@claudexor/schema 1.0.1 → 2.1.1

package/dist/credential-profile.js

@@ -0,0 +1,140 @@
+import { z } from "zod";
+import { namespacedSecretRefBase } from "@claudexor/util";
+import { Id, IsoTimestamp } from "./primitives.js";
+import { AuthAvailability, AuthVerification } from "./auth.js";
+/**
+ * The credential transport a profile isolates (INV-135). `config_dir_login` is
+ * a vendor-owned login living in a Claudexor-scoped config dir (claude
+ * CLAUDE_CONFIG_DIR / codex CODEX_HOME); `oauth_token` and `api_key` are
+ * secret-store references. The default vendor dirs (~/.claude, native codex
+ * home) are NEVER a profile's isolation locator — profiles are additive.
+ */
+export const CredentialKind = z
+    .enum(["config_dir_login", "oauth_token", "api_key"])
+    .describe("Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key.");
+/**
+ * Durable, NON-SECRET registry entry for one credential identity of one
+ * harness (INV-135). Secret material never lives here: `config_dir_login`
+ * points at a vendor-owned directory, token/key kinds point at a namespaced
+ * secret-store name. Readiness is intentionally NOT durable — it is the
+ * doctor's `CredentialProfileStatus` projection.
+ */
+export const CredentialProfile = z
+    .object({
+    profile_id: Id.describe("Stable user-chosen profile identifier (unique per harness)."),
+    harness_id: Id.describe("Harness family this profile belongs to."),
+    display_name: z.string().min(1).describe("Human label shown wherever the profile appears."),
+    credential_kind: CredentialKind,
+    isolation_locator: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."),
+    secret_ref: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Namespaced secret-store name (e.g. claude_oauth:work) for oauth_token/api_key profiles; null for config_dir_login."),
+    enabled: z.boolean().default(true).describe("Disabled profiles are never routable."),
+    created_at: IsoTimestamp.nullable()
+        .default(null)
+        .describe("When the profile was registered; null for hand-written config entries."),
+})
+    .strict()
+    .superRefine((profile, ctx) => {
+    if (profile.credential_kind === "config_dir_login") {
+        if (!profile.isolation_locator)
+            ctx.addIssue({
+                code: "custom",
+                message: "config_dir_login profiles require isolation_locator (the scoped config dir)",
+            });
+        if (profile.secret_ref)
+            ctx.addIssue({
+                code: "custom",
+                message: "config_dir_login profiles must not carry secret_ref",
+            });
+    }
+    else {
+        if (!profile.secret_ref)
+            ctx.addIssue({
+                code: "custom",
+                message: `${profile.credential_kind} profiles require secret_ref`,
+            });
+        // Release wave round-15 #5: a profile's ref must be NAMESPACED
+        // (`base:profile`). A bare engine-default slot (e.g. "anthropic") would
+        // silently alias the default credential — profiles are ADDITIVE.
+        else if (namespacedSecretRefBase(profile.secret_ref) === null)
+            ctx.addIssue({
+                code: "custom",
+                message: `secret_ref "${profile.secret_ref}" must be a namespaced managed slot (base:profile, e.g. claude_oauth:work); bare engine-default slots would alias the default credential`,
+            });
+        if (profile.isolation_locator)
+            ctx.addIssue({
+                code: "custom",
+                message: `${profile.credential_kind} profiles must not carry isolation_locator`,
+            });
+    }
+})
+    .describe("Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here.");
+/**
+ * Doctor-owned readiness projection for one profile — deliberately separate
+ * from the durable registry entry so stored config never asserts liveness.
+ */
+export const CredentialProfileStatus = z
+    .object({
+    profile_id: Id,
+    harness_id: Id,
+    availability: AuthAvailability,
+    verification: AuthVerification,
+    detail: z.string().optional().describe("Redacted human-readable probe evidence."),
+    last_verified_at: IsoTimestamp.nullable()
+        .default(null)
+        .describe("When a probe last verified this profile; null = never verified."),
+})
+    .strict()
+    .describe("Doctor-owned readiness projection for one credential profile; never durable config.");
+/** Control response: every registered profile with its doctor projection. */
+export const ControlCredentialProfilesResponse = z
+    .object({
+    profiles: z
+        .array(z.object({ profile: CredentialProfile, status: CredentialProfileStatus }).strict())
+        .describe("Every registered credential profile paired with its doctor readiness projection."),
+})
+    .strict()
+    .describe("Credential-profile registry listing with per-profile doctor readiness.");
+/** Register a config-dir login profile (claude/codex) from a UI surface —
+ * the same ONE locked registration owner `claudexor profiles add` uses. */
+export const ControlCredentialProfileCreateRequest = z
+    .object({
+    harnessId: Id.describe("Harness family (claude | codex) for the config-dir login profile."),
+    profileId: Id.describe("New profile id (bounded slug, unique per harness)."),
+    displayName: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Human label shown wherever the account appears; defaults to the id."),
+})
+    .strict()
+    .describe("Request body for POST /credential-profiles.");
+/** DELETE /credential-profiles/:harness/:id — removes the registry entry and
+ * the profile's OWN credential material (its scoped login dir, or its
+ * namespaced secret). The default vendor store is untouchable by design. */
+export const ControlCredentialProfileDeleteResponse = z
+    .object({
+    profile: CredentialProfile.describe("The removed registry entry."),
+    removed: z.literal(true),
+    credentialCleanup: z
+        .enum(["config_dir_removed", "secret_deleted", "none"])
+        .describe("What credential material was deleted alongside the registry entry."),
+    cleanupWarning: z
+        .string()
+        .optional()
+        .describe("Present when the registry entry was removed but cleanup failed (orphan left)."),
+})
+    .strict()
+    .describe("Receipt for a credential-profile removal.");
+export const ControlCredentialProfileCreateResponse = z
+    .object({ profile: CredentialProfile, status: CredentialProfileStatus })
+    .strict()
+    .describe("The registered profile with its initial doctor readiness projection.");
+//# sourceMappingURL=credential-profile.js.map

