@claudexor/orchestrator 3.1.0 → 3.1.2

package/dist/delegation-parent-activation.d.ts

@@ -0,0 +1,6 @@
+import type { BudgetLedger } from "@claudexor/budget";
+import type { EventLog } from "@claudexor/event-log";
+import type { DelegationBudgetAuthority } from "./delegationBudgetAuthority.js";
+import type { RoutedAdapter, RunInput } from "./orchestrator.js";
+export declare function activateDelegationParent(authority: DelegationBudgetAuthority | undefined, input: RunInput, runId: string, ledger: BudgetLedger, routes: readonly RoutedAdapter[], log: EventLog): void;
+//# sourceMappingURL=delegation-parent-activation.d.ts.map

package/dist/delegation-parent-activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-parent-activation.d.ts","sourceRoot":"","sources":["../src/delegation-parent-activation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEjE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,yBAAyB,GAAG,SAAS,EAChD,KAAK,EAAE,QAAQ,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,GAAG,EAAE,QAAQ,GACZ,IAAI,CAWN"}

package/dist/delegation-parent-activation.js

@@ -0,0 +1,13 @@
+export function activateDelegationParent(authority, input, runId, ledger, routes, log) {
+    if (input.delegate !== true || !routes.some((route) => route.delegationRequirement.effective))
+        return;
+    if (!authority) {
+        throw Object.assign(new Error("effective Delegate requires daemon-lifetime budget authority"), {
+            code: "delegation_budget_authority_unavailable",
+            status: 503,
+        });
+    }
+    authority.registerParent(runId, ledger);
+    log.deferTerminal();
+}
+//# sourceMappingURL=delegation-parent-activation.js.map

package/dist/delegation-parent-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-parent-activation.js","sourceRoot":"","sources":["../src/delegation-parent-activation.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,wBAAwB,CACtC,SAAgD,EAChD,KAAe,EACf,KAAa,EACb,MAAoB,EACpB,MAAgC,EAChC,GAAa;IAEb,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC;QAC3F,OAAO;IACT,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8DAA8D,CAAC,EAAE;YAC7F,IAAI,EAAE,yCAAyC;YAC/C,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IACD,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,aAAa,EAAE,CAAC;AACtB,CAAC"}

package/dist/delegationBudgetAuthority.d.ts

@@ -0,0 +1,30 @@
+import { BudgetLedger } from "@claudexor/budget";
+export interface DelegationBudgetAuthorityOptions {
+    /** Daemon-owned cancellation by admission/job id. Bound once at the
+     * composition root so the budget registry never owns process control. */
+    cancelAdmission?: (admissionId: string) => void | Promise<void>;
+}
+/**
+ * Daemon-lifetime financial registry for active Delegate families. It is
+ * intentionally narrow: no grants or general identity framework, only one
+ * live parent ledger, its monotonic child count, and task-scoped child views.
+ */
+export declare class DelegationBudgetAuthority {
+    private readonly options;
+    private readonly parents;
+    private readonly childParents;
+    constructor(options?: DelegationBudgetAuthorityOptions);
+    registerParent(runId: string, ledger: BudgetLedger): void;
+    hasParent(runId: string): boolean;
+    assertCanAdmitChild(parentRunId: string): void;
+    noteChildAccepted(parentRunId: string, admissionId: string): void;
+    cancelAcceptedChild(parentRunId: string, admissionId: string): void;
+    attachChild(parentRunId: string, admissionId: string, childRunId: string, taskId: string, onCashSettled?: (cashSpendUsd: number, valuationUsd: number, cashEstimated: boolean, valuationKnowledge: "exact" | "estimated" | "unknown") => void): BudgetLedger;
+    beginParentClose(parentRunId: string): void;
+    waitForChildren(parentRunId: string, timeoutMs?: number): Promise<void>;
+    releaseRun(runId: string): void;
+    acceptedChildCount(parentRunId: string): number;
+    private isDrained;
+    private notifyIfDrained;
+}
+//# sourceMappingURL=delegationBudgetAuthority.d.ts.map

package/dist/delegationBudgetAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationBudgetAuthority.d.ts","sourceRoot":"","sources":["../src/delegationBudgetAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAajD,MAAM,WAAW,gCAAgC;IAC/C;6EACyE;IACzE,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,qBAAa,yBAAyB;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;gBAE7B,OAAO,GAAE,gCAAqC;IAE3E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI;IAkBzD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIjC,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAkB9C,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAOjE,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAMnE,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,CACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,OAAO,EACtB,kBAAkB,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,KAClD,IAAI,GACR,YAAY;IAqBf,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAKrC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD7E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAqB/B,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAI/C,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,eAAe;CAIxB"}

