@celestea/core 2.7.1

package/contracts/probe-evidence.json

@@ -0,0 +1,219 @@
+{
+  "generatedAt": "2026-09-16T06:20:11.193Z",
+  "studio": "http://127.0.0.1:3799",
+  "policy": "read-only: GET probes + error branches proven mutation-free in the retired backend source",
+  "counts": {
+    "checks": 28,
+    "passed": 28,
+    "failed": 0,
+    "degraded": 0,
+    "endpointsSampled": 22,
+    "sseEvents": 9,
+    "tools": 12
+  },
+  "verdict": "consistent",
+  "checks": [
+    {
+      "endpoint": "contracts/endpoints.json",
+      "kind": "contract-count",
+      "status": "pass",
+      "detail": "51 endpoints (contract declares 51)"
+    },
+    {
+      "endpoint": "contracts/sse-events.json",
+      "kind": "contract-count",
+      "status": "pass",
+      "detail": "9 SSE events (contract declares 9)"
+    },
+    {
+      "endpoint": "contracts/tools.json",
+      "kind": "contract-count",
+      "status": "pass",
+      "detail": "12 tool specs (contract declares 12)"
+    },
+    {
+      "endpoint": "GET /api/health",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 6 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/status",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 14 key(s); additive (not in contract doc): busy, effective_model, fallback, grants_active",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/tools",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 1 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/config",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 10 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/sessions",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 2 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/sessions/{id}/messages",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 3 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/workspaces",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 2 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/fs/browse",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 4 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/providers",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 2 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/prompts",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 8 key(s)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/worker/status",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; 8 key(s); optional absent: error, wid; additive (not in contract doc): watchdogs",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /login",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 200; HTML login page (text/html) — no JSON keys to compare",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /auth/check",
+      "kind": "response-shape",
+      "status": "pass",
+      "detail": "HTTP 401; cookie-gated, so the documented 401 \"unauthorized\" branch is the correct answer for an unauthenticated probe",
+      "observedStatus": 401
+    },
+    {
+      "endpoint": "POST /api/turn",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"input must not be empty\"",
+      "observedStatus": 400,
+      "safeBecause": "src/main.rs:986-991 rejects a blank input BEFORE the busy slot is taken"
+    },
+    {
+      "endpoint": "POST /api/cancel",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 200",
+      "observedStatus": 200,
+      "safeBecause": "src/main.rs:1028-1037 only signals the watch channel; no state is written"
+    },
+    {
+      "endpoint": "POST /api/workspaces",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"path must not be empty\"",
+      "observedStatus": 400,
+      "safeBecause": "src/workspaces.rs:825-827 validates before WorkspaceRegistry::register"
+    },
+    {
+      "endpoint": "POST /api/providers/test",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"base_url\"",
+      "observedStatus": 400,
+      "safeBecause": "src/providers.rs:729-735 builds an inline candidate and fails before run_probe; never persists"
+    },
+    {
+      "endpoint": "POST /api/prompts",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"prompt id must be 1-128 chars\"",
+      "observedStatus": 400,
+      "safeBecause": "src/prompts.rs:748-751 validates the id before load_prompt_file/persist"
+    },
+    {
+      "endpoint": "POST /api/prompts/__p0_probe_missing__/default",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 404 + \"unknown prompt\"",
+      "observedStatus": 404,
+      "safeBecause": "src/prompts.rs:857-860 returns 404 before any persist"
+    },
+    {
+      "endpoint": "GET /api/sessions/no-slash/messages",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"invalid session id\"",
+      "observedStatus": 400,
+      "safeBecause": "parse_session_id rejects the id before any filesystem access"
+    },
+    {
+      "endpoint": "GET /api/fs/browse?path=relative-not-absolute",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 400 + \"must be absolute\"",
+      "observedStatus": 400,
+      "safeBecause": "pure read-only directory listing"
+    },
+    {
+      "endpoint": "GET /api/worker/status?wid=__p0_probe_missing__",
+      "kind": "error-branch",
+      "status": "pass",
+      "detail": "HTTP 200 + \"no worker\"",
+      "observedStatus": 200,
+      "safeBecause": "read-only registry lookup"
