@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/egress/ledger-schema.js

@@ -0,0 +1,117 @@
+import { PROVIDER_CALL_ERROR_CODES } from "./wire.js";
+export const REQUEST_CHUNK_BYTES = 96 * 1024;
+const pad = (index) => String(index).padStart(6, "0");
+export const callKey = (callId) => `egress_call/${encodeURIComponent(callId)}`;
+export const requestPrefix = (callId) => `egress_call_request/${encodeURIComponent(callId)}/`;
+export const requestChunkKey = (callId, index) => `${requestPrefix(callId)}${pad(index)}`;
+export const resultPrefix = (callId) => `egress_call_result/${encodeURIComponent(callId)}/`;
+export const resultChunkKey = (callId, index) => `${resultPrefix(callId)}${pad(index)}`;
+export const stepIndexPrefix = (stepId) => `egress_step/${encodeURIComponent(stepId)}/`;
+export const stepIndexKey = (stepId, attempt) => `${stepIndexPrefix(stepId)}${pad(attempt)}`;
+export const cancelledKey = (stepId) => `session/step.cancelled/${encodeURIComponent(stepId)}`;
+export const variantPrefix = (providerId) => `session/variants/${encodeURIComponent(providerId)}/`;
+export const variantKey = (providerId, deviceId) => `${variantPrefix(providerId)}${encodeURIComponent(deviceId)}`;
+/** Splits UTF-8 text into chunks of at most `REQUEST_CHUNK_BYTES` bytes, never inside a code point. */
+export function splitUtf8(text) {
+    const bytes = new TextEncoder().encode(text);
+    const decoder = new TextDecoder();
+    const chunks = [];
+    for (let start = 0; start < bytes.length;) {
+        let end = Math.min(start + REQUEST_CHUNK_BYTES, bytes.length);
+        while (end < bytes.length && ((bytes[end] ?? 0) & 0xc0) === 0x80)
+            end--;
+        chunks.push(decoder.decode(bytes.subarray(start, end)));
+        start = end;
+    }
+    return chunks.length > 0 ? chunks : [""];
+}
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isErrorCode = (value) => PROVIDER_CALL_ERROR_CODES.some((code) => code === value);
+const isState = (value) => value === "dispatched" || value === "ended" || value === "superseded" || value === "cancelled" || value === "closed";
+function decodeCall(value) {
+    if (!isObject(value))
+        return undefined;
+    if (value.kind === "step" && typeof value.stepId === "string" && typeof value.attempt === "number")
+        return { kind: "step", stepId: value.stepId, attempt: value.attempt };
+    const { auxId, streamKind, auxKind } = value;
+    if (value.kind !== "aux" || typeof auxId !== "string" || typeof streamKind !== "string")
+        return undefined;
+    if (auxKind !== "stream" && auxKind !== "warm" && auxKind !== "compact-endpoint")
+        return undefined;
+    return { kind: "aux", auxId, streamKind, auxKind };
+}
+/** The ledger's own result JSON; the shape check guards against a truncated or foreign document. */
+function isCallResult(value) {
+    if (typeof value !== "object" || value === null || !("kind" in value))
+        return false;
+    if (value.kind === "message")
+        return "chunks" in value && typeof value.chunks === "number" && "stopReason" in value && "usage" in value;
+    return value.kind === "error" && "code" in value && isErrorCode(value.code) && "message" in value;
+}
+/** The stored message text is the ledger's own JSON; the shape check guards against a truncated or foreign chunk set. */
+export function isStoredMessage(value) {
+    if (typeof value !== "object" || value === null || !("role" in value) || value.role !== "assistant")
+        return false;
+    return "content" in value && Array.isArray(value.content) && "stopReason" in value && "usage" in value;
+}
+export function encodeCallRow(row) {
+    const { deviceId, result, ...fields } = row;
+    return {
+        ...fields,
+        ...(deviceId === undefined ? {} : { deviceId }),
+        ...(result === undefined ? {} : { result: JSON.stringify(result) }),
+    };
+}
+export function decodeCallRow(value) {
+    if (!isObject(value))
+        return undefined;
+    const { callId, sessionId, route, deviceId, providerId, modelId, epoch, capability, hooksApplied, state } = value;
+    const { requestChunks, result } = value;
+    const call = decodeCall(value.call);
+    if (typeof callId !== "string" || typeof sessionId !== "string" || !call)
+        return undefined;
+    if ((route !== "sealed" && route !== "device") || typeof providerId !== "string" || typeof modelId !== "string")
+        return undefined;
+    if (typeof epoch !== "number" || typeof hooksApplied !== "boolean" || typeof requestChunks !== "number")
+        return undefined;
+    if ((capability !== "callback-stream" && capability !== "stream") || !isState(state))
+        return undefined;
+    const parsed = typeof result === "string" ? JSON.parse(result) : undefined;
+    if (result !== undefined && !isCallResult(parsed))
+        return undefined;
+    return {
+        callId,
+        sessionId,
+        call,
+        route,
+        providerId,
+        modelId,
+        epoch,
+        capability,
+        hooksApplied,
+        state,
+        requestChunks,
+        ...(typeof deviceId === "string" ? { deviceId } : {}),
+        ...(isCallResult(parsed) ? { result: parsed } : {}),
+    };
+}
+export function decodeVariant(value) {
+    if (!isObject(value))
+        return undefined;
+    const { headDigest, liveAtMismatch, mismatches, stepId } = value;
+    if (typeof headDigest !== "string" || typeof mismatches !== "number" || typeof stepId !== "string")
+        return undefined;
+    return {
+        headDigest,
+        liveAtMismatch: typeof liveAtMismatch === "string" ? liveAtMismatch : undefined,
+        mismatches,
+        stepId,
+    };
+}
+export const encodeVariant = (variant) => ({
+    headDigest: variant.headDigest,
+    liveAtMismatch: variant.liveAtMismatch ?? null,
+    mismatches: variant.mismatches,
+    stepId: variant.stepId,
+});
+//# sourceMappingURL=ledger-schema.js.map

