@cat-factory/server 0.253.0 → 0.255.0

package/dist/modules/publicApi/openapiDocument.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,y9pcAAy9pc,CAAA"}
+{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,ys2dAAys2d,CAAA"}

package/dist/modules/publicApi/publicApiAdmission.d.ts

@@ -1,5 +1,5 @@
 import { type AgentKindRegistry } from '@cat-factory/agents';
-import { HUMAN_WAIT_GATE_KINDS } from '@cat-factory/contracts';
+import type { GateRegistry } from '@cat-factory/kernel';
 /**
  * Inline agent kinds that PARK a run on a human/gate decision. This MUST list every
  * inline-and-parking kind: the two review gates AND the two brainstorm dialogues (all four set the
@@ -42,8 +42,7 @@ export declare const INPUT_GATE_PARK_SURFACE = "input-gate";
  *
  * A FOURTH mechanism, read off the step kind's `interview-gate` TRAIT rather than a list of
  * interviewer kinds, which is what makes a deployment's OWN registered interviewer visible to
- * admission with no edit here, the opposite of the wait-gate gap {@link HUMAN_WAIT_GATE_KINDS}
- * documents. Being visible HERE is not the same as being answerable: the decision surface needs the
+ * admission with no edit here. Being visible HERE is not the same as being answerable: the decision surface needs the
  * gate's controller wired too (`ExecutionService.interviewGateFor`), and a kind registered without
  * one is admitted as a park and 503s when answered. That order is the safe one (the refusal
  * over-counts rather than under-counts), but it is why the two checks are not one.
@@ -58,40 +57,30 @@ export declare const INPUT_GATE_PARK_SURFACE = "input-gate";
  */
 export declare const INTERVIEW_PARK_SURFACE = "interview";
 /**
- * POLLING-GATE kinds that park on a human, re-exported from `@cat-factory/contracts` so every park
- * surface this module enumerates is reachable from one place.
+ * Whether a polling-GATE kind parks the run on a human, read off the gate's OWN registration.
  *
- * A third category beside {@link PARKING_INLINE_KINDS} and {@link APPROVAL_GATE_PARK_SURFACE},
- * because it is a third MECHANISM: not an inline review that sets the run `blocked`, and not an
- * approval flag riding an ordinary step, but a gate step whose own poll loop never times out
- * (`pollExhaustion: 'rearm'`) because it is waiting on a person. `human-review` is the one built-in
+ * A third mechanism beside {@link PARKING_INLINE_KINDS} and {@link APPROVAL_GATE_PARK_SURFACE},
+ * because it is a third KIND of thing: not an inline review that sets the run `blocked`, and not
+ * an approval flag riding an ordinary step, but a gate step whose poll loop never times out
+ * (`pollExhaustion: 'rearm'`) because it is waiting on a person. `human-review` is the built-in
  * that qualifies, and it is why `pl_full` (the shipped Adaptive build preset, which carries a
  * risk-gated `human-review`) is a parking pipeline.
  *
- * Missing it was a real hole rather than a theoretical one: `human-review` is not answerable through
- * `/api/v1/runs/:runId/decisions` at all, so a plain `write` key could start the platform's flagship
- * board preset and have it park forever on the one surface with no public answer path.
- *
- * ONLY BUILT-IN GATES ARE IN IT, and a deployment that registers its own unbounded-wait gate
- * through the public `GateRegistry` seam is therefore INVISIBLE to this check: such a pipeline is
- * admitted for a plain `write` key and then parks with nothing here able to name it. That is a
- * limit of what a request-time check can read, not an oversight: a gate's `pollExhaustion` is
- * declared inside the object its FACTORY builds from an engine context, and standing a fake
- * context up per admission call to interrogate a static declaration would be a shortcut, not a
- * design. So the deployment that registered the gate owns the answer to it, in whatever surface
- * it registered it for, and the run reports `parked: true` with an empty decision list until then.
- *
- * Note what the neighbouring surfaces do NOT share this limit: {@link INTERVIEW_PARK_SURFACE} is
- * read off an AGENT KIND's trait, and follow-up triage would be readable off the pipeline's own
- * per-step toggles (it has no constant here because it is deliberately not enumerated, see
- * {@link parkSurfacesOf}), both of which a deployment's own registrations flow through, so a custom
- * interviewer is seen here and a custom wait gate is not. Closing the gap means a gate declaring
- * `pollExhaustion` at REGISTRATION time rather than only on the built definition; that is a change
- * to the registry seam, and its shape is recorded in
- * `backend/docs/adr/0043-public-decision-surface.md` rather than smuggled in behind a park-surface
- * slice.
+ * Missing it entirely was a real hole rather than a theoretical one: `human-review` is not
+ * answerable through `/api/v1/runs/:runId/decisions` at all, so a plain `write` key could start the
+ * platform's flagship board preset and have it park forever on the one surface with no public
+ * answer path. It was first closed with a hand-kept constant in `@cat-factory/contracts` naming the
+ * SHIPPED human-wait gates, pinned by a drift guard, which left the same hole open one level down:
+ * a gate a DEPLOYMENT registered through the public `GateRegistry` seam was invisible to the rule,
+ * admitted for a `write` key, and then parked with nothing here able to name it.
+ *
+ * Reading the registration closes that, and it is the shape ADR 0043 recorded rather than a
+ * shortcut: `pollExhaustion` is DECLARED at registration, so answering costs a map lookup and
+ * standing a fake engine context up per admission call (the thing that made this unreadable
+ * before) never enters into it. Every mechanism this module enumerates now derives from a
+ * declaration a deployment's own registrations flow through.
  */
-export { HUMAN_WAIT_GATE_KINDS };
+export declare function isHumanWaitGate(kind: string, gates: GateRegistry): boolean;
 /**
  * The route that frees an abandoned park, per public START surface. Named here rather than inlined
  * at each call site because {@link parkingRefusalMessage} puts one of them in front of an operator:
@@ -133,13 +122,36 @@ export interface AdmissiblePipelineShape {
  * container work or a GitHub write through the jobs surface, whatever its scope.
  */
 export declare function isInlineOnlyPipeline(pipeline: AdmissiblePipelineShape, registry: AgentKindRegistry): boolean;
+/**
