoot } from "./authority";
 import {
   CHECKS_FILE,
   checkCommand,
@@ -495,6 +493,69 @@ export const findingVerificationPasses = (
   evidence.status === "passed" &&
   (evidence.kind === "check" || evidence.kind === "review") &&
   ((findingCandidateId ?? null) === null || evidence.candidateId != null);
+/** A decision about a document stays current only while its bytes are unchanged. */
+export const verifyDecisionContentAtRoot = (
+  checkoutRoot: string,
+  binding: Decision["binding"],
+): Result<null> => {
+  let root: string;
+  try {
+    root = fs.realpathSync(checkoutRoot);
+  } catch {
+    return failure("permission_denied", "checkout root is unavailable");
+  }
+  for (const reference of binding.contentRefs) {
+    if (reference.kind !== "file") continue;
+    if (!reference.digest)
+      return failure("invalid_input", "document references require a byte digest");
+    const target = path.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path.sep}`))
+      return failure(
+        "invalid_input",
+        "document reference escapes checkout; cite it as an external file:// reference instead",
+        {
+          fields: [
+            { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` },
+          ],
+        },
+      );
+    try {
+      const below = path.relative(root, target);
+      let current = root;
+      for (const segment of below.split(path.sep)) {
+        if (!segment) continue;
+        current = path.join(current, segment);
+        const stat = fs.lstatSync(current);
+        const real = fs.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path.sep}`))
+          return failure(
+            "invalid_input",
+            "document reference escapes checkout; cite it as an external file:// reference instead",
+            {
+              fields: [
+                {
+                  path: "contentRefs.path",
+                  reason: `${reference.path} resolves outside the checkout`,
+                },
+              ],
+            },
+          );
+        if (stat.isSymbolicLink())
+          return failure("invalid_input", "document reference uses a symlink");
+        if (current === target && !stat.isFile())
+          return failure("invalid_input", "document reference is not a regular file");
+        if (current !== target && !stat.isDirectory())
+          return failure("invalid_input", "document reference ancestor is not a directory");
+      }
+      if (digestBytes(fs.readFileSync(target)) !== reference.digest)
+        return failure("permission_denied", "decision document bytes have changed");
+    } catch {
+      return failure("invalid_input", "decision document is unavailable");
+    }
+  }
+  return success(null, null, null);
+};
+
 const applicableDecision = (
   task: TaskRecord,
   workspace: WorkspaceRecord,
@@ -514,7 +575,6 @@ const applicableDecision = (
         decision.requirementIds.includes(requirement.id) &&
         decision.binding.scope &&
         scopeCovers(decision.binding.scope, requirement.scope) &&
-        decision.digest === decisionDigest(decision) &&
         (checkoutRoot
           ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok
           : decision.binding.contentRefs.every((reference) => reference.kind !== "file")),
@@ -537,7 +597,6 @@ const applicableRequirementDecision = (
         data.binding.workspaceId === workspace.id &&
         data.requirementIds.includes(requirement.id) &&
         scopeCovers(data.binding.scope, requirement.scope) &&
-        data.digest === decisionDigest(data) &&
         (checkoutRoot
           ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok
           : data.binding.contentRefs.every((reference) => reference.kind !== "file")),
@@ -903,7 +962,6 @@ export function evaluateClosure(
             decision.purpose === "limitation" &&
             decision.response === "approved" &&
             decision.revoked === null &&
-            decision.digest === decisionDigest(decision) &&
             verifyDecisionContentAtRoot(view.workspace.root, decision.binding).ok &&
             decision.binding.taskId === view.task.id &&
             decision.binding.workspaceId === view.workspace.id &&

package/src/core/task-store.ts

@@ -5,8 +5,8 @@
 //
 //   store.json                       format marker (a newer format fails closed)
 //   checkouts/<slug>/workspace.json  this checkout's workspace record
-//   checkouts/<slug>/metadata.lock   checkout lock: workspace writes, task
-//                                    creation and managed external actions
+//   checkouts/<slug>/metadata.lock   checkout lock: workspace writes and task
+//                                    creation
 //   tasks/<id>/events.jsonl          the task's append-only event log
 //   tasks/<id>/snapshot.json         rebuildable cache of the reduced state
 //   tasks/<id>/lock                  task lock: one append at a time
@@ -24,7 +24,6 @@
 // A 2.x store in `<root>/.workit` is migrated on first use (idempotent, under
 // the checkout lock, backup kept). The migrated `.workit/workspace.json` is
 // replaced by a marker that 2.x readers reject with an upgrade message.
-import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import path from "node:path";
@@ -341,7 +340,6 @@ export const sameDirectoryIdentity = (left: string, right: string): boolean => {
   }
 };
 
