@coool/opencode-adaptive 0.0.0-stage → 1.0.1

package/dist/core/work-unit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/work-unit/types.ts"],"names":[],"mappings":"AAiBA,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,CAAW,EAAE,CAAW;IACnD,OAAO,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAA;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB;IACnB,mBAAmB;IACnB,SAAS;CAC2B,CAAA;AAmGtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,8BAA8B,CAAsC,CAAA","sourcesContent":["/**\n * Work-unit model (ADP-001): one unit is exactly one OpenCode execution\n * episode — `session.execution.started` → `succeeded`/`failed`/`interrupted`.\n * Tool/step/text continuations never open, close, or split a unit (only the\n * execution events do); a subagent runs in its own session and therefore gets\n * its own units; a later continuation on the same session (e.g. a new /goal\n * round) is a new episode of that session.\n */\nimport type { InterruptReason } from \"./interruption.js\"\n\n/** OpenCode model reference (`Model.Ref`): provider, model, optional variant. */\nexport interface ModelRef {\n  readonly providerID: string\n  readonly id: string\n  readonly variant?: string | undefined\n}\n\n/** Full-field equality; a variant change is a different reference. */\nexport function sameModelRef(a: ModelRef, b: ModelRef): boolean {\n  return a.providerID === b.providerID && a.id === b.id && a.variant === b.variant\n}\n\n/**\n * How the model in effect became known. `selected-*` comes from the\n * `session.model.selected` event (which fires for both manual and\n * plugin-made switches — the tracker resolves which via pending own-switch\n * notes, see `WorkUnitTracker.noteOwnSwitch`); `request` comes from the\n * `context` hook and reports the model actually executing.\n */\nexport const MODEL_SOURCES = [\n  \"selected-adaptive\",\n  \"selected-external\",\n  \"request\",\n] as const satisfies readonly string[]\n\nexport type ModelSource = (typeof MODEL_SOURCES)[number]\n\nexport interface ModelTransition {\n  readonly at: number\n  readonly model: ModelRef\n  readonly source: ModelSource\n}\n\n/**\n * Minimal shape of the wire `Session.StructuredError` carried by\n * `session.execution.failed` (`response.body` is deliberately dropped here —\n * the adapter folds it into bounded `ErrorEvidence` for the classifier).\n */\nexport interface ExecutionError {\n  readonly type: string\n  readonly message: string\n  readonly status?: number | undefined\n  readonly retryAfterMs?: number | undefined\n}\n\n/**\n * The episode lifecycle. `kind` doubles as status: `\"active\"` while the\n * execution runs, then the terminal kind it closed with.\n */\ninterface UnitBase {\n  /** Stable per-episode identifier: `${sessionID}#${episode}`. */\n  readonly id: string\n  readonly sessionID: string\n  /** 1-based count of episodes started for this session (tracker lifetime). */\n  readonly episode: number\n  readonly startedAt: number\n  /**\n   * Model in effect for the unit: seeded from the last known selection when\n   * the unit opens, then updated by transitions.\n   */\n  readonly model?: ModelRef | undefined\n  readonly transitions: readonly ModelTransition[]\n}\n\nexport interface ActiveUnit extends UnitBase {\n  readonly kind: \"active\"\n}\n\nexport interface SucceededUnit extends UnitBase {\n  readonly kind: \"succeeded\"\n  readonly closedAt: number\n}\n\nexport interface FailedUnit extends UnitBase {\n  readonly kind: \"failed\"\n  readonly closedAt: number\n  readonly error: ExecutionError\n}\n\nexport interface InterruptedUnit extends UnitBase {\n  readonly kind: \"interrupted\"\n  readonly closedAt: number\n  readonly reason: InterruptReason\n}\n\nexport type ClosedUnit = SucceededUnit | FailedUnit | InterruptedUnit\n\nexport type WorkUnit = ActiveUnit | ClosedUnit\n\n/**\n * Normalized episode events. The OpenCode adapter unwraps host event payloads\n * (`event.data.*`) and forwards them here; `model-request` is fed from the\n * `context` session hook.\n */\nexport type WorkUnitEvent =\n  | { readonly kind: \"execution-started\"; readonly sessionID: string; readonly at: number }\n  | { readonly kind: \"execution-succeeded\"; readonly sessionID: string; readonly at: number }\n  | {\n      readonly kind: \"execution-failed\"\n      readonly sessionID: string\n      readonly at: number\n      readonly error: ExecutionError\n    }\n  | {\n      readonly kind: \"execution-interrupted\"\n      readonly sessionID: string\n      readonly at: number\n      readonly reason: InterruptReason\n    }\n  | {\n      readonly kind: \"model-selected\"\n      readonly sessionID: string\n      readonly at: number\n      readonly model: ModelRef\n    }\n  | {\n      readonly kind: \"model-request\"\n      readonly sessionID: string\n      readonly at: number\n      readonly model: ModelRef\n    }\n\n/**\n * Why an event produced no state change. Only terminal events can be ignored\n * — they arrive without an active unit when the terminal was already handled\n * (duplicate delivery) or never preceded by `execution-started`.\n */\nexport const IGNORED_REASONS = [\"terminal-without-active-unit\"] as const satisfies readonly string[]\n\nexport type IgnoredReason = (typeof IGNORED_REASONS)[number]\n\n/** Result of an execution-started event: the tracker always opens (possibly superseding). */\nexport type OpenedResult = Extract<ApplyResult, { kind: \"opened\" }>\n\n/** Result of a selection event: the tracker always records model knowledge. */\nexport type SelectionResult = Extract<\n  ApplyResult,\n  { kind: \"model-noted\" } | { kind: \"model-tracked\" }\n>\n\nexport type ApplyResult =\n  | {\n      readonly kind: \"opened\"\n      readonly unit: ActiveUnit\n      readonly superseded?: ClosedUnit | undefined\n    }\n  | { readonly kind: \"closed\"; readonly unit: ClosedUnit }\n  | {\n      readonly kind: \"model-tracked\"\n      readonly unit: ActiveUnit\n      readonly transition: ModelTransition\n    }\n  /** Model knowledge recorded with no active unit; remembered for the next admission. */\n  | { readonly kind: \"model-noted\"; readonly transition: ModelTransition }\n  | { readonly kind: \"ignored\"; readonly reason: IgnoredReason }\n"]}

