@calliopelabs/cli 3.5.4 → 3.6.0

package/dist/orchestration/interruption.js

@@ -0,0 +1,38 @@
+import { authorizeSessionAction } from '../session-management/index.js';
+import { inspectExecution } from './coordinator-actions.js';
+import { RunStore } from './store.js';
+import { OrchestrationError } from './types.js';
+export function interruptionRecoveryCapabilities() {
+    return { version: 1, owner: 'calliope-cli', eventVersion: 10, semantics: 'record-interruption-without-execution' };
+}
+/** Record a confirmed dead coordinator without retrying work or settling charges. */
+export async function recoverInterruptedExecution(cwd, runId, revision, options = {}) {
+    const initial = await inspectExecution(cwd, runId, options), { store, execution, owner } = initial;
+    if (typeof revision !== 'string' || !/^[a-f0-9]{64}$/.test(revision))
+        throw new OrchestrationError('invalid', 'Recovery requires the observed execution revision.');
+    if (!execution || execution.state.status !== 'running' || !execution.state.ownerId || !owner || owner.alive || owner.id !== execution.state.ownerId)
+        throw new OrchestrationError('conflict', 'Recovery requires a confirmed dead matching coordinator.');
+    store.assertRevision(revision);
+    store.assertApproval(execution.header);
+    const authority = initial.view.manifest.version === 2 ? (await import('../goals/index.js')).goalRunAuthority(initial.view.manifest, (options.store ?? new RunStore()).root) : undefined;
+    authority?.assertActive();
+    await authorizeSessionAction(cwd, 'orchestration_recover', { path: cwd, runId, revision, ownerId: owner.id,
+        planHash: execution.state.graph?.hash ?? initial.view.manifest.planHash, operation: 'Record interrupted work without execution, retry or budget settlement.' }, options);
+    const currentOwner = store.owner();
+    if (!currentOwner || currentOwner.alive || currentOwner.id !== owner.id || currentOwner.pid !== owner.pid)
+        throw new OrchestrationError('conflict', 'Coordinator ownership changed during recovery review.');
+    const lease = store.acquire();
+    try {
+        await store.append({ type: 'interruption_recovered', ownerId: owner.id, source: options.source === 'repl' ? 'repl' : 'cli' }, options.signal, undefined, () => {
+            lease.check();
+            store.assertRevision(revision);
+            store.assertApproval(execution.header);
+            authority?.assertActive();
+        });
+        return store.read();
+    }
+    finally {
+        lease.release();
+    }
+}
+//# sourceMappingURL=interruption.js.map

package/dist/orchestration/interruption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interruption.js","sourceRoot":"","sources":["../../src/orchestration/interruption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAC,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAC,QAAQ,EAAC,MAAM,YAAY,CAAC;AACpC,OAAO,EAAC,kBAAkB,EAAC,MAAM,YAAY,CAAC;AAG9C,MAAM,UAAU,gCAAgC;IAC9C,OAAO,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,cAAc,EAAC,YAAY,EAAC,EAAE,EAAC,SAAS,EAAC,uCAAuC,EAAU,CAAC;AACrH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAU,EAAC,KAAY,EAAC,QAAe,EAAC,OAAO,GAAkB,EAAE;IACnH,MAAM,OAAO,GAAC,MAAM,gBAAgB,CAAC,GAAG,EAAC,KAAK,EAAC,OAAO,CAAC,EAAC,EAAC,KAAK,EAAC,SAAS,EAAC,KAAK,EAAC,GAAC,OAAO,CAAC;IACxF,IAAG,OAAO,QAAQ,KAAG,QAAQ,IAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAC,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAC,oDAAoD,CAAC,CAAC;IAC7J,IAAG,CAAC,SAAS,IAAE,SAAS,CAAC,KAAK,CAAC,MAAM,KAAG,SAAS,IAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAE,CAAC,KAAK,IAAE,KAAK,CAAC,KAAK,IAAE,KAAK,CAAC,EAAE,KAAG,SAAS,CAAC,KAAK,CAAC,OAAO;QAClI,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,0DAA0D,CAAC,CAAC;IACtG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAAA,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,SAAS,GAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAG,CAAC,CAAA,CAAC,CAAA,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAC,CAAC,OAAO,CAAC,KAAK,IAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IAC7K,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,MAAM,sBAAsB,CAAC,GAAG,EAAC,uBAAuB,EAAC,EAAC,IAAI,EAAC,GAAG,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,CAAC,EAAE;QAChG,QAAQ,EAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAC,SAAS,EAAC,wEAAwE,EAAC,EAAC,OAAO,CAAC,CAAC;IACpK,MAAM,YAAY,GAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACjC,IAAG,CAAC,YAAY,IAAE,YAAY,CAAC,KAAK,IAAE,YAAY,CAAC,EAAE,KAAG,KAAK,CAAC,EAAE,IAAE,YAAY,CAAC,GAAG,KAAG,KAAK,CAAC,GAAG;QAC5F,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,uDAAuD,CAAC,CAAC;IACnG,MAAM,KAAK,GAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,wBAAwB,EAAC,OAAO,EAAC,KAAK,CAAC,EAAE,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,KAAG,MAAM,CAAA,CAAC,CAAA,MAAM,CAAA,CAAC,CAAA,KAAK,EAAC,EAAC,OAAO,CAAC,MAAM,EAAC,SAAS,EAAC,GAAE,EAAE;YAC3I,KAAK,CAAC,KAAK,EAAE,CAAC;YAAA,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAAA,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAA,SAAS,EAAE,YAAY,EAAE,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAO,CAAC;QAAA,KAAK,CAAC,OAAO,EAAE,CAAC;IAAA,CAAC;AAC5B,CAAC"}

package/dist/orchestration/question-contract.d.ts

@@ -0,0 +1,19 @@
+/** A question is input to one tool call, never an expansion of its authority. */
+export interface ExecutionQuestionRequest {
+    id: string;
+    ownerId: string;
+    attempt: number;
+    sessionId: string;
+    callId: string;
+    text: string;
+    options: string[];
+    context: string | null;
+}
+export interface ExecutionQuestion extends ExecutionQuestionRequest {
+    taskId: string;
+    status: 'pending' | 'answered' | 'closed';
+    answer: string | null;
+}
+export declare function validateQuestionRequest(value: unknown): asserts value is ExecutionQuestionRequest;
+export declare function validateQuestionAnswer(value: unknown): asserts value is string;
+//# sourceMappingURL=question-contract.d.ts.map