+ * The two app-owned registries every park question is answered against, passed as one object so a
+ * call site cannot supply them in the wrong order, and so adding a third mechanism that reads a
+ * third registry is one edit rather than one per function in this chain.
+ */
+export interface AdmissionRegistries {
+    /** Decides traits (the interview gate) and whether a step runs inline. */
+    agentKinds: AgentKindRegistry;
+    /** Decides what a spent poll budget means for a gate kind, which is what {@link isHumanWaitGate} reads. */
+    gates: GateRegistry;
+}
+/**
+ * Read the two registries off whatever carries them (the request container, an engine
+ * `CoreDependencies`), so a call site names the container once instead of spelling the pairing out
+ * at each of the four places that ask a park question.
+ *
+ * Structurally typed rather than taking `ServerContainer`, which keeps this module what it is: pure,
+ * runtime-neutral policy with no HTTP or container dependency, unit-testable from two registries.
+ */
+export declare function admissionRegistries(source: {
+    agentKindRegistry: AgentKindRegistry;
+    gateRegistry: GateRegistry;
+}): AdmissionRegistries;
 /**
  * Whether a pipeline can PARK the run on a human decision: an approval gate on an enabled step, one
- * of the {@link PARKING_INLINE_KINDS} review/brainstorm kinds, or one of the
- * {@link HUMAN_WAIT_GATE_KINDS} unbounded-wait gates. Parking is not a defect: it is the
- * clarification loop. It just needs an answerer, which is what the `decide` scope asserts.
+ * of the {@link PARKING_INLINE_KINDS} review/brainstorm kinds, or a gate that waits on a person
+ * with no deadline ({@link isHumanWaitGate}). Parking is not a defect: it is the clarification
+ * loop. It just needs an answerer, which is what the `decide` scope asserts.
  */
-export declare function canParkOnHuman(pipeline: AdmissiblePipelineShape, registry: AgentKindRegistry): boolean;
+export declare function canParkOnHuman(pipeline: AdmissiblePipelineShape, registries: AdmissionRegistries): boolean;
 /**
  * Every park surface an ENABLED step of `pipeline` can put the run on, in step order and deduped.
  * Four mechanisms, each a separate check because each parks for a different reason:
@@ -147,7 +159,7 @@ export declare function canParkOnHuman(pipeline: AdmissiblePipelineShape, regist
  *  1. an approval gate flag on the step ({@link APPROVAL_GATE_PARK_SURFACE});
  *  2. the step's own kind being an inline review/brainstorm ({@link PARKING_INLINE_KINDS});
  *  3. the step's own kind being a polling gate that waits on a human with no deadline
- *     ({@link HUMAN_WAIT_GATE_KINDS});
+ *     ({@link isHumanWaitGate});
  *  4. the step's own kind carrying the `interview-gate` TRAIT ({@link INTERVIEW_PARK_SURFACE}).
  *
  * This is the single enumeration {@link canParkOnHuman} derives its boolean from, so the predicate
@@ -156,18 +168,15 @@ export declare function canParkOnHuman(pipeline: AdmissiblePipelineShape, regist
  * Case 4 arrived after the first three had shipped, which is the lesson the human-wait gates
  * already taught repeating itself: an enumeration written against the park mechanisms somebody
  * thought of misses the ones they did not, so ask what each entry is DERIVED from. Cases 2, 3 and 4
- * each derive from a declaration (a kind list, a `pollExhaustion` value pinned by a drift guard, a
- * registered trait) rather than from a hand-kept list of pipelines. Whatever is added next should
- * be derivable too.
+ * each derive from a declaration a deployment's own registrations flow through (a kind list, a
+ * gate's registered `pollExhaustion`, a registered trait) rather than from a hand-kept list of
+ * pipelines. Whatever is added next should be derivable too.
  *
- * THREE THINGS ARE DELIBERATELY NOT HERE, and they are absent for three different reasons:
+ * TWO THINGS ARE DELIBERATELY NOT HERE, and they are absent for two different reasons:
  *
  *  - A park raised dynamically mid-run (an agent-raised decision, a judge `park` disposition) is
  *    not knowable from the step chain at start time, so the rule cannot see it and does not pretend
  *    to. ADR 0032.
- *  - An unbounded human-wait gate a DEPLOYMENT registered itself cannot be read at request time;
- *    see the note on {@link HUMAN_WAIT_GATE_KINDS}. It is the only mechanism here a deployment's own
- *    registration escapes: a custom interviewer carries the trait case 4 reads and IS seen.
  *  - FOLLOW-UP TRIAGE is knowable (the companion is seeded on a Coder step unless the pipeline's
  *    per-step `followUps` toggle turns it off) and is deliberately left out anyway, because
  *    counting it would refuse a plain `write` key EVERY board pipeline that builds anything: the
@@ -180,7 +189,7 @@ export declare function canParkOnHuman(pipeline: AdmissiblePipelineShape, regist
  *    Recorded in `backend/docs/adr/0043-public-decision-surface.md` so it is not re-proposed as
  *    an oversight.
  */
-export declare function parkSurfacesOf(pipeline: AdmissiblePipelineShape, registry: AgentKindRegistry): string[];
+export declare function parkSurfacesOf(pipeline: AdmissiblePipelineShape, registries: AdmissionRegistries): string[];
 /**
  * The message behind the `pipeline_requires_decide_scope` refusal, built from the pipeline's ACTUAL
  * park surfaces.
@@ -217,7 +226,7 @@ export declare function parkingRefusalMessage(surfaces: string[], options: {
  * `true` refuses runs that were never going to park. Required means a new start surface has to
  * answer the question rather than inherit somebody else's answer.
  */
-export declare function publicRunParkSurfaces(pipeline: AdmissiblePipelineShape, registry: AgentKindRegistry, options: {
+export declare function publicRunParkSurfaces(pipeline: AdmissiblePipelineShape, registries: AdmissionRegistries, options: {
     inputGateBlocks: boolean;
 }): string[];
 /**
@@ -226,5 +235,5 @@ export declare function publicRunParkSurfaces(pipeline: AdmissiblePipelineShape,
  * can drive such a pipeline end to end with no follow-up. A parking pipeline is still admissible
  * for a `decide`-scoped key (see {@link PARKING_INLINE_KINDS}), it simply needs answering.
  */
-export declare function isHeadlessInlinePipeline(pipeline: AdmissiblePipelineShape, registry: AgentKindRegistry): boolean;
+export declare function isHeadlessInlinePipeline(pipeline: AdmissiblePipelineShape, registries: AdmissionRegistries): boolean;
 //# sourceMappingURL=publicApiAdmission.d.ts.map