package/dist/credential-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile.js","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;KACpD,QAAQ,CACP,uHAAuH,CACxH,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtF,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,eAAe,EAAE,cAAc;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8FAA8F,CAC/F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,UAAU;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,UAAU;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,8BAA8B;aAClE,CAAC,CAAC;QACL,+DAA+D;QAC/D,wEAAwE;QACxE,iEAAiE;aAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,0IAA0I;aACrL,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,iBAAiB;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,4CAA4C;aAChF,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CACP,wJAAwJ,CACzJ,CAAC;AAGJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACjF,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE;SACtC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,iEAAiE,CAAC;CAC/E,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qFAAqF,CAAC,CAAC;AAGnG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SACzF,QAAQ,CAAC,kFAAkF,CAAC;CAChG,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,wEAAwE,CAAC,CAAC;AAGtF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC3F,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC5E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAK3D;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;SACtD,QAAQ,CAAC,oEAAoE,CAAC;IACjF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+EAA+E,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAKzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC"}

package/dist/decision.d.ts

@@ -28,7 +28,7 @@ export declare const PairwiseComparison: z.ZodObject<{
     }>;
 }>;
 export type PairwiseComparison = z.infer<typeof PairwiseComparison>;
-export declare const RunStatus: z.ZodEnum<["success", "no_op", "ungated", "review_not_run", "blocked", "not_converged", "stuck_no_progress", "failed", "exhausted", "cancelled"]>;
+export declare const RunStatus: z.ZodEnum<["success", "no_op", "ungated", "review_not_run", "blocked", "failed", "interrupted_unknown", "cost_unverifiable", "exhausted_overshoot", "exhausted", "not_converged", "stuck_no_progress", "cancelled"]>;
 export type RunStatus = z.infer<typeof RunStatus>;
 export declare const ApplyRecommendation: z.ZodEnum<["apply", "inspect", "continue", "split_task", "human_review"]>;
 export type ApplyRecommendation = z.infer<typeof ApplyRecommendation>;
@@ -63,9 +63,9 @@ export declare const FinalVerifyRecord: z.ZodObject<{
     /** Typed reason when attempted=false (e.g. no_patch, no_base_sha) or a failure detail. */
     reason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
+    reason: string | null;
     duration_ms: number | null;
     base_sha: string | null;
-    reason: string | null;
     attempted: boolean;
     applied_cleanly: boolean | null;
     gates_passed: boolean | null;
@@ -75,9 +75,9 @@ export declare const FinalVerifyRecord: z.ZodObject<{
     }[];
 }, {
     attempted: boolean;
+    reason?: string | null | undefined;
     duration_ms?: number | null | undefined;
     base_sha?: string | null | undefined;
-    reason?: string | null | undefined;
     applied_cleanly?: boolean | null | undefined;
     gates_passed?: boolean | null | undefined;
     gates?: {
@@ -88,7 +88,7 @@ export declare const FinalVerifyRecord: z.ZodObject<{
 export type FinalVerifyRecord = z.infer<typeof FinalVerifyRecord>;
 export declare const DecisionRecord: z.ZodObject<{
     winner: z.ZodNullable<z.ZodString>;
-    status: z.ZodEnum<["success", "no_op", "ungated", "review_not_run", "blocked", "not_converged", "stuck_no_progress", "failed", "exhausted", "cancelled"]>;
+    status: z.ZodEnum<["success", "no_op", "ungated", "review_not_run", "blocked", "failed", "interrupted_unknown", "cost_unverifiable", "exhausted_overshoot", "exhausted", "not_converged", "stuck_no_progress", "cancelled"]>;
     outcome: z.ZodDefault<z.ZodEnum<["ready", "no_op", "ungated", "review_not_run", "blocked"]>>;
     why_winner: z.ZodDefault<z.ZodString>;
     why_not_others: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -127,9 +127,9 @@ export declare const DecisionRecord: z.ZodObject<{
         /** Typed reason when attempted=false (e.g. no_patch, no_base_sha) or a failure detail. */
         reason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, "strip", z.ZodTypeAny, {