package/dist/orchestration/question-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"question-contract.d.ts","sourceRoot":"","sources":["../../src/orchestration/question-contract.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAC;IACvE,IAAI,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,EAAE,CAAC;IAAA,OAAO,EAAC,MAAM,GAAC,IAAI,CAAC;CAClD;AACD,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,MAAM,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,SAAS,GAAC,UAAU,GAAC,QAAQ,CAAC;IAAA,MAAM,EAAC,MAAM,GAAC,IAAI,CAAC;CACvE;AACD,wBAAgB,uBAAuB,CAAC,KAAK,EAAC,OAAO,GAAE,OAAO,CAAC,KAAK,IAAI,wBAAwB,CAQ/F;AACD,wBAAgB,sBAAsB,CAAC,KAAK,EAAC,OAAO,GAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAoB"}

package/dist/orchestration/question-contract.js

@@ -0,0 +1,21 @@
+import { array, fail, integer, shape, text, uuid } from './validation.js';
+export function validateQuestionRequest(value) {
+    shape(value, ['id', 'ownerId', 'attempt', 'sessionId', 'callId', 'text', 'options', 'context']);
+    if (!uuid(value.id) || !uuid(value.ownerId))
+        fail('Invalid question request identity.');
+    integer(value.attempt, 1, 4);
+    text(value.sessionId, 128);
+    text(value.callId, 256);
+    if (!/^[a-zA-Z0-9_-]+$/.test(value.sessionId))
+        fail('Invalid question session.');
+    text(value.text, 8192);
+    array(value.options, 8);
+    for (const option of value.options)
+        text(option, 256);
+    if (new Set(value.options).size !== value.options.length)
+        fail('Question options must be distinct.');
+    if (value.context !== null)
+        text(value.context, 8192);
+}
+export function validateQuestionAnswer(value) { text(value, 8192); }
+//# sourceMappingURL=question-contract.js.map

package/dist/orchestration/question-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"question-contract.js","sourceRoot":"","sources":["../../src/orchestration/question-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,IAAI,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAUnE,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,KAAK,CAAC,KAAK,EAAC,CAAC,IAAI,EAAC,SAAS,EAAC,SAAS,EAAC,WAAW,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,SAAS,CAAC,CAAC,CAAC;IACxF,IAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,OAAO,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAAA,IAAI,CAAC,KAAK,CAAC,SAAS,EAAC,GAAG,CAAC,CAAC;IAAA,IAAI,CAAC,KAAK,CAAC,MAAM,EAAC,GAAG,CAAC,CAAC;IAC5E,IAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;IAAA,KAAK,CAAC,KAAK,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC;IAAA,KAAI,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;QAAC,IAAI,CAAC,MAAM,EAAC,GAAG,CAAC,CAAC;IAChG,IAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAG,KAAK,CAAC,OAAO,CAAC,MAAM;QAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACjG,IAAG,KAAK,CAAC,OAAO,KAAG,IAAI;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,KAAa,IAA2B,IAAI,CAAC,KAAK,EAAC,IAAI,CAAC,CAAC,CAAA,CAAC"}

package/dist/orchestration/questions.d.ts

@@ -0,0 +1,9 @@
+import type { ToolCall } from '../types.js';
+import type { RunActionOptions } from './actions.js';
+import type { ExecutionInspection } from './coordinator-types.js';
+import type { ExecutionStore } from './execution-store.js';
+/** The coordinator retains its lease and active task slot throughout this wait. */
+export declare function waitForExecutionAnswer(store: ExecutionStore, taskId: string, call: ToolCall, signal: AbortSignal | undefined, assertAuthority: () => void): Promise<string>;
+/** Answer one inspected request under current policy and the journal writer lock. */
+export declare function answerExecutionQuestion(cwd: string, runId: string, questionId: string, revision: string, answer: string, options?: RunActionOptions): Promise<ExecutionInspection>;
+//# sourceMappingURL=questions.d.ts.map

package/dist/orchestration/questions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"questions.d.ts","sourceRoot":"","sources":["../../src/orchestration/questions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,wBAAwB,CAAC;AAGhE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAczD,mFAAmF;AACnF,wBAAsB,sBAAsB,CAAC,KAAK,EAAC,cAAc,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC,WAAW,GAAC,SAAS,EAAC,eAAe,EAAC,MAAI,IAAI,GAAE,OAAO,CAAC,MAAM,CAAC,CAiBnK;AAED,qFAAqF;AACrF,wBAAsB,uBAAuB,CAAC,GAAG,EAAC,MAAM,EAAC,KAAK,EAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,GAAC,gBAAmB,gCAqBhJ"}