package/dist/modules/publicApi/publicApiAdmission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publicApiAdmission.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiAdmission.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,iBAAiB,EAQvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oBAAoB,aAK/B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAA;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,iCAAiC,CAAA;AACpE,eAAO,MAAM,qBAAqB,oCAAoC,CAAA;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,aAQ5C,CAAA;AAEF,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;CAClB;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,GAC1B,MAAM,EAAE,CAQV;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgBjG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE;IAAE,eAAe,EAAE,OAAO,CAAA;CAAE,GACpC,MAAM,EAAE,CAKV;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAET"}
+{"version":3,"file":"publicApiAdmission.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiAdmission.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,iBAAiB,EAQvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oBAAoB,aAK/B,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAA;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAE1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,iCAAiC,CAAA;AACpE,eAAO,MAAM,qBAAqB,oCAAoC,CAAA;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,aAQ5C,CAAA;AAEF,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;CAClB;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAIT;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,UAAU,EAAE,iBAAiB,CAAA;IAC7B,2GAA2G;IAC3G,KAAK,EAAE,YAAY,CAAA;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;CAC3B,GAAG,mBAAmB,CAEtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,uBAAuB,EACjC,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,uBAAuB,EACjC,UAAU,EAAE,mBAAmB,GAC9B,MAAM,EAAE,CAYV;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgBjG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,uBAAuB,EACjC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE;IAAE,eAAe,EAAE,OAAO,CAAA;CAAE,GACpC,MAAM,EAAE,CAKV;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,uBAAuB,EACjC,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAIT"}