-const externalActionLockRoots = new AsyncLocalStorage<ReadonlySet<string>>();
 /** Locks this process holds; waiting on them can only time out. */
 const heldInProcess = new Map<string, number>();
 const hold = (lock: string) => heldInProcess.set(lock, (heldInProcess.get(lock) ?? 0) + 1);
@@ -854,7 +852,6 @@ export class TaskStore {
         const reserved = this.writeWorkspace(nextWorkspace.data);
         if (!reserved.ok) return reserved;
         const uncertain = (message: string) => {
-          this.markUncertain(nextWorkspace.data);
           return failure("external_outcome_unknown", message, {
             operation: "coupled_mutation",
             outcome: "unknown",
@@ -885,92 +882,6 @@ export class TaskStore {
     return result;
   }
 
-  /** Hold this checkout's lock across a managed effect. */
-  async withExternalActionLock<T>(
-    operation: () => Promise<Result<T>>,
-    reentrant = false,
-  ): Promise<Result<T>> {
-    const activeRoots = externalActionLockRoots.getStore();
-    if (
-      activeRoots &&
-      [...activeRoots].some((root) => root === this.root || sameDirectoryIdentity(root, this.root))
-    )
-      return operation();
-    const ready = this.ready(true);
-    if (!ready.ok) return ready;
-    const lockPath = this.paths().checkoutLock;
-    try {
-      this.initializeStorage();
-    } catch (error) {
-      return failure("storage_error", `unable to initialize store: ${String(error)}`, {
-        path: this.paths().dir,
-      });
-    }
-    let handle: FileLockSyncHandle;
-    try {
-      const options = this.lockOptions(lockPath);
-      handle = this.acquire(lockPath, {
-        ...options,
-        payload: () => ({ ...options.payload(), externalAction: true }),
-      });
-    } catch (error) {
-      return this.lockFailure(lockPath, error);
-    }
-    hold(lockPath);
-    let result: Result<T>;
-    try {
-      if (!handle.verifyStillHeld())
-        result = failure("recovery_required", "metadata lock was compromised", { path: lockPath });
-      else {
-        try {
-          const run = () => operation();
-          result = await (reentrant
-            ? externalActionLockRoots.run(new Set([...(activeRoots ?? []), this.root]), run)
-            : run());
-        } catch {
-          result = failure("external_outcome_unknown", "external action outcome is unknown", {
-            outcome: "unknown",
-          });
-        }
-        try {
-          if (!handle.verifyStillHeld())
-            result = failure("external_outcome_unknown", "metadata lock was compromised", {
-              outcome: "unknown",
-              path: lockPath,
-            });
-        } catch {
-          result = failure("external_outcome_unknown", "metadata lock could not be verified", {
-            outcome: "unknown",
-            path: lockPath,
-          });
-        }
-      }
-    } catch {
-      result = failure("external_outcome_unknown", "external action lock operation failed", {
-        outcome: "unknown",
-        path: lockPath,
-      });
-    }
-    drop(lockPath);
-    try {
-      retryTransient(() => handle.release());
-    } catch (error) {
-      const released = this.lockFailure(lockPath, error);
-      const releaseError = released.ok ? "metadata lock release failed" : released.error;
-      return result.ok
-        ? failure(
-            "external_outcome_unknown",
-            "external action metadata lock release is uncertain",
-            {
-              outcome: "unknown",
-              path: lockPath,
-            },
-          )
-        : failure("recovery_required", `${result.error}; ${releaseError}`, result.details);
-    }
-    return result;
-  }
-
   /**
    * `workit gc`: compact long task logs into a checkpoint plus their most
    * recent events (the latest state is never lost), remove unreferenced
@@ -1700,7 +1611,6 @@ export class TaskStore {
           revision: newRevision(),
           root: this.root,
           runtime: { createdWith: runtimeVersion(), updatedWith: runtimeVersion() },
-          writer: null,
         };
   }
 