package/dist/orchestration/questions.js

@@ -0,0 +1,75 @@
+import { randomUUID } from 'node:crypto';
+import { dirname } from 'node:path';
+import { canonicalJson, describeApproval, digest } from '../approvals/index.js';
+import { cancellableDelay, throwIfCancelled } from '../cancellation.js';
+import { authorizeSessionAction } from '../session-management/index.js';
+import { withScope } from '../scope.js';
+import { inspectExecution } from './coordinator-actions.js';
+import { agentStopped } from './execution-journal.js';
+import { validateQuestionRequest, validateQuestionAnswer } from './question-contract.js';
+import { OrchestrationError } from './types.js';
+import { hex, shape, uuid } from './validation.js';
+function pendingQuestion(store, execution, id) {
+    const q = execution.state.questions?.[id], owner = store.owner();
+    if (!q || q.status !== 'pending' || !owner?.alive || owner.id !== q.ownerId || execution.state.ownerId !== q.ownerId)
+        throw new OrchestrationError('conflict', 'Question has no live waiting coordinator; inspect its task before recovery.');
+    const task = execution.state.tasks[q.taskId], context = store.context(execution), agent = context.plan.agents.find(a => a.id === task.agentId);
+    if (task.status !== 'running' || task.sessionId !== q.sessionId || task.attempts !== q.attempt || agentStopped(execution.state, context, agent.id) || Date.now() >= Math.min(execution.header.deadline, Date.parse(execution.header.createdAt) + agent.timeBudgetMs))
+        throw new OrchestrationError('conflict', 'Question task stopped or its original deadline expired.');
+    store.assertApproval(execution.header);
+    return q;
+}
+/** The coordinator retains its lease and active task slot throughout this wait. */
+export async function waitForExecutionAnswer(store, taskId, call, signal, assertAuthority) {
+    throwIfCancelled(signal);
+    assertAuthority();
+    if (call.name !== 'ask_question')
+        throw new OrchestrationError('invalid', 'Only ask_question can wait for a question answer.');
+    shape(call.arguments, ['question'], ['options', 'context']);
+    const state = store.read().state, task = state.tasks[taskId];
+    if (!task?.sessionId || !state.ownerId)
+        throw new OrchestrationError('conflict', 'Question has no active task session.');
+    const request = { id: randomUUID(), ownerId: state.ownerId, attempt: task.attempts, sessionId: task.sessionId, callId: call.id,
+        text: call.arguments.question, options: (call.arguments.options ?? []), context: (call.arguments.context ?? null) };
+    validateQuestionRequest(request);
+    await store.append({ type: 'question_asked', taskId, request }, signal, undefined, assertAuthority);
+    for (;;) {
+        throwIfCancelled(signal);
+        assertAuthority();
+        const execution = store.read(), q = execution.state.questions?.[request.id];
+        if (q?.status === 'answered' && q.answer !== null)
+            return q.answer;
+        pendingQuestion(store, execution, request.id);
+        await cancellableDelay(100, signal);
+    }
+}
+/** Answer one inspected request under current policy and the journal writer lock. */
+export async function answerExecutionQuestion(cwd, runId, questionId, revision, answer, options = {}) {
+    if (!uuid(questionId) || !hex(revision))
+        throw new OrchestrationError('invalid', 'Answer requires the exact question ID and inspected execution revision.');
+    validateQuestionAnswer(answer);
+    const initial = await inspectExecution(cwd, runId, options), { store, view } = initial;
+    if (!initial.execution)
+        throw new OrchestrationError('unavailable', 'Run has no execution history.');
+    if (initial.execution.state.revision !== revision)
+        throw new OrchestrationError('conflict', 'Execution changed; inspect the pending question again.');
+    const q = pendingQuestion(store, initial.execution, questionId);
+    const goalAuthority = view.manifest.version === 2 ? (await import('../goals/index.js')).goalRunAuthority(view.manifest, dirname(dirname(store.root))) : undefined;
+    const permissionCall = { id: questionId, name: 'orchestration_answer', arguments: { path: cwd, runId, questionId, revision, taskId: q.taskId, sessionId: q.sessionId, attempt: q.attempt, callId: q.callId, ownerId: q.ownerId,
+            planHash: initial.execution.state.graph?.hash ?? view.manifest.planHash, questionHash: digest(canonicalJson(q)), answerHash: digest(answer) } };
+    const permissionKey = () => withScope(cwd, () => describeApproval(permissionCall, cwd).key), approvedKey = permissionKey();
+    const assertAuthority = () => {
+        throwIfCancelled(options.signal);
+        goalAuthority?.assertActive();
+        const current = store.read();
+        if (current.state.revision !== revision)
+            throw new OrchestrationError('conflict', 'Execution changed during the answer decision.');
+        pendingQuestion(store, current, questionId);
+        if (permissionKey() !== approvedKey)
+            throw new OrchestrationError('policy-denied', 'Question answer scope or policy changed before commit.');
+    };
+    await authorizeSessionAction(cwd, permissionCall.name, permissionCall.arguments, { ...options, confirmation: options.confirmation ?? 'mutating' });
+    await store.append({ type: 'question_answered', taskId: q.taskId, questionId, answer }, options.signal, undefined, assertAuthority);
+    return store.read();
+}
+//# sourceMappingURL=questions.js.map

package/dist/orchestration/questions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"questions.js","sourceRoot":"","sources":["../../src/orchestration/questions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,EAAC,aAAa,EAAC,gBAAgB,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAC,gBAAgB,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAC,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAC,SAAS,EAAC,MAAM,aAAa,CAAC;AAItC,OAAO,EAAC,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAC,uBAAuB,EAAC,sBAAsB,EAA+B,MAAM,wBAAwB,CAAC;AACpH,OAAO,EAAC,kBAAkB,EAAC,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAC,GAAG,EAAC,KAAK,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAE/C,SAAS,eAAe,CAAC,KAAoB,EAAC,SAA6B,EAAC,EAAS;IACnF,MAAM,CAAC,GAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,EAAC,KAAK,GAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5D,IAAG,CAAC,CAAC,IAAE,CAAC,CAAC,MAAM,KAAG,SAAS,IAAE,CAAC,KAAK,EAAE,KAAK,IAAE,KAAK,CAAC,EAAE,KAAG,CAAC,CAAC,OAAO,IAAE,SAAS,CAAC,KAAK,CAAC,OAAO,KAAG,CAAC,CAAC,OAAO;QAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,6EAA6E,CAAC,CAAC;IAC7N,MAAM,IAAI,GAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAE,EAAC,OAAO,GAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAC,KAAK,GAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,IAAI,CAAC,OAAO,CAAE,CAAC;IACrI,IAAG,IAAI,CAAC,MAAM,KAAG,SAAS,IAAE,IAAI,CAAC,SAAS,KAAG,CAAC,CAAC,SAAS,IAAE,IAAI,CAAC,QAAQ,KAAG,CAAC,CAAC,OAAO,IAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAC,OAAO,EAAC,KAAK,CAAC,EAAE,CAAC,IAAE,IAAI,CAAC,GAAG,EAAE,IAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAC,KAAK,CAAC,YAAY,CAAC;QAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,yDAAyD,CAAC,CAAC;IAClV,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoB,EAAC,MAAa,EAAC,IAAa,EAAC,MAA4B,EAAC,eAAwB;IACjJ,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAAA,eAAe,EAAE,CAAC;IAC3C,IAAG,IAAI,CAAC,IAAI,KAAG,cAAc;QAAC,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAC,mDAAmD,CAAC,CAAC;IAC1H,KAAK,CAAC,IAAI,CAAC,SAAS,EAAC,CAAC,UAAU,CAAC,EAAC,CAAC,SAAS,EAAC,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAC,IAAI,GAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,IAAG,CAAC,IAAI,EAAE,SAAS,IAAE,CAAC,KAAK,CAAC,OAAO;QAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,sCAAsC,CAAC,CAAC;IACpH,MAAM,OAAO,GAA0B,EAAC,EAAE,EAAC,UAAU,EAAE,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO,EAAC,OAAO,EAAC,IAAI,CAAC,QAAQ,EAAC,SAAS,EAAC,IAAI,CAAC,SAAS,EAAC,MAAM,EAAC,IAAI,CAAC,EAAE;QACzI,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,QAAkB,EAAC,OAAO,EAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAE,EAAE,CAAa,EAAC,OAAO,EAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAE,IAAI,CAAgB,EAAC,CAAC;IACjJ,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,MAAM,EAAC,SAAS,EAAC,eAAe,CAAC,CAAC;IAC5F,SAAO,CAAC;QACN,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAAA,eAAe,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAC,KAAK,CAAC,IAAI,EAAE,EAAC,CAAC,GAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,IAAG,CAAC,EAAE,MAAM,KAAG,UAAU,IAAE,CAAC,CAAC,MAAM,KAAG,IAAI;YAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC3D,eAAe,CAAC,KAAK,EAAC,SAAS,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,gBAAgB,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAU,EAAC,KAAY,EAAC,UAAiB,EAAC,QAAe,EAAC,MAAa,EAAC,OAAO,GAAkB,EAAE;IAC/I,IAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAC,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAC,yEAAyE,CAAC,CAAC;IACvJ,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAC,MAAM,gBAAgB,CAAC,GAAG,EAAC,KAAK,EAAC,OAAO,CAAC,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,GAAC,OAAO,CAAC;IAC7E,IAAG,CAAC,OAAO,CAAC,SAAS;QAAC,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAC,+BAA+B,CAAC,CAAC;IAClG,IAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAG,QAAQ;QAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,wDAAwD,CAAC,CAAC;IACjJ,MAAM,CAAC,GAAC,eAAe,CAAC,KAAK,EAAC,OAAO,CAAC,SAAS,EAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAG,CAAC,CAAA,CAAC,CAAA,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IACzJ,MAAM,cAAc,GAAC,EAAC,EAAE,EAAC,UAAU,EAAC,IAAI,EAAC,sBAAsB,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,GAAG,EAAC,KAAK,EAAC,UAAU,EAAC,QAAQ,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAC,SAAS,EAAC,CAAC,CAAC,SAAS,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO;YACrM,QAAQ,EAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAC,YAAY,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,EAAC,CAAC;IACzI,MAAM,aAAa,GAAC,GAAE,EAAE,CAAA,SAAS,CAAC,GAAG,EAAC,GAAE,EAAE,CAAA,gBAAgB,CAAC,cAAc,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAC,WAAW,GAAC,aAAa,EAAE,CAAC;IAChH,MAAM,eAAe,GAAC,GAAE,EAAE;QACxB,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAA,aAAa,EAAE,YAAY,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAG,QAAQ;YAAC,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,+CAA+C,CAAC,CAAC;QAC9H,eAAe,CAAC,KAAK,EAAC,OAAO,EAAC,UAAU,CAAC,CAAC;QAC1C,IAAG,aAAa,EAAE,KAAG,WAAW;YAAC,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAC,wDAAwD,CAAC,CAAC;IAC1I,CAAC,CAAC;IACF,MAAM,sBAAsB,CAAC,GAAG,EAAC,cAAc,CAAC,IAAI,EAAC,cAAc,CAAC,SAAS,EAAC,EAAC,GAAG,OAAO,EAAC,YAAY,EAAC,OAAO,CAAC,YAAY,IAAE,UAAU,EAAC,CAAC,CAAC;IAC1I,MAAM,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,mBAAmB,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAC,UAAU,EAAC,MAAM,EAAC,EAAC,OAAO,CAAC,MAAM,EAAC,SAAS,EAAC,eAAe,CAAC,CAAC;IAC1H,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/orchestration/reviewed-ledger.d.ts