package/dist/modules/publicApi/publicApiAdmission.js

@@ -11,7 +11,6 @@
 //
 // See backend/docs/adr/0047-headless-clarification-loop.md (D1).
 import { ARCHITECTURE_BRAINSTORM_AGENT_KIND, CLARITY_REVIEW_AGENT_KIND, hasTrait, INTERVIEW_GATE_TRAIT, isInlineModelStep, REQUIREMENTS_BRAINSTORM_AGENT_KIND, REQUIREMENTS_REVIEW_AGENT_KIND, } from '@cat-factory/agents';
-import { HUMAN_WAIT_GATE_KINDS } from '@cat-factory/contracts';
 /**
  * Inline agent kinds that PARK a run on a human/gate decision. This MUST list every
  * inline-and-parking kind: the two review gates AND the two brainstorm dialogues (all four set the
@@ -59,8 +58,7 @@ export const INPUT_GATE_PARK_SURFACE = 'input-gate';
  *
  * A FOURTH mechanism, read off the step kind's `interview-gate` TRAIT rather than a list of
  * interviewer kinds, which is what makes a deployment's OWN registered interviewer visible to
- * admission with no edit here, the opposite of the wait-gate gap {@link HUMAN_WAIT_GATE_KINDS}
- * documents. Being visible HERE is not the same as being answerable: the decision surface needs the
+ * admission with no edit here. Being visible HERE is not the same as being answerable: the decision surface needs the
  * gate's controller wired too (`ExecutionService.interviewGateFor`), and a kind registered without
  * one is admitted as a park and 503s when answered. That order is the safe one (the refusal
  * over-counts rather than under-counts), but it is why the two checks are not one.
@@ -75,40 +73,32 @@ export const INPUT_GATE_PARK_SURFACE = 'input-gate';
  */
 export const INTERVIEW_PARK_SURFACE = 'interview';
 /**
- * POLLING-GATE kinds that park on a human, re-exported from `@cat-factory/contracts` so every park
- * surface this module enumerates is reachable from one place.
+ * Whether a polling-GATE kind parks the run on a human, read off the gate's OWN registration.
  *
- * A third category beside {@link PARKING_INLINE_KINDS} and {@link APPROVAL_GATE_PARK_SURFACE},
- * because it is a third MECHANISM: not an inline review that sets the run `blocked`, and not an
- * approval flag riding an ordinary step, but a gate step whose own poll loop never times out
- * (`pollExhaustion: 'rearm'`) because it is waiting on a person. `human-review` is the one built-in
+ * A third mechanism beside {@link PARKING_INLINE_KINDS} and {@link APPROVAL_GATE_PARK_SURFACE},
+ * because it is a third KIND of thing: not an inline review that sets the run `blocked`, and not
+ * an approval flag riding an ordinary step, but a gate step whose poll loop never times out
+ * (`pollExhaustion: 'rearm'`) because it is waiting on a person. `human-review` is the built-in
  * that qualifies, and it is why `pl_full` (the shipped Adaptive build preset, which carries a
  * risk-gated `human-review`) is a parking pipeline.
  *
- * Missing it was a real hole rather than a theoretical one: `human-review` is not answerable through
- * `/api/v1/runs/:runId/decisions` at all, so a plain `write` key could start the platform's flagship
- * board preset and have it park forever on the one surface with no public answer path.
+ * Missing it entirely was a real hole rather than a theoretical one: `human-review` is not
+ * answerable through `/api/v1/runs/:runId/decisions` at all, so a plain `write` key could start the
+ * platform's flagship board preset and have it park forever on the one surface with no public
+ * answer path. It was first closed with a hand-kept constant in `@cat-factory/contracts` naming the
+ * SHIPPED human-wait gates, pinned by a drift guard, which left the same hole open one level down:
+ * a gate a DEPLOYMENT registered through the public `GateRegistry` seam was invisible to the rule,
+ * admitted for a `write` key, and then parked with nothing here able to name it.
  *
- * ONLY BUILT-IN GATES ARE IN IT, and a deployment that registers its own unbounded-wait gate
- * through the public `GateRegistry` seam is therefore INVISIBLE to this check: such a pipeline is
- * admitted for a plain `write` key and then parks with nothing here able to name it. That is a
- * limit of what a request-time check can read, not an oversight: a gate's `pollExhaustion` is
- * declared inside the object its FACTORY builds from an engine context, and standing a fake
- * context up per admission call to interrogate a static declaration would be a shortcut, not a
- * design. So the deployment that registered the gate owns the answer to it, in whatever surface
- * it registered it for, and the run reports `parked: true` with an empty decision list until then.
- *
- * Note what the neighbouring surfaces do NOT share this limit: {@link INTERVIEW_PARK_SURFACE} is
- * read off an AGENT KIND's trait, and follow-up triage would be readable off the pipeline's own
- * per-step toggles (it has no constant here because it is deliberately not enumerated, see
- * {@link parkSurfacesOf}), both of which a deployment's own registrations flow through, so a custom
- * interviewer is seen here and a custom wait gate is not. Closing the gap means a gate declaring
- * `pollExhaustion` at REGISTRATION time rather than only on the built definition; that is a change
- * to the registry seam, and its shape is recorded in
- * `backend/docs/adr/0043-public-decision-surface.md` rather than smuggled in behind a park-surface
- * slice.
+ * Reading the registration closes that, and it is the shape ADR 0043 recorded rather than a
+ * shortcut: `pollExhaustion` is DECLARED at registration, so answering costs a map lookup and
+ * standing a fake engine context up per admission call (the thing that made this unreadable
+ * before) never enters into it. Every mechanism this module enumerates now derives from a
+ * declaration a deployment's own registrations flow through.
  */
-export { HUMAN_WAIT_GATE_KINDS };
+export function isHumanWaitGate(kind, gates) {
+    return gates.pollExhaustion(kind) === 'rearm';
+}
 /**
  * The route that frees an abandoned park, per public START surface. Named here rather than inlined
  * at each call site because {@link parkingRefusalMessage} puts one of them in front of an operator:
@@ -161,14 +151,25 @@ export function isInlineOnlyPipeline(pipeline, registry) {
         return false;
     return enabled.every(({ kind }) => isInlineModelStep(kind, registry));
 }
+/**
+ * Read the two registries off whatever carries them (the request container, an engine
