@caupulican/pi-adaptative 0.86.2 → 0.86.5

package/dist/core/orchestration/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/orchestration/contracts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAA0B,MAAM,2BAA2B,CAAC;AAEzF;;;;GAIG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AAEvD,yGAAyG;AACzG,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AACrD,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,8CAA8C,GAAG,EAAE,GAAG,IAAI,CAAC;AACxE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,GAAG,IAAI,CAAC;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,cAAc;IACd,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,KAAK;IACL,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;CACE,CAAC;AAqBX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAG1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAGrH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CACA,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAwF1G,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,OAAO;IACP,QAAQ;IACR,SAAS;CACA,CAAC;AAGX,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAC9D,CAAC;AAWD,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAuO5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAYnE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,mBAAmB;IACnB,mBAAmB;IACnB,6BAA6B;IAC7B,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,cAAc;IACd,YAAY;IACZ,aAAa;IACb,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;CACf,CAAC;AA6BX,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC7C,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAoC,MAAS,EAAE,KAAc;IACnF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IACjD,OAAO,cAAc,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CACN,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,cAAc,CAAC,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC;QACrD,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,cAAc,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,KAAK,CAAC,KAAK,CAAC;QAClG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5E,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9E,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAC;AACH,CAAC","sourcesContent":["import type { JsonObject, JsonValue } from \"../autonomy/contracts.ts\";\nimport { HARNESS_CAPABILITIES, type HarnessCapability } from \"../capability-contract.ts\";\nimport { isPlainRecord } from \"../util/value-guards.ts\";\n\nexport { HARNESS_CAPABILITIES, type HarnessCapability } from \"../capability-contract.ts\";\n\n/**\n * Versioned control-plane contracts. These records are the durable truth exchanged between the\n * deterministic kernel/runtime and replaceable execution-plane workers. They deliberately do not\n * contain callbacks, provider objects, tool implementations, or transcript messages.\n */\n\nexport const ORCHESTRATION_SCHEMA_VERSION = 1 as const;\n\n/** Shared durable-control bounds. Keep persisted orchestration records small enough to replay safely. */\nexport const MAX_ORCHESTRATION_IDENTIFIER_LENGTH = 512;\nexport const MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH = 128;\nexport const MAX_ORCHESTRATION_MODEL_ID_LENGTH = 512;\nexport const MAX_ORCHESTRATION_DESCRIPTION_LENGTH = 4 * 1024;\nexport const MAX_ORCHESTRATION_COLLECTION_LENGTH = 64;\nexport const MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH = 16 * 1024;\n/** Matches the bounded worker/process result contract retained by the execution plane. */\nexport const MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES = 512 * 1024;\nexport const MAX_WORKER_AUTHORITY_PATHS = 64;\nexport const MAX_WORKER_AUTHORITY_PATH_LENGTH = 4 * 1024;\nexport const MAX_WORKER_SOUL_LENGTH = 16 * 1024;\n\nexport const WORKER_ROLES = [\n\t\"orchestrator\",\n\t\"planner\",\n\t\"explorer\",\n\t\"implementer\",\n\t\"operator\",\n\t\"verifier\",\n\t\"database\",\n] as const;\nexport type WorkerRole = (typeof WORKER_ROLES)[number];\n\nexport const ORCHESTRATION_THINKING_LEVELS = [\n\t\"off\",\n\t\"minimal\",\n\t\"low\",\n\t\"medium\",\n\t\"high\",\n\t\"xhigh\",\n\t\"max\",\n\t\"ultra\",\n] as const;\nexport type OrchestrationThinkingLevel = (typeof ORCHESTRATION_THINKING_LEVELS)[number];\n\nexport interface OrchestrationModelBinding {\n\tprovider: string;\n\tmodelId: string;\n\tthinkingLevel: OrchestrationThinkingLevel;\n}\n\nexport interface OrchestrationModelPolicy {\n\tmode: \"fixed\" | \"ordered-fallback\";\n\tcandidates: readonly OrchestrationModelBinding[];\n}\n\n/** Constrained direct-argv launcher policy. This is allowlisting, not OS/container isolation. */\nexport interface OrchestrationExecutionPolicy {\n\tallowedExecutables: readonly string[];\n\tallowedEnvironmentVariables: readonly string[];\n\tmaxOutputBytes: number;\n}\n\nexport const OBJECTIVE_STATUSES = [\"active\", \"paused\", \"completed\", \"cancelled\"] as const;\nexport type ObjectiveStatus = (typeof OBJECTIVE_STATUSES)[number];\n\nexport const TASK_STATUSES = [\"pending\", \"ready\", \"running\", \"blocked\", \"completed\", \"failed\", \"cancelled\"] as const;\nexport type OrchestrationTaskStatus = (typeof TASK_STATUSES)[number];\n\nexport const ATTEMPT_STATUSES = [\n\t\"queued\",\n\t\"leased\",\n\t\"running\",\n\t\"suspended\",\n\t\"completed\",\n\t\"partial\",\n\t\"blocked\",\n\t\"failed\",\n\t\"cancelled\",\n\t\"expired\",\n] as const;\nexport type AttemptStatus = (typeof ATTEMPT_STATUSES)[number];\n\nexport const WORKER_RESULT_STATUSES = [\"completed\", \"partial\", \"blocked\", \"failed\", \"cancelled\"] as const;\nexport type WorkerResultContractStatus = (typeof WORKER_RESULT_STATUSES)[number];\n\nexport type AgentBindingStatus = \"registered\" | \"active\" | \"suspended\" | \"resuming\" | \"retired\";\n\nexport interface AgentResumeContext {\n\tprovider: \"pi\" | \"external\";\n\tsessionId: string;\n\tsessionDir?: string;\n\tsessionFile?: string;\n\tcwd: string;\n\tworktreeLaneKey?: string;\n\torchestrationProfileId?: string;\n\tresourceProfileNames: readonly string[];\n\tmodelRef?: string;\n\tcontextPointers: readonly ResourcePointer[];\n\tlatestCheckpointId?: string;\n}\n\n/** Provider-neutral logical identity shared by durable orchestration and process supervision. */\nexport interface AgentIdentityContract {\n\tagentId: string;\n\tresumeContext: AgentResumeContext;\n}\n\n/** Durable logical identity. A replacement OS process resumes this same binding after interruption. */\nexport interface AgentBindingContract extends AgentIdentityContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\t/** Direct creator in the durable orchestration tree. Root agents omit this field. */\n\tparentAgentId?: string;\n\t/** Stable root identity retained across arbitrary recursive delegation depth. */\n\trootAgentId: string;\n\t/** Informational lineage depth. It is observed and persisted, never used as an admission cap. */\n\tdepth: number;\n\trole: WorkerRole;\n\tstatus: AgentBindingStatus;\n\tactiveAttemptId?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface RiskBudget {\n\tmaxTokens?: number;\n\tmaxWallClockMs?: number;\n\tmaxCostUsd?: number;\n\tmaxAttempts?: number;\n\tmaxToolCalls?: number;\n\trequireApprovalAboveCostUsd?: number;\n}\n\nexport interface AcceptanceCriterion {\n\tid: string;\n\tdescription: string;\n\trequired: boolean;\n\tevaluator?: string;\n}\n\nexport interface ObjectiveContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tobjectiveId: string;\n\ttitle: string;\n\tdescription: string;\n\tstatus: ObjectiveStatus;\n\tconstraints: readonly string[];\n\tacceptanceCriteria: readonly AcceptanceCriterion[];\n\triskBudget: RiskBudget;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface TaskContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\ttaskId: string;\n\tobjectiveId: string;\n\ttitle: string;\n\tdescription: string;\n\trole: WorkerRole;\n\tstatus: OrchestrationTaskStatus;\n\tdependsOn: readonly string[];\n\trequiredCapabilities: readonly HarnessCapability[];\n\tacceptanceCriterionIds: readonly string[];\n\t/** Implementer task this verifier task must independently reconcile. */\n\tverificationOfTaskId?: string;\n\triskBudget: RiskBudget;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport const RESOURCE_POINTER_KINDS = [\n\t\"repository\",\n\t\"worktree\",\n\t\"artifact\",\n\t\"evidence\",\n\t\"memory-query\",\n\t\"skill\",\n\t\"prompt\",\n\t\"service\",\n] as const;\nexport type ResourcePointerKind = (typeof RESOURCE_POINTER_KINDS)[number];\n\nexport