package/dist/execution/continuation/execute.d.ts

@@ -0,0 +1,18 @@
+import type { ContinuationOutcome } from "./types.js";
+import type { ContinuationExecuteInput } from "./types.js";
+/**
+ * Executes a planned continuation through the narrow ops seam, enforcing
+ * the partial-work invariants in one place (ADP-014/ADP-023):
+ *
+ * 1. Every owned path settles the session FIRST — Adaptive never switches
+ *    or prompts while a failed execution is still settling.
+ * 2. The delivered prompt is always the fixed continuation prompt over the
+ *    existing session/workspace state — the original instruction is never
+ *    re-sent, so the never-replay invariant holds by construction.
+ * 3. `allow-native` performs no host operations at all.
+ *
+ * Ops failures propagate to the caller (the wiring's fail-open wrapper
+ * decides degradation); the ordering guarantee holds up to the first
+ * failure because each step awaits the previous one.
+ */
+export declare function executeContinuation(input: ContinuationExecuteInput): Promise<ContinuationOutcome>;

package/dist/execution/continuation/execute.js

@@ -0,0 +1,31 @@
+import { CONTINUATION_PROMPT } from "./prompts.js";
+/**
+ * Executes a planned continuation through the narrow ops seam, enforcing
+ * the partial-work invariants in one place (ADP-014/ADP-023):
+ *
+ * 1. Every owned path settles the session FIRST — Adaptive never switches
+ *    or prompts while a failed execution is still settling.
+ * 2. The delivered prompt is always the fixed continuation prompt over the
+ *    existing session/workspace state — the original instruction is never
+ *    re-sent, so the never-replay invariant holds by construction.
+ * 3. `allow-native` performs no host operations at all.
+ *
+ * Ops failures propagate to the caller (the wiring's fail-open wrapper
+ * decides degradation); the ordering guarantee holds up to the first
+ * failure because each step awaits the previous one.
+ */
+export async function executeContinuation(input) {
+    const { action, ops, sessionID } = input;
+    if (action.kind === "allow-native")
+        return { kind: "left-native" };
+    if (action.kind === "in-session") {
+        await ops.settle(sessionID);
+        await ops.switchModel(sessionID, action.model);
+        await ops.prompt(sessionID, CONTINUATION_PROMPT);
+        return { kind: "resumed" };
+    }
+    await ops.settle(sessionID);
+    await ops.prompt(sessionID, CONTINUATION_PROMPT);
+    return { kind: "continuation-started" };
+}
+//# sourceMappingURL=execute.js.map