+ * `CoreDependencies`), so a call site names the container once instead of spelling the pairing out
+ * at each of the four places that ask a park question.
+ *
+ * Structurally typed rather than taking `ServerContainer`, which keeps this module what it is: pure,
+ * runtime-neutral policy with no HTTP or container dependency, unit-testable from two registries.
+ */
+export function admissionRegistries(source) {
+    return { agentKinds: source.agentKindRegistry, gates: source.gateRegistry };
+}
 /**
  * Whether a pipeline can PARK the run on a human decision: an approval gate on an enabled step, one
- * of the {@link PARKING_INLINE_KINDS} review/brainstorm kinds, or one of the
- * {@link HUMAN_WAIT_GATE_KINDS} unbounded-wait gates. Parking is not a defect: it is the
- * clarification loop. It just needs an answerer, which is what the `decide` scope asserts.
+ * of the {@link PARKING_INLINE_KINDS} review/brainstorm kinds, or a gate that waits on a person
+ * with no deadline ({@link isHumanWaitGate}). Parking is not a defect: it is the clarification
+ * loop. It just needs an answerer, which is what the `decide` scope asserts.
  */
-export function canParkOnHuman(pipeline, registry) {
-    return parkSurfacesOf(pipeline, registry).length > 0;
+export function canParkOnHuman(pipeline, registries) {
+    return parkSurfacesOf(pipeline, registries).length > 0;
 }
 /**
  * Every park surface an ENABLED step of `pipeline` can put the run on, in step order and deduped.
@@ -177,7 +178,7 @@ export function canParkOnHuman(pipeline, registry) {
  *  1. an approval gate flag on the step ({@link APPROVAL_GATE_PARK_SURFACE});
  *  2. the step's own kind being an inline review/brainstorm ({@link PARKING_INLINE_KINDS});
  *  3. the step's own kind being a polling gate that waits on a human with no deadline
- *     ({@link HUMAN_WAIT_GATE_KINDS});
+ *     ({@link isHumanWaitGate});
  *  4. the step's own kind carrying the `interview-gate` TRAIT ({@link INTERVIEW_PARK_SURFACE}).
  *
  * This is the single enumeration {@link canParkOnHuman} derives its boolean from, so the predicate
@@ -186,18 +187,15 @@ export function canParkOnHuman(pipeline, registry) {
  * Case 4 arrived after the first three had shipped, which is the lesson the human-wait gates
  * already taught repeating itself: an enumeration written against the park mechanisms somebody
  * thought of misses the ones they did not, so ask what each entry is DERIVED from. Cases 2, 3 and 4
- * each derive from a declaration (a kind list, a `pollExhaustion` value pinned by a drift guard, a
- * registered trait) rather than from a hand-kept list of pipelines. Whatever is added next should
- * be derivable too.
+ * each derive from a declaration a deployment's own registrations flow through (a kind list, a
+ * gate's registered `pollExhaustion`, a registered trait) rather than from a hand-kept list of
+ * pipelines. Whatever is added next should be derivable too.
  *
- * THREE THINGS ARE DELIBERATELY NOT HERE, and they are absent for three different reasons:
+ * TWO THINGS ARE DELIBERATELY NOT HERE, and they are absent for two different reasons:
  *
  *  - A park raised dynamically mid-run (an agent-raised decision, a judge `park` disposition) is
  *    not knowable from the step chain at start time, so the rule cannot see it and does not pretend
  *    to. ADR 0032.
- *  - An unbounded human-wait gate a DEPLOYMENT registered itself cannot be read at request time;
- *    see the note on {@link HUMAN_WAIT_GATE_KINDS}. It is the only mechanism here a deployment's own
- *    registration escapes: a custom interviewer carries the trait case 4 reads and IS seen.
  *  - FOLLOW-UP TRIAGE is knowable (the companion is seeded on a Coder step unless the pipeline's
  *    per-step `followUps` toggle turns it off) and is deliberately left out anyway, because
  *    counting it would refuse a plain `write` key EVERY board pipeline that builds anything: the
@@ -210,15 +208,17 @@ export function canParkOnHuman(pipeline, registry) {
  *    Recorded in `backend/docs/adr/0043-public-decision-surface.md` so it is not re-proposed as
  *    an oversight.
  */
-export function parkSurfacesOf(pipeline, registry) {
+export function parkSurfacesOf(pipeline, registries) {
     const surfaces = new Set();
     for (const { kind, i } of enabledSteps(pipeline)) {
         if (pipeline.gates?.[i])
             surfaces.add(APPROVAL_GATE_PARK_SURFACE);
-        if (PARKING_INLINE_KINDS.has(kind) || HUMAN_WAIT_GATE_KINDS.has(kind))
+        if (PARKING_INLINE_KINDS.has(kind) || isHumanWaitGate(kind, registries.gates)) {
             surfaces.add(kind);
-        if (hasTrait(kind, INTERVIEW_GATE_TRAIT, registry))
+        }
+        if (hasTrait(kind, INTERVIEW_GATE_TRAIT, registries.agentKinds)) {
             surfaces.add(INTERVIEW_PARK_SURFACE);
+        }
     }
     return [...surfaces];
 }
@@ -268,8 +268,8 @@ export function parkingRefusalMessage(surfaces, options) {
  * `true` refuses runs that were never going to park. Required means a new start surface has to
  * answer the question rather than inherit somebody else's answer.
  */
-export function publicRunParkSurfaces(pipeline, registry, options) {
-    const surfaces = parkSurfacesOf(pipeline, registry);
+export function publicRunParkSurfaces(pipeline, registries, options) {
+    const surfaces = parkSurfacesOf(pipeline, registries);
     // Prepended: the gate parks BEFORE the first dispatch, so if it is going to hold this run it
     // holds it before any of the pipeline's own park surfaces are reached.
     return options.inputGateBlocks ? [INPUT_GATE_PARK_SURFACE, ...surfaces] : surfaces;
@@ -280,7 +280,7 @@ export function publicRunParkSurfaces(pipeline, registry, options) {
  * can drive such a pipeline end to end with no follow-up. A parking pipeline is still admissible
  * for a `decide`-scoped key (see {@link PARKING_INLINE_KINDS}), it simply needs answering.
  */
-export function isHeadlessInlinePipeline(pipeline, registry) {
-    return isInlineOnlyPipeline(pipeline, registry) && !canParkOnHuman(pipeline, registry);
+export function isHeadlessInlinePipeline(pipeline, registries) {
+    return (isInlineOnlyPipeline(pipeline, registries.agentKinds) && !canParkOnHuman(pipeline, registries));
 }
 //# sourceMappingURL=publicApiAdmission.js.map