+        reason: string | null;
         duration_ms: number | null;
         base_sha: string | null;
-        reason: string | null;
         attempted: boolean;
         applied_cleanly: boolean | null;
         gates_passed: boolean | null;
@@ -139,9 +139,9 @@ export declare const DecisionRecord: z.ZodObject<{
         }[];
     }, {
         attempted: boolean;
+        reason?: string | null | undefined;
         duration_ms?: number | null | undefined;
         base_sha?: string | null | undefined;
-        reason?: string | null | undefined;
         applied_cleanly?: boolean | null | undefined;
         gates_passed?: boolean | null | undefined;
         gates?: {
@@ -150,7 +150,7 @@ export declare const DecisionRecord: z.ZodObject<{
         }[] | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
-    status: "cancelled" | "success" | "no_op" | "ungated" | "review_not_run" | "blocked" | "not_converged" | "stuck_no_progress" | "failed" | "exhausted";
+    status: "failed" | "cancelled" | "interrupted_unknown" | "success" | "no_op" | "ungated" | "review_not_run" | "blocked" | "cost_unverifiable" | "exhausted_overshoot" | "exhausted" | "not_converged" | "stuck_no_progress";
     winner: string | null;
     outcome: "ready" | "no_op" | "ungated" | "review_not_run" | "blocked";
     why_winner: string;
@@ -165,9 +165,9 @@ export declare const DecisionRecord: z.ZodObject<{
     apply_recommendation: "apply" | "inspect" | "continue" | "split_task" | "human_review";
     verification_basis: "none" | "cross_family_review" | "both";
     final_verify: {
+        reason: string | null;
         duration_ms: number | null;
         base_sha: string | null;
-        reason: string | null;
         attempted: boolean;
         applied_cleanly: boolean | null;
         gates_passed: boolean | null;
@@ -177,7 +177,7 @@ export declare const DecisionRecord: z.ZodObject<{
         }[];
     } | null;
 }, {
-    status: "cancelled" | "success" | "no_op" | "ungated" | "review_not_run" | "blocked" | "not_converged" | "stuck_no_progress" | "failed" | "exhausted";
+    status: "failed" | "cancelled" | "interrupted_unknown" | "success" | "no_op" | "ungated" | "review_not_run" | "blocked" | "cost_unverifiable" | "exhausted_overshoot" | "exhausted" | "not_converged" | "stuck_no_progress";
     winner: string | null;
     outcome?: "ready" | "no_op" | "ungated" | "review_not_run" | "blocked" | undefined;
     why_winner?: string | undefined;
@@ -193,9 +193,9 @@ export declare const DecisionRecord: z.ZodObject<{
     verification_basis?: "none" | "cross_family_review" | "both" | undefined;
     final_verify?: {
         attempted: boolean;
+        reason?: string | null | undefined;
         duration_ms?: number | null | undefined;
         base_sha?: string | null | undefined;
-        reason?: string | null | undefined;
         applied_cleanly?: boolean | null | undefined;
         gates_passed?: boolean | null | undefined;
         gates?: {

package/dist/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../src/decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAciD,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,SAAS,mJAenB,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,mBAAmB,2EAEkH,CAAC;AACnJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,eAAe,uEAIzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAS9D,eAAO,MAAM,iBAAiB,oDAI3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;IAG1B,8EAA8E;;;;;;;;;;;;;;;IAS9E,0FAA0F;;;;;;;;;;;;;;;;;;;;;;;;EAK3F,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;QAjBvB,8EAA8E;;;;;;;;;;;;;;;QAS9E,0FAA0F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqC0C,CAAC;AACzI,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../src/decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAciD,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,SAAS,sNAkBnB,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,mBAAmB,2EAI7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,eAAe,uEAIzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAS9D,eAAO,MAAM,iBAAiB,oDAI3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;IAG1B,8EAA8E;;;;;;;;;;;;;;;IAgC9E,0FAA0F;;;;;;;;;;;;;;;;;;;;;;;;EAW3F,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;QA9CvB,8EAA8E;;;;;;;;;;;;;;;QAgC9E,0FAA0F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkE3F,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/decision.js