package/dist/delegationBudgetAuthority.js

@@ -0,0 +1,157 @@
+import { MAX_DELEGATED_CHILDREN } from "@claudexor/schema";
+/**
+ * Daemon-lifetime financial registry for active Delegate families. It is
+ * intentionally narrow: no grants or general identity framework, only one
+ * live parent ledger, its monotonic child count, and task-scoped child views.
+ */
+export class DelegationBudgetAuthority {
+    options;
+    parents = new Map();
+    childParents = new Map();
+    constructor(options = {}) {
+        this.options = options;
+    }
+    registerParent(runId, ledger) {
+        if (this.parents.has(runId)) {
+            throw Object.assign(new Error(`Delegate budget authority already exists for ${runId}`), {
+                code: "delegation_budget_parent_duplicate",
+                status: 409,
+            });
+        }
+        this.parents.set(runId, {
+            ledger,
+            accepting: true,
+            acceptedChildren: 0,
+            pendingAdmissions: new Set(),
+            children: new Map(),
+            waiters: new Set(),
+            cancellationStarted: false,
+        });
+    }
+    hasParent(runId) {
+        return this.parents.has(runId);
+    }
+    assertCanAdmitChild(parentRunId) {
+        const parent = this.parents.get(parentRunId);
+        if (!parent || !parent.accepting) {
+            throw Object.assign(new Error(`no live effective Delegate budget authority for parent ${parentRunId}`), { code: "delegation_budget_parent_unavailable", status: 409 });
+        }
+        if (parent.acceptedChildren >= MAX_DELEGATED_CHILDREN) {
+            throw Object.assign(new Error(`delegation sub-run cap reached (${parent.acceptedChildren}/${MAX_DELEGATED_CHILDREN}) for parent ${parentRunId}`), { code: "delegation_subrun_cap", status: 409 });
+        }
+    }
+    noteChildAccepted(parentRunId, admissionId) {
+        this.assertCanAdmitChild(parentRunId);
+        const parent = this.parents.get(parentRunId);
+        parent.acceptedChildren += 1;
+        parent.pendingAdmissions.add(admissionId);
+    }
+    cancelAcceptedChild(parentRunId, admissionId) {
+        const parent = this.parents.get(parentRunId);
+        if (!parent?.pendingAdmissions.delete(admissionId))
+            return;
+        this.notifyIfDrained(parent);
+    }
+    attachChild(parentRunId, admissionId, childRunId, taskId, onCashSettled) {
+        const parent = this.parents.get(parentRunId);
+        if (!parent || !parent.pendingAdmissions.has(admissionId)) {
+            throw Object.assign(new Error(`delegated child ${childRunId} has no admitted parent budget authority`), { code: "delegation_budget_parent_unavailable", status: 409 });
+        }
+        if (this.childParents.has(childRunId)) {
+            throw Object.assign(new Error(`delegated child ${childRunId} is already attached`), {
+                code: "delegation_budget_child_duplicate",
+                status: 409,
+            });
+        }
+        parent.pendingAdmissions.delete(admissionId);
+        const ledger = parent.ledger.scopedToTask(taskId, onCashSettled);
+        parent.children.set(childRunId, { ledger, admissionId });
+        this.childParents.set(childRunId, parentRunId);
+        return ledger;
+    }
+    beginParentClose(parentRunId) {
+        const parent = this.parents.get(parentRunId);
+        if (parent)
+            parent.accepting = false;
+    }
+    async waitForChildren(parentRunId, timeoutMs = 30_000) {
+        const parent = this.parents.get(parentRunId);
+        if (!parent || this.isDrained(parent))
+            return;
+        if (!parent.cancellationStarted && this.options.cancelAdmission) {
+            parent.cancellationStarted = true;
+            const admissionIds = new Set([
+                ...parent.pendingAdmissions,
+                ...[...parent.children.values()].map((child) => child.admissionId),
+            ]);
+            await Promise.allSettled([...admissionIds].map((admissionId) => Promise.resolve().then(() => this.options.cancelAdmission(admissionId))));
+            if (this.isDrained(parent))
+                return;
+        }
+        await new Promise((resolve, reject) => {
+            const done = () => {
+                clearTimeout(timer);
+                parent.waiters.delete(done);
+                resolve();
+            };
+            const timer = setTimeout(() => {
+                parent.waiters.delete(done);
+                // The daemon already signalled every admission above. If a broken
+                // injected runner ignores abort, fence its scoped financial mutations
+                // BEFORE the parent failure terminal is allowed to flush: it can no
+                // longer emit parent-family cash or retain a hold. Production Delegate
+                // lanes are narrower: Claude/Codex run through core spawnProcess, whose
+                // abort path sends the cooperative signal, escalates to SIGKILL after
+                // 1s, bounds tree reaping, and then completes the generator with typed
+                // termination_unconfirmed at worst. Their daemon jobs therefore settle
+                // well inside this 30s bound. This timeout is a typed broken-runner
+                // fail-safe, not a claim that an arbitrary injected runner is dead.
+                for (const child of parent.children.values())
+                    child.ledger.releaseTask();
+                reject(Object.assign(new Error(`timed out waiting for ${parent.children.size + parent.pendingAdmissions.size} delegated child run(s) of ${parentRunId}`), { code: "delegation_child_drain_timeout", status: 503 }));
+            }, timeoutMs);
+            timer.unref?.();
+            parent.waiters.add(done);
+            if (this.isDrained(parent))
+                done();
+        });
+    }
+    releaseRun(runId) {
+        const parentRunId = this.childParents.get(runId);
+        if (parentRunId) {
+            const parent = this.parents.get(parentRunId);
+            const child = parent?.children.get(runId);
+            child?.ledger.releaseTask();
+            parent?.children.delete(runId);
+            this.childParents.delete(runId);
+            if (parent)
+                this.notifyIfDrained(parent);
+            return;
+        }
+        const parent = this.parents.get(runId);
+        if (!parent)
+            return;
+        parent.accepting = false;
+        parent.pendingAdmissions.clear();
+        for (const child of parent.children.values())
+            child.ledger.releaseTask();
+        for (const childRunId of parent.children.keys())
+            this.childParents.delete(childRunId);
+        for (const waiter of [...parent.waiters])
+            waiter();
+        this.parents.delete(runId);
+    }
+    acceptedChildCount(parentRunId) {
+        return this.parents.get(parentRunId)?.acceptedChildren ?? 0;
+    }
+    isDrained(parent) {
+        return parent.children.size === 0 && parent.pendingAdmissions.size === 0;
+    }
+    notifyIfDrained(parent) {
+        if (!this.isDrained(parent))
+            return;
+        for (const waiter of [...parent.waiters])
+            waiter();
+    }
+}
+//# sourceMappingURL=delegationBudgetAuthority.js.map