package/dist/execution/continuation/execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute.js","sourceRoot":"","sources":["../../../src/execution/continuation/execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAIlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3B,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;QAChD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAA;IAChD,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAA;AACzC,CAAC","sourcesContent":["import { CONTINUATION_PROMPT } from \"./prompts.js\"\nimport type { ContinuationOutcome } from \"./types.js\"\nimport type { ContinuationExecuteInput } from \"./types.js\"\n\n/**\n * Executes a planned continuation through the narrow ops seam, enforcing\n * the partial-work invariants in one place (ADP-014/ADP-023):\n *\n * 1. Every owned path settles the session FIRST — Adaptive never switches\n *    or prompts while a failed execution is still settling.\n * 2. The delivered prompt is always the fixed continuation prompt over the\n *    existing session/workspace state — the original instruction is never\n *    re-sent, so the never-replay invariant holds by construction.\n * 3. `allow-native` performs no host operations at all.\n *\n * Ops failures propagate to the caller (the wiring's fail-open wrapper\n * decides degradation); the ordering guarantee holds up to the first\n * failure because each step awaits the previous one.\n */\nexport async function executeContinuation(\n  input: ContinuationExecuteInput,\n): Promise<ContinuationOutcome> {\n  const { action, ops, sessionID } = input\n  if (action.kind === \"allow-native\") return { kind: \"left-native\" }\n  if (action.kind === \"in-session\") {\n    await ops.settle(sessionID)\n    await ops.switchModel(sessionID, action.model)\n    await ops.prompt(sessionID, CONTINUATION_PROMPT)\n    return { kind: \"resumed\" }\n  }\n  await ops.settle(sessionID)\n  await ops.prompt(sessionID, CONTINUATION_PROMPT)\n  return { kind: \"continuation-started\" }\n}\n"]}

package/dist/execution/continuation/index.d.ts

@@ -0,0 +1,4 @@
+export type { ContinuationAction, ContinuationActionKind, ContinuationExecuteInput, ContinuationOps, ContinuationOutcome, ContinuationPlanInput, } from "./types.js";
+export { CONTINUATION_PROMPT } from "./prompts.js";
+export { planContinuation } from "./plan.js";
+export { executeContinuation } from "./execute.js";

package/dist/execution/continuation/index.js

@@ -0,0 +1,4 @@
+export { CONTINUATION_PROMPT } from "./prompts.js";
+export { planContinuation } from "./plan.js";
+export { executeContinuation } from "./execute.js";
+//# sourceMappingURL=index.js.map

package/dist/execution/continuation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/continuation/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA","sourcesContent":["export type {\n  ContinuationAction,\n  ContinuationActionKind,\n  ContinuationExecuteInput,\n  ContinuationOps,\n  ContinuationOutcome,\n  ContinuationPlanInput,\n} from \"./types.js\"\nexport { CONTINUATION_PROMPT } from \"./prompts.js\"\nexport { planContinuation } from \"./plan.js\"\nexport { executeContinuation } from \"./execute.js\"\n"]}

package/dist/execution/continuation/plan.d.ts

@@ -0,0 +1,12 @@
+import type { ContinuationAction, ContinuationPlanInput } from "./types.js";
+/**
+ * Partial-work safety planner (ADP-023). Total, deterministic, pure.
+ *
+ * - No owned recovery: OpenCode's native retry is the preferred recovery;
+ *   Adaptive leaves it alone.
+ * - Owned recovery and the in-session path is possible: continue the same
+ *   session on the recovered candidate (settle → switch → resume).
+ * - Owned recovery and the in-session path is impossible: start a clean
+ *   continuation work unit from existing durable session state.
+ */
+export declare function planContinuation(input: ContinuationPlanInput): ContinuationAction;