@@ -1747,16 +1657,6 @@ export class TaskStore {
     }
   }
 
-  private markUncertain(workspace: WorkspaceRecord) {
-    if (!workspace.writer || workspace.writer.state === "uncertain") return;
-    this.writeWorkspace({
-      ...workspace,
-      writer: { ...workspace.writer, state: "uncertain" as const },
-      revision: newRevision(),
-      runtime: stampNew(workspace),
-    });
-  }
-
   // -------------------------------------------------------------------------
   // internals: index cache
 
@@ -2388,11 +2288,6 @@ export class TaskStore {
       try {
         lock = parseMetadataLockOrNull(fs.readFileSync(lockPath, "utf8"));
       } catch {}
-      if (lock?.externalAction)
-        return failure("writer_conflict", "workspace is reserved by a managed external action", {
-          outcome: "not_started",
-          path: lockPath,
-        });
       return failure(
         "busy",
         `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`,

package/src/core/workers.ts

@@ -1,30 +1,17 @@
-import {
-  canonicalJson,
-  failure,
-  success,
-  type Caller,
-  type Id,
-  type Owner,
-  type Provenance,
-  type Ref,
-  type Result,
-  type Revision,
-  type TaskRecord,
-  type Worker,
-  type WorkerReport,
-  type WorkspaceRecord,
+import type {
+  Caller,
+  Id,
+  Provenance,
+  Ref,
+  Result,
+  Revision,
+  Worker,
+  WorkerReport,
 } from "./task-contract";
-import { TaskStore } from "./task-store";
 
 export type WorkerState = Worker["state"];
 export type HostSession = Extract<Ref, { kind: "host" }>;
 
-/** The adapter-owned caller identity used by all writer checks. */
-export type CallerContext = Caller & {
-  workerId?: Id | null;
-  session?: HostSession;
-};
-
 export type NativeWorkerObservation = {
   taskId: Id;
   workerId: Id;
@@ -44,55 +31,9 @@ export type NativeWorkerVerification = {
   caller: Caller;
 };
 
-/**
- * Host attestation for a worker that has no session yet: `prepare` claims the launch
- * slot, `not_started` claims that no child was ever created for that same reservation.
- */
-export type WorkerDispatchStage = "prepare" | "not_started";
-
-export type NativeWorkerDispatchVerification = {
-  observation: unknown;
-  expected: {
-    taskId: Id;
-    workspaceId: Id;
-    workerId: Id;
-    expectedRevision: Revision;
-    expectedWorkspaceRevision: Revision;
-    stage: WorkerDispatchStage;
-  };
-  caller: Caller;
-};
-
+/** A host that observes its own child sessions attests their lifecycle. */
 export type NativeWorkerVerifier = {
   verifyWorker: (input: NativeWorkerVerification) => Result<Provenance>;
-  /** Hosts that can observe their own launch surface also attest dispatch stages. */
-  verifyDispatch?: (input: NativeWorkerDispatchVerification) => Result<Provenance>;
-};
-
-declare const workerDispatch: unique symbol;
-/** Opaque in-process launch reservation. Adapters hold it; it is never serialized. */
-export type WorkerDispatch = { readonly [workerDispatch]: true };
-
-export type WorkerDispatchRequest = {
-  taskId: Id;
-  workerId: Id;
-  expectedRevision: Revision;
-  expectedWorkspaceRevision: Revision;
-  observation: unknown;
-};
-
-export type WorkerDispatchCommit = WorkerDispatchRequest & {
-  dispatch: WorkerDispatch;
-  outcome: "started" | "not_started";
-  session: HostSession | null;
-};
-
-const same = (left: unknown, right: unknown): boolean => {
-  try {
-    return canonicalJson(left) === canonicalJson(right);
-  } catch {
-    return false;
-  }
 };
 
 /** The one shared definition of active or uncertain worker state used by
@@ -103,97 +44,10 @@ export const isUncertainWorker = (state: WorkerState): boolean =>
 