function isResourcePointerKind(value: unknown): value is ResourcePointerKind {\n\treturn RESOURCE_POINTER_KINDS.some((kind) => kind === value);\n}\n\nexport interface ResourcePointer {\n\tid: string;\n\tkind: ResourcePointerKind;\n\turi: string;\n\treadOnly: boolean;\n\tdigest?: string;\n\tmetadata?: JsonObject;\n}\n\n/** Bounded metadata-only resources retained in one worker execution contract. */\nexport const MAX_WORKER_RESOURCE_POINTERS = 64;\nexport const MAX_WORKER_RESOURCE_PATH_LENGTH = 4096;\nexport const MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH = 256;\n\n/** Lightweight metadata catalogued without importing the executable tool module. */\nexport interface ToolCapabilityManifest {\n\ttoolName: string;\n\tmoduleSpecifier: string;\n\tcapabilities: readonly HarnessCapability[];\n\troles: readonly WorkerRole[];\n\tenforcements: readonly CapabilityEnforcementKind[];\n\tsourcePath?: string;\n}\n\nexport interface OrchestrationProfile {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tprofileId: string;\n\tdescription: string;\n\trole: WorkerRole;\n\tmodelPolicy: OrchestrationModelPolicy;\n\tcapabilityCeiling: readonly HarnessCapability[];\n\ttoolNames: readonly string[];\n\tresourceProfileNames: readonly string[];\n\t/** Optional preset-routing metadata retained for authored profiles; never an admission allowlist. */\n\tdispatchProfileIds: readonly string[];\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tbudget: RiskBudget;\n\t/** Authored scheduling hint retained in the snapshot; the global scheduler owns actual concurrency. */\n\tmaxConcurrent: number;\n\tleaseTtlMs: number;\n\trequireIndependentVerification: boolean;\n\t/** Owner-pinned verifier profile. Required when independent verification is enabled. */\n\tverificationProfileId?: string;\n\t/** Resolved origin retained for controlled improvements; omitted from authored JSON. */\n\tsourcePath?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n/** Admission-time worker profile materialization. Profile files are never consulted after this is persisted. */\nexport interface WorkerProfileExecutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tprofile: OrchestrationProfile;\n\tmodelBinding: OrchestrationModelBinding;\n\tauthority: WorkerExecutionAuthorityContract;\n\t/** Metadata-only resources fixed at admission; their content remains lazy and non-durable. */\n\tresourcePointers: readonly ResourcePointer[];\n\t/** Resolved resource-profile identity text. Other worker resources are represented by profile tools. */\n\tsoul?: string;\n}\n\n/** Effective authority admitted for one materialized worker profile. */\nexport interface WorkerExecutionAuthorityContract {\n\tcapabilities: readonly HarnessCapability[];\n\ttoolNames: readonly string[];\n\treadPaths: readonly string[];\n\twritePaths: readonly string[];\n\tdeniedPaths: readonly string[];\n\tbudget: RiskBudget;\n}\n\n/** Immutable execution contract owned by the runtime, including any mandatory verifier. */\nexport interface WorkerExecutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tworker: WorkerProfileExecutionContract;\n\tverifier?: WorkerProfileExecutionContract;\n}\n\n/** Durable dispatch metadata. Model/tool choices are retained in the runtime-owned executionContract. */\nexport interface OrchestrationDispatchRequest {\n\ttaskId: string;\n\tprofileId: string;\n\tinstructions: string;\n\tresourcePointerIds: readonly string[];\n\t/** Direct logical-agent creator for recursively delegated in-process work. */\n\tparentAgentId?: string;\n\t/** Runtime-owned goal/task correlation. Omitted by legacy records and normalized to an empty list. */\n\trequirementIds?: readonly string[];\n\t/** Execution owner. Omitted on legacy records and normalized to in-process. */\n\texecutionKind?: \"in-process\" | \"managed-process\";\n\t/** Stable external lane identity shared by successive managed-process turns. */\n\tlogicalLaneId?: string;\n\t/** Monotonic dispatch sequence within a managed-process logical lane. */\n\tdispatchSequence?: number;\n\t/** External provider identity retained for routing and diagnostics. */\n\tprovider?: string;\n\t/** Owner approval or standing-grant record that authorized an external launch. */\n\tauthorizationId?: string;\n\t/** Worktree-sync lane claimed by the external dispatcher. */\n\tworktreeLaneKey?: string;\n\t/** Runtime-owned immutable worker materialization. Never accepted from a model tool call. */\n\texecutionContract?: WorkerExecutionContract;\n}\n\nexport type CapabilityEnforcementKind =\n\t| \"path-scope\"\n\t| \"process-launcher\"\n\t| \"service-proxy\"\n\t| \"memory-broker\"\n\t| \"control-plane\";\n\nexport interface CapabilityDecision {\n\tcapability: HarnessCapability;\n\toutcome: \"allow\" | \"deny\";\n\treasonCode: string;\n\tsource: string;\n}\n\nexport interface ExecutionGrant {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tgrantId: string;\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools: readonly string[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths: readonly string[];\n\tdeniedPaths: readonly string[];\n\tbudget: RiskBudget;\n\tpolicyVersion: string;\n\tdecisionTrace: readonly CapabilityDecision[];\n\tissuedAt: string;\n\texpiresAt?: string;\n}\n\nexport interface AttemptLease {\n\tleaseId: string;\n\tattemptId: string;\n\townerId: string;\n\tfencingToken: number;\n\tissuedAt: string;\n\texpiresAt: string;\n}\n\n/** Complete cumulative active usage for one execution attempt. Restart downtime is never included. */\nexport interface AttemptUsageSnapshot {\n\ttoolCalls: number;\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\t/** Provider-authoritative total; detail categories are not assumed to be additive. */\n\ttotalTokens: number;\n\tcostUsd: number;\n\tactiveWallClockMs: number;\n}\n\nexport interface AttemptCheckpoint {\n\tcheckpointId: string;\n\tattemptId: string;\n\tfencingToken: number;\n\tsummary: string;\n\tartifactIds: readonly string[];\n\tevidenceIds: readonly string[];\n\t/** Omitted only by legacy checkpoints created before durable usage accounting existed. */\n\tusage?: AttemptUsageSnapshot;\n\tcreatedAt: string;\n}\n\nexport interface ArtifactContract {\n\tartifactId: string;\n\tkind: \"diff\" | \"file\" | \"report\" | \"test-result\" | \"log\" | \"structured-data\";\n\turi: string;\n\tdigest?: string;\n\tsizeBytes?: number;\n\tcreatedAt: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface EvidenceContract {\n\tevidenceId: string;\n\tcriterionId?: string;\n\tkind: \"observation\" | \"command\" | \"test\" | \"review\" | \"external\";\n\tsummary: string;\n\tartifactIds: readonly string[];\n\ttrusted: boolean;\n\tcreatedAt: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface WorkerErrorContract {\n\tcode: string;\n\tmessage: string;\n\tretryable: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface WorkerUsageContract {\n\tinputTokens?: number;\n\toutputTokens?: number;\n\ttotalTokens?: number;\n\tcostUsd?: number;\n\twallClockMs: number;\n\ttoolCalls: number;\n}\n\nexport interface WorkerResultContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tresultId: string;\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tleaseId: string;\n\tfencingToken: number;\n\tstatus: WorkerResultContractStatus;\n\treasonCode: string;\n\tsummary: string;\n\tartifacts: readonly ArtifactContract[];\n\tevidence: readonly EvidenceContract[];\n\terrors: readonly WorkerErrorContract[];\n\tnextAction?: string;\n\tusage: WorkerUsageContract;\n\tcreatedAt: string;\n}\n\nexport interface ApprovalRequestContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tapprovalId: string;\n\tobjectiveId: string;\n\ttaskId?: string;\n\tattemptId?: string;\n\treasonCode: string;\n\tsummary: string;\n\trequestedCapabilities: readonly HarnessCapability[];\n\trequestedBudget?: RiskBudget;\n\treversible: boolean;\n\tcreatedAt: string;\n}\n\nexport const APPROVAL_OUTCOMES = [\"approved\", \"rejected\"] as const;\nexport type ApprovalOutcome = (typeof APPROVAL_OUTCOMES)[number];\n\n/** Human decision only. Approval is not an execution grant; policy must compile a new grant afterward. */\nexport interface ApprovalResolutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tapprovalId: string;\n\toutcome: ApprovalOutcome;\n\treasonCode: string;\n\tresolvedAt: string;\n}\n\nexport const ORCHESTRATION_EVENT_TYPES = [\n\t\"objective.created\",\n\t\"objective.updated\",\n\t\"objective.evidence_recorded\",\n\t\"objective.paused\",\n\t\"objective.resumed\",\n\t\"objective.completed\",\n\t\"objective.cancelled\",\n\t\"task.created\",\n\t\"task.ready\",\n\t\"task.failed\",\n\t\"task.verification_finished\",\n\t\"agent.registered\",\n\t\"agent.suspended\",\n\t\"agent.resume_requested\",\n\t\"agent.resumed\",\n\t\"attempt.queued\",\n\t\"attempt.grant_bound\",\n\t\"attempt.leased\",\n\t\"attempt.started\",\n\t\"attempt.checkpointed\",\n\t\"attempt.suspended\",\n\t\"attempt.resumed\",\n\t\"attempt.cancelled\",\n\t\"attempt.finished\",\n\t\"attempt.lease_expired\",\n\t\"approval.requested\",\n\t\"approval.resolved\",\n\t\"notification.enqueued\",\n\t\"notification.delivered\",\n] as const;\n\nexport type OrchestrationEventType = (typeof ORCHESTRATION_EVENT_TYPES)[number];\nexport type OrchestrationActorKind = \"human\" | \"kernel\" | \"runtime\" | \"policy\" | \"router\" | \"worker\";\n\nexport interface OrchestrationEvent {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tordinal: number;\n\teventId: string;\n\ttype: OrchestrationEventType;\n\taggregateId: string;\n\tactor: OrchestrationActorKind;\n\toccurredAt: string;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tidempotencyKey?: string;\n\tpayload: JsonObject;\n}\n\nexport interface AppendOrchestrationEventInput {\n\ttype: OrchestrationEventType;\n\taggregateId: string;\n\tactor: OrchestrationActorKind;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tidempotencyKey?: string;\n\tpayload: JsonObject;\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.length > 0;\n}\n\nfunction isJsonValue(value: unknown, depth = 0): value is JsonValue {\n\tif (depth > 30) return false;\n\tif (value === null || typeof value === \"string\" || typeof value === \"boolean\") return true;\n\tif (typeof value === \"number\") return Number.isFinite(value);\n\tif (Array.isArray(value)) return value.every((entry) => isJsonValue(entry, depth + 1));\n\tif (!isPlainRecord(value)) return false;\n\treturn Object.values(value).every((entry) => isJsonValue(entry, depth + 1));\n}\n\nfunction includesString<const T extends readonly string[]>(values: T, value: unknown): value is T[number] {\n\treturn typeof value === \"string\" && values.includes(value);\n}\n\nexport function isHarnessCapability(value: unknown): value is HarnessCapability {\n\treturn includesString(HARNESS_CAPABILITIES, value);\n}\n\n/** Clone a runtime value into the persisted JSON domain, rejecting unsupported or over-deep data. */\nexport function toJsonObject(value: unknown): JsonObject {\n\tif (!isPlainRecord(value) || !isJsonValue(value)) {\n\t\tthrow new TypeError(\"Value is not a valid orchestration JSON object.\");\n\t}\n\treturn structuredClone(value);\n}\n\nexport function isOrchestrationEvent(value: unknown): value is OrchestrationEvent {\n\tif (!isPlainRecord(value)) return false;\n\treturn (\n\t\tvalue.schemaVersion === ORCHESTRATION_SCHEMA_VERSION &&\n\t\tNumber.isSafeInteger(value.ordinal) &&\n\t\tNumber(value.ordinal) > 0 &&\n\t\tisNonEmptyString(value.eventId) &&\n\t\tincludesString(ORCHESTRATION_EVENT_TYPES, value.type) &&\n\t\tisNonEmptyString(value.aggregateId) &&\n\t\tincludesString([\"human\", \"kernel\", \"runtime\", \"policy\", \"router\", \"worker\"] as const, value.actor) &&\n\t\tisNonEmptyString(value.occurredAt) &&\n\t\t(value.correlationId === undefined || isNonEmptyString(value.correlationId)) &&\n\t\t(value.causationId === undefined || isNonEmptyString(value.causationId)) &&\n\t\t(value.idempotencyKey === undefined || isNonEmptyString(value.idempotencyKey)) &&\n\t\tisPlainRecord(value.payload) &&\n\t\tisJsonValue(value.payload)\n\t);\n}\n"]}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/core/orchestration/contracts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,OAAO,EAAE,oBAAoB,EAA0B,MAAM,2BAA2B,CAAC;AAEzF;;;;GAIG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AAEvD,yGAAyG;AACzG,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AACrD,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,8CAA8C,GAAG,EAAE,GAAG,IAAI,CAAC;AACxE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,GAAG,IAAI,CAAC;AACpE,yGAAyG;AACzG,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnE,wGAAwG;AACxG,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnE,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5E,MAAM,CAAC,MAAM,2CAA2C,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5E,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,GAAG,IAAI,CAAC;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,cAAc;IACd,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;CACD,CAAC;AAGX,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,KAAK;IACL,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;CACE,CAAC;AAqBX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAG1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAGrH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CACA,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AA8F1G,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,OAAO;IACP,QAAQ;IACR,SAAS;CACA,CAAC;AAGX,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAC9D,CAAC;AAWD,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAmP5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAYnE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,mBAAmB;IACnB,mBAAmB;IACnB,6BAA6B;IAC7B,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,YAAY;IACZ,aAAa;IACb,4BAA4B;IAC5B,kBAAkB;IAClB,eAAe;IACf,iBAAiB;IACjB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;CACf,CAAC;AA6BX,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC7C,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAoC,MAAS,EAAE,KAAc;IACnF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IACjD,OAAO,cAAc,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CACN,KAAK,CAAC,aAAa,KAAK,4BAA4B;QACpD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/B,cAAc,CAAC,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC;QACrD,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,cAAc,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,EAAE,KAAK,CAAC,KAAK,CAAC;QAClG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5E,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9E,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAC;AACH,CAAC","sourcesContent":["import type { JsonObject, JsonValue } from \"../autonomy/contracts.ts\";\nimport { HARNESS_CAPABILITIES, type HarnessCapability } from \"../capability-contract.ts\";\nimport { isPlainRecord } from \"../util/value-guards.ts\";\nimport type { WorkerContextForkReference } from \"./worker-context-fork-reference.ts\";\n\nexport { HARNESS_CAPABILITIES, type HarnessCapability } from \"../capability-contract.ts\";\n\n/**\n * Versioned control-plane contracts. These records are the durable truth exchanged between the\n * deterministic kernel/runtime and replaceable execution-plane workers. They deliberately do not\n * contain callbacks, provider objects, tool implementations, or transcript messages.\n */\n\nexport const ORCHESTRATION_SCHEMA_VERSION = 1 as const;\n\n/** Shared durable-control bounds. Keep persisted orchestration records small enough to replay safely. */\nexport const MAX_ORCHESTRATION_IDENTIFIER_LENGTH = 512;\nexport const MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH = 128;\nexport const MAX_ORCHESTRATION_MODEL_ID_LENGTH = 512;\nexport const MAX_ORCHESTRATION_DESCRIPTION_LENGTH = 4 * 1024;\nexport const MAX_ORCHESTRATION_COLLECTION_LENGTH = 64;\nexport const MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH = 16 * 1024;\n/**\n * Lifetime ceilings for the retained hot projection. Terminal records are intentionally retained,\n * so these limits match the durable worker-fleet ceiling rather than only counting active work.