@@ -0,0 +1,23 @@
+import type { RunActionOptions } from './actions.js';
+export declare const REVIEWED_LEDGER_CAPABILITY: {
+    readonly version: 1;
+    readonly ownerScope: 1;
+    readonly tokenVersion: 2;
+    readonly reviewedAuthority: 1;
+    readonly grants: 'native-admissions-only';
+};
+/** Returns an unbound server and a private owner token. Only the trusted host listens or delivers credentials. */
+export declare function prepareReviewedLedger(cwd: string, runId: string, agentId: string, maxOutputTokens: number, options?: RunActionOptions): Promise<{
+    server: import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;
+    ownerToken: string;
+    execution: import("../execution/guard.js").AgentExecution;
+    deadline: number;
+    capability: {
+        readonly version: 1;
+        readonly ownerScope: 1;
+        readonly tokenVersion: 2;
+        readonly reviewedAuthority: 1;
+        readonly grants: 'native-admissions-only';
+    };
+}>;
+//# sourceMappingURL=reviewed-ledger.d.ts.map

package/dist/orchestration/reviewed-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewed-ledger.d.ts","sourceRoot":"","sources":["../../src/orchestration/reviewed-ledger.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,cAAc,CAAC;AAEnD,eAAO,MAAM,0BAA0B;aAAE,OAAO,EAAC,CAAC;aAAC,UAAU,EAAC,CAAC;aAAC,YAAY,EAAC,CAAC;aAAC,iBAAiB,EAAC,CAAC;aAAC,MAAM,EAAC,wBAAwB;CAAU,CAAC;AAE7I,kHAAkH;AAClH,wBAAsB,qBAAqB,CAAC,GAAG,EAAC,MAAM,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,eAAe,EAAC,MAAM,EAAC,OAAO,GAAC,gBAAmB;;;;;;0BAHpF,CAAC;6BAAY,CAAC;+BAAc,CAAC;oCAAmB,CAAC;yBAAQ,wBAAwB;;GA6BjI"}

package/dist/orchestration/reviewed-ledger.js

@@ -0,0 +1,49 @@
+/** Host an existing reviewed allowance; native graph admission remains the only writer of children. */
+import { dirname, join } from 'node:path';
+import { canonicalJson, digest } from '../approvals/index.js';
+import { throwIfCancelled } from '../cancellation.js';
+import { accountLineage } from '../execution/authority.js';
+import { effectiveExecutionManifest } from '../execution/child-grants.js';
+import { createLedgerServer } from '../execution/ledger-server.js';
+import { LedgerServerState, mintLedgerToken } from '../execution/ledger-protocol.js';
+import { ExecutionLimitError } from '../execution/types.js';
+import { inspectSpawnAuthority } from '../spawning/authority.js';
+import { RunStore } from './store.js';
+import { ExecutionStore } from './execution-store.js';
+import { agentStopped } from './execution-journal.js';
+import { prepareAgentExecution } from './execution.js';
+export const REVIEWED_LEDGER_CAPABILITY = { version: 1, ownerScope: 1, tokenVersion: 2, reviewedAuthority: 1, grants: 'native-admissions-only' };
+/** Returns an unbound server and a private owner token. Only the trusted host listens or delivers credentials. */
+export async function prepareReviewedLedger(cwd, runId, agentId, maxOutputTokens, options = {}) {
+    const runs = options.store ?? new RunStore(), execution = await prepareAgentExecution(cwd, runId, agentId, maxOutputTokens, { ...options, store: runs });
+    const ledger = execution.ledger, view = await runs.read(runId, cwd, options.signal), history = new ExecutionStore(join(runs.root, runId), view.manifest);
+    const assertOwner = () => { throwIfCancelled(options.signal); execution.assertAuthority(); };
+    const assertAccount = (id) => {
+        assertOwner();
+        const current = history.exists() ? inspectSpawnAuthority(history, ledger) : undefined, context = current?.context ?? view.manifest;
+        if (!context.plan.agents.some(agent => agent.id === id) || current && agentStopped(current.view.state, context, id))
+            throw new ExecutionLimitError('authority', 'Account is not active in the reviewed native graph.');
+    };
+    const assertGrant = (grant) => {
+        assertOwner();
+        const admitted = history.exists() ? inspectSpawnAuthority(history, ledger).view.state.graph?.admissions.find(entry => entry.grant.grant.id === grant.id) : undefined;
+        if (!admitted || canonicalJson(admitted.grant.grant) !== canonicalJson(grant))
+            throw new ExecutionLimitError('authority', 'Child grant requires its existing native reviewed admission.');
+        for (const account of grant.accounts)
+            assertAccount(account.id);
+    };
+    assertAccount(agentId);
+    const saved = ledger.read(cwd), effective = effectiveExecutionManifest(saved.manifest, saved.projection), deadline = Math.min(...accountLineage(effective, agentId).map(account => account.deadline));
+    if (Date.now() >= deadline)
+        throw new ExecutionLimitError('deadline', 'Original owner allowance expired.');
+    history.create({ version: 1, runId, manifestHash: view.manifest.hash, approvalRevision: view.run.revision, createdAt: new Date(saved.manifest.createdAt).toISOString(), deadline: saved.manifest.deadline });
+    assertAccount(agentId);
+    const authority = digest(canonicalJson({ version: 1, runId, manifestHash: view.manifest.hash, approvalRevision: view.run.revision }));
+    const state = new LedgerServerState(join(dirname(ledger.root), `${runId}.ledger-server`));
+    const server = createLedgerServer({ ledger, cwd, state, ownerAgentId: agentId, authority, assertAuthority: assertOwner, assertAccountAuthority: assertAccount, assertGrantAuthority: assertGrant,
+        assertReservationAuthority: reservation => { if (reservation.outputTokens > maxOutputTokens)
+            throw new ExecutionLimitError('budget', 'Request exceeds the reviewed host output limit.'); } });
+    const ownerToken = mintLedgerToken(state.secret(), { v: 2, authority, run: runId, role: 'parent', owner: agentId, exp: deadline });
+    return { server, ownerToken, execution, deadline, capability: REVIEWED_LEDGER_CAPABILITY };
+}
+//# sourceMappingURL=reviewed-ledger.js.map