package/dist/delegationBudgetAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationBudgetAuthority.js","sourceRoot":"","sources":["../src/delegationBudgetAuthority.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAkB3D;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAIP;IAHZ,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D,YAA6B,UAA4C,EAAE;QAA9C,YAAO,GAAP,OAAO,CAAuC;IAAG,CAAC;IAE/E,cAAc,CAAC,KAAa,EAAE,MAAoB;QAChD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,EAAE;gBACtF,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;YACtB,MAAM;YACN,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,CAAC;YACnB,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,mBAAmB,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,0DAA0D,WAAW,EAAE,CAAC,EAClF,EAAE,IAAI,EAAE,sCAAsC,EAAE,MAAM,EAAE,GAAG,EAAE,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,sBAAsB,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,mCAAmC,MAAM,CAAC,gBAAgB,IAAI,sBAAsB,gBAAgB,WAAW,EAAE,CAClH,EACD,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,WAAmB,EAAE,WAAmB;QACxD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QAC9C,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW,CACT,WAAmB,EACnB,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,aAKS;QAET,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,mBAAmB,UAAU,0CAA0C,CAAC,EAClF,EAAE,IAAI,EAAE,sCAAsC,EAAE,MAAM,EAAE,GAAG,EAAE,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,UAAU,sBAAsB,CAAC,EAAE;gBAClF,IAAI,EAAE,mCAAmC;gBACzC,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,SAAS,GAAG,MAAM;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO;QAC9C,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAChE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;gBAC3B,GAAG,MAAM,CAAC,iBAAiB;gBAC3B,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;aACnE,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,UAAU,CACtB,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACpC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,eAAgB,CAAC,WAAW,CAAC,CAAC,CACzE,CACF,CAAC;YACF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO;QACrC,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,oEAAoE;gBACpE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;oBAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzE,MAAM,CACJ,MAAM,CAAC,MAAM,CACX,IAAI,KAAK,CACP,yBAAyB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,8BAA8B,WAAW,EAAE,CACzH,EACD,EAAE,IAAI,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,EAAE,CACxD,CACF,CAAC;YACJ,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,gBAAgB,IAAI,CAAC,CAAC;IAC9D,CAAC;IAEO,SAAS,CAAC,MAAuB;QACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,eAAe,CAAC,MAAuB;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO;QACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,EAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/delegationFailure.d.ts