package/dist/modules/publicApi/publicApiAdmission.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicApiAdmission.js","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiAdmission.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,0FAA0F;AAC1F,mCAAmC;AACnC,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,sFAAsF;AACtF,mCAAmC;AACnC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAEL,kCAAkC,EAClC,yBAAyB,EACzB,QAAQ,EACR,oBAAoB,EACpB,iBAAiB,EACjB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAClD,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,kCAAkC;CACnC,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAA;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAS;IAC/D,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,kCAAkC;IAClC,uBAAuB;IACvB,0BAA0B;IAC1B,sBAAsB;CACvB,CAAC,CAAA;AAWF,mGAAmG;AACnG,SAAS,YAAY,CAAC,QAAiC;IACrD,OAAO,QAAQ,CAAC,UAAU;SACvB,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiC,EACjC,QAA2B;IAE3B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,QAA2B;IAE3B,OAAO,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;QACjE,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzF,IAAI,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,OAA+B;IACvF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,CAAC,+CAA+C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtF,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,wDAAwD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC;QACxH,CAAC,CAAC,yCAAyC,CAC9C,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,6CAA6C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF,UAAU,GAAG,CACnK,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiC,EACjC,QAA2B,EAC3B,OAAqC;IAErC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACnD,6FAA6F;IAC7F,uEAAuE;IACvE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAiC,EACjC,QAA2B;IAE3B,OAAO,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AACxF,CAAC"}
+{"version":3,"file":"publicApiAdmission.js","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiAdmission.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,0FAA0F;AAC1F,mCAAmC;AACnC,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,sFAAsF;AACtF,mCAAmC;AACnC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAEL,kCAAkC,EAClC,yBAAyB,EACzB,QAAQ,EACR,oBAAoB,EACpB,iBAAiB,EACjB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAG5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAClD,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,kCAAkC;CACnC,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAmB;IAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAA;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAS;IAC/D,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,kCAAkC;IAClC,uBAAuB;IACvB,0BAA0B;IAC1B,sBAAsB;CACvB,CAAC,CAAA;AAWF,mGAAmG;AACnG,SAAS,YAAY,CAAC,QAAiC;IACrD,OAAO,QAAQ,CAAC,UAAU;SACvB,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAiC,EACjC,QAA2B;IAE3B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;AACvE,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAGnC;IACC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,UAA+B;IAE/B,OAAO,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,UAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;QACjE,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,OAA+B;IACvF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,CAAC,+CAA+C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtF,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,wDAAwD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC;QACxH,CAAC,CAAC,yCAAyC,CAC9C,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,6CAA6C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iFAAiF,UAAU,GAAG,CACnK,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiC,EACjC,UAA+B,EAC/B,OAAqC;IAErC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACrD,6FAA6F;IAC7F,uEAAuE;IACvE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACpF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAiC,EACjC,UAA+B;IAE/B,OAAO,CACL,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAC/F,CAAA;AACH,CAAC"}