package/dist/core/egress/ledger.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The brain's `egress_call` ledger (row CK9; custody design 4.5). Every write is one admitted mutation supplied by the
+ * host wrapper, which fences it (epoch, admission seq, instance generation) and commits it atomically; the ledger only
+ * builds the writes. W4 (row + request chunks) precedes any dial, W4' (`hooked`) replaces the request and sets
+ * `hooksApplied` in one mutation, `ended` (row + the assembled message in result chunks) is durable before the terminal
+ * event, and the step commit (W9) closes the row and deletes its chunks with `closeCallWrites` inside its own mutation.
+ * A cancelled step (W14) is never dialed again, so W14 deletes the live row's chunks too: nothing else would.
+ */
+import type { DeviceId, ProviderId } from "@earendil-works/pi-agent-core";
+import type { DurableStore, StoreWrite } from "@earendil-works/pi-agent-core/conformance";
+import type { AssistantMessage } from "@earendil-works/pi-ai";
+import { type EgressCallEnd, type EgressCallRow, type VariantRecord } from "./ledger-schema.ts";
+/** Runs `build` inside the host's admission slot and commits the writes it returns as one fenced, atomic mutation. */
+export type AdmittedMutation = (build: () => Promise<readonly StoreWrite[]>) => Promise<void>;
+export type NewCallRow = Omit<EgressCallRow, "state" | "requestChunks" | "result">;
+export interface VariantMismatch {
+    readonly providerId: ProviderId;
+    readonly deviceId: DeviceId;
+    readonly stepId: string;
+    readonly headDigest: string;
+    readonly liveAtMismatch: string | undefined;
+}
+export interface EgressLedger {
+    /** Every row of the step, oldest attempt first. */
+    rowsForStep(stepId: string): Promise<EgressCallRow[]>;
+    /** The stored request text, byte-identical to what was admitted (or what `hooked` replaced it with). */
+    readRequest(row: EgressCallRow): Promise<string>;
+    /** The assembled message of an `ended` row whose result is a message. */
+    readMessage(row: EgressCallRow): Promise<AssistantMessage>;
+    /** W4. With `previous`, the previous row is retired (`ended` -> `closed`) and its request chunks deleted, atomically. */
+    dispatch(next: NewCallRow, requestJson: string, previous?: EgressCallRow): Promise<EgressCallRow>;
+    /** W4': the post-hook request replaces the stored one and `hooksApplied` becomes true, in one mutation. */
+    recordHooked(row: EgressCallRow, requestJson: string): Promise<EgressCallRow>;
+    end(row: EgressCallRow, result: EgressCallEnd): Promise<EgressCallRow>;
+    /**
+     * The hand refused `row`'s start, so nothing ran: the row and its chunks are replaced by the same call under a new
+     * `callId` (same attempt, same stored request) in one mutation. A duplicate `start{callId}` is a result query (4.3),
+     * so the refused callId can never be started again.
+     */
+    replaceRefused(row: EgressCallRow, callId: string): Promise<EgressCallRow>;
+    /** The row is superseded; a definition mismatch records the device variant in the same mutation. */
+    supersede(row: EgressCallRow, variant?: VariantMismatch): Promise<EgressCallRow>;
+    /** W14: the step is cancelled (and its live row with it); a cancelled step is never dialed again. */
+    cancelStep(stepId: string, row: EgressCallRow | undefined): Promise<void>;
+    isCancelled(stepId: string): Promise<boolean>;
+    recordVariant(variant: VariantMismatch): Promise<void>;
+    variants(providerId: ProviderId): Promise<ReadonlyMap<DeviceId, VariantRecord>>;
+}
+/** The W9 part the ledger owns: the step's row becomes `closed` and its request chunks are deleted (4.5 retention). */
+export declare function closeCallWrites(row: EgressCallRow): StoreWrite[];
+export declare function createEgressLedger(options: {
+    readonly store: Pick<DurableStore, "getDocument" | "scanDocuments">;
+    readonly mutate: AdmittedMutation;
+}): EgressLedger;
+//# sourceMappingURL=ledger.d.ts.map