\n */\nexport const MAX_ORCHESTRATION_AGENT_BINDINGS = 256;\nexport const MAX_ORCHESTRATION_OBJECTIVES = 256;\nexport const MAX_ORCHESTRATION_TASKS = 256;\nexport const MAX_ORCHESTRATION_ATTEMPTS = 256;\nexport const MAX_ORCHESTRATION_CHECKPOINTS = 4_096;\nexport const MAX_ORCHESTRATION_APPROVALS = 256;\n/** Approval prompts and terminal handoffs may each retain one notification per attempt. */\nexport const MAX_ORCHESTRATION_NOTIFICATIONS = 512;\n/** Source goal state admits at most 512 evidence entries for one objective. */\nexport const MAX_ORCHESTRATION_OBJECTIVE_EVIDENCE = 512;\nexport const MAX_ORCHESTRATION_EVIDENCE = 4_096;\nexport const MAX_ORCHESTRATION_CHECKPOINT_SUMMARY_LENGTH = 4 * 1024;\n/** One changed retained map value; aggregate projection accounting remains the authoritative ceiling. */\nexport const MAX_ORCHESTRATION_RETAINED_RECORD_BYTES = 1024 * 1024;\n/** Leaves room for bounded idempotency evidence and the snapshot envelope below the on-disk ceiling. */\nexport const MAX_ORCHESTRATION_PROJECTION_BYTES = 24 * 1024 * 1024;\nexport const MAX_ORCHESTRATION_SNAPSHOT_IDEMPOTENCY_BYTES = 4 * 1024 * 1024;\nexport const MAX_ORCHESTRATION_PROJECTION_SNAPSHOT_BYTES = 32 * 1024 * 1024;\n/** Matches the bounded worker/process result contract retained by the execution plane. */\nexport const MAX_ORCHESTRATION_PROCESS_OUTPUT_BYTES = 512 * 1024;\nexport const MAX_WORKER_AUTHORITY_PATHS = 64;\nexport const MAX_WORKER_AUTHORITY_PATH_LENGTH = 4 * 1024;\nexport const MAX_WORKER_SOUL_LENGTH = 16 * 1024;\n\nexport const WORKER_ROLES = [\n\t\"orchestrator\",\n\t\"planner\",\n\t\"explorer\",\n\t\"implementer\",\n\t\"operator\",\n\t\"verifier\",\n\t\"database\",\n] as const;\nexport type WorkerRole = (typeof WORKER_ROLES)[number];\n\nexport const ORCHESTRATION_THINKING_LEVELS = [\n\t\"off\",\n\t\"minimal\",\n\t\"low\",\n\t\"medium\",\n\t\"high\",\n\t\"xhigh\",\n\t\"max\",\n\t\"ultra\",\n] as const;\nexport type OrchestrationThinkingLevel = (typeof ORCHESTRATION_THINKING_LEVELS)[number];\n\nexport interface OrchestrationModelBinding {\n\tprovider: string;\n\tmodelId: string;\n\tthinkingLevel: OrchestrationThinkingLevel;\n}\n\nexport interface OrchestrationModelPolicy {\n\tmode: \"fixed\" | \"ordered-fallback\";\n\tcandidates: readonly OrchestrationModelBinding[];\n}\n\n/** Constrained direct-argv launcher policy. This is allowlisting, not OS/container isolation. */\nexport interface OrchestrationExecutionPolicy {\n\tallowedExecutables: readonly string[];\n\tallowedEnvironmentVariables: readonly string[];\n\tmaxOutputBytes: number;\n}\n\nexport const OBJECTIVE_STATUSES = [\"active\", \"paused\", \"completed\", \"cancelled\"] as const;\nexport type ObjectiveStatus = (typeof OBJECTIVE_STATUSES)[number];\n\nexport const TASK_STATUSES = [\"pending\", \"ready\", \"running\", \"blocked\", \"completed\", \"failed\", \"cancelled\"] as const;\nexport type OrchestrationTaskStatus = (typeof TASK_STATUSES)[number];\n\nexport const ATTEMPT_STATUSES = [\n\t\"queued\",\n\t\"leased\",\n\t\"running\",\n\t\"suspended\",\n\t\"completed\",\n\t\"partial\",\n\t\"blocked\",\n\t\"failed\",\n\t\"cancelled\",\n\t\"expired\",\n] as const;\nexport type AttemptStatus = (typeof ATTEMPT_STATUSES)[number];\n\nexport const WORKER_RESULT_STATUSES = [\"completed\", \"partial\", \"blocked\", \"failed\", \"cancelled\"] as const;\nexport type WorkerResultContractStatus = (typeof WORKER_RESULT_STATUSES)[number];\n\nexport type AgentBindingStatus = \"registered\" | \"active\" | \"suspended\" | \"resuming\" | \"retired\";\n\nexport interface AgentResumeContext {\n\tprovider: \"pi\" | \"external\";\n\tsessionId: string;\n\tsessionDir?: string;\n\tsessionFile?: string;\n\tcwd: string;\n\tworktreeLaneKey?: string;\n\torchestrationProfileId?: string;\n\tresourceProfileNames: readonly string[];\n\tmodelRef?: string;\n\tcontextPointers: readonly ResourcePointer[];\n\tlatestCheckpointId?: string;\n}\n\n/** Provider-neutral logical identity shared by durable orchestration and process supervision. */\nexport interface AgentIdentityContract {\n\tagentId: string;\n\tresumeContext: AgentResumeContext;\n}\n\n/** Durable logical identity. A replacement OS process resumes this same binding after interruption. */\nexport interface AgentBindingContract extends AgentIdentityContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\t/** Direct creator in the durable orchestration tree. Root agents omit this field. */\n\tparentAgentId?: string;\n\t/** Stable root identity retained across bounded recursive delegation depth. */\n\trootAgentId: string;\n\t/** Durable lineage depth. Fleet admission enforces the host-configured depth ceiling. */\n\tdepth: number;\n\trole: WorkerRole;\n\tstatus: AgentBindingStatus;\n\tactiveAttemptId?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface RiskBudget {\n\t/**\n\t * Budget-counted tokens, not raw provider totals: input/output/cache-write tokens charge at\n\t * face value, prompt-cache reads at CACHE_READ_BUDGET_WEIGHT (see capability-gateway.ts).\n\t * Charging cache reads fully would turn this into a request counter, since every request\n\t * re-reads the fixed system prompt.\n\t */\n\tmaxTokens?: number;\n\tmaxWallClockMs?: number;\n\tmaxCostUsd?: number;\n\tmaxAttempts?: number;\n\tmaxToolCalls?: number;\n\trequireApprovalAboveCostUsd?: number;\n}\n\nexport interface AcceptanceCriterion {\n\tid: string;\n\tdescription: string;\n\trequired: boolean;\n\tevaluator?: string;\n}\n\nexport interface ObjectiveContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tobjectiveId: string;\n\ttitle: string;\n\tdescription: string;\n\tstatus: ObjectiveStatus;\n\tconstraints: readonly string[];\n\tacceptanceCriteria: readonly AcceptanceCriterion[];\n\triskBudget: RiskBudget;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface TaskContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\ttaskId: string;\n\tobjectiveId: string;\n\ttitle: string;\n\tdescription: string;\n\trole: WorkerRole;\n\tstatus: OrchestrationTaskStatus;\n\tdependsOn: readonly string[];\n\trequiredCapabilities: readonly HarnessCapability[];\n\tacceptanceCriterionIds: readonly string[];\n\t/** Implementer task this verifier task must independently reconcile. */\n\tverificationOfTaskId?: string;\n\triskBudget: RiskBudget;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport const RESOURCE_POINTER_KINDS = [\n\t\"repository\",\n\t\"worktree\",\n\t\"artifact\",\n\t\"evidence\",\n\t\"memory-query\",\n\t\"skill\",\n\t\"prompt\",\n\t\"service\",\n] as const;\nexport type ResourcePointerKind = (typeof RESOURCE_POINTER_KINDS)[number];\n\nexport function isResourcePointerKind(value: unknown): value is ResourcePointerKind {\n\treturn RESOURCE_POINTER_KINDS.some((kind) => kind === value);\n}\n\nexport interface ResourcePointer {\n\tid: string;\n\tkind: ResourcePointerKind;\n\turi: string;\n\treadOnly: boolean;\n\tdigest?: string;\n\tmetadata?: JsonObject;\n}\n\n/** Bounded metadata-only resources retained in one worker execution contract. */\nexport const MAX_WORKER_RESOURCE_POINTERS = 64;\nexport const MAX_WORKER_RESOURCE_PATH_LENGTH = 4096;\nexport const MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH = 256;\n\n/** Lightweight metadata catalogued without importing the executable tool module. */\nexport interface ToolCapabilityManifest {\n\ttoolName: string;\n\tmoduleSpecifier: string;\n\tcapabilities: readonly HarnessCapability[];\n\troles: readonly WorkerRole[];\n\tenforcements: readonly CapabilityEnforcementKind[];\n\tsourcePath?: string;\n}\n\nexport interface OrchestrationProfile {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tprofileId: string;\n\tdescription: string;\n\trole: WorkerRole;\n\tmodelPolicy: OrchestrationModelPolicy;\n\tcapabilityCeiling: readonly HarnessCapability[];\n\ttoolNames: readonly string[];\n\tresourceProfileNames: readonly string[];\n\t/** Optional preset-routing metadata retained for authored profiles; never an admission allowlist. */\n\tdispatchProfileIds: readonly string[];\n\texecutionPolicy?: OrchestrationExecutionPolicy;\n\tbudget: RiskBudget;\n\t/** Authored scheduling hint retained in the snapshot; the global scheduler owns actual concurrency. */\n\tmaxConcurrent: number;\n\tleaseTtlMs: number;\n\trequireIndependentVerification: boolean;\n\t/** Owner-pinned verifier profile. Required when independent verification is enabled. */\n\tverificationProfileId?: string;\n\t/** Resolved origin retained for controlled improvements; omitted from authored JSON. */\n\tsourcePath?