@@ -19,13 +19,16 @@ export const RunStatus = z
     "ungated",
     "review_not_run",
     "blocked",
-    "not_converged",
-    "stuck_no_progress",
     "failed",
+    "interrupted_unknown",
+    "cost_unverifiable",
+    "exhausted_overshoot",
     "exhausted",
+    "not_converged",
+    "stuck_no_progress",
     "cancelled",
 ])
-    .describe("Terminal status of a run: success, no_op (nothing to change), ungated (no gates configured), review_not_run, blocked (accepted blocking findings), not_converged, stuck_no_progress, failed, exhausted (attempt/budget caps), or cancelled.");
+    .describe("Terminal status of a run, including truthful blocked, interrupted-unknown, cost-unverifiable, overshoot, exhaustion, non-convergence, failure, and cancellation outcomes.");
 export const ApplyRecommendation = z
     .enum(["apply", "inspect", "continue", "split_task", "human_review"])
     .describe("Recommended next action for the run's work product: apply it, inspect first, continue working, split the task, or get human review.");
@@ -53,16 +56,41 @@ export const FinalVerifyRecord = z
     .object({
     attempted: z.boolean().describe("Whether the final verify was attempted."),
     /** Base the verify tree was created from (the winner envelope's base_sha). */
-    base_sha: z.string().nullable().default(null).describe("Base SHA the verify tree was created from (the winner envelope's base)."),
-    applied_cleanly: z.boolean().nullable().default(null).describe("Whether the patch applied cleanly onto the fresh tree; null when not attempted."),
-    gates_passed: z.boolean().nullable().default(null).describe("Whether the re-run deterministic gates passed; null when not attempted."),
+    base_sha: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Base SHA the verify tree was created from (the winner envelope's base)."),
+    applied_cleanly: z
+        .boolean()
+        .nullable()
+        .default(null)
+        .describe("Whether the patch applied cleanly onto the fresh tree; null when not attempted."),
+    gates_passed: z
+        .boolean()
+        .nullable()
+        .default(null)
+        .describe("Whether the re-run deterministic gates passed; null when not attempted."),
     gates: z
-        .array(z.object({ id: z.string().describe("Gate id."), status: z.string().describe("Gate status.") }))
+        .array(z.object({
+        id: z.string().describe("Gate id."),
+        status: z.string().describe("Gate status."),
+    }))
         .default([])
         .describe("Per-gate re-run results."),
-    duration_ms: z.number().int().nonnegative().nullable().default(null).describe("How long the verify took, in milliseconds."),
+    duration_ms: z
+        .number()
+        .int()
+        .nonnegative()
+        .nullable()
+        .default(null)
+        .describe("How long the verify took, in milliseconds."),
     /** Typed reason when attempted=false (e.g. no_patch, no_base_sha) or a failure detail. */
-    reason: z.string().nullable().default(null).describe("Typed reason when attempted=false (e.g. no_patch, no_base_sha) or a failure detail."),
+    reason: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Typed reason when attempted=false (e.g. no_patch, no_base_sha) or a failure detail."),
 })
     .describe("FinalVerifier record: the winner's patch was applied onto a fresh worktree at the candidate's own base SHA and the deterministic gates were re-run there; no model involvement.");
 export const DecisionRecord = z
@@ -71,16 +99,35 @@ export const DecisionRecord = z
     status: RunStatus,
     outcome: DecisionOutcome.default("blocked"),
     why_winner: z.string().default("").describe("Why the winner was chosen."),
-    why_not_others: z.record(z.string(), z.string()).default({}).describe("Per-candidate reasons the others lost, keyed by candidate id."),
-    accepted_risks: z.array(z.string()).default([]).describe("Risks explicitly accepted in the decision."),
-    final_checks: z.array(z.string()).default([]).describe("Final checks performed before the decision."),
-    evidence_facts: z.array(z.string()).default([]).describe("Evidence facts the decision rests on."),
+    why_not_others: z
+        .record(z.string(), z.string())
+        .default({})
+        .describe("Per-candidate reasons the others lost, keyed by candidate id."),
+    accepted_risks: z
+        .array(z.string())
+        .default([])
+        .describe("Risks explicitly accepted in the decision."),
+    final_checks: z
+        .array(z.string())
+        .default([])
+        .describe("Final checks performed before the decision."),
+    evidence_facts: z
+        .array(z.string())
+        .default([])
+        .describe("Evidence facts the decision rests on."),
     budget_summary: z
         .object({
         // Total settled spend. `estimated` is true when any of it is token-derived
         // (e.g. codex) rather than natively reported — never present an estimate as exact.
-        spend_usd: z.number().nullable().default(null).describe("Total settled spend in USD; null when unknown."),
-        estimated: z.boolean().default(false).describe("True when any of the spend is token-derived rather than natively reported."),
+        spend_usd: z
+            .number()
+            .nullable()
+            .default(null)
+            .describe("Total settled spend in USD; null when unknown."),
+        estimated: z
+            .boolean()
+            .default(false)
+            .describe("True when any of the spend is token-derived rather than natively reported."),
     })
         .default({ spend_usd: null, estimated: false })
         .describe("Settled spend for the run; estimates are disclosed, never presented as exact."),