package/dist/core/egress/ledger.js

@@ -0,0 +1,159 @@
+import { callKey, cancelledKey, decodeCallRow, decodeVariant, encodeCallRow, encodeVariant, isStoredMessage, requestChunkKey, resultChunkKey, splitUtf8, stepIndexKey, stepIndexPrefix, variantKey, variantPrefix, } from "./ledger-schema.js";
+const putRow = (row) => ({ op: "put", key: callKey(row.callId), data: encodeCallRow(row) });
+const deletes = (count, key) => Array.from({ length: count }, (_, index) => ({ op: "delete", key: key(index) }));
+/** Every stored chunk of `row`: its request and, once `ended` with a message, the assembled message. */
+const chunkDeletes = (row) => [
+    ...deletes(row.requestChunks, (index) => requestChunkKey(row.callId, index)),
+    ...deletes(row.result?.kind === "message" ? row.result.chunks : 0, (index) => resultChunkKey(row.callId, index)),
+];
+/** A cancelled row keeps its identity and an error result, never pointers to chunks W14 deleted. */
+function cancelledRow(row) {
+    const { result, ...fields } = row;
+    return { ...fields, state: "cancelled", requestChunks: 0, ...(result?.kind === "error" ? { result } : {}) };
+}
+/**
+ * W14 on the step's live row. A dispatched or ended row becomes `cancelled`; a superseded row (the abort came while its
+ * reissue waited: the pacer backoff or the user's choice) stays superseded. Either way its chunks are deleted, because a
+ * cancelled step is never dialed again, so no later W4 retires them.
+ */
+function cancelWrites(row) {
+    if (row.state === "closed" || row.state === "cancelled")
+        return [];
+    const kept = row.state === "superseded" ? { ...row, requestChunks: 0 } : cancelledRow(row);
+    return [putRow(kept), ...chunkDeletes(row)];
+}
+/** The W9 part the ledger owns: the step's row becomes `closed` and its request chunks are deleted (4.5 retention). */
+export function closeCallWrites(row) {
+    return [putRow({ ...row, state: "closed" }), ...chunkDeletes(row)];
+}
+export function createEgressLedger(options) {
+    const { store, mutate } = options;
+    const withRequest = (row, requestJson) => {
+        const chunks = splitUtf8(requestJson);
+        const next = { ...row, requestChunks: chunks.length };
+        const writes = chunks.map((data, index) => ({
+            op: "put",
+            key: requestChunkKey(row.callId, index),
+            data,
+        }));
+        return { row: next, writes: [...writes, putRow(next)] };
+    };
+    const variantWrite = async (variant) => {
+        const key = variantKey(variant.providerId, variant.deviceId);
+        const prior = decodeVariant(await store.getDocument(key));
+        const sameRun = prior !== undefined && prior.headDigest === variant.headDigest && prior.stepId === variant.stepId;
+        const mismatches = sameRun ? prior.mismatches + 1 : 1;
+        const { headDigest, liveAtMismatch, stepId } = variant;
+        return { op: "put", key, data: encodeVariant({ headDigest, liveAtMismatch, mismatches, stepId }) };
+    };
+    const stepOf = (row) => {
+        if (row.call.kind !== "step")
+            throw new Error("the device-route ledger indexes loop steps only");
+        return row.call;
+    };
+    const readRow = async (callId) => decodeCallRow(await store.getDocument(callKey(callId)));
+    const readChunks = async (row, what, count, key) => {
+        const chunks = await Promise.all(Array.from({ length: count }, (_, index) => store.getDocument(key(index))));
+        if (!chunks.every((chunk) => typeof chunk === "string"))
+            throw new Error(`egress_call ${row.callId}: stored ${what} is incomplete`);
+        return chunks.join("");
+    };
+    return {
+        async rowsForStep(stepId) {
+            const index = await store.scanDocuments(stepIndexPrefix(stepId));
+            const rows = await Promise.all(index.map((entry) => (typeof entry.data === "string" ? readRow(entry.data) : undefined)));
+            return rows.filter((row) => row !== undefined);
+        },
+        readRequest: (row) => readChunks(row, "request", row.requestChunks, (index) => requestChunkKey(row.callId, index)),
+        async readMessage(row) {
+            if (row.result?.kind !== "message")
+                throw new Error(`egress_call ${row.callId} has no stored message`);