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\n/** Admission-time worker profile materialization. Profile files are never consulted after this is persisted. */\nexport interface WorkerProfileExecutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tprofile: OrchestrationProfile;\n\tmodelBinding: OrchestrationModelBinding;\n\tauthority: WorkerExecutionAuthorityContract;\n\t/** Metadata-only resources fixed at admission; their content remains lazy and non-durable. */\n\tresourcePointers: readonly ResourcePointer[];\n\t/** Resolved resource-profile identity text. Other worker resources are represented by profile tools. */\n\tsoul?: string;\n}\n\n/** Effective authority admitted for one materialized worker profile. */\nexport interface WorkerExecutionAuthorityContract {\n\tcapabilities: readonly HarnessCapability[];\n\ttoolNames: readonly string[];\n\treadPaths: readonly string[];\n\twritePaths: readonly string[];\n\tdeniedPaths: readonly string[];\n\tbudget: RiskBudget;\n}\n\n/** Immutable execution contract owned by the runtime, including any mandatory verifier. */\nexport interface WorkerExecutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tworker: WorkerProfileExecutionContract;\n\tverifier?: WorkerProfileExecutionContract;\n}\n\n/** Durable dispatch metadata. Model/tool choices are retained in the runtime-owned executionContract. */\nexport interface OrchestrationDispatchRequest {\n\ttaskId: string;\n\tprofileId: string;\n\tinstructions: string;\n\tresourcePointerIds: readonly string[];\n\t/** Direct logical-agent creator for recursively delegated in-process work. */\n\tparentAgentId?: string;\n\t/** Runtime-owned goal/task correlation. Omitted by legacy records and normalized to an empty list. */\n\trequirementIds?: readonly string[];\n\t/** Execution owner. Omitted on legacy records and normalized to in-process. */\n\texecutionKind?: \"in-process\" | \"managed-process\";\n\t/** Stable external lane identity shared by successive managed-process turns. */\n\tlogicalLaneId?: string;\n\t/** Monotonic dispatch sequence within a managed-process logical lane. */\n\tdispatchSequence?: number;\n\t/** Durable mailbox message whose task-bearing intent owns this logical-agent turn. */\n\tcontrolMessageId?: string;\n\t/** External provider identity retained for routing and diagnostics. */\n\tprovider?: string;\n\t/** Owner approval or standing-grant record that authorized an external launch. */\n\tauthorizationId?: string;\n\t/** Worktree-sync lane claimed by the external dispatcher. */\n\tworktreeLaneKey?: string;\n\t/** Immutable sanitized parent context captured for this persistent logical worker at birth. */\n\tbirthContextForkReference?: WorkerContextForkReference;\n\t/** Runtime-owned immutable worker materialization. Never accepted from a model tool call. */\n\texecutionContract?: WorkerExecutionContract;\n}\n\nexport type CapabilityEnforcementKind =\n\t| \"path-scope\"\n\t| \"process-launcher\"\n\t| \"service-proxy\"\n\t| \"memory-broker\"\n\t| \"control-plane\";\n\nexport interface CapabilityDecision {\n\tcapability: HarnessCapability;\n\toutcome: \"allow\" | \"deny\";\n\treasonCode: string;\n\tsource: string;\n}\n\nexport interface ExecutionGrant {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tgrantId: string;\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tsubjectId: string;\n\trole: WorkerRole;\n\tcapabilities: readonly HarnessCapability[];\n\tallowedTools: readonly string[];\n\tresources: readonly ResourcePointer[];\n\treadPaths: readonly string[];\n\twritePaths: readonly string[];\n\tdeniedPaths: readonly string[];\n\tbudget: RiskBudget;\n\tpolicyVersion: string;\n\tdecisionTrace: readonly CapabilityDecision[];\n\tissuedAt: string;\n\texpiresAt?: string;\n}\n\nexport interface AttemptLease {\n\tleaseId: string;\n\tattemptId: string;\n\townerId: string;\n\tfencingToken: number;\n\tissuedAt: string;\n\texpiresAt: string;\n}\n\n/** Restart-durable host retry ladder state for one resumable worker attempt. */\nexport interface AttemptRetryState {\n\t/** Scheduled retries already consumed; the initial execution is not included. */\n\tretriesUsed: number;\n\t/** Earliest instant at which the suspended attempt may receive a fresh lease. */\n\tnotBefore: string;\n}\n\n/** Complete cumulative active usage for one execution attempt. Restart downtime is never included. */\nexport interface AttemptUsageSnapshot {\n\ttoolCalls: number;\n\tinputTokens: number;\n\toutputTokens: number;\n\tcacheReadTokens: number;\n\tcacheWriteTokens: number;\n\t/** Provider-authoritative total; detail categories are not assumed to be additive. */\n\ttotalTokens: number;\n\tcostUsd: number;\n\tactiveWallClockMs: number;\n}\n\nexport interface AttemptCheckpoint {\n\tcheckpointId: string;\n\tattemptId: string;\n\tfencingToken: number;\n\tsummary: string;\n\tartifactIds: readonly string[];\n\tevidenceIds: readonly string[];\n\t/** Omitted only by legacy checkpoints created before durable usage accounting existed. */\n\tusage?: AttemptUsageSnapshot;\n\tcreatedAt: string;\n}\n\nexport interface ArtifactContract {\n\tartifactId: string;\n\tkind: \"diff\" | \"file\" | \"report\" | \"test-result\" | \"log\" | \"structured-data\";\n\turi: string;\n\tdigest?: string;\n\tsizeBytes?: number;\n\tcreatedAt: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface EvidenceContract {\n\tevidenceId: string;\n\tcriterionId?: string;\n\tkind: \"observation\" | \"command\" | \"test\" | \"review\" | \"external\";\n\tsummary: string;\n\tartifactIds: readonly string[];\n\ttrusted: boolean;\n\tcreatedAt: string;\n\tmetadata?: JsonObject;\n}\n\nexport interface WorkerErrorContract {\n\tcode: string;\n\tmessage: string;\n\tretryable: boolean;\n\tdetails?: JsonObject;\n}\n\nexport interface WorkerUsageContract {\n\tinputTokens?: number;\n\toutputTokens?: number;\n\ttotalTokens?: number;\n\tcostUsd?: number;\n\twallClockMs: number;\n\ttoolCalls: number;\n}\n\nexport interface WorkerResultContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tresultId: string;\n\tobjectiveId: string;\n\ttaskId: string;\n\tattemptId: string;\n\tleaseId: string;\n\tfencingToken: number;\n\tstatus: WorkerResultContractStatus;\n\treasonCode: string;\n\tsummary: string;\n\tartifacts: readonly ArtifactContract[];\n\tevidence: readonly EvidenceContract[];\n\terrors: readonly WorkerErrorContract[];\n\tnextAction?: string;\n\tusage: WorkerUsageContract;\n\tcreatedAt: string;\n}\n\nexport interface ApprovalRequestContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tapprovalId: string;\n\tobjectiveId: string;\n\ttaskId?: string;\n\tattemptId?: string;\n\treasonCode: string;\n\tsummary: string;\n\trequestedCapabilities: readonly HarnessCapability[];\n\trequestedBudget?: RiskBudget;\n\treversible: boolean;\n\tcreatedAt: string;\n}\n\nexport const APPROVAL_OUTCOMES = [\"approved\", \"rejected\"] as const;\nexport type ApprovalOutcome = (typeof APPROVAL_OUTCOMES)[number];\n\n/** Human decision only. Approval is not an execution grant; policy must compile a new grant afterward. */\nexport interface ApprovalResolutionContract {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tapprovalId: string;\n\toutcome: ApprovalOutcome;\n\treasonCode: string;\n\tresolvedAt: string;\n}\n\nexport const ORCHESTRATION_EVENT_TYPES = [\n\t\"objective.created\",\n\t\"objective.updated\",\n\t\"objective.evidence_recorded\",\n\t\"objective.paused\",\n\t\"objective.resumed\",\n\t\"objective.completed\",\n\t\"objective.cancelled\",\n\t\"task.created\",\n\t\"task.attempt_prepared\",\n\t\"task.ready\",\n\t\"task.failed\",\n\t\"task.verification_finished\",\n\t\"agent.registered\",\n\t\"agent.retired\",\n\t\"agent.suspended\",\n\t\"agent.resume_requested\",\n\t\"agent.resumed\",\n\t\"attempt.queued\",\n\t\"attempt.grant_bound\",\n\t\"attempt.leased\",\n\t\"attempt.started\",\n\t\"attempt.checkpointed\",\n\t\"attempt.suspended\",\n\t\"attempt.resumed\",\n\t\"attempt.cancelled\",\n\t\"attempt.finished\",\n\t\"attempt.lease_expired\",\n\t\"approval.requested\",\n\t\"approval.resolved\",\n\t\"notification.enqueued\",\n\t\"notification.delivered\",\n] as const;\n\nexport type OrchestrationEventType = (typeof ORCHESTRATION_EVENT_TYPES)[number];\nexport type OrchestrationActorKind = \"human\" | \"kernel\" | \"runtime\" | \"policy\" | \"router\" | \"worker\";\n\nexport interface OrchestrationEvent {\n\tschemaVersion: typeof ORCHESTRATION_SCHEMA_VERSION;\n\tordinal: number;\n\teventId: string;\n\ttype: OrchestrationEventType;\n\taggregateId: string;\n\tactor: OrchestrationActorKind;\n\toccurredAt: string;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tidempotencyKey?: string;\n\tpayload: JsonObject;\n}\n\nexport interface AppendOrchestrationEventInput {\n\ttype: OrchestrationEventType;\n\taggregateId: string;\n\tactor: OrchestrationActorKind;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tidempotencyKey?: string;\n\tpayload: JsonObject;\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.length > 0;\n}\n\nfunction isJsonValue(value: unknown, depth = 0): value is JsonValue {\n\tif (depth > 30) return false;\n\tif (value === null || typeof value === \"string\" || typeof value === \"boolean\") return true;\n\tif (typeof value === \"number\") return Number.isFinite(value);\n\tif (Array.isArray(value)) return value.every((entry) => isJsonValue(entry, depth + 1));\n\tif (!isPlainRecord(value)) return false;\n\treturn Object.values(value).every((entry) => isJsonValue(entry, depth + 1));\n}\n\nfunction includesString<const T extends readonly string[]>(values: T, value: unknown): value is T[number] {\n\treturn typeof value === \"string\" && values.includes(value);\n}\n\nexport function isHarnessCapability(value: unknown): value is HarnessCapability {\n\treturn includesString(HARNESS_CAPABILITIES, value);\n}\n\n/** Clone a runtime value into the persisted JSON domain, rejecting unsupported or over-deep data. */\nexport function toJsonObject(value: unknown): JsonObject {\n\tif (!isPlainRecord(value) || !isJsonValue(value)) {\n\t\tthrow new TypeError(\"Value is not a valid orchestration JSON object.