package/dist/decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"decision.js","sourceRoot":"","sources":["../src/decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAErC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC9D,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC/D,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QACzF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACxE,CAAC,CACH;SACA,QAAQ,CAAC,iDAAiD,CAAC;CAC/D,CAAC;KACD,QAAQ,CAAC,mEAAmE,CAAC,CAAC;AAGjF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,IAAI,CAAC;IACJ,SAAS;IACT,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,eAAe;IACf,mBAAmB;IACnB,QAAQ;IACR,WAAW;IACX,WAAW;CACZ,CAAC;KACD,QAAQ,CACP,6OAA6O,CAC9O,CAAC;AAGJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;KACpE,QAAQ,CAAC,qIAAqI,CAAC,CAAC;AAGnJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;KAChE,QAAQ,CACP,2JAA2J,CAC5J,CAAC;AAGJ,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;KAC7C,QAAQ,CACP,oKAAoK,CACrK,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC1E,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IACjI,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IACjJ,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IACtI,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;SACrG,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,0BAA0B,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC3H,0FAA0F;IAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,qFAAqF,CAAC;CAC5I,CAAC;KACD,QAAQ,CACP,iLAAiL,CAClL,CAAC;AAGJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACtF,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACtI,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACrG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACjG,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,2EAA2E;QAC3E,mFAAmF;QACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACzG,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,4EAA4E,CAAC;KAC7H,CAAC;SACD,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SAC9C,QAAQ,CAAC,+EAA+E,CAAC;IAC5F,oBAAoB,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,kBAAkB,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;IACrD,sEAAsE;IACtE,kEAAkE;IAClE,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE;SACvC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,oHAAoH,CAAC;CAClI,CAAC;KACD,QAAQ,CAAC,2HAA2H,CAAC,CAAC"}
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../src/decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAErC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC9D,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC/D,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QACzF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACxE,CAAC,CACH;SACA,QAAQ,CAAC,iDAAiD,CAAC;CAC/D,CAAC;KACD,QAAQ,CAAC,mEAAmE,CAAC,CAAC;AAGjF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,IAAI,CAAC;IACJ,SAAS;IACT,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,eAAe;IACf,mBAAmB;IACnB,WAAW;CACZ,CAAC;KACD,QAAQ,CACP,2KAA2K,CAC5K,CAAC;AAGJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;KACpE,QAAQ,CACP,qIAAqI,CACtI,CAAC;AAGJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;KAChE,QAAQ,CACP,2JAA2J,CAC5J,CAAC;AAGJ,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;KAC7C,QAAQ,CACP,oKAAoK,CACrK,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC1E,8EAA8E;IAC9E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,yEAAyE,CAAC;IACtF,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,yEAAyE,CAAC;IACtF,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;KAC5C,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,0BAA0B,CAAC;IACvC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,EAAE;SACL,WAAW,EAAE;SACb,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,4CAA4C,CAAC;IACzD,0FAA0F;IAC1F,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,qFAAqF,CACtF;CACJ,CAAC;KACD,QAAQ,CACP,iLAAiL,CAClL,CAAC;AAGJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACtF,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACzE,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,4CAA4C,CAAC;IACzD,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,uCAAuC,CAAC;IACpD,cAAc,EAAE,CAAC;SACd,MAAM,CAAC;QACN,2EAA2E;QAC3E,mFAAmF;QACnF,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,SAAS,EAAE,CAAC;aACT,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,4EAA4E,CAAC;KAC1F,CAAC;SACD,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SAC9C,QAAQ,CAAC,+EAA+E,CAAC;IAC5F,oBAAoB,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,kBAAkB,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;IACrD,sEAAsE;IACtE,kEAAkE;IAClE,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE;SACvC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;CACJ,CAAC;KACD,QAAQ,CACP,2HAA2H,CAC5H,CAAC"}

