@calltelemetry/ct-lab-mcp 0.8.90 → 0.8.92

package/dist/src/tools/claim-custody.js

@@ -0,0 +1,196 @@
+/**
+ * ApplianceClaim custody (REL-1746, supersedes physical-slot reservation Leases).
+ *
+ * The original-owner record lives ON the claim as annotation `calltelemetry.com/claim-custody`
+ * (canonical JSON, <= 64 KiB, strict parse), written in the SAME create call as the claim. No Lease is
+ * ever created, renewed or required: per-guest serialization is in-process keyed by (node, vmid) and
+ * cross-actor safety is the claim UID/resourceVersion plus the claim-occupancy scan. Deletion only
+ * requests claim deletion with UID + resourceVersion preconditions; the operator owns teardown.
+ * Claims that still hold a legacy reservation Lease are verified READ-ONLY (the operator migrates them).
+ */
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import { actualClaimIssue, claimCreationSha256, effectiveClaimSpec } from "./claim-creation-projection.js";
+import { createClaimApi } from "./claim-kubernetes.js";
+import { ContextSchema, GuestSchema, ProviderSchema, annotationJson, canonicalJson, claimGuest, digest, objectName, requireCustody, readLegacyReservation, sha, uuid, verifyLegacyClaim, legacyReservationLeaseName, } from "./legacy-reservation.js";
+export { canonicalJson, claimGuest, objectName };
+export const CUSTODY_ANNOTATION = "calltelemetry.com/claim-custody";
+const CLAIMS = "/apis/calltelemetry.com/v1alpha1/namespaces/ct-lab/applianceclaims";
+export const CustodySchema = z.object({
+    schema: z.literal("claim-custody/v1"), guest: GuestSchema,
+    phase: z.enum(["bound", "provider-bound", "retiring"]),
+    operationNonce: uuid, requestSha256: sha, context: ContextSchema,
+    provider: ProviderSchema.nullable(),
+}).strict();
+/** Strict custody parse: closed field set, duplicate keys rejected, provider/phase coherence, sorted volumes. */
+export function parseCustody(text) {
+    const record = CustodySchema.parse(annotationJson(text));
+    if (record.provider)
+        requireCustody(canonicalJson(record.provider.volumes) === canonicalJson([...new Set(record.provider.volumes)].sort()), "provider volumes are not sorted and unique");
+    requireCustody(record.phase !== "provider-bound" || record.provider !== null, "provider phase lacks immutable provider binding");
+    requireCustody(record.phase !== "bound" || record.provider === null, "bound phase carries a provider binding");
+    return record;
+}
+/** The custody record of a claim, or null when the annotation is absent. Malformed records throw. */
+export function claimCustody(claim) {
+    const text = claim?.metadata?.annotations?.[CUSTODY_ANNOTATION];
+    return text === undefined ? null : parseCustody(text);
+}
+export function creationOwnerSha(record) {
+    const { schema, guest, operationNonce, requestSha256, context } = CustodySchema.parse(record);
+    return digest({ schema, guest, operationNonce, requestSha256, context });
+}
+/** Verifies a live claim against its own custody record. */
+export function verifyCustodyClaim(live, record, expectedUid) {
+    requireCustody(live?.apiVersion === "calltelemetry.com/v1alpha1" && live.kind === "ApplianceClaim"
+        && live.metadata?.namespace === "ct-lab" && objectName.safeParse(live.metadata.name).success
+        && uuid.safeParse(live.metadata.uid).success && (!expectedUid || live.metadata.uid === expectedUid)
+        && typeof live.metadata.resourceVersion === "string" && live.metadata.resourceVersion.length > 0
+        && canonicalJson(claimGuest(live)) === canonicalJson(record.guest)
+        && (actualClaimIssue(live) ?? null) === (record.context.issueKey ?? null)
+        && claimCreationSha256(live) === record.requestSha256, "claim UID, guest tuple or source lineage differs");
+}
+/**
+ * A claim with neither a custody annotation nor a legacy reservation Lease was created outside the guarded
+ * path: there is no original-owner record to retire it against. Distinct from a record that exists but
+ * fails identity checks.
+ */
+export class NoClaimCustodyError extends Error {
+    claimName;
+    guest;
+    constructor(claimName, guest) {
+        super(`ApplianceClaim '${claimName}' has no claim-custody annotation (and no legacy reservation Lease) for ${guest.node}/${guest.vmid}: it was created outside the guarded create path, so the guard has no original-owner record to retire it against; nothing was modified`);
+        this.claimName = claimName;
+        this.guest = guest;
+        this.name = "NoClaimCustodyError";
+    }
+}
+const defaults = () => ({ api: createClaimApi(), now: Date.now, nonce: randomUUID });
+const tails = new Map();
+/** In-process serialization keyed by (node, vmid). Single MCP replica; cross-actor safety is claim UID/resourceVersion. */
+function serialized(guest, action) {
+    const key = `${guest.node}/${guest.vmid}`;
+    const run = (tails.get(key) ?? Promise.resolve()).catch(() => { }).then(action);
+    const tail = run.catch(() => { });
+    tails.set(key, tail);
+    void tail.then(() => { if (tails.get(key) === tail)
+        tails.delete(key); });
+    return run;
+}
+const nodeAlias = (node) => node === "proxmox-lab" ? "proxmox" : ["proxmox-mini", "proxmox-minis-lab"].includes(node) ? "minis" : node === "proxmox-ibm64" ? "ibm64" : node;
+async function noOtherClaim(deps, guest, ownUid) {
+    let next = "";
+    for (let page = 0; page < 10; page++) {
+        const result = await deps.api.request(`${CLAIMS}?limit=500${next ? `&continue=${encodeURIComponent(next)}` : ""}`, "GET");
+        requireCustody(result?.kind === "ApplianceClaimList" && result.apiVersion === "calltelemetry.com/v1alpha1" && Array.isArray(result.items), "claim occupancy list unavailable");
+        for (const claim of result.items) {
+            if (claim.metadata?.uid === ownUid)
+                continue;
+            const alias = nodeAlias(claim.spec?.node);
+            if (String(claim.spec?.vmid) === String(guest.vmid) && (alias === guest.node || !["minis", "proxmox", "ibm64", "esxi"].includes(alias)))
+                throw new Error("claim custody guest has another existing ApplianceClaim; custody unchanged");
+        }
+        next = result.metadata?.continue || "";
+        requireCustody(typeof next === "string", "claim occupancy pagination malformed");
+        if (!next)
+            return;
+    }
+    throw new Error("claim custody occupancy scan incomplete; custody unchanged");
+}
+function requireResumable(live, manifest, deps) {
+    requireCustody(!live.metadata.deletionTimestamp && live.spec?.closed !== true && live.spec?.state !== "Closed" && live.status?.phase !== "Closed", "bound claim is retiring");
+    requireCustody(Number.isInteger(live.spec?.ttlHours) && live.spec.ttlHours >= manifest.spec.ttlHours && live.spec.ttlHours <= 8760 && live.spec.claimType !== "fixture", "bound claim finite TTL differs");