package/dist/orchestration/reviewed-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewed-ledger.js","sourceRoot":"","sources":["../../src/orchestration/reviewed-ledger.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,EAAC,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAC,0BAA0B,EAAC,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,iBAAiB,EAAC,eAAe,EAAC,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAC,mBAAmB,EAAiB,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAC,qBAAqB,EAAC,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAC,QAAQ,EAAC,MAAM,YAAY,CAAC;AACpC,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,gBAAgB,CAAC;AAGrD,MAAM,CAAC,MAAM,0BAA0B,GAAC,EAAC,OAAO,EAAC,CAAC,EAAC,UAAU,EAAC,CAAC,EAAC,YAAY,EAAC,CAAC,EAAC,iBAAiB,EAAC,CAAC,EAAC,MAAM,EAAC,wBAAwB,EAAU,CAAC;AAE7I,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAU,EAAC,KAAY,EAAC,OAAc,EAAC,eAAsB,EAAC,OAAO,GAAkB,EAAE;IACnI,MAAM,IAAI,GAAC,OAAO,CAAC,KAAK,IAAE,IAAI,QAAQ,EAAE,EAAC,SAAS,GAAC,MAAM,qBAAqB,CAAC,GAAG,EAAC,KAAK,EAAC,OAAO,EAAC,eAAe,EAAC,EAAC,GAAG,OAAO,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAC,SAAS,CAAC,MAA2B,EAAC,IAAI,GAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAC,GAAG,EAAC,OAAO,CAAC,MAAM,CAAC,EAAC,OAAO,GAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,KAAK,CAAC,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClK,MAAM,WAAW,GAAC,GAAE,EAAE,GAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA,SAAS,CAAC,eAAgB,EAAE,CAAC,CAAA,CAAC,CAAC;IACvF,MAAM,aAAa,GAAC,CAAC,EAAS,EAAC,EAAE;QAC/B,WAAW,EAAE,CAAC;QACd,MAAM,OAAO,GAAC,OAAO,CAAC,MAAM,EAAE,CAAA,CAAC,CAAA,qBAAqB,CAAC,OAAO,EAAC,MAAM,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,OAAO,GAAC,OAAO,EAAE,OAAO,IAAE,IAAI,CAAC,QAAQ,CAAC;QACvH,IAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,KAAG,EAAE,CAAC,IAAE,OAAO,IAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,qDAAqD,CAAC,CAAC;IAC5M,CAAC,CAAC;IACF,MAAM,WAAW,GAAC,CAAC,KAAgB,EAAC,EAAE;QACpC,WAAW,EAAE,CAAC;QACd,MAAM,QAAQ,GAAC,OAAO,CAAC,MAAM,EAAE,CAAA,CAAC,CAAA,qBAAqB,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAG,KAAK,CAAC,EAAE,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;QAC1J,IAAG,CAAC,QAAQ,IAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAG,aAAa,CAAC,KAAK,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,8DAA8D,CAAC,CAAC;QACnL,KAAI,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ;YAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,SAAS,GAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,EAAC,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,SAAS,EAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA,EAAE,CAAA,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1L,IAAG,IAAI,CAAC,GAAG,EAAE,IAAE,QAAQ;QAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,mCAAmC,CAAC,CAAC;IACtG,OAAO,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,YAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAC,gBAAgB,EAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAC,SAAS,EAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAC,CAAC,CAAC;IACjM,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,SAAS,GAAC,MAAM,CAAC,aAAa,CAAC,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,YAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAC,gBAAgB,EAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAC,kBAAkB,CAAC,EAAC,MAAM,EAAC,GAAG,EAAC,KAAK,EAAC,YAAY,EAAC,OAAO,EAAC,SAAS,EAAC,eAAe,EAAC,WAAW,EAAC,sBAAsB,EAAC,aAAa,EAAC,oBAAoB,EAAC,WAAW;QAChL,0BAA0B,EAAC,WAAW,CAAA,EAAE,GAAC,IAAG,WAAW,CAAC,YAAY,GAAC,eAAe;YAAC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAC,iDAAiD,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;IACrL,MAAM,UAAU,GAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC,EAAC,CAAC,EAAC,CAAC,EAAC,SAAS,EAAC,GAAG,EAAC,KAAK,EAAC,IAAI,EAAC,QAAQ,EAAC,KAAK,EAAC,OAAO,EAAC,GAAG,EAAC,QAAQ,EAAC,CAAC,CAAC;IACpH,OAAO,EAAC,MAAM,EAAC,UAAU,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,0BAA0B,EAAC,CAAC;AACtF,CAAC"}