+            const key = (index) => resultChunkKey(row.callId, index);
+            const parsed = JSON.parse(await readChunks(row, "message", row.result.chunks, key));
+            if (!isStoredMessage(parsed))
+                throw new Error(`egress_call ${row.callId}: stored message is malformed`);
+            return parsed;
+        },
+        async dispatch(next, requestJson, previous) {
+            const { stepId, attempt } = stepOf(next);
+            const created = withRequest({ ...next, state: "dispatched", requestChunks: 0 }, requestJson);
+            const retire = previous
+                ? [
+                    putRow({ ...previous, state: previous.state === "ended" ? "closed" : previous.state }),
+                    ...chunkDeletes(previous),
+                ]
+                : [];
+            const index = { op: "put", key: stepIndexKey(stepId, attempt), data: next.callId };
+            await mutate(async () => [...retire, ...created.writes, index]);
+            return created.row;
+        },
+        async recordHooked(row, requestJson) {
+            const updated = withRequest({ ...row, hooksApplied: true }, requestJson);
+            await mutate(async () => [...chunkDeletes(row), ...updated.writes]);
+            return updated.row;
+        },
+        async end(row, result) {
+            if (result.kind === "error") {
+                const failed = { ...row, state: "ended", result };
+                await mutate(async () => [putRow(failed)]);
+                return failed;
+            }
+            const chunks = splitUtf8(JSON.stringify(result.message));
+            const { stopReason, usage } = result.message;
+            const ended = {
+                ...row,
+                state: "ended",
+                result: { kind: "message", stopReason, usage, chunks: chunks.length },
+            };
+            const writes = chunks.map((data, index) => ({
+                op: "put",
+                key: resultChunkKey(row.callId, index),
+                data,
+            }));
+            await mutate(async () => [...writes, putRow(ended)]);
+            return ended;
+        },
+        async replaceRefused(row, callId) {
+            const { stepId, attempt } = stepOf(row);
+            const requestJson = await readChunks(row, "request", row.requestChunks, (i) => requestChunkKey(row.callId, i));
+            const created = withRequest({ ...row, callId, state: "dispatched", requestChunks: 0 }, requestJson);
+            const index = { op: "put", key: stepIndexKey(stepId, attempt), data: callId };
+            const dropped = { op: "delete", key: callKey(row.callId) };
+            await mutate(async () => [dropped, ...chunkDeletes(row), ...created.writes, index]);
+            return created.row;
+        },
+        async supersede(row, variant) {
+            const superseded = { ...row, state: "superseded" };
+            await mutate(async () => [putRow(superseded), ...(variant ? [await variantWrite(variant)] : [])]);
+            return superseded;
+        },
+        async cancelStep(stepId, row) {
+            const live = row ? cancelWrites(row) : [];
+            await mutate(async () => [{ op: "put", key: cancelledKey(stepId), data: stepId }, ...live]);
+        },
+        async isCancelled(stepId) {
+            return (await store.getDocument(cancelledKey(stepId))) !== undefined;
+        },
+        async recordVariant(variant) {
+            await mutate(async () => [await variantWrite(variant)]);
+        },
+        async variants(providerId) {
+            const prefix = variantPrefix(providerId);
+            const entries = await store.scanDocuments(prefix);
+            const variants = new Map();
+            for (const entry of entries) {
+                const stored = decodeVariant(entry.data);
+                if (!stored)
+                    continue;
+                const { headDigest, liveAtMismatch, mismatches } = stored;
+                variants.set(decodeURIComponent(entry.key.slice(prefix.length)), {
+                    headDigest,
+                    liveAtMismatch,
+                    mismatches,
+                });
+            }
+            return variants;
+        },
+    };
+}
+//# sourceMappingURL=ledger.js.map