+    if (live.status?.phase === "Ready" || live.status?.completionTime) {
+        const baseline = Date.parse(live.status?.completionTime || "");
+        requireCustody(Number.isFinite(baseline) && baseline + live.spec.ttlHours * 3_600_000 > deps.now(), "bound claim expired or Ready TTL baseline unavailable");
+    }
+}
+export async function createClaimWithCustody(manifest, deps = defaults()) {
+    requireCustody(manifest.metadata?.namespace === "ct-lab", "namespace must be ct-lab");
+    objectName.parse(manifest.metadata.name);
+    manifest = { ...manifest, spec: effectiveClaimSpec(manifest.spec) };
+    const guest = claimGuest(manifest);
+    requireCustody(typeof manifest.spec.vmName === "string" && manifest.spec.vmName.length > 0, "constructor must provide the actual VM name before claim POST");
+    requireCustody(Number.isInteger(manifest.spec?.ttlHours) && manifest.spec.ttlHours > 0 && manifest.spec.ttlHours <= 8760, "dynamic claim requires finite TTL");
+    const context = ContextSchema.parse({ kind: "mcp", ...(actualClaimIssue(manifest) ? { issueKey: actualClaimIssue(manifest) } : {}) });
+    const requestSha256 = claimCreationSha256(manifest);
+    const path = `${CLAIMS}/${manifest.metadata.name}`;
+    return serialized(guest, async () => {
+        const existing = await deps.api.request(path, "GET");
+        if (existing)
+            return resume(existing, manifest, guest, context, requestSha256, deps);
+        await noOtherClaim(deps, guest);
+        // A stale legacy reservation for a different (now absent) claim blocks reuse of the guest until the
+        // operator's legacy sweep removes it; we never delete it ourselves.
+        const stale = await readLegacyReservation(deps.api, guest);
+        requireCustody(!stale, `guest ${guest.node}/${guest.vmid} still has a legacy reservation Lease (${legacyReservationLeaseName(guest)}) for another claim; the operator migrates or sweeps it`);
+        const record = CustodySchema.parse({ schema: "claim-custody/v1", guest, phase: "bound", operationNonce: deps.nonce(), requestSha256, context, provider: null });
+        const body = { ...manifest, metadata: { ...manifest.metadata, annotations: { ...(manifest.metadata.annotations || {}), [CUSTODY_ANNOTATION]: canonicalJson(record) } } };
+        const response = await deps.api.request(CLAIMS, "POST", body);
+        requireCustody(uuid.safeParse(response?.metadata?.uid).success, "claim creation response lacks actual UID");
+        const live = await deps.api.request(path, "GET");
+        const held = claimCustody(live);
+        requireCustody(held && canonicalJson(held) === canonicalJson(record), "created custody annotation not independently confirmed");
+        verifyCustodyClaim(live, held, response.metadata.uid);
+        requireCustody(!live.metadata.deletionTimestamp, "new claim is already deleting");
+        await noOtherClaim(deps, guest, live.metadata.uid);
+        return { claim: live, custody: { source: "annotation", record: held, creationOwnerSha256: creationOwnerSha(held) }, reused: false };
+    });
+}
+async function resume(live, manifest, guest, context, requestSha256, deps) {
+    const held = claimCustody(live);
+    if (held) {
+        requireCustody(["bound", "provider-bound"].includes(held.phase) && held.requestSha256 === requestSha256
+            && canonicalJson(held.context) === canonicalJson(context) && canonicalJson(held.guest) === canonicalJson(guest), "existing claim custody is occupied by a different request");
+        verifyCustodyClaim(live, held);
+        requireResumable(live, manifest, deps);
+        await noOtherClaim(deps, guest, live.metadata.uid);
+        return { claim: live, custody: { source: "annotation", record: held, creationOwnerSha256: creationOwnerSha(held) }, reused: true };
+    }
+    const legacy = await readLegacyReservation(deps.api, guest);
+    if (!legacy)
+        throw new NoClaimCustodyError(manifest.metadata.name, guest);
+    const { record, lease } = legacy;
+    requireCustody(["bound", "provider-bound"].includes(record.phase) && record.requestSha256 === requestSha256
+        && canonicalJson(record.context) === canonicalJson(context) && record.intendedClaim.name === manifest.metadata.name, "legacy reservation is occupied by a different request");
+    verifyLegacyClaim(live, record, record.claim.uid);
+    requireResumable(live, manifest, deps);
+    await noOtherClaim(deps, guest, live.metadata.uid);
+    return { claim: live, custody: { source: "legacy-lease", record, legacyLease: { name: lease.metadata.name, uid: lease.metadata.uid }, migration: "operator-pending" }, reused: true };
+}
+export async function deleteClaimWithCustody(name, expectedUid, deps = defaults()) {
+    objectName.parse(name);
+    uuid.parse(expectedUid);
+    const live = await deps.api.request(`${CLAIMS}/${name}`, "GET");
+    requireCustody(live?.metadata?.uid === expectedUid, "original selected claim UID differs or is absent");
+    const guest = claimGuest(live);
+    return serialized(guest, async () => {
+        const selected = await deps.api.request(`${CLAIMS}/${name}`, "GET");
+        requireCustody(selected?.metadata?.uid === expectedUid, "original selected claim UID differs or is absent");
+        let source;
+        let phase;
+        const held = claimCustody(selected);
+        if (held) {
+            requireCustody(selected.metadata.name === name && canonicalJson(held.guest) === canonicalJson(guest), "claim does not own its custody record");
+            verifyCustodyClaim(selected, held, expectedUid);
+            source = "annotation";
+            phase = held.phase;
+        }
+        else {
+            const legacy = await readLegacyReservation(deps.api, guest);
+            if (!legacy)
+                throw new NoClaimCustodyError(name, guest);
+            requireCustody(["bound", "provider-bound", "retiring"].includes(legacy.record.phase) && legacy.record.claim?.uid === expectedUid && legacy.record.intendedClaim.name === name, "claim does not own the bound legacy reservation");
+            verifyLegacyClaim(selected, legacy.record, expectedUid);
+            source = "legacy-lease";
+            phase = legacy.record.phase;
+        }
+        await deps.api.request(`${CLAIMS}/${name}`, "DELETE", { apiVersion: "v1", kind: "DeleteOptions", preconditions: { uid: expectedUid, resourceVersion: selected.metadata.resourceVersion } });
+        return {
+            requested: true, expectedUid, custodySource: source, custodyPhase: phase, custodyRetained: true,
+            ...(source === "legacy-lease" ? { migration: "operator-pending" } : {}),
+            next: "The governed operator/controller owns teardown: it proves original claim, provider and owned-volume absence before releasing custody."
+        };
+    });
+}
+//# sourceMappingURL=claim-custody.js.map