package/dist/orchestration/source-candidates.d.ts

@@ -0,0 +1,64 @@
+import { type WriterReview } from '../source-changes/writer.js';
+import type { RunActionOptions } from './actions.js';
+export interface SourceCandidateSelection {
+    runId: string;
+    executionRevision: string;
+    taskId: string;
+    attempt: number;
+    artifactId: string;
+    artifactHash: string;
+}
+export interface SourceCandidateReview extends WriterReview<SourceCandidateSelection> {
+    kind: 'source-candidate-review';
+    verification: 'required';
+}
+export declare function sourceCandidateCapabilities(): {
+    readonly version: 1;
+    readonly owner: 'calliope-cli';
+    readonly writer: 'git';
+    readonly operations: readonly ['preview', 'create', 'inspect', 'list'];
+    readonly semantics: 'generated-task-patch-to-unverified-local-candidate';
+    readonly verification: 'required';
+    readonly installation: false;
+    readonly merge: false;
+    readonly push: false;
+    readonly mayCallModel: false;
+};
+/** Preview creates no Git object/ref and does not turn task checks into migration acceptance. */
+export declare function previewSourceCandidate(cwd: string, source: SourceCandidateSelection, options?: RunActionOptions): Promise<{
+    review: SourceCandidateReview;
+    hash: string;
+    branch: string;
+    patch: string;
+}>;
+export declare const createSourceCandidate: (cwd: string, source: SourceCandidateSelection, reviewedHash: string, options?: RunActionOptions) => Promise<{
+    version: 1;
+    status: "candidate" | "prepared";
+    hash: string;
+    branch: string;
+    review: SourceCandidateReview;
+    createdAt: string;
+    commit: string | null;
+    tree: string | null;
+}>;
+export declare const inspectSourceCandidate: (cwd: string, runId: string, hash: string, options?: RunActionOptions) => Promise<{
+    version: 1;
+    status: "candidate" | "prepared";
+    hash: string;
+    branch: string;
+    review: SourceCandidateReview;
+    createdAt: string;
+    commit: string | null;
+    tree: string | null;
+}>;
+export declare const listSourceCandidates: (cwd: string, runId: string, options?: RunActionOptions) => Promise<{
+    version: 1;
+    status: "candidate" | "prepared";
+    hash: string;
+    branch: string;
+    review: SourceCandidateReview;
+    createdAt: string;
+    commit: string | null;
+    tree: string | null;
+}[]>;
+//# sourceMappingURL=source-candidates.d.ts.map

package/dist/orchestration/source-candidates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-candidates.d.ts","sourceRoot":"","sources":["../../src/orchestration/source-candidates.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,YAAY,EAAC,MAAM,6BAA6B,CAAC;AAM3E,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAC,MAAM,CAAC;IAAA,iBAAiB,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAC;IAAA,UAAU,EAAC,MAAM,CAAC;IAAA,YAAY,EAAC,MAAM,CAAC;CAC1G;AACD,MAAM,WAAW,qBAAsB,SAAQ,YAAY,CAAC,wBAAwB,CAAC;IACnF,IAAI,EAAC,yBAAyB,CAAC;IAAA,YAAY,EAAC,UAAU,CAAC;CACxD;AASD,wBAAgB,2BAA2B;aAAW,OAAO,EAAC,CAAC;aAAC,KAAK,EAAC,cAAc;aAAC,MAAM,EAAC,KAAK;aAC/F,UAAU,YAAE,SAAS,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM;aAAE,SAAS,EAAC,oDAAoD;aAC/G,YAAY,EAAC,UAAU;aAAC,YAAY;aAAO,KAAK;aAAO,IAAI;aAAO,YAAY;EAAkB;AAUlG,iGAAiG;AACjG,wBAAsB,sBAAsB,CAAC,GAAG,EAAC,MAAM,EAAC,MAAM,EAAC,wBAAwB,EAAC,OAAO,GAAC,gBAAmB;;;;;GAElH;AAgDD,eAAO,MAAM,qBAAqB;;;;;;;;;EAAa,CAAC;AAChD,eAAO,MAAM,sBAAsB;;;;;;;;;EAAe,CAAC;AACnD,eAAO,MAAM,oBAAoB;;;;;;;;;IAAY,CAAC"}