 /**
  * Lifecycle gate table: which worker states block each lead transition.
- * Pause freezes, so live workers never block it (writer release stays a
- * separate explicit step); resume, revise, and close must reconcile first.
+ * Pause freezes, so live workers never block it; resume, revise, and close
+ * must reconcile first.
  */
 export const workerBlocksTransition = (
   transition: "pause" | "resume" | "revise" | "close",
   state: WorkerState,
 ): boolean => (transition === "pause" ? false : isUncertainWorker(state));
-
-const callerSession = (caller: CallerContext): HostSession =>
-  caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
-
-const validPath = (value: unknown): value is string =>
-  typeof value === "string" &&
-  value.length > 0 &&
-  !Array.from(value).some((char) => {
-    const code = char.charCodeAt(0);
-    return code < 32 || code === 127;
-  }) &&
-  !value.split(/[\\/]/).includes("..");
-
-const callerValue = (value: CallerContext): Caller => ({ host: value.host, actor: value.actor });
-const workerIdOf = (value: CallerContext): Id | null => value.workerId ?? null;
-
-export type ProductWriteInput = {
-  task: TaskRecord;
-  workspace: WorkspaceRecord;
-  caller: CallerContext;
-  paths: string[];
-  store?: TaskStore;
-};
-
-export const currentWriterOwnsTask = (
-  task: TaskRecord,
-  workspace: WorkspaceRecord,
-  caller: { host: string; actor: string },
-): boolean => {
-  const owner = workspace.writer?.owner;
-  return (
-    task.status === "active" &&
-    task.workspaceId === workspace.id &&
-    owner?.taskId === task.id &&
-    owner.session.host === caller.host &&
-    owner.session.handle === caller.actor
-  );
-};
-
-/** Check the authoritative workspace owner and the caller's role. File paths
- *  are host-policy territory: only malformed paths are rejected here, never
- *  out-of-scope ones. */
-export function assertProductWriteAllowed(input: ProductWriteInput): Result<Owner> {
-  if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
-    return failure("invalid_input", "invalid product write path");
-  if (!input.store) return failure("permission_denied", "write authorization requires core state");
-  const task = input.store.readTask(input.task.id);
-  if (!task.ok) return task;
-  const workspace = input.store.readWorkspace();
-  if (!workspace.ok) return workspace;
-  if (!workspace.data) return failure("not_found", "workspace not found");
-  const workspaceRecord = workspace.data;
-  if (task.data.status !== "active")
-    return failure("invalid_transition", "paused or closed tasks cannot own product writes");
-  if (workspaceRecord.id !== task.data.workspaceId || workspaceRecord.root.length === 0)
-    return failure("recovery_required", "task and workspace bindings are invalid");
-  const writer = workspaceRecord.writer;
-  if (!writer) return failure("permission_denied", "checkout has no writer owner");
-  if (writer.state === "uncertain")
-    return failure("recovery_required", "checkout writer requires recovery", {
-      owner: writer.owner,
-    });
-  const caller = callerValue(input.caller);
-  const workerId = workerIdOf(input.caller);
-  const owner = writer.owner;
-  if (
-    owner.taskId !== task.data.id ||
-    owner.workerId !== workerId ||
-    owner.session.host !== caller.host ||
-    owner.session.handle !== caller.actor
-  )
-    return failure("writer_conflict", "checkout is owned by another validated actor", { owner });
-  const worker =
-    workerId === null ? null : task.data.workers.find((entry) => entry.id === workerId);
-  if (workerId !== null && (!worker || worker.data.assignment.role !== "implementer"))
-    return failure("permission_denied", "only implementers can own product writes");
-  if (
-    workerId !== null &&
-    (!worker?.data.session ||
-      worker.data.state === "cancelling" ||
-      worker.data.state === "unknown" ||
-      worker.data.state === "stopped" ||
-      !same(worker.data.session, callerSession(input.caller)))
-  )
-    return failure("recovery_required", "worker session is not an active writer");
-  return success(null, workspaceRecord.revision, owner);
-}