package/dist/modules/publicApi/publicApiStream.d.ts

@@ -1,4 +1,4 @@
-import type { ExecutionStatus } from '@cat-factory/contracts';
+import type { ExecutionStatus, PublicRun } from '@cat-factory/contracts';
 /**
  * Whether a run is PARKED: waiting on a human decision and unable to move until one is answered.
  *
@@ -21,4 +21,32 @@ export declare function createParkAnnouncer(): {
     /** Feed each poll's status; true exactly on the tick a NEW park should be announced. */
     shouldAnnounce: (status: ExecutionStatus) => boolean;
 };
+/**
+ * Per-step character cap on the deliverable a STREAM frame carries, applied to `output` and to
+ * `data`'s serialized size alike.
+ *
+ * Sized as a preview a caller can act on (recognise the shape of the deliverable, decide whether
+ * to fetch the rest) rather than as a budget for the deliverable itself, and deliberately smaller
+ * than the run detail's own 8,000-char sibling (`MAX_HISTORY_OUTPUT_CHARS`, which bounds the same
+ * class of content for the same reason): this cap is paid once per step per FRAME, where that one
+ * is paid once per step.
+ */
+export declare const STREAM_DELIVERABLE_PREVIEW_CHARS = 2000;
+/**
+ * Reduce a run for an SSE frame: clip each step's oversized `output` to a preview, withhold an
+ * oversized `data`, and mark every step the reduction touched.
+ *
+ * The stream re-sends the whole run on every change, so an unreduced frame repeats every output
+ * the run has produced so far and the traffic grows with the SQUARE of the pipeline's length. The
+ * point read (`GET /api/v1/tasks/{taskId}/run`) serves both fields whole and is what a caller
+ * reads for the deliverable; this keeps the progress channel a progress channel.
+ *
+ * Only what EXCEEDS the cap is touched. A step whose deliverable already fits — which is the
+ * ordinary case for the structured `data` a fork choice or an estimate carries — rides the stream
+ * unchanged and unflagged, so `truncated` means exactly "something was left out of this frame"
+ * rather than "this frame came from the stream". That is the whole reason the flag exists: a
+ * clipped preview that did not say so is indexed by a caller as the step's output, and its tail is
+ * then absent in a way that reads as never written.
+ */
+export declare function reduceRunForStream(run: PublicRun): PublicRun;
 //# sourceMappingURL=publicApiStream.d.ts.map

package/dist/modules/publicApi/publicApiStream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publicApiStream.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiStream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAA;CACrD,CAaA"}
+{"version":3,"file":"publicApiStream.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiStream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAiB,MAAM,wBAAwB,CAAA;AAUvF;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,wFAAwF;IACxF,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAA;CACrD,CAaA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,OAAQ,CAAA;AAErD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,CAE5D"}