package/dist/delivery.d.ts

@@ -0,0 +1,99 @@
+import { z } from "zod";
+/** Immutable evidence for one DeliveryService attempt, shared by every apply surface. */
+export declare const DeliveryReceipt: z.ZodObject<{
+    mode: z.ZodEnum<["artifact_only", "apply", "branch", "commit", "pr"]>;
+    applied: z.ZodBoolean;
+    branch: z.ZodOptional<z.ZodString>;
+    commit: z.ZodOptional<z.ZodString>;
+    prUrl: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    treeMutated: z.ZodOptional<z.ZodBoolean>;
+    refused: z.ZodOptional<z.ZodBoolean>;
+    finalVerify: z.ZodObject<{
+        attempted: z.ZodBoolean;
+        base_sha: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        applied_cleanly: z.ZodDefault<z.ZodNullable<z.ZodBoolean>>;
+        gates_passed: z.ZodDefault<z.ZodNullable<z.ZodBoolean>>;
+        gates: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            status: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            status: string;
+            id: string;
+        }, {
+            status: string;
+            id: string;
+        }>, "many">>;
+        duration_ms: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+        reason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        reason: string | null;
+        duration_ms: number | null;
+        base_sha: string | null;
+        attempted: boolean;
+        applied_cleanly: boolean | null;
+        gates_passed: boolean | null;
+        gates: {
+            status: string;
+            id: string;
+        }[];
+    }, {
+        attempted: boolean;
+        reason?: string | null | undefined;
+        duration_ms?: number | null | undefined;
+        base_sha?: string | null | undefined;
+        applied_cleanly?: boolean | null | undefined;
+        gates_passed?: boolean | null | undefined;
+        gates?: {
+            status: string;
+            id: string;
+        }[] | undefined;
+    }>;
+    targetPreimageSha: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    mode: "apply" | "commit" | "branch" | "pr" | "artifact_only";
+    applied: boolean;
+    finalVerify: {
+        reason: string | null;
+        duration_ms: number | null;
+        base_sha: string | null;
+        attempted: boolean;
+        applied_cleanly: boolean | null;
+        gates_passed: boolean | null;
+        gates: {
+            status: string;
+            id: string;
+        }[];
+    };
+    targetPreimageSha: string;
+    detail?: string | undefined;
+    commit?: string | undefined;
+    branch?: string | undefined;
+    prUrl?: string | undefined;
+    treeMutated?: boolean | undefined;
+    refused?: boolean | undefined;
+}, {
+    mode: "apply" | "commit" | "branch" | "pr" | "artifact_only";
+    applied: boolean;
+    finalVerify: {
+        attempted: boolean;
+        reason?: string | null | undefined;
+        duration_ms?: number | null | undefined;
+        base_sha?: string | null | undefined;
+        applied_cleanly?: boolean | null | undefined;
+        gates_passed?: boolean | null | undefined;
+        gates?: {
+            status: string;
+            id: string;
+        }[] | undefined;
+    };
+    targetPreimageSha: string;
+    detail?: string | undefined;
+    commit?: string | undefined;
+    branch?: string | undefined;
+    prUrl?: string | undefined;
+    treeMutated?: boolean | undefined;
+    refused?: boolean | undefined;
+}>;
+export type DeliveryReceipt = z.infer<typeof DeliveryReceipt>;
+//# sourceMappingURL=delivery.d.ts.map

package/dist/delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,yFAAyF;AACzF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc6C,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/delivery.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+import { FinalVerifyRecord } from "./decision.js";
+/** Immutable evidence for one DeliveryService attempt, shared by every apply surface. */
+export const DeliveryReceipt = z
+    .object({
+    mode: z.enum(["artifact_only", "apply", "branch", "commit", "pr"]),
+    applied: z.boolean(),
+    branch: z.string().optional(),
+    commit: z.string().optional(),
+    prUrl: z.string().optional(),
+    detail: z.string().optional(),
+    treeMutated: z.boolean().optional(),
+    refused: z.boolean().optional(),
+    finalVerify: FinalVerifyRecord.describe("Fresh verifier evidence for this delivery attempt."),
+    targetPreimageSha: z.string().describe("Target snapshot verified immediately before delivery."),
+})
+    .strict()
+    .describe("Immutable receipt for a freshly verified delivery attempt.");
+//# sourceMappingURL=delivery.js.map

package/dist/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC7F,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;CAChG,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,4DAA4D,CAAC,CAAC"}