+    },
+    {
+      "endpoint": "GET /api/events",
+      "kind": "sse-transport",
+      "status": "pass",
+      "detail": "content-type=text/event-stream; envelope + 9 event names frozen from source (passive connect, no turn running)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/tools?session=...(standard)",
+      "kind": "tool-set",
+      "status": "pass",
+      "detail": "session=ws/std (mode=standard); 12 names match contracts/tools.json exactly (full registry)",
+      "observedStatus": 200
+    },
+    {
+      "endpoint": "GET /api/tools?session=...(execution)",
+      "kind": "tool-set",
+      "status": "pass",
+      "detail": "session=ws/exec (mode=execution); live=[http_request,process_control,run_code,session_send_message,spawn_worker,worker_status] folded-out=[ask_user_question,list_dir,read_file,read_image,run_shell,write_file]; exactly 6 kept: the full registry folded out the four SDK bridge tools + ask_user_question + read_image",
+      "observedStatus": 200
+    }
+  ]
+}

package/contracts/route-table.snapshot.json

@@ -0,0 +1,377 @@
+{
+  "source": "frozen from the retired backend implementation (original source file deleted 2026-09-15); this snapshot is now the authoritative route table",
+  "extractedAt": "2026-09-10T01:20:00Z",
+  "extraction": "read-only regex over the Router::new() chain",
+  "routeDeclarations": 38,
+  "methodPathCombos": 43,
+  "apiEndpoints": 39,
+  "staticRoutes": [
+    {
+      "method": "GET",
+      "path": "/",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/index.html",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/assets/{*path}",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/favicon.ico",
+      "rustHandler": "get_static"
+    }
+  ],
+  "routes": [
+    {
+      "method": "GET",
+      "path": "/",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/index.html",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/assets/{*path}",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/favicon.ico",
+      "rustHandler": "get_static"
+    },
+    {
+      "method": "GET",
+      "path": "/api/health",
+      "rustHandler": "get_health"
+    },
+    {
+      "method": "GET",
+      "path": "/api/status",
+      "rustHandler": "api::get_status"
+    },
+    {
+      "method": "GET",
+      "path": "/api/events",
+      "rustHandler": "get_events"
+    },
+    {
+      "method": "POST",
+      "path": "/api/turn",
+      "rustHandler": "post_turn"
+    },
+    {
+      "method": "POST",
+      "path": "/api/cancel",
+      "rustHandler": "post_cancel"
+    },
+    {
+      "method": "GET",
+      "path": "/api/tools",
+      "rustHandler": "api::get_tools"
+    },
+    {
+      "method": "GET",
+      "path": "/api/config",
+      "rustHandler": "api::get_config"
+    },
+    {
+      "method": "POST",
+      "path": "/api/config",
+      "rustHandler": "api::post_config"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions",
+      "rustHandler": "workspaces::get_sessions"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions",
+      "rustHandler": "workspaces::post_session_create"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/messages",
+      "rustHandler": "workspaces::get_session_messages"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/activate",
+      "rustHandler": "workspaces::post_session_activate"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/rename",
+      "rustHandler": "workspaces::post_session_rename"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/branch",
+      "rustHandler": "workspaces::post_session_branch"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/compact",
+      "rustHandler": "compact::post_session_compact"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/archive",
+      "rustHandler": "workspaces::post_session_archive"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/unarchive",
+      "rustHandler": "workspaces::post_session_unarchive"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/batch-archive",
+      "rustHandler": "workspaces::post_sessions_batch_archive"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/batch-delete",
+      "rustHandler": "workspaces::post_sessions_batch_delete"
+    },
+    {
+      "method": "GET",
+      "path": "/api/workspaces",
+      "rustHandler": "workspaces::get_workspaces"
+    },
+    {
+      "method": "POST",
+      "path": "/api/workspaces",
+      "rustHandler": "workspaces::post_workspace_create"
+    },
+    {
+      "method": "POST",
+      "path": "/api/workspaces/{name}/rename",
+      "rustHandler": "workspaces::post_workspace_rename"
+    },
+    {
+      "method": "POST",
+      "path": "/api/workspaces/{name}/delete",
+      "rustHandler": "workspaces::post_workspace_delete"
+    },
+    {
+      "method": "POST",
+      "path": "/api/workspaces/batch-delete",
+      "rustHandler": "workspaces::post_workspaces_batch_delete"
+    },
+    {
+      "method": "GET",
+      "path": "/api/fs/browse",
+      "rustHandler": "workspaces::get_fs_browse"
+    },
+    {
+      "method": "GET",
+      "path": "/api/providers",
+      "rustHandler": "providers::get_providers"
+    },
+    {
+      "method": "POST",
+      "path": "/api/providers",
+      "rustHandler": "providers::post_providers"