package/dist/src/tools/claim-custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-custody.js","sourceRoot":"","sources":["../../../src/tools/claim-custody.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAiB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EACL,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EACzH,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,0BAA0B,GAEhF,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAEjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AACpE,MAAM,MAAM,GAAG,oEAAoE,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,WAAW;IACzD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACtD,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa;IAChE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ;QAAE,cAAc,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC1L,cAAc,CAAC,MAAM,CAAC,KAAK,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,iDAAiD,CAAC,CAAC;IACjI,cAAc,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,KAAU;IACrC,MAAM,IAAI,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAChE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AACD,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,IAAS,EAAE,MAAe,EAAE,WAAoB;IACjF,cAAc,CAAC,IAAI,EAAE,UAAU,KAAK,4BAA4B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;WAC7F,IAAI,CAAC,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO;WACzF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,WAAW,CAAC;WAChG,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;WAC7F,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;WAC/D,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;WACtE,mBAAmB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAChB;IAAmC;IAA/D,YAA4B,SAAiB,EAAkB,KAAiB;QAC9E,KAAK,CAAC,mBAAmB,SAAS,2EAA2E,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,wIAAwI,CAAC,CAAC;QADrP,cAAS,GAAT,SAAS,CAAQ;QAAkB,UAAK,GAAL,KAAK,CAAY;QAE9E,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAID,MAAM,QAAQ,GAAG,GAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAElG,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;AAClD,2HAA2H;AAC3H,SAAS,UAAU,CAAI,KAAiB,EAAE,MAAwB;IAChE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,SAAS,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/L,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,KAAiB,EAAE,MAAe;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,aAAa,IAAI,CAAC,CAAC,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1H,cAAc,CAAC,MAAM,EAAE,IAAI,KAAK,oBAAoB,IAAI,MAAM,CAAC,UAAU,KAAK,4BAA4B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,kCAAkC,CAAC,CAAC;QAC/K,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM;gBAAE,SAAS;YAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAe,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnP,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QACvC,cAAc,CAAC,OAAO,IAAI,KAAK,QAAQ,EAAE,sCAAsC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO;IACpB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAS,EAAE,QAAa,EAAE,IAAiB;IACnE,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IAC9K,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAC3M,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC/D,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,uDAAuD,CAAC,CAAC;IAC/J,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAa,EAAE,IAAI,GAAG,QAAQ,EAAE;IAC3E,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,KAAK,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACtF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,cAAc,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,+DAA+D,CAAC,CAAC;IAC7J,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAC/J,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtI,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QACrF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,oGAAoG;QACpG,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,cAAc,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,0CAA0C,0BAA0B,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC9L,MAAM,MAAM,GAAY,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzK,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;QACzK,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,cAAc,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAChI,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtD,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;QAClF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/I,CAAC,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAS,EAAE,QAAa,EAAE,KAAiB,EAAE,OAAY,EAAE,aAAqB,EAAE,IAAiB;IACvH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa;eAClG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,2DAA2D,CAAC,CAAC;QAChL,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9I,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACjC,cAAc,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa;WACtG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAChL,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAM,CAAC,GAAG,CAAC,CAAC;IACnD,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAuB,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,kBAA2B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1M,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,WAAmB,EAAE,IAAI,GAAG,QAAQ,EAAE;IAC/F,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,WAAW,EAAE,kDAAkD,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACpE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,WAAW,EAAE,kDAAkD,CAAC,CAAC;QAC5G,IAAI,MAAqB,CAAC;QAAC,IAAI,KAAa,CAAC;QAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,uCAAuC,CAAC,CAAC;YAC/I,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,GAAG,YAAY,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxD,cAAc,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,EAAE,iDAAiD,CAAC,CAAC;YAClO,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,GAAG,cAAc,CAAC;YAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5L,OAAO;YACL,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI;YAC/F,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,EAAE,uIAAuI;SAC9I,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/tools/claim-kubernetes.d.ts