package/dist/orchestration/source-candidates.js

@@ -0,0 +1,95 @@
+/** Generated task patches become immutable candidates, never verified proposals. */
+import { canonicalJson, digest } from '../approvals/index.js';
+import { sourceWriter } from '../source-changes/writer.js';
+import { readPinnedWorktreeBase, worktreeGit } from '../isolation/worktree.js';
+import { inspectExecution } from './coordinator-actions.js';
+import { readCollectedArtifact } from './verification.js';
+import { OrchestrationError } from './types.js';
+import { id, pathName, shape } from './validation.js';
+function conflict(message) { throw new OrchestrationError('conflict', message); }
+const hash = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const uuid = (v) => typeof v === 'string' && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(v);
+const git = (project, args, options, input) => worktreeGit(project, ['--no-replace-objects', '--literal-pathspecs', ...args], options.signal, [0], input);
+const branchFor = (source, review) => `refs/calliope-candidates/${source.runId}/${review}`;
+const commitMessage = (source, review) => `Stage unverified candidate for ${source.taskId}\n\nCalliope-Source-Candidate: ${review}\nRun: ${source.runId}\nAttempt: ${source.attempt}\nArtifact-SHA256: ${source.artifactHash}\nVerification: required\n`;
+export function sourceCandidateCapabilities() {
+    return { version: 1, owner: 'calliope-cli', writer: 'git',
+        operations: ['preview', 'create', 'inspect', 'list'], semantics: 'generated-task-patch-to-unverified-local-candidate',
+        verification: 'required', installation: false, merge: false, push: false, mayCallModel: false };
+}
+function selection(source) {
+    shape(source, ['runId', 'executionRevision', 'taskId', 'attempt', 'artifactId', 'artifactHash']);
+    if (!uuid(source.runId) || !hash(source.executionRevision) || !hash(source.artifactHash) ||
+        !Number.isSafeInteger(source.attempt) || source.attempt < 1)
+        throw new OrchestrationError('invalid', 'Select the exact native task attempt and patch.');
+    id(source.taskId);
+    id(source.artifactId);
+}
+/** Preview creates no Git object/ref and does not turn task checks into migration acceptance. */
+export async function previewSourceCandidate(cwd, source, options = {}) {
+    return preview(cwd, source, options);
+}
+async function preview(cwd, source, options, leaseId) {
+    selection(source);
+    const current = await inspectExecution(cwd, source.runId, options), { view, store } = current, state = current.execution?.state;
+    if (!state || state.revision !== source.executionRevision || state.ownerId || current.owner?.alive && current.owner.id !== leaseId)
+        conflict('The source execution changed or is still owned. Inspect its current task evidence.');
+    store.assertApproval(current.execution.header);
+    const context = store.context(), task = context.plan.tasks.find(t => t.id === source.taskId), attempt = state.tasks[source.taskId], output = attempt?.output;
+    if (!task?.isolation || task.isolation.mode === 'read-only-v1' || task.isolation.patchArtifactId !== source.artifactId ||
+        !attempt || attempt.attempts !== source.attempt || attempt.status !== 'completed' || !output ||
+        !output.checks.length || output.checks.some(check => !check.passed))
+        conflict('Select a completed isolated task attempt and its executor-collected patch. Independent verification is still required.');
+    const artifact = output.artifacts.find(a => a.id === source.artifactId);
+    if (!artifact || artifact.sha256 !== source.artifactHash || artifact.kind !== 'patch' || artifact.location !== 'run' ||
+        artifact.bytes < 1 || artifact.bytes > 1024 * 1024)
+        conflict('Select the collected nonempty patch, up to 1 MiB.');
+    const bytes = await readCollectedArtifact(store, artifact, options);
+    let patch;
+    try {
+        patch = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        conflict('Native patches must use UTF-8.');
+    }
+    const project = view.manifest.project, baseCommit = readPinnedWorktreeBase(store.root, project.root, view.manifest.planHash);
+    if ((await git(project.root, ['rev-parse', '--verify', 'HEAD^{commit}'], options)).trim() !== baseCommit)
+        conflict('The owning source advanced beyond the task base. Replan the affected unit before creating a candidate.');
+    const author = { name: (await git(project.root, ['config', '--local', '--get', 'user.name'], options)).trim(),
+        email: (await git(project.root, ['config', '--local', '--get', 'user.email'], options)).trim() };
+    if (Object.values(author).some(v => !v || v.length > 256 || /[\r\n<>\x00]/.test(v)))
+        conflict('Configure a valid repository-local Git author before reviewing a candidate.');
+    const stats = await git(project.root, ['apply', '--numstat', '-z', '--'], options, { text: patch });
+    const paths = stats.split('\0').filter(Boolean).map(line => {
+        const match = /^(?:\d+|-)\t(?:\d+|-)\t(.+)$/s.exec(line);
+        if (!match)
+            conflict('Native patch path inventory is unavailable.');
+        const value = match[1];
+        pathName(value);
+        if (value.split('/').some(p => p.toLowerCase() === '.git'))
+            conflict('Git metadata cannot be staged.');
+        return value;
+    });
+    const grants = context.plan.agents.find(a => a.id === task.agentId).allowedPaths.filter(g => g.access === 'write');
+    if (!paths.length || paths.length > 1000 || paths.some(p => !grants.some(g => g.path === '.' || p === g.path || p.startsWith(g.path + '/'))))
+        conflict('The patch exceeds the selected worker’s original write scope or path bound.');
+    // Do not silently hide an overlapping user edit, including an ignored/untracked target.
+    if (await git(project.root, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignored=matching', '--', ...paths], options))
+        conflict('Candidate paths conflict with local staged, unstaged, untracked or ignored changes. Preserve them and replan.');
+    const review = { version: 1, kind: 'source-candidate-review', writer: 'git', verification: 'required',
+        project: { root: project.root, key: project.key }, source, manifestHash: view.manifest.hash,
+        sourceHash: digest(canonicalJson({ task, attempt, artifact })), baseCommit, author, paths, patchBytes: bytes.length };
+    const reviewHash = digest(canonicalJson(review));
+    store.assertRevision(source.executionRevision);
+    store.assertApproval(current.execution.header);
+    return { review, hash: reviewHash, branch: branchFor(source, reviewHash), patch };
+}
+const writer = sourceWriter({
+    directory: 'source-candidates', kind: 'source-candidate-review', status: 'candidate', tool: 'orchestration_source_candidate',
+    operation: 'Create one unverified local candidate for independent verification; do not mark verified, merge, install, push or run work.',
+    selection, branchFor, commitMessage, preview,
+});
+export const createSourceCandidate = writer.write;
+export const inspectSourceCandidate = writer.inspect;
+export const listSourceCandidates = writer.list;
+//# sourceMappingURL=source-candidates.js.map