package/src/core/workspaces.ts

@@ -117,7 +117,22 @@ const workspaceConfigSchema = z
       })
       .passthrough()
       .optional(),
+    /** Legacy (≤4.x) standing approvals; read once as autonomy grants (autonomy.ts). */
     autoApprove: z.union([z.boolean(), z.array(nonBlank)]).optional(),
+    /** Where an unnamed request stops (skills read it); same rules as grants. */
+    defaultEndpoint: z.enum(["commit", "pr"]).optional(),
+    /** Autonomy grants (D15): only ever set here, by the user. */
+    autonomy: z
+      .object(
+        Object.fromEntries(
+          ["push", "pr", "merge", "release", "rerun"].map((kind) => [
+            kind,
+            z.union([z.boolean(), z.literal("verified")]).optional(),
+          ]),
+        ),
+      )
+      .passthrough()
+      .optional(),
     youtrack: z
       .object({ baseUrl: nonBlank.optional(), link_issues: z.boolean().optional() })
       .passthrough()

package/src/core/youtrack-writes.ts

@@ -0,0 +1,92 @@
+// Idempotent YouTrack writes for `workit youtrack note|time|meeting` (S16
+// review M4). Each comment or work item carries a deterministic marker,
+// `<!-- workit-action:<sha256> -->`, derived from the request. Before writing,
+// the issue is read back and a write whose marker is already present is
+// skipped (`already_done`); after a write with an unknown outcome (a timeout
+// after the server applied it), the read-back settles it instead of a retry
+// posting a duplicate.
+import { sha256 } from "./task-contract";
+import { youTrackRequest, youTrackToken } from "./youtrack";
+
+export type MarkerWhere = "comments" | "workItems";
+
+export const youTrackMarker = (request: Record<string, unknown>): string | null => {
+  const creds = youTrackToken();
+  if ("error" in creds) return null;
+  return `<!-- workit-action:${sha256({ ...request, baseUrl: creds.base })} -->`;
+};
+
+export const withMarker = (text: string, marker: string): string =>
+  `${text}${text ? "\n\n" : ""}${marker}`;
+
+const PAGE = 500;
+
+/** true/false when the read-back is conclusive, null when it is not. */
+export async function markerPresent(
+  issueId: string,
+  marker: string,
+  where: MarkerWhere,
+): Promise<boolean | null> {
+  const creds = youTrackToken();
+  if ("error" in creds) return null;
+  const endpoint =
+    where === "comments"
+      ? `/api/issues/${encodeURIComponent(issueId)}/comments?fields=id,text,deleted`
+      : `/api/issues/${encodeURIComponent(issueId)}/timeTracking/workItems?fields=id,text`;
+  const result = await youTrackRequest(`${creds.base}${endpoint}&$top=${PAGE}&$skip=0`, {
+    method: "GET",
+    token: creds.token,
+  });
+  if (result.status !== 0) return null;
+  try {
+    const items = JSON.parse(result.stdout) as unknown;
+    if (!Array.isArray(items)) return null;
+    const found = items.some(
+      (item) =>
+        item &&
+        typeof item === "object" &&
+        (item as { deleted?: unknown }).deleted !== true &&
+        typeof (item as { text?: unknown }).text === "string" &&
+        (item as { text: string }).text.includes(marker),
+    );
+    // A full page may hide an older match: only a hit is conclusive then.
+    return found ? true : items.length < PAGE ? false : null;
+  } catch {
+    return null;
+  }
+}
+
+type WriteResult = { ok: boolean; error?: string | null; data?: unknown };
+
+export type OnceOutcome =
+  | {
+      status: "done" | "already_done" | "settled";
+      data?: unknown;
+      /** The pre-write read-back could not rule out an earlier copy (>1 page). */
+      precheck?: "inconclusive";
+    }
+  | { status: "failed" | "unknown"; error: string; data?: unknown };
+
+/** Write at most once: skip when the marker is there, read back an unknown outcome. */
+export async function writeOnce(
+  issueId: string,
+  marker: string,
+  where: MarkerWhere,
+  write: () => Promise<WriteResult>,
+): Promise<OnceOutcome> {
+  const before = await markerPresent(issueId, marker, where);
+  if (before === true) return { status: "already_done" };
+  const precheck = before === null ? { precheck: "inconclusive" as const } : {};
+  const result = await write();
+  if (result.ok) return { status: "done", data: result.data, ...precheck };
+  const outcome = (result.data as { outcome?: unknown } | undefined)?.outcome;
+  if (outcome === "not_applied")
+    return { status: "failed", error: result.error ?? "not applied", data: result.data };
+  const settled = await markerPresent(issueId, marker, where);
+  if (settled === true) return { status: "settled", ...precheck };
+  return {
+    status: settled === false ? "failed" : "unknown",
+    error: result.error ?? "YouTrack write failed",
+    data: result.data,
+  };
+}