@@ -0,0 +1,58 @@
+import { ArtifactStore, type RunPaths } from "@claudexor/artifact-store";
+import { EventLog } from "@claudexor/event-log";
+import { type ModeKind } from "@claudexor/schema";
+import type { AttemptTelemetry } from "./attemptTelemetry.js";
+import type { CandidateRun } from "./candidateEvidence.js";
+export type DelegationFailureKind = "startup" | "runtime";
+/** One owner for the post-injection failure boundary shared by race,
+ * convergence, and attempt finalization. Runtime takes precedence if corrupt
+ * evidence ever reports both facts. */
+export declare function delegationFailureKind(t: AttemptTelemetry): DelegationFailureKind | null;
+export declare function delegationFailureError(t: AttemptTelemetry): string | null;
+export declare function candidateFailureKind(run: CandidateRun): DelegationFailureKind | "artifact_security" | null;
+/** Race-level precedence: an unrecovered injected-belt failure dominates all
+ * siblings; a safely discarded isolated secret candidate is merely ineligible,
+ * while an in-place refusal remains terminal because cleanup may be required. */
+export declare function dominantRaceCandidateFailure(runs: CandidateRun[]): CandidateRun | undefined;
+/** Build the terminal cause/provenance without duplicating the race and
+ * convergence messages or raw-attempt links. */
+export declare function delegationFailureTerminal(run: CandidateRun, lane: "race" | "convergence"): {
+    phase: string;
+    error: Error;
+    metadata: {
+        category: "harness_error";
+        harnessId: string;
+        attemptId: string;
+        rawDetailRef: string;
+        nextActions: string[];
+    };
+};
+export declare function candidateFailureTerminal(run: CandidateRun, lane: "race" | "convergence"): {
+    phase: string;
+    error: Error;
+    metadata: {
+        category: "harness_error";
+        harnessId: string;
+        attemptId: string;
+        rawDetailRef: string;
+        nextActions: string[];
+    };
+};
+/** An explicitly in-place harness may have changed the live tree before a
+ * required Delegate failure becomes terminal. Persist those unavoidable bytes
+ * as blocked and revertable; envelope runs stay diagnostic-only. */
+export declare function persistFailedInPlaceWorkProduct(input: {
+    live: boolean;
+    run: CandidateRun;
+    store: ArtifactStore;
+    log: EventLog;
+    paths: RunPaths;
+    execRoot: string;
+    preTurnSha: string | null;
+    postTurnSha?: string | null;
+    taskId: string;
+    mode: ModeKind;
+    kind: "patch" | "new_repo";
+    attempts?: number;
+}): Promise<void>;
+//# sourceMappingURL=delegationFailure.d.ts.map

package/dist/delegationFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationFailure.d.ts","sourceRoot":"","sources":["../src/delegationFailure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAI3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D;;uCAEuC;AACvC,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,GAAG,IAAI,CAIvF;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,YAAY,GAChB,qBAAqB,GAAG,mBAAmB,GAAG,IAAI,CAIpD;AAED;;iFAEiF;AACjF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY,GAAG,SAAS,CAK3F;AAED;gDACgD;AAChD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa;;;;;;;;;;EA2BxF;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa;;;;;;;;;;EAgCvF;AAED;;oEAEoE;AACpE,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,QAAQ,CAAC;IACd,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFhB"}