package/dist/core/egress/pinned-infra.d.ts

@@ -1,5 +1,5 @@
 import { type KeyFactsAnswer } from "./key-facts-client.ts";
-import { type CustodyRoleArns, type KeyPolicyTemplate } from "./key-policy-template.ts";
+import { type CustodyRoleArns, type KeyPolicyKind, type KeyPolicyTemplate } from "./key-policy-template.ts";
 import type { ServiceKeyEntry } from "./roster-entries.ts";
 import type { VerifierKeyPin } from "./signed-statement.ts";
 export type CustodyRole = keyof CustodyRoleArns;
@@ -14,7 +14,28 @@ export interface PinnedCustodyInfra {
     /** The verifier signing keys this release trusts (three consecutive generations once minted, 15.15 M-2). */
     readonly keyFactsVerifierKeys: readonly VerifierKeyPin[];
 }
-export declare const PINNED_CUSTODY_INFRA: PinnedCustodyInfra;
+export declare const PINNED_CUSTODY_INFRA: {
+    readonly custodyAccountIds: readonly [];
+    readonly arnNamespace: "arn:aws:kms:us-east-1:";
+    readonly roleNames: {
+        readonly runtime: readonly ["custody-runtime"];
+        readonly registrySigner: readonly ["registry-signer"];
+        readonly provisioning: readonly ["custody-provisioning"];
+        readonly reader: readonly ["key-facts-reader"];
+        readonly breakglass: readonly ["custody-breakglass"];
+    };
+    readonly templates: {
+        readonly 1: {
+            readonly render: ({ keyKind, roles }: {
+                readonly accountId: string;
+                readonly keyKind: KeyPolicyKind;
+                readonly roles: CustodyRoleArns;
+            }) => string;
+        };
+    };
+    readonly keyFactsEndpoint: undefined;
+    readonly keyFactsVerifierKeys: readonly [];
+};
 export type ServiceKeyCheckReason = "ok" | "template-unknown" | "facts-unknown" | "facts-stale" | "shape" | "arn" | "arn-namespace" | "account-not-pinned" | "key-usage" | "key-property" | "spki" | "principal-id" | "role-outside-pins" | "policy";
 export interface ServiceKeyCheck {
     readonly result: "ok" | "mismatch" | "unknown";

package/dist/core/egress/pinned-infra.js

@@ -29,7 +29,13 @@ const SERVICE_KEY_NOTICES = {
     "principal-id": "the custody key's access policy no longer matches; cloud custody for this key is unavailable",
 };
 const KMS_KEY_ARN = /^(arn:[a-z0-9-]+:kms:[a-z0-9-]+:)(\d{12}):key\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-const ROLE_ORDER = ["runtime", "registrySigner", "provisioning", "reader", "breakglass"];
+const ROLE_ORDER = [
+    "runtime",
+    "registrySigner",
+    "provisioning",
+    "reader",
+    "breakglass",
+];
 export function roleArn(accountId, roleName) {
     return `arn:aws:iam::${accountId}:role/${roleName}`;
 }
@@ -117,7 +123,8 @@ function isFresh(facts, now) {
     return now - facts.readAt <= MAX_FACTS_AGE_MS && facts.readAt - now <= MAX_FACTS_FUTURE_SKEW_MS;
 }
 function outcome(result, reason) {
-    const notice = SERVICE_KEY_NOTICES[reason];
+    const notices = SERVICE_KEY_NOTICES;
+    const notice = notices[reason];
     return notice === undefined ? { result, reason } : { result, reason, notice };
 }
 /** `facts` maps each of `entry.kmsKeyArns` to the verifier's answer for exactly that ARN. */