@@ -0,0 +1,14 @@
+export type ClaimMethod = "GET" | "POST" | "DELETE";
+export interface ClaimApi {
+    request(path: string, method: ClaimMethod, body?: unknown): Promise<any | null>;
+}
+export declare class ClaimApiError extends Error {
+    readonly status: number | null;
+    constructor(status: number | null, message: string);
+}
+export declare function assertClaimPath(path: string, method: ClaimMethod): void;
+/** Names the denied operation from the request itself. Remote error text is never echoed. */
+export declare function describeClaimRequest(path: string, method: ClaimMethod): string;
+export declare function claimFailureMessage(status: number | null, path: string, method: ClaimMethod): string;
+export declare function createClaimApi(): ClaimApi;
+//# sourceMappingURL=claim-kubernetes.d.ts.map

package/dist/src/tools/claim-kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-kubernetes.d.ts","sourceRoot":"","sources":["../../../src/tools/claim-kubernetes.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AACpD,MAAM,WAAW,QAAQ;IAAG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CAAE;AAC9G,qBAAa,aAAc,SAAQ,KAAK;aACV,MAAM,EAAE,MAAM,GAAG,IAAI;gBAArB,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM;CACnE;AAGD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAcvE;AACD,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAO9E;AACD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAIpG;AAOD,wBAAgB,cAAc,IAAI,QAAQ,CAgCzC"}