package/dist/execution/continuation/plan.js

@@ -0,0 +1,18 @@
+/**
+ * Partial-work safety planner (ADP-023). Total, deterministic, pure.
+ *
+ * - No owned recovery: OpenCode's native retry is the preferred recovery;
+ *   Adaptive leaves it alone.
+ * - Owned recovery and the in-session path is possible: continue the same
+ *   session on the recovered candidate (settle → switch → resume).
+ * - Owned recovery and the in-session path is impossible: start a clean
+ *   continuation work unit from existing durable session state.
+ */
+export function planContinuation(input) {
+    if (input.recovery.kind === "none")
+        return { kind: "allow-native" };
+    if (input.continuationPossible)
+        return { kind: "in-session", model: input.recovery.model };
+    return { kind: "clean-continuation" };
+}
+//# sourceMappingURL=plan.js.map

package/dist/execution/continuation/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/execution/continuation/plan.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;IACnE,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;IAC1F,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;AACvC,CAAC","sourcesContent":["import type { ContinuationAction, ContinuationPlanInput } from \"./types.js\"\n\n/**\n * Partial-work safety planner (ADP-023). Total, deterministic, pure.\n *\n * - No owned recovery: OpenCode's native retry is the preferred recovery;\n *   Adaptive leaves it alone.\n * - Owned recovery and the in-session path is possible: continue the same\n *   session on the recovered candidate (settle → switch → resume).\n * - Owned recovery and the in-session path is impossible: start a clean\n *   continuation work unit from existing durable session state.\n */\nexport function planContinuation(input: ContinuationPlanInput): ContinuationAction {\n  if (input.recovery.kind === \"none\") return { kind: \"allow-native\" }\n  if (input.continuationPossible) return { kind: \"in-session\", model: input.recovery.model }\n  return { kind: \"clean-continuation\" }\n}\n"]}

package/dist/execution/continuation/prompts.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Continuation prompt for owned recovery and parked-work resume (ADP-023).
+ * Continues from session state; never replays the original instruction once
+ * tool side effects may exist. The executor sends exactly this prompt — the
+ * never-replay invariant is structural, not a caller responsibility.
+ */
+export declare const CONTINUATION_PROMPT = "Continue the interrupted work from the current session state. Do not repeat completed work; resume from what the session already produced.";

package/dist/execution/continuation/prompts.js

@@ -0,0 +1,8 @@
+/**
+ * Continuation prompt for owned recovery and parked-work resume (ADP-023).
+ * Continues from session state; never replays the original instruction once
+ * tool side effects may exist. The executor sends exactly this prompt — the
+ * never-replay invariant is structural, not a caller responsibility.
+ */
+export const CONTINUATION_PROMPT = "Continue the interrupted work from the current session state. Do not repeat completed work; resume from what the session already produced.";
+//# sourceMappingURL=prompts.js.map

package/dist/execution/continuation/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/execution/continuation/prompts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,4IAA4I,CAAA","sourcesContent":["/**\n * Continuation prompt for owned recovery and parked-work resume (ADP-023).\n * Continues from session state; never replays the original instruction once\n * tool side effects may exist. The executor sends exactly this prompt — the\n * never-replay invariant is structural, not a caller responsibility.\n */\nexport const CONTINUATION_PROMPT =\n  \"Continue the interrupted work from the current session state. Do not repeat completed work; resume from what the session already produced.\"\n"]}