package/dist/core/egress/placement-claim.d.ts

@@ -0,0 +1,69 @@
+import { type RosterView, type ServiceSig } from "./roster-entries.ts";
+import { type LocalKeyVerification } from "./verified-keys.ts";
+import type { VerifierRevocation } from "./verifier-revocations.ts";
+export interface PlacementClaim {
+    readonly accountId: string;
+    readonly placementId: string;
+    readonly epoch: number;
+    /** Generation of the placement-registry key that signed this claim (4.6). */
+    readonly registryGeneration: number;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+export interface SignedPlacementClaim {
+    readonly claim: PlacementClaim;
+    readonly sig: ServiceSig;
+}
+/** A claim may live at most 24 h; the brain renews it at half-life under the same epoch (4.6). */
+export declare const CLAIM_MAX_LIFETIME_MS = 86400000;
+/** Device-side tolerance for a claim's `issuedAt` in the hand's future (15.15 M-1); `MOVE_SKEW_MS` stays server-side. */
+export declare const CLAIM_ISSUE_SKEW_MS = 300000;
+export type ClaimVerdict = "valid" | "invalid" | "malformed" | "expired" | "superseded" | "unknown";
+/** The `provider.call.error` each refusal answers with (4.6, 15.14 M-3, C.P1). */
+export declare const CLAIM_VERDICT_ERRORS: {
+    readonly invalid: {
+        readonly code: "stale_epoch";
+        readonly retryable: false;
+    };
+    readonly malformed: {
+        readonly code: "claim_invalid";
+        readonly retryable: false;
+    };
+    readonly expired: {
+        readonly code: "claim_expired";
+        readonly retryable: true;
+    };
+    readonly superseded: {
+        readonly code: "registry_key_revoked";
+        readonly retryable: true;
+    };
+    readonly unknown: {
+        readonly code: "registry_key_unknown";
+        readonly retryable: true;
+    };
+};
+/** The highest epoch this hand accepted for one (account, registry generation), and the placement that held it. */
+export interface EpochFloor {
+    readonly epoch: number;
+    readonly placementId: string;
+}
+/** What this hand trusts when it checks a claim; supplied by the hand's executor (CK8), read fresh per check. */
+export interface ClaimTrust {
+    readonly accountId: string;
+    readonly records: readonly LocalKeyVerification[];
+    readonly roster: RosterView;
+    readonly revocations: readonly VerifierRevocation[];
+    epochFloor(accountId: string, registryGeneration: number): EpochFloor | undefined;
+}
+export interface ClaimClock {
+    readonly now: number;
+    readonly nowMono: number;
+}
+export interface ClaimVerifier {
+    verify(claim: unknown, clock: ClaimClock): Promise<ClaimVerdict>;
+}
+/** `ASCII(domain) || 0x00 || UTF8(canonicalJson(claim))`: the exact bytes the registry key signs (C.P1). */
+export declare function placementClaimSigningInput(claim: PlacementClaim): Uint8Array<ArrayBuffer>;
+/** The claim's verdict for this hand (custody design 4.6, 15.15, 15.16 and the total order of C.P1). */
+export declare function verifyPlacementClaim(value: unknown, trust: ClaimTrust, clock: ClaimClock): Promise<ClaimVerdict>;
+//# sourceMappingURL=placement-claim.d.ts.map