package/dist/src/tools/{slot-kubernetes.js → claim-kubernetes.js}

@@ -1,8 +1,8 @@
-/** Shared configured Kubernetes transport for physical-slot custody. Never retry an unknown write. */
+/** Shared configured Kubernetes transport for ApplianceClaim custody (REL-1746). Never retry an unknown write. Leases are read-only legacy evidence. */
 import * as fs from "node:fs";
 import { fetch, Agent } from "undici";
 import { KubernetesCommandError, resolveLabKubernetesBackend, runLabKubectl } from "./kubernetes-backend.js";
-export class SlotApiError extends Error {
+export class ClaimApiError extends Error {
     status;
     constructor(status, message) {
         super(message);
@@ -11,68 +11,72 @@ export class SlotApiError extends Error {
 }
 const MAX_BYTES = 1_048_576;
 const COLLECTIONS = ["/apis/coordination.k8s.io/v1/namespaces/ct-lab/leases", "/apis/calltelemetry.com/v1alpha1/namespaces/ct-lab/applianceclaims"];
-export function assertSlotPath(path, method) {
+export function assertClaimPath(path, method) {
     const cleanPath = path.split("?")[0];
     if (path !== cleanPath && !/^\?limit=500(?:&continue=[A-Za-z0-9%._~-]+)?$/.test(path.slice(cleanPath.length)))
-        throw new Error("physical slot query refused");
+        throw new Error("claim custody query refused");
     const collection = COLLECTIONS.find(p => cleanPath === p || cleanPath.startsWith(p + "/"));
     if (!collection)
-        throw new Error("physical slot API path refused");
+        throw new Error("claim custody API path refused");
     const name = cleanPath.slice(collection.length + 1);
     if (cleanPath !== collection && (name.length > 253 || !name.split(".").every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))))
-        throw new Error("physical slot object name refused");
-    if (method === "POST" && cleanPath !== collection || method !== "POST" && cleanPath === collection && !(method === "GET" && collection === COLLECTIONS[1]))
-        throw new Error("physical slot method refused");
-    if (collection === COLLECTIONS[0] && method === "DELETE")
-        throw new Error("MCP cannot release a durable physical reservation");
-    if (collection === COLLECTIONS[1] && method === "PUT")
-        throw new Error("physical slot adapter cannot replace a claim");
+        throw new Error("claim custody object name refused");
+    if (collection === COLLECTIONS[0]) {
+        // Legacy reservation Leases are read-only evidence: the operator owns migration and deletion.
+        if (method !== "GET" || cleanPath === collection || !name.startsWith("ct-physical-slot-reservation."))
+            throw new Error("MCP never creates, renews or releases a Lease; only legacy reservation reads are allowed");
+        return;
+    }
+    if (!["GET", "POST", "DELETE"].includes(method))
+        throw new Error("claim custody method refused");
+    if (method === "POST" && cleanPath !== collection || method !== "POST" && cleanPath === collection && method !== "GET")
+        throw new Error("claim custody method refused");
 }
 /** Names the denied operation from the request itself. Remote error text is never echoed. */
-export function describeSlotRequest(path, method) {
+export function describeClaimRequest(path, method) {
     const cleanPath = path.split("?")[0];
     const match = /^\/apis\/([^/]+)\/[^/]+\/namespaces\/([^/]+)\/([^/]+)(\/[^/]+)?$/.exec(cleanPath);
     if (!match)
         return "an unrecognised resource";
     const [, group, namespace, resource, named] = match;
-    const verb = method === "GET" ? (named ? "get" : "list") : method === "POST" ? "create" : method === "PUT" ? "update" : "delete";
+    const verb = method === "GET" ? (named ? "get" : "list") : method === "POST" ? "create" : "delete";
     return `${verb} ${resource}.${group} in namespace ${namespace}`;
 }
-export function slotFailureMessage(status, path, method) {
-    const detail = describeSlotRequest(path, method);
+export function claimFailureMessage(status, path, method) {
+    const detail = describeClaimRequest(path, method);
     const hint = status === 403 ? `; the service account needs RBAC to ${detail}` : "";
-    return `physical slot Kubernetes request failed (${status ?? "unknown"}) on ${detail}${hint}; retain custody`;
+    return `claim custody Kubernetes request failed (${status ?? "unknown"}) on ${detail}${hint}; custody unchanged`;
 }
 function parse(text) {
     if (Buffer.byteLength(text) > MAX_BYTES)
-        throw new Error("physical slot response exceeds bound");
+        throw new Error("claim custody response exceeds bound");
     const value = JSON.parse(text);
     if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new Error("physical slot response is not an object");
+        throw new Error("claim custody response is not an object");
     return value;
 }
-export function createSlotApi() {
+export function createClaimApi() {
     return { async request(path, method, body) {
-            assertSlotPath(path, method);
+            assertClaimPath(path, method);
             const backend = resolveLabKubernetesBackend();
             if (backend.mode === "in-cluster") {
                 const token = fs.readFileSync(backend.tokenPath, "utf8").trim();
                 if (!token)
-                    throw new Error("physical slot Kubernetes service identity refused");
+                    throw new Error("claim custody Kubernetes service identity refused");
                 const agent = new Agent({ connect: { ca: fs.readFileSync(backend.caPath), rejectUnauthorized: true } });
                 try {
                     const response = await fetch(`${backend.server}${path}`, { method, headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), dispatcher: agent, signal: AbortSignal.timeout(10_000) });
                     if (response.status === 404 && method === "GET")
                         return null;
                     if (!response.ok)
-                        throw new SlotApiError(response.status, slotFailureMessage(response.status, path, method));
+                        throw new ClaimApiError(response.status, claimFailureMessage(response.status, path, method));
                     return parse(await response.text());
                 }
                 finally {
                     await agent.close();
                 }
             }
-            const command = method === "GET" ? "get" : method === "POST" ? "create" : method === "PUT" ? "replace" : "delete";
+            const command = method === "GET" ? "get" : method === "POST" ? "create" : "delete";
             try {
                 const result = await runLabKubectl([command, "--raw", path, ...(body === undefined ? [] : ["-f", "-"])], {
                     ...(body === undefined ? {} : { input: JSON.stringify(body) }),
@@ -86,10 +90,10 @@ export function createSlotApi() {
                 if (method === "GET" && status === 404)
                     return null;
                 if (error instanceof KubernetesCommandError) {
-                    throw new SlotApiError(status, slotFailureMessage(status, path, method));
+                    throw new ClaimApiError(status, claimFailureMessage(status, path, method));
                 }
                 throw error;
             }
         } };
 }
-//# sourceMappingURL=slot-kubernetes.js.map
+//# sourceMappingURL=claim-kubernetes.js.map