package/dist/orchestration/source-candidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-candidates.js","sourceRoot":"","sources":["../../src/orchestration/source-candidates.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAC,aAAa,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAC,YAAY,EAAmB,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,sBAAsB,EAAC,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAC,gBAAgB,EAAC,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAC,kBAAkB,EAAC,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAC,EAAE,EAAC,QAAQ,EAAC,KAAK,EAAC,MAAM,iBAAiB,CAAC;AASlD,SAAS,QAAQ,CAAC,OAAc,IAAQ,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAC,OAAO,CAAC,CAAC,CAAA,CAAC;AAC1F,MAAM,IAAI,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtE,MAAM,IAAI,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,OAAO,CAAC,KAAG,QAAQ,IAAE,+CAA+C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrG,MAAM,GAAG,GAAC,CAAC,OAAc,EAAC,IAAa,EAAC,OAAwB,EAAC,KAAwC,EAAC,EAAE,CAC1G,WAAW,CAAC,OAAO,EAAC,CAAC,sBAAsB,EAAC,qBAAqB,EAAC,GAAG,IAAI,CAAC,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,CAAC;AACvG,MAAM,SAAS,GAAC,CAAC,MAA+B,EAAC,MAAa,EAAC,EAAE,CAAA,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;AACtH,MAAM,aAAa,GAAC,CAAC,MAA+B,EAAC,MAAa,EAAC,EAAE,CAAA,kCAAkC,MAAM,CAAC,MAAM,kCAAkC,MAAM,UAAU,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,OAAO,sBAAsB,MAAM,CAAC,YAAY,4BAA4B,CAAC;AAEpR,MAAM,UAAU,2BAA2B;IAAG,OAAO,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,cAAc,EAAC,MAAM,EAAC,KAAK;QAC/F,UAAU,EAAC,CAAC,SAAS,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,CAAC,EAAC,SAAS,EAAC,oDAAoD;QAC/G,YAAY,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,EAAC,YAAY,EAAC,KAAK,EAAU,CAAC;AAAA,CAAC;AAElG,SAAS,SAAS,CAAC,MAA+B;IAChD,KAAK,CAAC,MAAM,EAAC,CAAC,OAAO,EAAC,mBAAmB,EAAC,QAAQ,EAAC,SAAS,EAAC,YAAY,EAAC,cAAc,CAAC,CAAC,CAAC;IAC3F,IAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/E,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAE,MAAM,CAAC,OAAO,GAAC,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAC,iDAAiD,CAAC,CAAC;IAC5F,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAAA,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAU,EAAC,MAA+B,EAAC,OAAO,GAAkB,EAAE;IACjH,OAAO,OAAO,CAAC,GAAG,EAAC,MAAM,EAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,GAAU,EAAC,MAA+B,EAAC,OAAwB,EAAC,OAAe;IACxG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,MAAM,OAAO,GAAC,MAAM,gBAAgB,CAAC,GAAG,EAAC,MAAM,CAAC,KAAK,EAAC,OAAO,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,GAAC,OAAO,EAAC,KAAK,GAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;IACnH,IAAG,CAAC,KAAK,IAAE,KAAK,CAAC,QAAQ,KAAG,MAAM,CAAC,iBAAiB,IAAE,KAAK,CAAC,OAAO,IAAE,OAAO,CAAC,KAAK,EAAE,KAAK,IAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAG,OAAO;QACnH,QAAQ,CAAC,oFAAoF,CAAC,CAAC;IACjG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,SAAU,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAC,KAAK,CAAC,OAAO,EAAE,EAAC,IAAI,GAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,MAAM,CAAC,MAAM,CAAC,EAAC,OAAO,GAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAC,MAAM,GAAC,OAAO,EAAE,MAAM,CAAC;IAC9I,IAAG,CAAC,IAAI,EAAE,SAAS,IAAE,IAAI,CAAC,SAAS,CAAC,IAAI,KAAG,cAAc,IAAE,IAAI,CAAC,SAAS,CAAC,eAAe,KAAG,MAAM,CAAC,UAAU;QACzG,CAAC,OAAO,IAAE,OAAO,CAAC,QAAQ,KAAG,MAAM,CAAC,OAAO,IAAE,OAAO,CAAC,MAAM,KAAG,WAAW,IAAE,CAAC,MAAM;QAClF,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,KAAK,CAAC,MAAM,CAAC;QACjE,QAAQ,CAAC,wHAAwH,CAAC,CAAC;IACrI,MAAM,QAAQ,GAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClE,IAAG,CAAC,QAAQ,IAAE,QAAQ,CAAC,MAAM,KAAG,MAAM,CAAC,YAAY,IAAE,QAAQ,CAAC,IAAI,KAAG,OAAO,IAAE,QAAQ,CAAC,QAAQ,KAAG,KAAK;QACnG,QAAQ,CAAC,KAAK,GAAC,CAAC,IAAE,QAAQ,CAAC,KAAK,GAAC,IAAI,GAAC,IAAI;QAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;IAC7G,MAAM,KAAK,GAAC,MAAM,qBAAqB,CAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,CAAC,CAAC;IAChE,IAAI,KAAY,CAAC;IAAA,IAAG,CAAC;QAAA,KAAK,GAAC,IAAI,WAAW,CAAC,OAAO,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IAAA,CAAC;IAClI,MAAM,OAAO,GAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAC,UAAU,GAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,CAAC,IAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtH,IAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC,WAAW,EAAC,UAAU,EAAC,eAAe,CAAC,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAG,UAAU;QAC/F,QAAQ,CAAC,wGAAwG,CAAC,CAAC;IACrH,MAAM,MAAM,GAAC,EAAC,IAAI,EAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC,QAAQ,EAAC,SAAS,EAAC,OAAO,EAAC,WAAW,CAAC,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;QAClG,KAAK,EAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC,QAAQ,EAAC,SAAS,EAAC,OAAO,EAAC,YAAY,CAAC,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC;IAC5F,IAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAE,CAAC,CAAC,MAAM,GAAC,GAAG,IAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,6EAA6E,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,IAAI,CAAC,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE;QACtD,MAAM,KAAK,GAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAA,IAAG,CAAC,KAAK;YAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACzH,MAAM,KAAK,GAAC,KAAM,CAAC,CAAC,CAAE,CAAC;QAAA,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAA,IAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,WAAW,EAAE,KAAG,MAAM,CAAC;YAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QAAA,OAAO,KAAK,CAAC;IACvJ,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,IAAI,CAAC,OAAO,CAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,OAAO,CAAC,CAAC;IAC1G,IAAG,CAAC,KAAK,CAAC,MAAM,IAAE,KAAK,CAAC,MAAM,GAAC,IAAI,IAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,GAAG,IAAE,CAAC,KAAG,CAAC,CAAC,IAAI,IAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAC,GAAG,CAAC,CAAC,CAAC;QACrH,QAAQ,CAAC,6EAA6E,CAAC,CAAC;IAC1F,wFAAwF;IACxF,IAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,CAAC,QAAQ,EAAC,gBAAgB,EAAC,IAAI,EAAC,uBAAuB,EAAC,oBAAoB,EAAC,IAAI,EAAC,GAAG,KAAK,CAAC,EAAC,OAAO,CAAC;QAC5H,QAAQ,CAAC,+GAA+G,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAuB,EAAC,OAAO,EAAC,CAAC,EAAC,IAAI,EAAC,yBAAyB,EAAC,MAAM,EAAC,KAAK,EAAC,YAAY,EAAC,UAAU;QAC/G,OAAO,EAAC,EAAC,IAAI,EAAC,OAAO,CAAC,IAAI,EAAC,GAAG,EAAC,OAAO,CAAC,GAAG,EAAC,EAAC,MAAM,EAAC,YAAY,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAClF,UAAU,EAAC,MAAM,CAAC,aAAa,CAAC,EAAC,IAAI,EAAC,OAAO,EAAC,QAAQ,EAAC,CAAC,CAAC,EAAC,UAAU,EAAC,MAAM,EAAC,KAAK,EAAC,UAAU,EAAC,KAAK,CAAC,MAAM,EAAC,CAAC;IAC7G,MAAM,UAAU,GAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAAA,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,SAAU,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,EAAC,MAAM,EAAC,SAAS,CAAC,MAAM,EAAC,UAAU,CAAC,EAAC,KAAK,EAAC,CAAC;AAC5E,CAAC;AAED,MAAM,MAAM,GAAC,YAAY,CAA6D;IACpF,SAAS,EAAC,mBAAmB,EAAC,IAAI,EAAC,yBAAyB,EAAC,MAAM,EAAC,WAAW,EAAC,IAAI,EAAC,gCAAgC;IACrH,SAAS,EAAC,6HAA6H;IACvI,SAAS,EAAC,SAAS,EAAC,aAAa,EAAC,OAAO;CAC1C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAC,MAAM,CAAC,KAAK,CAAC;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAC,MAAM,CAAC,OAAO,CAAC;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAC,MAAM,CAAC,IAAI,CAAC"}

package/dist/orchestration/validation.js

@@ -254,7 +254,7 @@ export function analyzePlan(value) {
                 fail('Task input exceeds its agent scope.');
         if ((v.version === 3 || v.version === 4)) {
             validateTaskIsolation(item.isolation, item, plan);
-            if (!owner.allowedTools.includes('write_file') && !owner.allowedTools.includes('edit_file'))
+            if (item.isolation.mode !== 'read-only-v1' && !owner.allowedTools.includes('write_file') && !owner.allowedTools.includes('edit_file'))
                 fail('Isolated mutation tasks require write_file or edit_file authority.');
         }
         if (v.version !== 1) {