package/dist/delegationFailure.js

@@ -0,0 +1,184 @@
+import { join } from "node:path";
+import { makeOutcomeFacts } from "@claudexor/schema";
+import { containsSecretLikeToken, newId, sha256 } from "@claudexor/util";
+import { createRevertAnchorOrNull, snapshotTree } from "@claudexor/workspace";
+import { delegationBeltToolFailure, delegationBeltUnavailable } from "./delegationToolEvidence.js";
+import { secretDiffNextActions } from "./secretDiff.js";
+/** One owner for the post-injection failure boundary shared by race,
+ * convergence, and attempt finalization. Runtime takes precedence if corrupt
+ * evidence ever reports both facts. */
+export function delegationFailureKind(t) {
+    if (delegationBeltToolFailure(t))
+        return "runtime";
+    if (delegationBeltUnavailable(t))
+        return "startup";
+    return null;
+}
+export function delegationFailureError(t) {
+    const kind = delegationFailureKind(t);
+    return kind === "runtime"
+        ? "delegation belt tool failed after injection"
+        : kind === "startup"
+            ? "delegation belt failed to start after injection"
+            : null;
+}
+export function candidateFailureKind(run) {
+    return (delegationFailureKind(run.telemetry) ?? (run.secretDiffRefusal ? "artifact_security" : null));
+}
+/** Race-level precedence: an unrecovered injected-belt failure dominates all
+ * siblings; a safely discarded isolated secret candidate is merely ineligible,
+ * while an in-place refusal remains terminal because cleanup may be required. */
+export function dominantRaceCandidateFailure(runs) {
+    return (runs.find((run) => delegationFailureKind(run.telemetry)) ??
+        runs.find((run) => run.secretDiffRefusal && run.secretDiffRefusal.disposition !== "discarded"));
+}
+/** Build the terminal cause/provenance without duplicating the race and
+ * convergence messages or raw-attempt links. */
+export function delegationFailureTerminal(run, lane) {
+    const kind = delegationFailureKind(run.telemetry);
+    if (!kind)
+        throw new Error("delegation failure terminal requested for a healthy attempt");
+    const runtime = kind === "runtime";
+    const message = runtime
+        ? lane === "race"
+            ? `Delegate belt tool failed in ${run.harnessId}; no deliverable or native fallback may replace the failed injected operation`
+            : `Delegate belt tool failed in ${run.harnessId}; convergence cannot review, repair, or continue after an unrecovered injected operation fails`
+        : lane === "race"
+            ? `Delegate startup failed in ${run.harnessId}; no degraded sibling may replace an injected failed belt`
+            : `Delegate startup failed in ${run.harnessId}; convergence cannot repair or continue after an injected belt fails`;
+    return {
+        phase: runtime ? "delegation_runtime" : "delegation_startup",
+        error: new Error(message),
+        metadata: {
+            category: "harness_error",
+            harnessId: run.harnessId,
+            attemptId: run.attemptId,
+            rawDetailRef: `attempts/${run.attemptId}/attempt.yaml`,
+            nextActions: [
+                `Inspect attempts/${run.attemptId}/attempt.yaml`,
+                runtime
+                    ? "Repair the failed Delegate belt operation, then retry the run"
+                    : "Repair the required Delegate belt startup, then retry the run",
+            ],
+        },
+    };
+}
+export function candidateFailureTerminal(run, lane) {
+    const delegation = delegationFailureKind(run.telemetry);
+    if (delegation) {
+        const terminal = delegationFailureTerminal(run, lane);
+        return run.secretDiffRefusal
+            ? {
+                ...terminal,
+                metadata: {
+                    ...terminal.metadata,
+                    nextActions: [
+                        ...secretDiffNextActions(run.secretDiffRefusal),
+                        ...terminal.metadata.nextActions,
+                    ],
+                },
+            }
+            : terminal;
+    }
+    if (!run.secretDiffRefusal)
+        throw new Error("candidate failure terminal requested without cause");
+    return {
+        phase: "artifact_security",
+        error: new Error(run.errors[0] ?? "candidate patch diff was refused by the secret fence"),
+        metadata: {
+            category: "harness_error",
+            harnessId: run.harnessId,
+            attemptId: run.attemptId,
+            rawDetailRef: `attempts/${run.attemptId}/attempt.yaml`,
+            nextActions: run.secretDiffRefusal.disposition === "manual_cleanup"
+                ? ["Remove the secret-bearing in-place bytes manually", "Retry the run"]
+                : ["Retry the run without writing secret material"],
+        },
+    };
+}
+/** An explicitly in-place harness may have changed the live tree before a
+ * required Delegate failure becomes terminal. Persist those unavoidable bytes
+ * as blocked and revertable; envelope runs stay diagnostic-only. */
+export async function persistFailedInPlaceWorkProduct(input) {
+    if (!input.live || (!input.run.diff.trim() && !input.run.secretDiffRefusal))
+        return;
+    const secretRefusal = input.run.secretDiffRefusal;
+    if (secretRefusal) {
+        const facts = makeOutcomeFacts("failed", {
+            reason: "harness_failed",
+            noChanges: secretRefusal.disposition !== "manual_cleanup",
+        });
+        const manualCleanup = secretRefusal.disposition === "manual_cleanup";
+        input.store.writeYaml(join(input.paths.finalDir, "work_product.yaml"), {
+            id: newId("wp"),
+            kind: input.kind,
+            source_task_id: input.taskId,
+            producer_attempt_id: input.run.attemptId,
+            meta: {
+                harness_id: input.run.harnessId,
+                result_kind: "none",
+                mode: input.mode,
+                ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+                lifecycle: facts.lifecycle,
+                outcome_facts: facts,
+                review_verified: false,
+                secret_diff_refused: true,
+                secret_recovery: secretRefusal.disposition,
+                recovery_detail: secretRefusal.detail,
+                adopted: manualCleanup,
+                apply_state: manualCleanup ? "applied_review_blocked" : "reverted",
+                pre_turn_sha: input.preTurnSha,
+                post_turn_sha: null,
+                revert_anchor_id: null,
+            },
+        });
+        input.log.emit("work_product.emitted", {
+            winner: input.run.attemptId,
+            apply_state: manualCleanup ? "applied_review_blocked" : "reverted",
+            secret_diff_refused: true,
+            manual_cleanup_required: manualCleanup,
+        });
+        return;
+    }
+    if (containsSecretLikeToken(input.run.diff)) {
+        throw new Error("failed in-place patch diff contains secret-like token; refusing artifact");
+    }
+    let postTurnSha = input.postTurnSha;
+    if (postTurnSha === undefined) {
+        try {
+            postTurnSha = await snapshotTree(input.execRoot);
+        }
+        catch {
+            postTurnSha = null;
+        }
+    }
+    const revertAnchorId = await createRevertAnchorOrNull(input.execRoot, input.preTurnSha, postTurnSha);
+    const facts = makeOutcomeFacts("failed", { reason: "harness_failed", noChanges: false });
+    input.store.writeText(join(input.paths.finalDir, "patch.diff"), input.run.diff);
+    input.store.writeYaml(join(input.paths.finalDir, "work_product.yaml"), {
+        id: newId("wp"),
+        kind: input.kind,
+        source_task_id: input.taskId,
+        producer_attempt_id: input.run.attemptId,
+        meta: {
+            harness_id: input.run.harnessId,
+            result_kind: "patch",
+            mode: input.mode,
+            ...(input.attempts !== undefined ? { attempts: input.attempts } : {}),
+            lifecycle: facts.lifecycle,
+            outcome_facts: facts,
+            review_verified: false,
+            patch_sha256: sha256(input.run.diff),
+            adopted: true,
+            apply_state: "applied_review_blocked",
+            pre_turn_sha: input.preTurnSha,
+            post_turn_sha: postTurnSha,
+            revert_anchor_id: revertAnchorId,
+        },
+    });
+    input.log.emit("work_product.emitted", {
+        winner: input.run.attemptId,
+        apply_state: "applied_review_blocked",
+    });
+}
+//# sourceMappingURL=delegationFailure.js.map