package/dist/core/egress/placement-claim.js

@@ -0,0 +1,115 @@
+/**
+ * Placement claims for hosted model-key custody (row CK7; custody design 2.2, 4.6, 15.15, 15.16, Appendix C.P1).
+ *
+ * The placement registry signs `{ claim, sig }` for the placement that currently owns a session. A hand executes a
+ * brain's request (provider.call.start/result, ToolHost dispatch, hook.model_request, custody.refresh.request) only
+ * when `verifyPlacementClaim` answers `valid`. The verdict is total and ordered (C.P1): closed envelope, roster
+ * freshness, key selection and local trust, signature/account/epoch/placement, lifetime bounds, expiry. Every input
+ * is untrusted; nothing here throws on bad input, and the hand records a new epoch floor only after `valid`.
+ *
+ * C.P1 checks local supersession before the signature, so a forged claim under a superseded generation also answers
+ * `superseded`. The hand executor (CK8) must audit-log every `superseded` verdict with `sig.keyId` and
+ * `claim.placementId`, as it does for `malformed`, so such a probe stays visible.
+ */
+import { canonicalJson } from "@earendil-works/pi-agent-core";
+import { verifyEcdsaP256Sha256 } from "./ecdsa-p256.js";
+import { rosterViewAt } from "./roster-entries.js";
+import { hasExactKeys, isRecord } from "./signed-statement.js";
+import { serviceEntryValidity } from "./verified-keys.js";
+/** A claim may live at most 24 h; the brain renews it at half-life under the same epoch (4.6). */
+export const CLAIM_MAX_LIFETIME_MS = 86_400_000;
+/** Device-side tolerance for a claim's `issuedAt` in the hand's future (15.15 M-1); `MOVE_SKEW_MS` stays server-side. */
+export const CLAIM_ISSUE_SKEW_MS = 300_000;
+const PLACEMENT_CLAIM_DOMAIN = "omo-custody/placement-claim/v1";
+/** The `provider.call.error` each refusal answers with (4.6, 15.14 M-3, C.P1). */
+export const CLAIM_VERDICT_ERRORS = {
+    invalid: { code: "stale_epoch", retryable: false },
+    malformed: { code: "claim_invalid", retryable: false },
+    expired: { code: "claim_expired", retryable: true },
+    superseded: { code: "registry_key_revoked", retryable: true },
+    unknown: { code: "registry_key_unknown", retryable: true },
+};
+/** `ASCII(domain) || 0x00 || UTF8(canonicalJson(claim))`: the exact bytes the registry key signs (C.P1). */
+export function placementClaimSigningInput(claim) {
+    const { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt } = claim;
+    const payload = canonicalJson({ accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt });
+    const encoder = new TextEncoder();
+    return new Uint8Array([...encoder.encode(PLACEMENT_CLAIM_DOMAIN), 0, ...encoder.encode(payload)]);
+}
+const CLAIM_KEYS = ["accountId", "placementId", "epoch", "registryGeneration", "issuedAt", "expiresAt"];
+function closedRecord(value, keys) {
+    return isRecord(value) && hasExactKeys(value, keys) ? value : undefined;
+}
+const isText = (value) => typeof value === "string" && value.length > 0;
+/** A nonnegative safe integer, never -0 (C.P1 boundary rules: no fractions, non-finite values or -0 enter `C`). */
+const isCount = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+/** The closed `{ claim, sig }` envelope, or `undefined` for any other shape (C.P1 canonical input). */
+function parseSignedPlacementClaim(value) {
+    const envelope = closedRecord(value, ["claim", "sig"]);
+    const claim = closedRecord(envelope?.claim, CLAIM_KEYS);
+    const sig = closedRecord(envelope?.sig, ["alg", "keyId", "sig"]);
+    if (!claim || !sig || sig.alg !== "ECDSA-P256-SHA256" || !isText(sig.keyId) || !isText(sig.sig))
+        return undefined;
+    const { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt } = claim;
+    if (!isText(accountId) || !isText(placementId))
+        return undefined;
+    if (!isCount(epoch) || !isCount(registryGeneration) || !isCount(issuedAt) || !isCount(expiresAt))
+        return undefined;
+    return {
+        claim: { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt },
+        sig: { alg: "ECDSA-P256-SHA256", keyId: sig.keyId, sig: sig.sig },
+    };
+}
+/**
+ * The one registry entry of the claim's generation this hand may verify under. A roster entry of that generation that
+ * this device's records supersede is `superseded`; a missing, unchecked or ambiguous key is `unknown` (also when a
+ * superseded generation's entry has left the roster); only bad entries left is `invalid`.
+ */
+async function selectRegistryKey(claim, trust, view, clock) {
+    const candidates = view.serviceEntries.filter((entry) => entry.kind === "placement-registry" &&
+        entry.accountId === trust.accountId &&
+        entry.generation === claim.registryGeneration);
+    const context = { revocations: trust.revocations, now: clock.now, nowMono: clock.nowMono };
+    const validities = await Promise.all(candidates.map((entry) => serviceEntryValidity(entry, trust.accountId, trust.records, view, context)));
+    if (validities.includes("superseded"))
+        return { verdict: "superseded" };
+    const valid = candidates.filter((_, index) => validities[index] === "valid");
+    const [first] = valid;
+    if (first && valid.every((entry) => entry.sigKeyId === first.sigKeyId && entry.sigPk === first.sigPk))
+        return { entry: first };
+    const onlyBad = candidates.length > 0 && validities.every((validity) => validity === "invalid");
+    return { verdict: onlyBad ? "invalid" : "unknown" };
+}
+function belowFloor(claim, floor) {
+    if (!floor)
+        return false;
+    return claim.epoch < floor.epoch || (claim.epoch === floor.epoch && claim.placementId !== floor.placementId);
+}
+/** The claim's verdict for this hand (custody design 4.6, 15.15, 15.16 and the total order of C.P1). */
+export async function verifyPlacementClaim(value, trust, clock) {
+    const signed = parseSignedPlacementClaim(value);
+    if (!signed)
+        return "malformed";
+    const view = rosterViewAt(trust.roster, clock.now, clock.nowMono);
+    if (view.state === "unknown")
+        return "unknown";
+    const { claim, sig } = signed;
+    if (claim.accountId !== trust.accountId)
+        return "invalid";
+    const selection = await selectRegistryKey(claim, trust, view, clock);
+    if ("verdict" in selection)
+        return selection.verdict;
+    if (sig.keyId !== selection.entry.sigKeyId)
+        return "invalid";
+    if (!(await verifyEcdsaP256Sha256(selection.entry.sigPk, placementClaimSigningInput(claim), sig.sig)))
+        return "invalid";
+    if (belowFloor(claim, trust.epochFloor(claim.accountId, claim.registryGeneration)))
+        return "invalid";
+    const effectiveNow = Math.max(clock.now, view.rosterIssuedAt);
+    if (claim.expiresAt - claim.issuedAt > CLAIM_MAX_LIFETIME_MS ||
+        claim.issuedAt > effectiveNow + CLAIM_ISSUE_SKEW_MS ||
+        claim.issuedAt > view.rosterIssuedAt + CLAIM_MAX_LIFETIME_MS)
+        return "malformed";
+    return claim.expiresAt > effectiveNow ? "valid" : "expired";
+}
+//# sourceMappingURL=placement-claim.js.map