package/src/core.ts

@@ -24,8 +24,6 @@ export {
   candidateDigest,
   requirementId,
   rewriteRecordRefs,
-  BINDING_QUESTION_BUDGET,
-  workitBindingQuestionIssue,
 } from "./core/task-contract";
 export type {
   OperationFamily,
@@ -74,76 +72,7 @@ export type { MethodId, SelectedMethod } from "./core/methods";
 export { shellBranchPolicyViolation, shellBranchTarget } from "./core/route-intent";
 export { classifyBranchDirt } from "./core/branch";
 export type { BranchDirt } from "./core/branch";
-export {
-  AUTO_CLASSES,
-  autoApproves,
-  operationAutoClass,
-  resolveAutoApproval,
-  standingApprovalLive,
-  standingAutoApplies,
-  standingAutoBinding,
-  standingReceiptFor,
-  verifyStandingApproval,
-} from "./core/auto-approval";
-export type {
-  AutoApproval,
-  AutoClass,
-  StandingAutoBinding,
-  StandingReceipt,
-} from "./core/auto-approval";
 export { bundleHashOfFile, isEphemeralCachePath, sha256Hex } from "./core/runtime-identity";
-export { applicableDecision, reserveAction, settleAction, reconcileAction } from "./core/authority";
-export { normalizeChainSteps, chainStepKey } from "./core/authority";
-export type { ChainStep } from "./core/authority";
-export {
-  createAuthorizedExternalActionRunner,
-  runAuthorizedExternalAction,
-} from "./core/external-action";
-export type {
-  AuthorizedActionInput,
-  ExternalActionResult,
-  ExternalActionRunner,
-  ExternalActionEffect,
-  ExternalActionBinding,
-  NativeExternalActionObservation,
-  ExternalActionRequest,
-  ExternalActionOperation,
-} from "./core/external-action";
-export {
-  approvedBranchSetupIntent,
-  approvedChainStep,
-  approvedExternalAction,
-  approvedPlanCommit,
-  branchSetupIntent,
-  chainStepBinding,
-  planCommitDescriptor,
-  planCommitBinding,
-  commitMessageFromDescriptor,
-  externalActionState,
-  priorExternalAction,
-  priorResolvedDrift,
-  externalActionRef,
-  externalActionDescriptor,
-  externalActionHelp,
-  externalActionJsonSchema,
-  externalActionSchema,
-  planReservationLength,
-  externalActionRequest,
-  matchesNativeExternalAction,
-  nativeExternalActionObservation,
-  readNativeExternalActionObservation,
-} from "./core/external-action";
-export type {
-  ActionReservation,
-  NativeAuthorityContext,
-  NativeAuthorityVerifier,
-  NativeActionVerification,
-  NativeReconciliationVerification,
-  NativeDecisionVerification,
-  ReserveActionInput,
-  SettleActionInput,
-  ReconcileActionInput,
-} from "./core/authority";
 export {
   captureCandidate,
   checkPin,
@@ -156,20 +85,14 @@ export {
 export type { CandidateEnvironment, ClosureEvaluation } from "./core/task-evaluation";
 export { WorkitCore } from "./core/task-engine";
 export type { OperationContext } from "./core/task-engine";
-export { assertProductWriteAllowed } from "./core/workers";
 export type {
-  CallerContext,
   HostSession,
-  NativeWorkerDispatchVerification,
   NativeWorkerObservation,
   NativeWorkerVerification,
   NativeWorkerVerifier,
-  ProductWriteInput,
-  WorkerDispatch,
-  WorkerDispatchCommit,
-  WorkerDispatchRequest,
-  WorkerDispatchStage,
 } from "./core/workers";
+export { contextReadJsonSchema, parseContextRead, readExternalContext } from "./core/context-read";
+export type { ContextReadPayload } from "./core/context-read";
 
 export type Result<T> =
   | { ok: true; data: T; error: null }