package/dist/delegationFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationFailure.js","sourceRoot":"","sources":["../src/delegationFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,gBAAgB,EAAiB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAIxD;;uCAEuC;AACvC,MAAM,UAAU,qBAAqB,CAAC,CAAmB;IACvD,IAAI,yBAAyB,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,yBAAyB,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,CAAmB;IACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,IAAI,KAAK,SAAS;YAClB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAiB;IAEjB,OAAO,CACL,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,IAAoB;IAC/D,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,iBAAiB,CAAC,WAAW,KAAK,WAAW,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED;gDACgD;AAChD,MAAM,UAAU,yBAAyB,CAAC,GAAiB,EAAE,IAA4B;IACvF,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,IAAI,KAAK,MAAM;YACf,CAAC,CAAC,gCAAgC,GAAG,CAAC,SAAS,+EAA+E;YAC9H,CAAC,CAAC,gCAAgC,GAAG,CAAC,SAAS,gGAAgG;QACjJ,CAAC,CAAC,IAAI,KAAK,MAAM;YACf,CAAC,CAAC,8BAA8B,GAAG,CAAC,SAAS,2DAA2D;YACxG,CAAC,CAAC,8BAA8B,GAAG,CAAC,SAAS,sEAAsE,CAAC;IACxH,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QAC5D,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC;QACzB,QAAQ,EAAE;YACR,QAAQ,EAAE,eAAwB;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,YAAY,GAAG,CAAC,SAAS,eAAe;YACtD,WAAW,EAAE;gBACX,oBAAoB,GAAG,CAAC,SAAS,eAAe;gBAChD,OAAO;oBACL,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,+DAA+D;aACpE;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAiB,EAAE,IAA4B;IACtF,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,iBAAiB;YAC1B,CAAC,CAAC;gBACE,GAAG,QAAQ;gBACX,QAAQ,EAAE;oBACR,GAAG,QAAQ,CAAC,QAAQ;oBACpB,WAAW,EAAE;wBACX,GAAG,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC;wBAC/C,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW;qBACjC;iBACF;aACF;YACH,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClG,OAAO;QACL,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sDAAsD,CAAC;QACzF,QAAQ,EAAE;YACR,QAAQ,EAAE,eAAwB;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,YAAY,GAAG,CAAC,SAAS,eAAe;YACtD,WAAW,EACT,GAAG,CAAC,iBAAiB,CAAC,WAAW,KAAK,gBAAgB;gBACpD,CAAC,CAAC,CAAC,mDAAmD,EAAE,eAAe,CAAC;gBACxE,CAAC,CAAC,CAAC,+CAA+C,CAAC;SACxD;KACF,CAAC;AACJ,CAAC;AAED;;oEAEoE;AACpE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAarD;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO;IACpF,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAClD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,aAAa,CAAC,WAAW,KAAK,gBAAgB;SAC1D,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,KAAK,gBAAgB,CAAC;QACrE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE;YACrE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;YACxC,IAAI,EAAE;gBACJ,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;gBAC/B,WAAW,EAAE,MAAM;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK;gBACpB,eAAe,EAAE,KAAK;gBACtB,mBAAmB,EAAE,IAAI;gBACzB,eAAe,EAAE,aAAa,CAAC,WAAW;gBAC1C,eAAe,EAAE,aAAa,CAAC,MAAM;gBACrC,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,UAAU;gBAClE,YAAY,EAAE,KAAK,CAAC,UAAU;gBAC9B,aAAa,EAAE,IAAI;gBACnB,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;YACrC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;YAC3B,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,UAAU;YAClE,mBAAmB,EAAE,IAAI;YACzB,uBAAuB,EAAE,aAAa;SACvC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,wBAAwB,CACnD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,EAChB,WAAW,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChF,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE;QACrE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,mBAAmB,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;QACxC,IAAI,EAAE;YACJ,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;YAC/B,WAAW,EAAE,OAAO;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,wBAAwB;YACrC,YAAY,EAAE,KAAK,CAAC,UAAU;YAC9B,aAAa,EAAE,WAAW;YAC1B,gBAAgB,EAAE,cAAc;SACjC;KACF,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;QACrC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;QAC3B,WAAW,EAAE,wBAAwB;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/delegationToolEvidence.d.ts