\");\n\t}\n\treturn structuredClone(value);\n}\n\nexport function isOrchestrationEvent(value: unknown): value is OrchestrationEvent {\n\tif (!isPlainRecord(value)) return false;\n\treturn (\n\t\tvalue.schemaVersion === ORCHESTRATION_SCHEMA_VERSION &&\n\t\tNumber.isSafeInteger(value.ordinal) &&\n\t\tNumber(value.ordinal) > 0 &&\n\t\tisNonEmptyString(value.eventId) &&\n\t\tincludesString(ORCHESTRATION_EVENT_TYPES, value.type) &&\n\t\tisNonEmptyString(value.aggregateId) &&\n\t\tincludesString([\"human\", \"kernel\", \"runtime\", \"policy\", \"router\", \"worker\"] as const, value.actor) &&\n\t\tisNonEmptyString(value.occurredAt) &&\n\t\t(value.correlationId === undefined || isNonEmptyString(value.correlationId)) &&\n\t\t(value.causationId === undefined || isNonEmptyString(value.causationId)) &&\n\t\t(value.idempotencyKey === undefined || isNonEmptyString(value.idempotencyKey)) &&\n\t\tisPlainRecord(value.payload) &&\n\t\tisJsonValue(value.payload)\n\t);\n}\n"]}

package/dist/core/orchestration/delegation-ledger.d.ts

@@ -1,11 +1,14 @@
 import type { WorkerDelegationTaskContext } from "../delegation/worker-delegation-request.ts";
 import type { GoalState } from "../goals/goal-state.ts";
 import type { AttemptUsageSnapshot, HarnessCapability, RiskBudget, WorkerExecutionContract, WorkerRole } from "./contracts.ts";
+import { OrchestrationEventStore } from "./event-store.ts";
 import { type AttemptRuntimeState, DurableTaskRuntime } from "./task-runtime.ts";
+import { type WorkerContextForkReference } from "./worker-context-fork-reference.ts";
 export interface DelegationLedgerOptions {
     agentDir: string;
     sessionId: string;
     now?: () => number;
+    store?: OrchestrationEventStore;
 }
 export interface PrepareDelegationInput {
     laneId: string;
@@ -16,6 +19,7 @@ export interface PrepareDelegationInput {
     goal?: GoalState;
     verificationOfTaskId?: string;
     taskContext?: WorkerDelegationTaskContext;
+    birthContextForkReference?: WorkerContextForkReference;
 }
 export interface PrepareManagedDelegationInput {
     laneId: string;
@@ -41,6 +45,8 @@ export interface StartedDelegationAttempt {
 export interface PrepareAgentTurnInput {
     agentId: string;
     instructions: string;
+    controlMessageId?: string;
+    dependsOnTaskIds?: readonly string[];
 }
 /**
  * Durable adapter for in-process delegated completions. It records the dispatch before execution,
@@ -55,11 +61,10 @@ export declare class DelegationOrchestrationLedger {
     prepareManaged(input: PrepareManagedDelegationInput): AttemptRuntimeState;
     /**
      * Queue one new turn for an existing logical agent. The agent identity and its immutable
-     * execution contract are inherited from the last bound turn; the durable task and attempt ids
-     * are intentionally new so retries, leases, and terminal evidence never collide across turns.
+     * execution contract are inherited from the last bound turn. Each distinct control message owns
+     * one deterministic task/attempt identity; exact retries adopt it instead of minting new work.
      */
     prepareAgentTurn(input: PrepareAgentTurnInput): AttemptRuntimeState;
-    private latestAgentAttempt;
     private prepareNormalized;
     synchronizeGoalState(goal: GoalState): void;
     start(attemptId: string, leaseTtlMs: number, ownerId?: string, agentId?: string): StartedDelegationAttempt;

package/dist/core/orchestration/delegation-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegation-ledger.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/delegation-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAEX,oBAAoB,EACpB,iBAAiB,EAEjB,UAAU,EACV,uBAAuB,EACvB,UAAU,EACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,mBAAmB,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAC;AAG1G,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,2BAA2B,CAAC;CAC1C;AAED,MAAM,WAAW,6BAA6B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACrB;AAMD;;;;GAIG;AACH,qBAAa,6BAA6B;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,OAAO,EAAE,uBAAuB,EAM3C;IAED,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CAgB1D;IAED,cAAc,CAAC,KAAK,EAAE,6BAA6B,GAAG,mBAAmB,CAuBxE;IAED;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA0ClE;IAED,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,iBAAiB;IAsFzB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CA0B1C;IAED,KAAK,CACJ,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,SAAiC,EACxC,OAAO,CAAC,EAAE,MAAM,GACd,wBAAwB,CAgB1B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAElD;IAED,iGAAiG;IACjG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CASnE;IAED,yFAAyF;IACzF,uBAAuB,IAAI,mBAAmB,EAAE,CAoB/C;CACD"}
+{"version":3,"file":"delegation-ledger.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/delegation-ledger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAG9F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EACX,oBAAoB,EACpB,iBAAiB,EAEjB,UAAU,EACV,uBAAuB,EACvB,UAAU,EACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACN,KAAK,mBAAmB,EACxB,kBAAkB,EAGlB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,oBAAoB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,2BAA2B,CAAC;IAC1C,yBAAyB,CAAC,EAAE,0BAA0B,CAAC;CACvD;AAED,MAAM,WAAW,6BAA6B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAgBD;;;;GAIG;AACH,qBAAa,6BAA6B;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,OAAO,EAAE,uBAAuB,EAO3C;IAED,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CAmB1D;IAED,cAAc,CAAC,KAAK,EAAE,6BAA6B,GAAG,mBAAmB,CAuBxE;IAED;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4FlE;IAED,OAAO,CAAC,iBAAiB;IAsJzB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CA4B1C;IAED,KAAK,CACJ,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,SAAiC,EACxC,OAAO,CAAC,EAAE,MAAM,GACd,wBAAwB,CAgB1B;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAElD;IAED,iGAAiG;IACjG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CASnE;IAED,yFAAyF;IACzF,uBAAuB,IAAI,mBAAmB,EAAE,CAoB/C;CACD"}

package/dist/core/orchestration/delegation-ledger.js

@@ -1,11 +1,25 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { deriveWorkerTaskLabel } from "../delegation/worker-task-label.js";
 import { hasGoalAcceptanceOverride } from "../goals/goal-acceptance.js";
+import { latestAgentAttemptByDurableOrder } from "./attempt-ordering.js";
+import { MAX_ORCHESTRATION_IDENTIFIER_LENGTH } from "./contracts.js";
 import { OrchestrationEventStore } from "./event-store.js";
-import { DurableTaskRuntime, DurableTaskRuntimeError } from "./task-runtime.js";
+import { DurableTaskRuntime, DurableTaskRuntimeError, validateTaskDependencyIds, } from "./task-runtime.js";
 import { goalObjectiveId, projectGoalAcceptanceEvidence, projectGoalObjective } from "./work-state-projection.js";
+import { normalizeWorkerContextForkReference, } from "./worker-context-fork-reference.js";
 function activeAttempt(attempt) {
     return attempt.status === "queued" || attempt.status === "leased" || attempt.status === "running";
 }
+function mailboxTurnTaskId(agentId, controlMessageId) {
+    return `mailbox-turn-${createHash("sha256")
+        .update("pi-worker-agent-mailbox-turn-v1")
+        .update("\0")
+        .update(agentId)
+        .update("\0")
+        .update(controlMessageId)
+        .digest("hex")}`;
+}
 /**
  * Durable adapter for in-process delegated completions. It records the dispatch before execution,
  * fences interrupted completions on restart, and returns queued work for event-driven re-dispatch.