package/dist/src/tools/claim-kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-kubernetes.js","sourceRoot":"","sources":["../../../src/tools/claim-kubernetes.ts"],"names":[],"mappings":"AAAA,wJAAwJ;AACxJ,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7G,MAAM,OAAO,aAAc,SAAQ,KAAK;IACV;IAA5B,YAA4B,MAAqB,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAzD,WAAM,GAAN,MAAM,CAAe;IAAqC,CAAC;CACxF;AACD,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,WAAW,GAAG,CAAC,uDAAuD,EAAE,oEAAoE,CAAC,CAAC;AACpJ,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAmB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9J,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnM,IAAI,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,8FAA8F;QAC9F,IAAI,MAAM,KAAK,KAAK,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QACnN,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjG,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU,IAAI,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAC1K,CAAC;AACD,6FAA6F;AAC7F,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAmB;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,kEAAkE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK;QAAE,OAAO,0BAA0B,CAAC;IAC9C,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnG,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,KAAK,iBAAiB,SAAS,EAAE,CAAC;AAClE,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,IAAY,EAAE,MAAmB;IAC1F,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,4CAA4C,MAAM,IAAI,SAAS,QAAQ,MAAM,GAAG,IAAI,qBAAqB,CAAC;AACnH,CAAC;AACD,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5H,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;YACvC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACjF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC7Q,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC;oBAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/G,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtC,CAAC;wBAAS,CAAC;oBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;YACpC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE;oBACvG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,SAAS,EAAE,MAAM;oBACjB,cAAc,EAAE,SAAS;iBAC1B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACpD,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;oBAC5C,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/src/tools/claim-reconcile-gate.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Claim reconcile gate (UAT-1785).
+ *
+ * A claim is only a guest's protection if an ApplianceClaim operator is actually
+ * watching the cluster the claim was written to. When the claim plane and the
+ * operator's cluster differ (for example the operator moved to another cluster
+ * and the tooling still writes to the old one), a new claim is never reconciled:
+ * its status stays empty, and the operator that is running elsewhere sees the
+ * imported guest as unclaimed and destroys it once its grace window elapses,
+ * minutes into a UAT run while the claim and lease still look live.
+ *
+ * A profile=bare claim reaches status.phase=Ready within seconds of an operator
+ * seeing it, before any guest exists. Creating the guest only after that
+ * observation turns the silent mid-run loss into an immediate, actionable
+ * refusal that happens before a guest exists.
+ */
+import { type CallToolResult } from "../types/mcp.js";
+export declare const CLAIM_RECONCILE_TIMEOUT_ENV = "CT_LAB_CLAIM_RECONCILE_TIMEOUT_MS";
+export declare const CLAIM_RECONCILE_DEFAULT_TIMEOUT_MS = 120000;
+export declare const CLAIM_RECONCILE_POLL_MS = 3000;
+export interface ClaimReconcileDeps {
+    getClaim: (args: {
+        name: string;
+        namespace: string;
+    }) => Promise<CallToolResult>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+    timeoutMs: number;
+    pollMs: number;
+}
+export type ClaimReconcileOutcome = {
+    reconciled: true;
+    phase: "Ready";
+} | {
+    reconciled: false;
+    reason: "not_reconciled" | "failed" | "closed";
+    phase: string | null;
+    detail: string;
+};
+export declare function claimReconcileTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * Poll the exact claim until an operator has set it Ready. A Failed or Closed
+ * phase is final; an empty phase is retried until the timeout and then reported
+ * as "not reconciled" (no operator saw the claim).
+ */
+export declare function awaitClaimReconciled(name: string, namespace: string, overrides?: Partial<ClaimReconcileDeps>): Promise<ClaimReconcileOutcome>;
+/** Tool error for a claim no operator reconciled. The claim stays; nothing was imported. */
+export declare function claimNotReconciledResult(outcome: Extract<ClaimReconcileOutcome, {
+    reconciled: false;
+}>, context: {
+    operation: string;
+    claimName: string;
+    namespace: string;
+    timeoutMs: number;
+}): CallToolResult;
+//# sourceMappingURL=claim-reconcile-gate.d.ts.map

package/dist/src/tools/claim-reconcile-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-reconcile-gate.d.ts","sourceRoot":"","sources":["../../../src/tools/claim-reconcile-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG7E,eAAO,MAAM,2BAA2B,sCAAsC,CAAC;AAC/E,eAAO,MAAM,kCAAkC,SAAU,CAAC;AAC1D,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAG7C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjF,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpC;IAAE,UAAU,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQpF;AAsBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAiChC;AAED,4FAA4F;AAC5F,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE;IAAE,UAAU,EAAE,KAAK,CAAA;CAAE,CAAC,EAC9D,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtF,cAAc,CAgBhB"}