@@ -0,0 +1,20 @@
+import type { HarnessEvent } from "@claudexor/schema";
+import type { AttemptTelemetry } from "./attemptTelemetry.js";
+/** The required belt server failed after injection. A ready/pending-but-unused
+ * belt is not unavailable; the harness remains free to solve the turn itself. */
+export declare function delegationBeltUnavailable(t: AttemptTelemetry): boolean;
+/** An exact injected belt operation failed and has not recovered through the
+ * same invocation success (matching non-null use id, with tool+kind+target as
+ * the compatibility fallback). INV-030 makes this a required-capability hard
+ * failure while reusing INV-043's recovery key; it does not rewrite the
+ * startup-only `delegation_belt.failed` receipt or the run-level `used` fact. */
+export declare function delegationBeltToolFailure(t: AttemptTelemetry): boolean;
+/** Record a non-error terminal shape that is nevertheless failure for the
+ * required belt. The caller has already proven this is the exact belt tool. */
+export declare function recordDelegationBeltResultFailure(t: AttemptTelemetry, tool: NonNullable<HarnessEvent["tool"]>, summary: string): void;
+/** Exact adapter-neutral belt evidence. Claude namespaces the normalized tool
+ * name as `mcp__server__tool`; Codex keeps the native tool name and records the
+ * server boundary in `target` as `server:tool`. Delimiters are mandatory so a
+ * similarly-prefixed foreign server cannot satisfy Delegate used=true. */
+export declare function isDelegationBeltTool(tool: HarnessEvent["tool"] | undefined, serverName: string): boolean;
+//# sourceMappingURL=delegationToolEvidence.d.ts.map

package/dist/delegationToolEvidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationToolEvidence.d.ts","sourceRoot":"","sources":["../src/delegationToolEvidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;iFACiF;AACjF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAEtE;AAED;;;;iFAIiF;AACjF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAgBtE;AAED;+EAC+E;AAC/E,wBAAgB,iCAAiC,CAC/C,CAAC,EAAE,gBAAgB,EACnB,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EACvC,OAAO,EAAE,MAAM,GACd,IAAI,CASN;AAED;;;0EAG0E;AAC1E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,SAAS,EACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAMT"}

package/dist/delegationToolEvidence.js

@@ -0,0 +1,46 @@
+/** The required belt server failed after injection. A ready/pending-but-unused
+ * belt is not unavailable; the harness remains free to solve the turn itself. */
+export function delegationBeltUnavailable(t) {
+    return t.delegationBelt.requested && t.delegationBelt.failed;
+}
+/** An exact injected belt operation failed and has not recovered through the
+ * same invocation success (matching non-null use id, with tool+kind+target as
+ * the compatibility fallback). INV-030 makes this a required-capability hard
+ * failure while reusing INV-043's recovery key; it does not rewrite the
+ * startup-only `delegation_belt.failed` receipt or the run-level `used` fact. */
+export function delegationBeltToolFailure(t) {
+    if (!t.delegationBelt.requested)
+        return false;
+    const serverName = t.delegationBelt.serverName;
+    if (!serverName)
+        return false;
+    return t.toolErrors.some((error) => !error.recovered &&
+        isDelegationBeltTool({
+            name: error.tool,
+            kind: error.kind,
+            ...(error.target !== null ? { target: error.target } : {}),
+        }, serverName));
+}
+/** Record a non-error terminal shape that is nevertheless failure for the
+ * required belt. The caller has already proven this is the exact belt tool. */
+export function recordDelegationBeltResultFailure(t, tool, summary) {
+    t.toolErrors.push({
+        tool: tool.name,
+        kind: tool.kind,
+        target: tool.target ?? null,
+        summary,
+        toolUseId: tool.use_id ?? null,
+        recovered: false,
+    });
+}
+/** Exact adapter-neutral belt evidence. Claude namespaces the normalized tool
+ * name as `mcp__server__tool`; Codex keeps the native tool name and records the
+ * server boundary in `target` as `server:tool`. Delimiters are mandatory so a
+ * similarly-prefixed foreign server cannot satisfy Delegate used=true. */
+export function isDelegationBeltTool(tool, serverName) {
+    if (!tool || tool.kind !== "mcp")
+        return false;
+    return (tool.name.startsWith(`mcp__${serverName}__`) ||
+        (typeof tool.target === "string" && tool.target.startsWith(`${serverName}:`)));
+}
+//# sourceMappingURL=delegationToolEvidence.js.map