@@ -15,7 +29,7 @@ export class DelegationOrchestrationLedger {
     constructor(options) {
         this.sessionId = options.sessionId;
         this.runtime = new DurableTaskRuntime({
-            store: new OrchestrationEventStore({ agentDir: options.agentDir, sessionId: options.sessionId }),
+            store: options.store ?? new OrchestrationEventStore({ agentDir: options.agentDir, sessionId: options.sessionId }),
             now: options.now,
         });
     }
@@ -33,7 +47,10 @@ export class DelegationOrchestrationLedger {
             ...(input.goal ? { goal: input.goal } : {}),
             ...(input.verificationOfTaskId ? { verificationOfTaskId: input.verificationOfTaskId } : {}),
             ...(input.taskContext ? { taskContext: input.taskContext } : {}),
-            dispatchMetadata: { logicalLaneId: input.laneId },
+            dispatchMetadata: {
+                logicalLaneId: input.laneId,
+                ...(input.birthContextForkReference ? { birthContextForkReference: input.birthContextForkReference } : {}),
+            },
         });
     }
     prepareManaged(input) {
@@ -62,24 +79,30 @@ export class DelegationOrchestrationLedger {
     }
     /**
      * Queue one new turn for an existing logical agent. The agent identity and its immutable
-     * execution contract are inherited from the last bound turn; the durable task and attempt ids
-     * are intentionally new so retries, leases, and terminal evidence never collide across turns.
+     * execution contract are inherited from the last bound turn. Each distinct control message owns
+     * one deterministic task/attempt identity; exact retries adopt it instead of minting new work.
      */
     prepareAgentTurn(input) {
         const agentId = input.agentId.trim();
         const instructions = input.instructions.trim();
+        const controlMessageId = input.controlMessageId?.trim();
         if (!agentId)
             throw new DurableTaskRuntimeError("Logical worker agent id is required.");
         if (!instructions)
             throw new DurableTaskRuntimeError("Worker follow-up instructions are required.");
+        if (input.controlMessageId !== undefined &&
+            (!controlMessageId || controlMessageId.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) {
+            throw new DurableTaskRuntimeError("Worker control message id is invalid.");
+        }
         const snapshot = this.runtime.getSnapshot();
         const agent = snapshot.agents[agentId];
         if (!agent)
             throw new DurableTaskRuntimeError(`Unknown logical worker agent '${agentId}'.`);
-        if (agent.status !== "registered") {
-            throw new DurableTaskRuntimeError(`Logical worker agent '${agentId}' is not idle.`);
-        }
-        const prior = this.latestAgentAttempt(snapshot, agent);
+        const agentAttempts = Object.values(snapshot.attempts).filter((attempt) => attempt.agentId === agentId || attempt.dispatch.logicalLaneId === agentId);
+        const sequence = agentAttempts.length + 1;
+        const taskId = controlMessageId ? mailboxTurnTaskId(agentId, controlMessageId) : `${agentId}:turn:${sequence}`;
+        const existingTask = snapshot.tasks[taskId]?.task;
+        const prior = latestAgentAttemptByDurableOrder(snapshot, agent.agentId);
         const contract = prior?.dispatch.executionContract;
         if (!prior || !contract) {
             throw new DurableTaskRuntimeError(`Logical worker agent '${agentId}' has no immutable execution contract.`);
@@ -87,9 +110,31 @@ export class DelegationOrchestrationLedger {
         const priorTask = snapshot.tasks[prior.taskId]?.task;
         if (!priorTask)
             throw new DurableTaskRuntimeError(`Logical worker agent '${agentId}' has no prior durable task.`);
-        const sequence = Object.values(snapshot.attempts).filter((attempt) => attempt.agentId === agentId).length + 1;
-        const taskId = `${agentId}:turn:${sequence}`;
-        if (snapshot.tasks[taskId]) {
+        const dependencyTaskIds = validateTaskDependencyIds(snapshot.tasks, existingTask?.objectiveId ?? priorTask.objectiveId, input.dependsOnTaskIds);
+        if (existingTask && controlMessageId) {
+            if (existingTask.description !== instructions ||
+                existingTask.role !== agent.role ||
+                existingTask.dependsOn.length !== dependencyTaskIds.length ||
+                existingTask.dependsOn.some((dependencyId, index) => dependencyId !== dependencyTaskIds[index])) {
+                throw new DurableTaskRuntimeError(`Worker control message '${controlMessageId}' has conflicting task identity.`);
+            }
+            const existingAttempts = (snapshot.tasks[taskId]?.attemptIds ?? []).map((attemptId) => snapshot.attempts[attemptId]);
+            for (const attempt of existingAttempts) {
+                if (!attempt ||
+                    attempt.dispatch.logicalLaneId !== agentId ||
+                    attempt.dispatch.controlMessageId !== controlMessageId ||
+                    attempt.dispatch.instructions !== instructions) {
+                    throw new DurableTaskRuntimeError(`Worker control message '${controlMessageId}' has conflicting dispatch evidence.`);
+                }
+            }
+            const existingAttempt = existingAttempts.at(-1);
+            if (existingAttempt)
+                return existingAttempt;
+        }
+        if (agent.status !== "registered") {
+            throw new DurableTaskRuntimeError(`Logical worker agent '${agentId}' is not idle.`);
+        }
+        if (existingTask && !controlMessageId) {
             throw new DurableTaskRuntimeError(`Logical worker agent '${agentId}' already has turn ${sequence}.`);
         }
         return this.prepareNormalized({
@@ -99,9 +144,10 @@ export class DelegationOrchestrationLedger {
             role: agent.role,
             requiredCapabilities: contract.worker.authority.capabilities,
             riskBudget: contract.worker.profile.budget,
+            ...(priorTask.objectiveId.startsWith("goal:") ? { goalId: priorTask.objectiveId.slice("goal:".length) } : {}),
             taskContext: {
                 requirementIds: prior.dispatch.requirementIds ?? [],
-                dependsOnTaskIds: priorTask.dependsOn,
+                dependsOnTaskIds: dependencyTaskIds,
                 acceptanceCriterionIds: priorTask.acceptanceCriterionIds,
                 resourcePointerIds: prior.dispatch.resourcePointerIds,
             },
@@ -109,16 +155,24 @@ export class DelegationOrchestrationLedger {
             dispatchMetadata: {
                 logicalLaneId: agentId,
                 dispatchSequence: sequence,
+                ...(controlMessageId ? { controlMessageId } : {}),
+                ...(prior.dispatch.birthContextForkReference
+                    ? { birthContextForkReference: prior.dispatch.birthContextForkReference }
+                    : {}),
             },
         });
     }
-    latestAgentAttempt(snapshot, agent) {
-        return Object.values(snapshot.attempts)
-            .filter((attempt) => attempt.agentId === agent.agentId)
-            .sort((left, right) => left.createdAt.localeCompare(right.createdAt))
-            .at(-1);
-    }
     prepareNormalized(input) {
+        let birthContextForkReference;
+        try {
+            birthContextForkReference =
+                input.dispatchMetadata?.birthContextForkReference === undefined
+                    ? undefined
+                    : normalizeWorkerContextForkReference(input.dispatchMetadata.birthContextForkReference);
+        }
+        catch (error) {
+            throw new DurableTaskRuntimeError(error instanceof Error ? error.message : String(error));
+        }
         let snapshot = this.runtime.getSnapshot();
         const existingVerificationSubject = input.verificationOfTaskId
             ? snapshot.tasks[input.verificationOfTaskId]
@@ -130,6 +184,34 @@ export class DelegationOrchestrationLedger {
         const objectiveId = existingVerificationSubject?.task.objectiveId ??
             projectedGoal?.objectiveId ??