+    },
+    {
+      "method": "POST",
+      "path": "/api/providers/{id}/delete",
+      "rustHandler": "providers::post_provider_delete"
+    },
+    {
+      "method": "POST",
+      "path": "/api/providers/test",
+      "rustHandler": "providers::post_provider_test"
+    },
+    {
+      "method": "POST",
+      "path": "/api/providers/{id}/models/fetch",
+      "rustHandler": "providers::post_models_fetch"
+    },
+    {
+      "method": "POST",
+      "path": "/api/providers/default",
+      "rustHandler": "providers::post_provider_default"
+    },
+    {
+      "method": "GET",
+      "path": "/api/prompts",
+      "rustHandler": "prompts::get_prompts"
+    },
+    {
+      "method": "POST",
+      "path": "/api/prompts",
+      "rustHandler": "prompts::post_prompts_upsert"
+    },
+    {
+      "method": "POST",
+      "path": "/api/prompts/{id}/delete",
+      "rustHandler": "prompts::post_prompts_delete"
+    },
+    {
+      "method": "POST",
+      "path": "/api/prompts/{id}/default",
+      "rustHandler": "prompts::post_prompts_default"
+    },
+    {
+      "method": "POST",
+      "path": "/api/clear",
+      "rustHandler": "workspaces::post_clear"
+    },
+    {
+      "method": "POST",
+      "path": "/api/worker/spawn",
+      "rustHandler": "api::post_worker_spawn"
+    },
+    {
+      "method": "POST",
+      "path": "/api/worker/send",
+      "rustHandler": "api::post_worker_send"
+    },
+    {
+      "method": "GET",
+      "path": "/api/worker/status",
+      "rustHandler": "api::get_worker_status"
+    }
+  ],
+  "tsOnlyRoutes": [
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/grants",
+      "rustHandler": "(none - TypeScript-only, W516)"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/grants",
+      "rustHandler": "(none - TypeScript-only, W516)"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/sessions/{id}/grants",
+      "rustHandler": "(none - TypeScript-only, W516)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/grants/confirm-token",
+      "rustHandler": "(none - TypeScript-only, W516)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/context",
+      "rustHandler": "(none - TypeScript-only, W725)"
+    },
+    {
+      "method": "GET",
+      "path": "/login",
+      "rustHandler": "(none - TypeScript-only, W767)"
+    },
+    {
+      "method": "POST",
+      "path": "/auth/login",
+      "rustHandler": "(none - TypeScript-only, W767)"
+    },
+    {
+      "method": "GET",
+      "path": "/auth/check",
+      "rustHandler": "(none - TypeScript-only, W767)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/questions",
+      "rustHandler": "(none - TypeScript-only, W783)"
+    },
+    {
+      "method": "POST",
+      "path": "/api/questions/{id}/answer",
+      "rustHandler": "(none - TypeScript-only, W783)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/usage/ledger",
+      "rustHandler": "(none - TypeScript-only, W785)"
+    },
+    {
+      "method": "POST",
+      "path": "/api/sessions/{id}/mode",
+      "rustHandler": "(none - TypeScript-only, W791)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/permissions/presets",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "POST",
+      "path": "/api/permissions/presets",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/permissions/presets/{id}",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/permissions/presets/{id}",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/permission",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/sessions/{id}/permission",
+      "rustHandler": "(none - TypeScript-only, W9)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/sessions/{id}/tools",
+      "rustHandler": "(none - TypeScript-only, W860)"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/sessions/{id}/tools",
+      "rustHandler": "(none - TypeScript-only, W860)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/plugins",
+      "rustHandler": "(none - TypeScript-only, W860)"
+    },
+    {
+      "method": "PUT",
+      "path": "/api/sessions/{id}/model",
+      "rustHandler": "(none - TypeScript-only, W870)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/fs/list",
+      "rustHandler": "(none - TypeScript-only, G5)"
+    },
+    {
+      "method": "POST",
+      "path": "/api/exec",
+      "rustHandler": "(none - TypeScript-only, G2)"
+    },
+    {
+      "method": "GET",
+      "path": "/api/fs/read",
+      "rustHandler": "(none - TypeScript-only, G5)"
+    }
+  ],
+  "tsApiEndpoints": 64,
+  "tsMethodPathCombos": 68,
+  "tsOnlyNote": "W516/W725/W767: the sessions grants endpoints, GET /api/sessions/{id}/context and the three W767 login-cookie endpoints (/login, /auth/login, /auth/check) exist ONLY in the TypeScript backend. The frozen extraction above is kept verbatim; a contract endpoint must appear in `route W783 adds GET /api/questions (pending list) and POST /api/questions/{id}/answer. W785 adds GET /api/usage/ledger (the cost/usage ledger aggregate view). W791 adds POST /api/sessions/{id}/mode (the P1 session working mode; TS-only, U8). W860 adds GET|PUT /api/sessions/{id}/tools (session-level tool switches) and GET /api/plugins (host plugin inventory). W870 adds PUT /api/sessions/{id}/model (the session-scoped model switch; TS-only, W870)."
+}