package/dist/src/tools/claim-reconcile-gate.js

@@ -0,0 +1,110 @@
+/**
+ * Claim reconcile gate (UAT-1785).
+ *
+ * A claim is only a guest's protection if an ApplianceClaim operator is actually
+ * watching the cluster the claim was written to. When the claim plane and the
+ * operator's cluster differ (for example the operator moved to another cluster
+ * and the tooling still writes to the old one), a new claim is never reconciled:
+ * its status stays empty, and the operator that is running elsewhere sees the
+ * imported guest as unclaimed and destroys it once its grace window elapses,
+ * minutes into a UAT run while the claim and lease still look live.
+ *
+ * A profile=bare claim reaches status.phase=Ready within seconds of an operator
+ * seeing it, before any guest exists. Creating the guest only after that
+ * observation turns the silent mid-run loss into an immediate, actionable
+ * refusal that happens before a guest exists.
+ */
+import { createToolErrorResult } from "../types/mcp.js";
+import { handleGetApplianceClaim } from "./appliance-claim-tools.js";
+export const CLAIM_RECONCILE_TIMEOUT_ENV = "CT_LAB_CLAIM_RECONCILE_TIMEOUT_MS";
+export const CLAIM_RECONCILE_DEFAULT_TIMEOUT_MS = 120_000;
+export const CLAIM_RECONCILE_POLL_MS = 3_000;
+const CLAIM_RECONCILE_MAX_TIMEOUT_MS = 900_000;
+export function claimReconcileTimeoutMs(env = process.env) {
+    const raw = env[CLAIM_RECONCILE_TIMEOUT_ENV]?.trim();
+    if (!raw)
+        return CLAIM_RECONCILE_DEFAULT_TIMEOUT_MS;
+    const parsed = Number(raw);
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > CLAIM_RECONCILE_MAX_TIMEOUT_MS) {
+        return CLAIM_RECONCILE_DEFAULT_TIMEOUT_MS;
+    }
+    return parsed;
+}
+function defaultDeps() {
+    return {
+        getClaim: (args) => handleGetApplianceClaim(args),
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        now: () => Date.now(),
+        timeoutMs: claimReconcileTimeoutMs(),
+        pollMs: CLAIM_RECONCILE_POLL_MS,
+    };
+}
+function claimOf(result) {
+    const block = result.content?.[0];
+    if (!block || block.type !== "text")
+        return null;
+    try {
+        return JSON.parse(block.text)?.claim ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Poll the exact claim until an operator has set it Ready. A Failed or Closed
+ * phase is final; an empty phase is retried until the timeout and then reported
+ * as "not reconciled" (no operator saw the claim).
+ */
+export async function awaitClaimReconciled(name, namespace, overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    const deadline = deps.now() + deps.timeoutMs;
+    let phase = null;
+    let detail = "the claim has no status; no operator has reconciled it";
+    for (;;) {
+        let result = null;
+        try {
+            result = await deps.getClaim({ name, namespace });
+        }
+        catch (error) {
+            detail = `claim read failed: ${String(error?.message ?? error).slice(0, 160)}`;
+        }
+        if (result && !result.isError) {
+            const claim = claimOf(result);
+            const live = typeof claim?.status?.phase === "string" && claim.status.phase ? claim.status.phase : null;
+            phase = live;
+            if (live === "Ready")
+                return { reconciled: true, phase: "Ready" };
+            if (live === "Failed" || live === "Closed") {
+                return {
+                    reconciled: false,
+                    reason: live === "Failed" ? "failed" : "closed",
+                    phase: live,
+                    detail: String(claim?.status?.message ?? `claim phase is ${live}`).slice(0, 240),
+                };
+            }
+            detail = live ? `claim phase is '${live}', not Ready` : "the claim has no status; no operator has reconciled it";
+        }
+        else if (result) {
+            detail = "claim read returned an error";
+        }
+        if (deps.now() + deps.pollMs > deadline)
+            break;
+        await deps.sleep(deps.pollMs);
+    }
+    return { reconciled: false, reason: "not_reconciled", phase, detail };
+}
+/** Tool error for a claim no operator reconciled. The claim stays; nothing was imported. */
+export function claimNotReconciledResult(outcome, context) {
+    const cause = outcome.reason === "not_reconciled"
+        ? "No ApplianceClaim operator reconciled it. The cluster this tool writes claims to (LAB_CLAIM_K8S_CONTEXT / LAB_CLAIM_K8S_SERVER) is not the cluster the operator watches, or the operator is not running there. An operator on another cluster would destroy an imported guest as unclaimed."
+        : `The operator set the claim to ${outcome.phase}.`;
+    return createToolErrorResult("CLAIM_NOT_RECONCILED", `${context.operation}: claim '${context.claimName}' did not reach Ready within ${Math.round(context.timeoutMs / 1000)}s (${outcome.detail}). ${cause} The image was NOT imported and no guest exists. The finite claim is retained; check the claim plane binding and the operator, then retry.`, {
+        operation: context.operation,
+        claimName: context.claimName,
+        namespace: context.namespace,
+        phase: outcome.phase,
+        guestCreated: false,
+        claimProtection: { disposition: "retained", guestAbsentVerified: true },
+    });
+}
+//# sourceMappingURL=claim-reconcile-gate.js.map

package/dist/src/tools/claim-reconcile-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-reconcile-gate.js","sourceRoot":"","sources":["../../../src/tools/claim-reconcile-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAuB,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,CAAC,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAC/E,MAAM,CAAC,MAAM,kCAAkC,GAAG,OAAO,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAc/C,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,kCAAkC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,8BAA8B,EAAE,CAAC;QACvF,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QACjD,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,uBAAuB,EAAE;QACpC,MAAM,EAAE,uBAAuB;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAsB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,SAAiB,EACjB,YAAyC,EAAE;IAE3C,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,MAAM,GAAG,wDAAwD,CAAC;IACtE,SAAS,CAAC;QACR,IAAI,MAAM,GAA0B,IAAI,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,GAAG,sBAAsB,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACxG,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAClE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;oBAC/C,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,IAAI,kBAAkB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACjF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,cAAc,CAAC,CAAC,CAAC,wDAAwD,CAAC;QACnH,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,8BAA8B,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,MAAM;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,wBAAwB,CACtC,OAA8D,EAC9D,OAAuF;IAEvF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,gBAAgB;QAC/C,CAAC,CAAC,6RAA6R;QAC/R,CAAC,CAAC,iCAAiC,OAAO,CAAC,KAAK,GAAG,CAAC;IACtD,OAAO,qBAAqB,CAC1B,sBAAsB,EACtB,GAAG,OAAO,CAAC,SAAS,YAAY,OAAO,CAAC,SAAS,gCAAgC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,MAAM,KAAK,4IAA4I,EAChS;QACE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE;KACxE,CACF,CAAC;AACJ,CAAC"}