             (input.goalId ? goalObjectiveId(input.goalId) : `session:${this.sessionId}`);
+        const dependencyTaskIds = validateTaskDependencyIds(snapshot.tasks, objectiveId, input.taskContext?.dependsOnTaskIds);
+        const existingTask = snapshot.tasks[input.laneId]?.task;
+        if (existingTask &&
+            (existingTask.objectiveId !== objectiveId ||
+                existingTask.description !== input.instructions ||
+                existingTask.role !== input.role ||
+                existingTask.dependsOn.length !== dependencyTaskIds.length ||
+                existingTask.dependsOn.some((dependencyId, index) => dependencyId !== dependencyTaskIds[index]))) {
+            throw new DurableTaskRuntimeError(`Task '${input.laneId}' has conflicting durable dispatch identity.`);
+        }
+        const taskStateBeforeWrites = snapshot.tasks[input.laneId];
+        const activeAttemptBeforeWrites = taskStateBeforeWrites?.attemptIds
+            .map((attemptId) => snapshot.attempts[attemptId])
+            .find((attempt) => attempt !== undefined && activeAttempt(attempt));
+        for (const attemptId of taskStateBeforeWrites?.attemptIds ?? []) {
+            const durableReference = snapshot.attempts[attemptId]?.dispatch.birthContextForkReference;
+            if (!isDeepStrictEqual(durableReference, birthContextForkReference)) {
+                throw new DurableTaskRuntimeError(`Task '${input.laneId}' has a conflicting birth context fork reference.`);
+            }
+        }
+        const projectedEvidence = input.goal && objectiveId === projectedGoal?.objectiveId ? projectGoalAcceptanceEvidence(input.goal) : [];
+        if (projectedGoal)
+            this.runtime.assertObjectiveSynchronizationHeadroom(projectedGoal, projectedEvidence);
+        this.runtime.assertProjectionHeadroom({
+            objectives: snapshot.objectives[objectiveId] ? 0 : 1,
+            tasks: taskStateBeforeWrites ? 0 : 1,
+            attempts: activeAttemptBeforeWrites ? 0 : 1,
+        });
         if (input.goal && objectiveId === projectedGoal?.objectiveId) {
             this.synchronizeGoalState(input.goal);
             snapshot = this.runtime.getSnapshot();
@@ -142,39 +224,25 @@ export class DelegationOrchestrationLedger {
             });
             snapshot = this.runtime.getSnapshot();
         }
-        if (!snapshot.tasks[input.laneId]) {
-            const verificationSubject = input.verificationOfTaskId
-                ? snapshot.tasks[input.verificationOfTaskId]
-                : undefined;
-            this.runtime.createTask({
-                taskId: input.laneId,
-                objectiveId,
-                title: deriveWorkerTaskLabel(input.instructions, `Delegated ${input.role} work`),
-                description: input.instructions,
-                role: input.role,
-                dependsOn: input.taskContext?.dependsOnTaskIds ?? [],
-                requiredCapabilities: input.requiredCapabilities,
-                acceptanceCriterionIds: input.taskContext?.acceptanceCriterionIds ?? [],
-                riskBudget: input.riskBudget,
-                ...(input.verificationOfTaskId
-                    ? {
-                        verificationOfTaskId: input.verificationOfTaskId,
-                        acceptanceCriterionIds: verificationSubject?.task.acceptanceCriterionIds ?? [],
-                    }
-                    : {}),
-            });
-            snapshot = this.runtime.getSnapshot();
-        }
-        const task = snapshot.tasks[input.laneId];
-        if (!task)
-            throw new DurableTaskRuntimeError(`Failed to create task '${input.laneId}'.`);
-        const existing = [...task.attemptIds]
-            .reverse()
-            .map((attemptId) => snapshot.attempts[attemptId])
-            .find((attempt) => attempt !== undefined && activeAttempt(attempt));
-        if (existing)
-            return existing;
-        return this.runtime.queueAttempt(input.laneId, {
+        const verificationSubject = input.verificationOfTaskId ? snapshot.tasks[input.verificationOfTaskId] : undefined;
+        const taskInput = {
+            taskId: input.laneId,
+            objectiveId,
+            title: deriveWorkerTaskLabel(input.instructions, `Delegated ${input.role} work`),
+            description: input.instructions,
+            role: input.role,
+            dependsOn: dependencyTaskIds,
+            requiredCapabilities: input.requiredCapabilities,
+            acceptanceCriterionIds: input.taskContext?.acceptanceCriterionIds ?? [],
+            riskBudget: input.riskBudget,
+            ...(input.verificationOfTaskId
+                ? {
+                    verificationOfTaskId: input.verificationOfTaskId,
+                    acceptanceCriterionIds: verificationSubject?.task.acceptanceCriterionIds ?? [],
+                }
+                : {}),
+        };
+        const dispatch = {
             taskId: input.laneId,
             profileId: input.profileId,
             instructions: input.instructions,
@@ -183,13 +251,38 @@ export class DelegationOrchestrationLedger {
             requirementIds: input.taskContext?.requirementIds ?? [],
             ...(input.executionContract ? { executionContract: input.executionContract } : {}),
             ...input.dispatchMetadata,
-        });
+            ...(birthContextForkReference ? { birthContextForkReference } : {}),
+        };
+        if (existingTask &&
+            (existingTask.title !== taskInput.title ||
+                existingTask.verificationOfTaskId !== taskInput.verificationOfTaskId ||
+                !isDeepStrictEqual(existingTask.requiredCapabilities, [...new Set(taskInput.requiredCapabilities)]) ||
+                !isDeepStrictEqual(existingTask.acceptanceCriterionIds, [...new Set(taskInput.acceptanceCriterionIds)]) ||
+                !isDeepStrictEqual(existingTask.riskBudget, taskInput.riskBudget))) {
+            throw new DurableTaskRuntimeError(`Task '${input.laneId}' has conflicting durable task identity.`);
+        }
+        if (activeAttemptBeforeWrites && !isDeepStrictEqual(activeAttemptBeforeWrites.dispatch, dispatch)) {
+            throw new DurableTaskRuntimeError(`Task '${input.laneId}' has conflicting durable dispatch identity.`);
+        }
+        if (!snapshot.tasks[input.laneId]) {
+            return this.runtime.prepareTaskAttempt({
+                ...taskInput,
+            }, dispatch).attempt;
+        }
+        const task = snapshot.tasks[input.laneId];
+        if (!task)
+            throw new DurableTaskRuntimeError(`Failed to create task '${input.laneId}'.`);
+        if (activeAttemptBeforeWrites)
+            return activeAttemptBeforeWrites;
+        return this.runtime.queueAttempt(input.laneId, dispatch);
     }
     synchronizeGoalState(goal) {
         const objective = projectGoalObjective(goal);
+        const evidence = projectGoalAcceptanceEvidence(goal);
+        this.runtime.assertObjectiveSynchronizationHeadroom(objective, evidence);
         this.runtime.ensureObjective(objective);
-        for (const evidence of projectGoalAcceptanceEvidence(goal)) {
-            this.runtime.recordObjectiveEvidence(objective.objectiveId, evidence);
+        for (const item of evidence) {
+            this.runtime.recordObjectiveEvidence(objective.objectiveId, item);
         }
         const status = this.runtime.getSnapshot().objectives[goalObjectiveId(goal.goalId)]?.objective.status;
         switch (goal.status) {