package/dist/modules/publicApi/publicApiStream.js

@@ -40,4 +40,49 @@ export function createParkAnnouncer() {
         },
     };
 }
+/**
+ * Per-step character cap on the deliverable a STREAM frame carries, applied to `output` and to
+ * `data`'s serialized size alike.
+ *
+ * Sized as a preview a caller can act on (recognise the shape of the deliverable, decide whether
+ * to fetch the rest) rather than as a budget for the deliverable itself, and deliberately smaller
+ * than the run detail's own 8,000-char sibling (`MAX_HISTORY_OUTPUT_CHARS`, which bounds the same
+ * class of content for the same reason): this cap is paid once per step per FRAME, where that one
+ * is paid once per step.
+ */
+export const STREAM_DELIVERABLE_PREVIEW_CHARS = 2_000;
+/**
+ * Reduce a run for an SSE frame: clip each step's oversized `output` to a preview, withhold an
+ * oversized `data`, and mark every step the reduction touched.
+ *
+ * The stream re-sends the whole run on every change, so an unreduced frame repeats every output
+ * the run has produced so far and the traffic grows with the SQUARE of the pipeline's length. The
+ * point read (`GET /api/v1/tasks/{taskId}/run`) serves both fields whole and is what a caller
+ * reads for the deliverable; this keeps the progress channel a progress channel.
+ *
+ * Only what EXCEEDS the cap is touched. A step whose deliverable already fits — which is the
+ * ordinary case for the structured `data` a fork choice or an estimate carries — rides the stream
+ * unchanged and unflagged, so `truncated` means exactly "something was left out of this frame"
+ * rather than "this frame came from the stream". That is the whole reason the flag exists: a
+ * clipped preview that did not say so is indexed by a caller as the step's output, and its tail is
+ * then absent in a way that reads as never written.
+ */
+export function reduceRunForStream(run) {
+    return { ...run, steps: run.steps.map(reduceStepForStream) };
+}
+function reduceStepForStream(step) {
+    const output = step.output;
+    const clipped = output !== null && output.length > STREAM_DELIVERABLE_PREVIEW_CHARS;
+    // Measured, not assumed: `data` is whatever the step's agent kind produced, so its size is a
+    // property of the deployment's kinds rather than of this contract.
+    const withheld = step.data != null && JSON.stringify(step.data).length > STREAM_DELIVERABLE_PREVIEW_CHARS;
+    if (!clipped && !withheld)
+        return step;
+    return {
+        ...step,
+        output: clipped && output !== null ? output.slice(0, STREAM_DELIVERABLE_PREVIEW_CHARS) : output,
+        data: withheld ? null : step.data,
+        truncated: true,
+    };
+}
 //# sourceMappingURL=publicApiStream.js.map

package/dist/modules/publicApi/publicApiStream.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicApiStream.js","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiStream.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,EAAE;AACF,kGAAkG;AAClG,4DAA4D;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAuB;IAC9C,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IAIjC,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,OAAO;QACL,cAAc,CAAC,MAAuB;YACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,KAAK,CAAA;gBACjB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,SAAS;gBAAE,OAAO,KAAK,CAAA;YAC3B,SAAS,GAAG,IAAI,CAAA;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"publicApiStream.js","sourceRoot":"","sources":["../../../src/modules/publicApi/publicApiStream.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,kGAAkG;AAClG,mGAAmG;AACnG,6FAA6F;AAC7F,EAAE;AACF,kGAAkG;AAClG,4DAA4D;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAuB;IAC9C,OAAO,MAAM,KAAK,SAAS,CAAA;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IAIjC,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,OAAO;QACL,cAAc,CAAC,MAAuB;YACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,KAAK,CAAA;gBACjB,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,SAAS;gBAAE,OAAO,KAAK,CAAA;YAC3B,SAAS,GAAG,IAAI,CAAA;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAA;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAc;IAC/C,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,gCAAgC,CAAA;IACnF,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,gCAAgC,CAAA;IAC1F,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC/F,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QACjC,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC"}

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAkxCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAmxCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/persistence/rpc-allowlist.js

@@ -1094,6 +1094,7 @@ export const REMOTE_PERSISTENCE_METHODS = {
         listByExecution: { scope: { kind: 'workspace', arg: 0 } },
         countByExecution: { scope: { kind: 'workspace', arg: 0 } },
         listByBlock: { scope: { kind: 'workspace', arg: 0 } },
+        countByBlock: { scope: { kind: 'workspace', arg: 0 } },
         // The document reclaim's two halves: an import running on a node retains a design source's
         // rendered frames and replaces the previous revision's, so both have to reach the mothership's
         // store or a local import would silently retain nothing. Same `workspace` rule as the reads