package/dist/events.d.ts

@@ -1,5 +1,42 @@
 import { z } from "zod";
-export declare const RunEventType: z.ZodEnum<["run.created", "task.contract.created", "context.pack.created", "project.git.initialized", "budget.lease.created", "budget.observation", "policy.web.upgraded", "harness.started", "harness.event", "harness.completed", "route.fallback.started", "route.fallback.completed", "route.fallback.exhausted", "route.transient.detected", "route.transient.retry_scheduled", "route.transient.exhausted", "route.fallback.auth_switched", "session.rebound", "interaction.requested", "interaction.answered", "interaction.timeout", "interaction.answer_discarded", "plan.progress", "budget.quota_pressure", "output.ready", "gate.started", "gate.completed", "review.started", "reviewer.started", "reviewer.first_event", "reviewer.auth_switched", "reviewer.completed", "reviewer.timed_out", "reviewer.failed", "finding.revalidated", "synthesis.started", "arbitration.completed", "work_product.emitted", "work_product.adopted", "orchestrate.subrun.started", "orchestrate.step.done", "orchestrate.step.blocked", "control.requested", "control.applied", "control.rejected", "run.blocked", "run.completed", "run.failed"]>;
+export declare const ControlJournalEvent: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    cursor: z.ZodString;
+    partition: z.ZodString;
+    type: z.ZodString;
+    observedAt: z.ZodString;
+    payload: z.ZodUnknown;
+}, "strict", z.ZodTypeAny, {
+    type: string;
+    cursor: string;
+    observedAt: string;
+    schemaVersion: 1;
+    partition: string;
+    payload?: unknown;
+}, {
+    type: string;
+    cursor: string;
+    observedAt: string;
+    schemaVersion: 1;
+    partition: string;
+    payload?: unknown;
+}>;
+export type ControlJournalEvent = z.infer<typeof ControlJournalEvent>;
+export declare const ThreadHeadPing: z.ZodObject<{
+    thread_id: z.ZodString;
+    project_id: z.ZodNullable<z.ZodString>;
+    revision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    thread_id: string;
+    project_id: string | null;
+    revision: number;
+}, {
+    thread_id: string;
+    project_id: string | null;
+    revision: number;
+}>;
+export type ThreadHeadPing = z.infer<typeof ThreadHeadPing>;
+export declare const RunEventType: z.ZodEnum<["run.created", "task.contract.created", "context.pack.created", "project.git.initialized", "budget.lease.created", "budget.observation", "budget.cash", "policy.web.upgraded", "harness.started", "harness.event", "harness.completed", "route.fallback.started", "route.fallback.completed", "route.fallback.exhausted", "route.transient.detected", "route.transient.retry_scheduled", "route.profile.headroom_exceeded", "route.profile.rotated", "route.transient.exhausted", "route.fallback.auth_switched", "session.rebound", "interaction.requested", "interaction.answered", "interaction.timeout", "interaction.answer_discarded", "plan.progress", "budget.quota_pressure", "output.ready", "gate.started", "gate.completed", "review.started", "reviewer.started", "reviewer.first_event", "reviewer.auth_switched", "reviewer.completed", "reviewer.timed_out", "reviewer.failed", "finding.revalidated", "synthesis.started", "arbitration.completed", "work_product.emitted", "work_product.adopted", "orchestrate.subrun.started", "orchestrate.step.done", "orchestrate.step.blocked", "control.requested", "control.applied", "control.rejected", "run.blocked", "run.completed", "run.failed"]>;
 export type RunEventType = z.infer<typeof RunEventType>;
 /**
  * Typed payload for `route.fallback.*` events. The orchestrator validates this
@@ -47,10 +84,10 @@ export declare const RunEvent: z.ZodObject<{
     /** Thread this run is a turn of, when any. Lets the global event multiplex
      * route live progress to a chat surface without a reverse job lookup. */
     thread_id: z.ZodOptional<z.ZodString>;
-    type: z.ZodEnum<["run.created", "task.contract.created", "context.pack.created", "project.git.initialized", "budget.lease.created", "budget.observation", "policy.web.upgraded", "harness.started", "harness.event", "harness.completed", "route.fallback.started", "route.fallback.completed", "route.fallback.exhausted", "route.transient.detected", "route.transient.retry_scheduled", "route.transient.exhausted", "route.fallback.auth_switched", "session.rebound", "interaction.requested", "interaction.answered", "interaction.timeout", "interaction.answer_discarded", "plan.progress", "budget.quota_pressure", "output.ready", "gate.started", "gate.completed", "review.started", "reviewer.started", "reviewer.first_event", "reviewer.auth_switched", "reviewer.completed", "reviewer.timed_out", "reviewer.failed", "finding.revalidated", "synthesis.started", "arbitration.completed", "work_product.emitted", "work_product.adopted", "orchestrate.subrun.started", "orchestrate.step.done", "orchestrate.step.blocked", "control.requested", "control.applied", "control.rejected", "run.blocked", "run.completed", "run.failed"]>;
+    type: z.ZodEnum<["run.created", "task.contract.created", "context.pack.created", "project.git.initialized", "budget.lease.created", "budget.observation", "budget.cash", "policy.web.upgraded", "harness.started", "harness.event", "harness.completed", "route.fallback.started", "route.fallback.completed", "route.fallback.exhausted", "route.transient.detected", "route.transient.retry_scheduled", "route.profile.headroom_exceeded", "route.profile.rotated", "route.transient.exhausted", "route.fallback.auth_switched", "session.rebound", "interaction.requested", "interaction.answered", "interaction.timeout", "interaction.answer_discarded", "plan.progress", "budget.quota_pressure", "output.ready", "gate.started", "gate.completed", "review.started", "reviewer.started", "reviewer.first_event", "reviewer.auth_switched", "reviewer.completed", "reviewer.timed_out", "reviewer.failed", "finding.revalidated", "synthesis.started", "arbitration.completed", "work_product.emitted", "work_product.adopted", "orchestrate.subrun.started", "orchestrate.step.done", "orchestrate.step.blocked", "control.requested", "control.applied", "control.rejected", "run.blocked", "run.completed", "run.failed"]>;