package/dist/execution/continuation/types.d.ts

@@ -0,0 +1,68 @@
+import type { ModelRef } from "../../core/work-unit/types.js";
+import type { RecoveryOption } from "../retry/types.js";
+/**
+ * What Adaptive does for a failed work unit's recovery (ADP-013/ADP-014).
+ * - `allow-native`: Adaptive did not take ownership (no veto) — OpenCode's
+ *   native retry lifecycle is the preferred recovery and stays untouched.
+ * - `in-session`: Adaptive vetoed native retry and continues the same
+ *   session on a recovered candidate (settle → switch → resume).
+ * - `clean-continuation`: the in-session path is not possible; start a
+ *   clean continuation work unit from existing durable session state.
+ *
+ * The union has no "replay" variant by construction: every owned path
+ * continues from session state, so "Adaptive replays the original
+ * instruction after side effects" is unrepresentable, not merely avoided.
+ */
+export declare const CONTINUATION_ACTIONS: readonly ["allow-native", "in-session", "clean-continuation"];
+export type ContinuationActionKind = (typeof CONTINUATION_ACTIONS)[number];
+export type ContinuationAction = {
+    kind: "allow-native";
+} | {
+    kind: "in-session";
+    model: ModelRef;
+} | {
+    kind: "clean-continuation";
+};
+export interface ContinuationPlanInput {
+    /**
+     * Recovery option computed by the wiring for the failing unit: `none`
+     * means Adaptive did not veto (OpenCode's native retry is the preferred
+     * recovery); `switch` means Adaptive vetoed and owns the recovery.
+     */
+    readonly recovery: RecoveryOption;
+    /**
+     * True when the in-session owned path is possible (session alive, settle
+     * + switch + resume available). Only consulted for `switch` recovery.
+     */
+    readonly continuationPossible: boolean;
+}
+/**
+ * Narrow seam over the host session operations the owned continuation
+ * needs. Implemented by the OpenCode adapter (which tags its own model
+ * switches for attribution before calling the host); tests use fakes that
+ * record call order. Never imports `@opencode/plugin`.
+ */
+export interface ContinuationOps {
+    /**
+     * Wait until the session's failed execution has settled. Every owned
+     * path settles first — Adaptive never switches or prompts while a failed
+     * execution is still settling.
+     */
+    settle(sessionID: string): Promise<void>;
+    /** Switch the session's model (own-switch attribution handled by the adapter). */
+    switchModel(sessionID: string, model: ModelRef): Promise<void>;
+    /** Deliver a prompt to the session; starts/continues execution. */
+    prompt(sessionID: string, text: string): Promise<void>;
+}
+export interface ContinuationExecuteInput {
+    readonly sessionID: string;
+    readonly action: ContinuationAction;
+    readonly ops: ContinuationOps;
+}
+export type ContinuationOutcome = {
+    kind: "left-native";
+} | {
+    kind: "resumed";
+} | {
+    kind: "continuation-started";
+};

package/dist/execution/continuation/types.js

@@ -0,0 +1,15 @@
+/**
+ * What Adaptive does for a failed work unit's recovery (ADP-013/ADP-014).
+ * - `allow-native`: Adaptive did not take ownership (no veto) — OpenCode's
+ *   native retry lifecycle is the preferred recovery and stays untouched.
+ * - `in-session`: Adaptive vetoed native retry and continues the same
+ *   session on a recovered candidate (settle → switch → resume).
+ * - `clean-continuation`: the in-session path is not possible; start a
+ *   clean continuation work unit from existing durable session state.
+ *
+ * The union has no "replay" variant by construction: every owned path
+ * continues from session state, so "Adaptive replays the original
+ * instruction after side effects" is unrepresentable, not merely avoided.
+ */
+export const CONTINUATION_ACTIONS = ["allow-native", "in-session", "clean-continuation"];
+//# sourceMappingURL=types.js.map