package/dist/core/egress/pool-state.d.ts

@@ -0,0 +1,18 @@
+import type { CredentialSlotState, StoredSlotRevisions } from "../credential-pool/state-store.ts";
+/**
+ * The credential-pool health that rotation reads and writes (senpi#5835): cooldowns, half-open probe leases and
+ * the revisions they are keyed by. On one machine it is the file-backed `CredentialSlotRepository`; a hosted brain
+ * supplies its own durable state behind the same calls.
+ */
+export interface PoolState {
+    listSlots(providerId: string, laneId: string): Promise<Record<string, CredentialSlotState>>;
+    /** Atomic read-modify-write of one slot; `stateVersion` increments on every write, undefined removes the slot. */
+    mutateSlotState(providerId: string, laneId: string, slotId: string, fn: (current: CredentialSlotState | undefined) => Omit<CredentialSlotState, "stateVersion"> | undefined): Promise<CredentialSlotState | undefined>;
+    storedSlotRevisions(providerId: string, slotName: string, material: {
+        key?: string;
+        access?: string;
+        refresh?: string;
+    }): Promise<StoredSlotRevisions>;
+    envCredentialRevision(envVarName: string, envValue: string): Promise<string>;
+}
+//# sourceMappingURL=pool-state.d.ts.map

package/dist/core/egress/pool-state.js

@@ -0,0 +1,5 @@
+// Compile-time proof that the fused implementation is today's repository, used as is.
+const fusedPoolState = (repository) => repository;
+void fusedPoolState;
+export {};
+//# sourceMappingURL=pool-state.js.map

package/dist/core/egress/redact.d.ts

@@ -0,0 +1,10 @@
+export declare const REDACTED = "<redacted>";
+export interface RedactorOptions {
+    readonly secrets: readonly string[];
+    readonly publicPrefixes: readonly string[];
+}
+export interface Redactor {
+    redact(text: string): string;
+}
+export declare function createRedactor(options: RedactorOptions): Redactor;
+//# sourceMappingURL=redact.d.ts.map