     payload: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    type: "run.created" | "task.contract.created" | "context.pack.created" | "project.git.initialized" | "budget.lease.created" | "budget.observation" | "policy.web.upgraded" | "harness.started" | "harness.event" | "harness.completed" | "route.fallback.started" | "route.fallback.completed" | "route.fallback.exhausted" | "route.transient.detected" | "route.transient.retry_scheduled" | "route.transient.exhausted" | "route.fallback.auth_switched" | "session.rebound" | "interaction.requested" | "interaction.answered" | "interaction.timeout" | "interaction.answer_discarded" | "plan.progress" | "budget.quota_pressure" | "output.ready" | "gate.started" | "gate.completed" | "review.started" | "reviewer.started" | "reviewer.first_event" | "reviewer.auth_switched" | "reviewer.completed" | "reviewer.timed_out" | "reviewer.failed" | "finding.revalidated" | "synthesis.started" | "arbitration.completed" | "work_product.emitted" | "work_product.adopted" | "orchestrate.subrun.started" | "orchestrate.step.done" | "orchestrate.step.blocked" | "control.requested" | "control.applied" | "control.rejected" | "run.blocked" | "run.completed" | "run.failed";
+    type: "run.created" | "task.contract.created" | "context.pack.created" | "project.git.initialized" | "budget.lease.created" | "budget.observation" | "budget.cash" | "policy.web.upgraded" | "harness.started" | "harness.event" | "harness.completed" | "route.fallback.started" | "route.fallback.completed" | "route.fallback.exhausted" | "route.transient.detected" | "route.transient.retry_scheduled" | "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.transient.exhausted" | "route.fallback.auth_switched" | "session.rebound" | "interaction.requested" | "interaction.answered" | "interaction.timeout" | "interaction.answer_discarded" | "plan.progress" | "budget.quota_pressure" | "output.ready" | "gate.started" | "gate.completed" | "review.started" | "reviewer.started" | "reviewer.first_event" | "reviewer.auth_switched" | "reviewer.completed" | "reviewer.timed_out" | "reviewer.failed" | "finding.revalidated" | "synthesis.started" | "arbitration.completed" | "work_product.emitted" | "work_product.adopted" | "orchestrate.subrun.started" | "orchestrate.step.done" | "orchestrate.step.blocked" | "control.requested" | "control.applied" | "control.rejected" | "run.blocked" | "run.completed" | "run.failed";
     ts: string;
     payload: Record<string, unknown>;
     run_id: string;
@@ -58,7 +95,7 @@ export declare const RunEvent: z.ZodObject<{
     thread_id?: string | undefined;
     seq?: number | undefined;
 }, {
-    type: "run.created" | "task.contract.created" | "context.pack.created" | "project.git.initialized" | "budget.lease.created" | "budget.observation" | "policy.web.upgraded" | "harness.started" | "harness.event" | "harness.completed" | "route.fallback.started" | "route.fallback.completed" | "route.fallback.exhausted" | "route.transient.detected" | "route.transient.retry_scheduled" | "route.transient.exhausted" | "route.fallback.auth_switched" | "session.rebound" | "interaction.requested" | "interaction.answered" | "interaction.timeout" | "interaction.answer_discarded" | "plan.progress" | "budget.quota_pressure" | "output.ready" | "gate.started" | "gate.completed" | "review.started" | "reviewer.started" | "reviewer.first_event" | "reviewer.auth_switched" | "reviewer.completed" | "reviewer.timed_out" | "reviewer.failed" | "finding.revalidated" | "synthesis.started" | "arbitration.completed" | "work_product.emitted" | "work_product.adopted" | "orchestrate.subrun.started" | "orchestrate.step.done" | "orchestrate.step.blocked" | "control.requested" | "control.applied" | "control.rejected" | "run.blocked" | "run.completed" | "run.failed";
+    type: "run.created" | "task.contract.created" | "context.pack.created" | "project.git.initialized" | "budget.lease.created" | "budget.observation" | "budget.cash" | "policy.web.upgraded" | "harness.started" | "harness.event" | "harness.completed" | "route.fallback.started" | "route.fallback.completed" | "route.fallback.exhausted" | "route.transient.detected" | "route.transient.retry_scheduled" | "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.transient.exhausted" | "route.fallback.auth_switched" | "session.rebound" | "interaction.requested" | "interaction.answered" | "interaction.timeout" | "interaction.answer_discarded" | "plan.progress" | "budget.quota_pressure" | "output.ready" | "gate.started" | "gate.completed" | "review.started" | "reviewer.started" | "reviewer.first_event" | "reviewer.auth_switched" | "reviewer.completed" | "reviewer.timed_out" | "reviewer.failed" | "finding.revalidated" | "synthesis.started" | "arbitration.completed" | "work_product.emitted" | "work_product.adopted" | "orchestrate.subrun.started" | "orchestrate.step.done" | "orchestrate.step.blocked" | "control.requested" | "control.applied" | "control.rejected" | "run.blocked" | "run.completed" | "run.failed";
     ts: string;
     run_id: string;
     task_id: string;

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,YAAY,olCA6DxB,CAAC;AACF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,iDAAiD;AACjD,eAAO,MAAM,QAAQ;IAEjB;;;;OAIG;;;;;IAYH;6EACyE;;;;;;;;;;;;;;;;;;;;EAKO,CAAC;AACrF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAU4C,CAAC;AAC7E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc;;;;;;;;;;;;EAoBxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,YAAY,+pCAkEtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAoB9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,iDAAiD;AACjD,eAAO,MAAM,QAAQ;IAEjB;;;;OAIG;;;;;IAYH;6EACyE;;;;;;;;;;;;;;;;;;;;EAKO,CAAC;AACrF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}