package/dist/execution/continuation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/execution/continuation/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,oBAAoB,CAAU,CAAA","sourcesContent":["import type { ModelRef } from \"../../core/work-unit/types.js\"\nimport type { RecoveryOption } from \"../retry/types.js\"\n\n/**\n * What Adaptive does for a failed work unit's recovery (ADP-013/ADP-014).\n * - `allow-native`: Adaptive did not take ownership (no veto) — OpenCode's\n *   native retry lifecycle is the preferred recovery and stays untouched.\n * - `in-session`: Adaptive vetoed native retry and continues the same\n *   session on a recovered candidate (settle → switch → resume).\n * - `clean-continuation`: the in-session path is not possible; start a\n *   clean continuation work unit from existing durable session state.\n *\n * The union has no \"replay\" variant by construction: every owned path\n * continues from session state, so \"Adaptive replays the original\n * instruction after side effects\" is unrepresentable, not merely avoided.\n */\nexport const CONTINUATION_ACTIONS = [\"allow-native\", \"in-session\", \"clean-continuation\"] as const\nexport type ContinuationActionKind = (typeof CONTINUATION_ACTIONS)[number]\n\nexport type ContinuationAction =\n  | { kind: \"allow-native\" }\n  | { kind: \"in-session\"; model: ModelRef }\n  | { kind: \"clean-continuation\" }\n\nexport interface ContinuationPlanInput {\n  /**\n   * Recovery option computed by the wiring for the failing unit: `none`\n   * means Adaptive did not veto (OpenCode's native retry is the preferred\n   * recovery); `switch` means Adaptive vetoed and owns the recovery.\n   */\n  readonly recovery: RecoveryOption\n  /**\n   * True when the in-session owned path is possible (session alive, settle\n   * + switch + resume available). Only consulted for `switch` recovery.\n   */\n  readonly continuationPossible: boolean\n}\n\n/**\n * Narrow seam over the host session operations the owned continuation\n * needs. Implemented by the OpenCode adapter (which tags its own model\n * switches for attribution before calling the host); tests use fakes that\n * record call order. Never imports `@opencode/plugin`.\n */\nexport interface ContinuationOps {\n  /**\n   * Wait until the session's failed execution has settled. Every owned\n   * path settles first — Adaptive never switches or prompts while a failed\n   * execution is still settling.\n   */\n  settle(sessionID: string): Promise<void>\n  /** Switch the session's model (own-switch attribution handled by the adapter). */\n  switchModel(sessionID: string, model: ModelRef): Promise<void>\n  /** Deliver a prompt to the session; starts/continues execution. */\n  prompt(sessionID: string, text: string): Promise<void>\n}\n\nexport interface ContinuationExecuteInput {\n  readonly sessionID: string\n  readonly action: ContinuationAction\n  readonly ops: ContinuationOps\n}\n\nexport type ContinuationOutcome =\n  { kind: \"left-native\" } | { kind: \"resumed\" } | { kind: \"continuation-started\" }\n"]}

package/dist/execution/escalation/index.d.ts

@@ -0,0 +1 @@
+export * from "./types.js";

package/dist/execution/escalation/index.js

@@ -0,0 +1,2 @@
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/execution/escalation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/escalation/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA","sourcesContent":["export * from \"./types.js\"\n"]}

package/dist/execution/escalation/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The Adaptive-owned escalation request surface (T-18, ADP-015..017). The
+ * schema requires a reason and evidence — it is deliberately the smallest
+ * typed mechanism for an agent to request stronger capability, and it is not
+ * a planning or task-management API. The request is recorded against the
+ * current work unit and applies at the next safe boundary within the finite
+ * per-unit budget; a completing unit discards it (routing re-runs fresh).
+ */
+/** The tool name as registered with the host. */
+export declare const ESCALATION_TOOL_NAME = "adaptive_escalate";
+/** Each field is bounded — the request never carries unbounded prose. */
+export declare const MAX_ESCALATION_FIELD_LENGTH = 256;
+export interface EscalationRequest {
+    readonly reason: string;
+    readonly evidence: string;
+}
+/**
+ * Truncates to `max` UTF-16 code units without splitting a surrogate pair:
+ * a trailing high surrogate whose low half was cut is dropped, so the
+ * persisted evidence never carries a lone surrogate.
+ */
+export declare function truncateBounded(text: string, max: number): string;
+/**
+ * Total parser for the tool input (the host forwards model-produced JSON, so
+ * the runtime shape is untrusted even though the standard schema describes
+ * it). Both fields are required, non-empty, and bounded.
+ */
+export declare function parseEscalationRequest(input: unknown): EscalationRequest | undefined;
+/** One-line summary recorded as escalation evidence (bounded). */
+export declare function escalationDetail(request: EscalationRequest): string;