package/dist/src/tools/claimed-import-qcow.d.ts

@@ -26,6 +26,7 @@
 import { z } from "zod";
 import { CallToolResult } from "../types/mcp.js";
 import { ToolContext } from "./list-hosts.js";
+import { type ClaimReconcileOutcome } from "./claim-reconcile-gate.js";
 export declare const ClaimedImportQcowInputObjectSchema: z.ZodObject<{
     readonly assetId: z.ZodString;
     readonly hostAssetId: z.ZodString;
@@ -120,6 +121,8 @@ export interface ClaimedImportDeps {
     createClaim: (args: unknown) => Promise<CallToolResult>;
     deleteClaim: (args: unknown) => Promise<CallToolResult>;
     importQcow: (args: unknown, context: ToolContext) => Promise<CallToolResult>;
+    /** Observes the created claim reaching Ready (an operator is watching this plane) before any guest exists. */
+    awaitClaimReconciled?: (name: string, namespace: string) => Promise<ClaimReconcileOutcome>;
 }
 export declare function handleClaimedImportQcow(rawArgs: ClaimedImportQcowRawInput | undefined, context: ToolContext, deps?: ClaimedImportDeps): Promise<CallToolResult>;
 export declare const CLAIMED_IMPORT_QCOW_TOOL_DESCRIPTION = "Import a published or private-candidate appliance QCOW2 as a Proxmox lab guest AND claim it, in one sanctioned step. The strict appliance operator destroys every guest no ApplianceClaim names within ~5 minutes, so this tool creates a profile=bare ApplianceClaim (no seed, no license, no bootstrap; names node + VMID + VM name; finite TTL) FIRST, then runs the canonical lab-inventory vm provision --source published-qcow apply (digest-bound, leased, journaled, receipted; the guest then awaits vm_repair, finalize and uat_access), and retains finite claim protection if the import fails, throws or has an uncertain outcome. Reconcile the exact canonical operation before explicit governed teardown. Dry-run is the default: it runs the canonical import plan and previews the claim. Requires vmid, vmPrefix and node (minis|proxmox|ibm64, matching hostAssetId). Renew with renew_appliance_claim; release with delete_appliance_claim. The guest disk is thin-only: thick or undeterminable storage is refused with THICK_STORAGE_REFUSED before the claim is created.";

package/dist/src/tools/claimed-import-qcow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claimed-import-qcow.d.ts","sourceRoot":"","sources":["../../../src/tools/claimed-import-qcow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2C,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiC9C,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBpC,CAAC;AAEZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE3F,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9E;AAoBD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,yBAAyB,GAAG,SAAS,EAC9C,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE,iBAA+B,GACpC,OAAO,CAAC,cAAc,CAAC,CAqKzB;AAED,eAAO,MAAM,oCAAoC,siCACo/B,CAAC"}
+{"version":3,"file":"claimed-import-qcow.d.ts","sourceRoot":"","sources":["../../../src/tools/claimed-import-qcow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2C,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAA2E,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA+BhJ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBpC,CAAC;AAEZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE3F,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,8GAA8G;IAC9G,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC5F;AAqBD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,yBAAyB,GAAG,SAAS,EAC9C,OAAO,EAAE,WAAW,EACpB,IAAI,GAAE,iBAA+B,GACpC,OAAO,CAAC,cAAc,CAAC,CAqLzB;AAED,eAAO,MAAM,oCAAoC,siCACo/B,CAAC"}

package/dist/src/tools/claimed-import-qcow.js

@@ -27,6 +27,7 @@ import { z } from "zod";
 import { ProxmoxErrorCode, createToolErrorResult } from "../types/mcp.js";
 import { canonicalOperationAvailable } from "./canonical-guard.js";
 import { guardCanonicalThinStorage } from "./thin-storage-policy.js";
+import { awaitClaimReconciled, claimNotReconciledResult, claimReconcileTimeoutMs } from "./claim-reconcile-gate.js";
 import { reservedIdentityError } from "./sha-channel.js";
 import { ImportQcowInputObjectSchema, ImportQcowInputSchema, handleProxmoxImportQcow, importQcowVersionFromUrl, } from "./import-qcow.js";
 import { buildApplianceClaimManifest, handleCreateApplianceClaim, handleDeleteApplianceClaim, normalizeClaimNode, CreateApplianceClaimInputSchema, } from "./appliance-claim-tools.js";
@@ -65,6 +66,7 @@ const defaultDeps = {
     createClaim: (args) => handleCreateApplianceClaim(args),
     deleteClaim: (args) => handleDeleteApplianceClaim(args),
     importQcow: (args, context) => handleProxmoxImportQcow(args, context),
+    awaitClaimReconciled: (name, namespace) => awaitClaimReconciled(name, namespace),
 };
 function textOf(result) {
     const block = result.content?.[0];
@@ -165,6 +167,21 @@ export async function handleClaimedImportQcow(rawArgs, context, deps = defaultDe
     if (created.isError) {
         return createToolErrorResult(ProxmoxErrorCode.UPSTREAM_API_ERROR, `claim creation failed; the image was NOT imported: ${textOf(created)}`, { operation: "claimed_import_qcow", claimName: built.claimName });
     }
+    // UAT-1785: the claim only protects the guest if an operator watches the plane
+    // it was written to. Require the operator to reconcile (Ready) it BEFORE the
+    // guest exists; otherwise refuse here instead of losing the guest mid-run.
+    const claimNamespace = built.manifest.metadata.namespace ?? "ct-lab";
+    if (deps.awaitClaimReconciled) {
+        const reconciled = await deps.awaitClaimReconciled(built.claimName, claimNamespace);
+        if (!reconciled.reconciled) {
+            return claimNotReconciledResult(reconciled, {
+                operation: "claimed_import_qcow",
+                claimName: built.claimName,
+                namespace: claimNamespace,
+                timeoutMs: claimReconcileTimeoutMs(),
+            });
+        }
+    }
     let imported;
     try {
         imported = await deps.importQcow(importArgs, context);