package/dist/delegationToolEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationToolEvidence.js","sourceRoot":"","sources":["../src/delegationToolEvidence.ts"],"names":[],"mappings":"AAGA;iFACiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,CAAmB;IAC3D,OAAO,CAAC,CAAC,cAAc,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED;;;;iFAIiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,CAAmB;IAC3D,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CACtB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,SAAS;QAChB,oBAAoB,CAClB;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,EACD,UAAU,CACX,CACJ,CAAC;AACJ,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,iCAAiC,CAC/C,CAAmB,EACnB,IAAuC,EACvC,OAAe;IAEf,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC9B,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;0EAG0E;AAC1E,MAAM,UAAU,oBAAoB,CAClC,IAAsC,EACtC,UAAkB;IAElB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,UAAU,IAAI,CAAC;QAC5C,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAC9E,CAAC;AACJ,CAAC"}

package/dist/effortGovernance.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Run-preflight effort gate (INV-105), the effort analog of `modelGovernance`.
+ *
+ * This gate DISCLOSES, it does not clamp. It answers exactly one question:
+ * does the harness's merged advertised ladder (`capabilities.effort_levels`,
+ * the positional merge of its models' vendor-ordered lists) know this level at
+ * all? A level the merged ladder has never seen is disclosed as ignored — the
+ * adapter would otherwise just omit the flag and the user would never learn
+ * their level went nowhere. A level the ladder DOES know rides through
+ * VERBATIM and is resolved by the adapter.
+ *
+ * Why the clamp lives downstream and not here: the manifest is discovered
+ * ONCE, against the DEFAULT native harness home (`discover()` takes no
+ * arguments), so its ladders describe the DEFAULT account's catalog. Codex
+ * advertises its ladders per ACCOUNT — every credential profile and API-key
+ * route gets its own `CODEX_HOME`, and `model/list` answers for whoever that
+ * home is logged into. Clamping here would therefore hold a profile-scoped run
+ * to another account's ceiling. The adapter re-resolves against the catalog
+ * for the env the child will ACTUALLY run in (`codexEffortsForEnv`), so it is
+ * the only layer entitled to clamp — and clamping is only ever a move INSIDE
+ * the vendor's own order, which only the adapter's resolved catalog carries.
+ *
+ * The membership test runs against the harness-wide merged ladder rather than
+ * the per-model narrowing, because the ladder is the broadest and least
+ * account-specific signal the manifest carries: a level any of the harness's
+ * models advertises is in it, so this gate cannot reject a level merely
+ * because the routed model's copy happens not to list it.
+ */
+import type { EffortHint } from "@claudexor/schema";
+export interface EffortGovernedRoute {
+    id: string;
+    /** Harness-wide merged advertised ladder; empty = effort is not a tunable surface. */
+    effortLevels: readonly EffortHint[];
+}
+/**
+ * The effort this route should FORWARD, plus any disclosure text.
+ * `effort: null` means "send no flag" — either nothing was asked for, or what
+ * was asked for could not be honored anywhere and is disclosed instead.
+ *
+ * A returned level is the RAW request, deliberately un-clamped: it is the
+ * adapter's `effort_hint`, and every adapter that consumes it resolves through
+ * the shared normalizer against its own profile-resolved advertised set
+ * (`normalizeEffort` in harness-claude, `codexEffortFor` in harness-codex).
+ */
+export declare function governRouteEffort(requested: EffortHint | null, route: EffortGovernedRoute): {
+    effort: EffortHint | null;
+    ignored: string | null;
+};
+//# sourceMappingURL=effortGovernance.d.ts.map

package/dist/effortGovernance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effortGovernance.d.ts","sourceRoot":"","sources":["../src/effortGovernance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,sFAAsF;IACtF,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,UAAU,GAAG,IAAI,EAC5B,KAAK,EAAE,mBAAmB,GACzB;IAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAuBvD"}