package/dist/execution/escalation/types.js

@@ -0,0 +1,49 @@
+/**
+ * The Adaptive-owned escalation request surface (T-18, ADP-015..017). The
+ * schema requires a reason and evidence — it is deliberately the smallest
+ * typed mechanism for an agent to request stronger capability, and it is not
+ * a planning or task-management API. The request is recorded against the
+ * current work unit and applies at the next safe boundary within the finite
+ * per-unit budget; a completing unit discards it (routing re-runs fresh).
+ */
+/** The tool name as registered with the host. */
+export const ESCALATION_TOOL_NAME = "adaptive_escalate";
+/** Each field is bounded — the request never carries unbounded prose. */
+export const MAX_ESCALATION_FIELD_LENGTH = 256;
+/**
+ * Truncates to `max` UTF-16 code units without splitting a surrogate pair:
+ * a trailing high surrogate whose low half was cut is dropped, so the
+ * persisted evidence never carries a lone surrogate.
+ */
+export function truncateBounded(text, max) {
+    if (text.length <= max)
+        return text;
+    const cut = text.slice(0, max);
+    const last = cut.charCodeAt(cut.length - 1);
+    return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut;
+}
+/**
+ * Total parser for the tool input (the host forwards model-produced JSON, so
+ * the runtime shape is untrusted even though the standard schema describes
+ * it). Both fields are required, non-empty, and bounded.
+ */
+export function parseEscalationRequest(input) {
+    if (typeof input !== "object" || input === null)
+        return undefined;
+    const record = input;
+    const reason = record["reason"];
+    const evidence = record["evidence"];
+    if (typeof reason !== "string" || reason.length === 0)
+        return undefined;
+    if (typeof evidence !== "string" || evidence.length === 0)
+        return undefined;
+    return {
+        reason: truncateBounded(reason, MAX_ESCALATION_FIELD_LENGTH),
+        evidence: truncateBounded(evidence, MAX_ESCALATION_FIELD_LENGTH),
+    };
+}
+/** One-line summary recorded as escalation evidence (bounded). */
+export function escalationDetail(request) {
+    return truncateBounded(`${request.reason}: ${request.evidence}`, MAX_ESCALATION_FIELD_LENGTH);
+}
+//# sourceMappingURL=types.js.map

package/dist/execution/escalation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/execution/escalation/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAA;AAEvD,yEAAyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAA;AAO9C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAW;IACvD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3C,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,2BAA2B,CAAC;QAC5D,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,2BAA2B,CAAC;KACjE,CAAA;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,OAAO,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,EAAE,2BAA2B,CAAC,CAAA;AAC/F,CAAC","sourcesContent":["/**\n * The Adaptive-owned escalation request surface (T-18, ADP-015..017). The\n * schema requires a reason and evidence — it is deliberately the smallest\n * typed mechanism for an agent to request stronger capability, and it is not\n * a planning or task-management API. The request is recorded against the\n * current work unit and applies at the next safe boundary within the finite\n * per-unit budget; a completing unit discards it (routing re-runs fresh).\n */\n\n/** The tool name as registered with the host. */\nexport const ESCALATION_TOOL_NAME = \"adaptive_escalate\"\n\n/** Each field is bounded — the request never carries unbounded prose. */\nexport const MAX_ESCALATION_FIELD_LENGTH = 256\n\nexport interface EscalationRequest {\n  readonly reason: string\n  readonly evidence: string\n}\n\n/**\n * Truncates to `max` UTF-16 code units without splitting a surrogate pair:\n * a trailing high surrogate whose low half was cut is dropped, so the\n * persisted evidence never carries a lone surrogate.\n */\nexport function truncateBounded(text: string, max: number): string {\n  if (text.length <= max) return text\n  const cut = text.slice(0, max)\n  const last = cut.charCodeAt(cut.length - 1)\n  return last >= 0xd800 && last <= 0xdbff ? cut.slice(0, -1) : cut\n}\n\n/**\n * Total parser for the tool input (the host forwards model-produced JSON, so\n * the runtime shape is untrusted even though the standard schema describes\n * it). Both fields are required, non-empty, and bounded.\n */\nexport function parseEscalationRequest(input: unknown): EscalationRequest | undefined {\n  if (typeof input !== \"object\" || input === null) return undefined\n  const record = input as Record<string, unknown>\n  const reason = record[\"reason\"]\n  const evidence = record[\"evidence\"]\n  if (typeof reason !== \"string\" || reason.length === 0) return undefined\n  if (typeof evidence !== \"string\" || evidence.length === 0) return undefined\n  return {\n    reason: truncateBounded(reason, MAX_ESCALATION_FIELD_LENGTH),\n    evidence: truncateBounded(evidence, MAX_ESCALATION_FIELD_LENGTH),\n  }\n}\n\n/** One-line summary recorded as escalation evidence (bounded). */\nexport function escalationDetail(request: EscalationRequest): string {\n  return truncateBounded(`${request.reason}: ${request.evidence}`, MAX_ESCALATION_FIELD_LENGTH)\n}\n"]}

package/dist/execution/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./retry/index.js";
+export * from "./continuation/index.js";
+export * from "./parking/index.js";
+export * from "./escalation/index.js";

package/dist/execution/index.js

@@ -0,0 +1,5 @@
+export * from "./retry/index.js";
+export * from "./continuation/index.js";
+export * from "./parking/index.js";
+export * from "./escalation/index.js";
+//# sourceMappingURL=index.js.map

package/dist/execution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/execution/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA","sourcesContent":["export * from \"./retry/index.js\"\nexport * from \"./continuation/index.js\"\nexport * from \"./parking/index.js\"\nexport * from \"./escalation/index.js\"\n"]}

package/dist/execution/parking/index.d.ts

@@ -0,0 +1,2 @@
+export { selectResumable } from "./plan.js";
+export type { ResumeContext, ResumePlan } from "./plan.js";

package/dist/execution/parking/index.js

@@ -0,0 +1,2 @@
+export { selectResumable } from "./plan.js";
+//# sourceMappingURL=index.js.map

package/dist/execution/parking/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/parking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA","sourcesContent":["export { selectResumable } from \"./plan.js\"\nexport type { ResumeContext, ResumePlan } from \"./plan.js\"\n"]}

package/dist/execution/parking/plan.d.ts

@@ -0,0 +1,39 @@
+import type { ParkedRecord } from "../../state/parked-work/types.js";
+/**
+ * Resume-attempt budget (ADP-011): a record whose continuation prompt kept
+ * failing is dropped once its attempts reach this count — the idle loop
+ * must be provably bounded, not "as long as idle events keep firing".
+ */
+export declare const MAX_PARKED_ATTEMPTS = 5;
+/**
+ * Predicates supplied by the wiring at each safe boundary. Kept as
+ * injected predicates so this module stays host-agnostic and fully
+ * unit-testable with fakes.
+ */
+export interface ResumeContext {
+    /** Whether the parked record's tier still has configured resources. */
+    tierConfigured(tier: ParkedRecord["tier"]): boolean;
+    /** Whether the session the record belongs to still exists. */
+    sessionAlive(sessionID: string): boolean;
+}
+export interface ResumePlan {
+    /**
+     * Records worth a fresh routing attempt now, oldest parked first (ties
+     * keep park order). The wiring re-runs routing for each; a successful
+     * route pops the record via the store and starts a clean continuation.
+     */
+    readonly attempt: readonly ParkedRecord[];
+    /** Tier no longer configured — keep parked until the user configures it. */
+    readonly hold: readonly ParkedRecord[];
+    /**
+     * Session gone, or the record exhausted its resume-attempt budget — the
+     * record can never (or may no longer) resume; the wiring drops it.
+     */
+    readonly drop: readonly ParkedRecord[];
+}
+/**
+ * Parked-work resume selection at a safe boundary (ADP-024). Total,
+ * deterministic, pure: partitions the parked list by resumability without
+ * consulting health (routing re-decides with fresh health per attempt).
+ */
+export declare function selectResumable(records: readonly ParkedRecord[], context: ResumeContext): ResumePlan;

package/dist/execution/parking/plan.js

@@ -0,0 +1,34 @@
+/**
+ * Resume-attempt budget (ADP-011): a record whose continuation prompt kept
+ * failing is dropped once its attempts reach this count — the idle loop
+ * must be provably bounded, not "as long as idle events keep firing".
+ */
+export const MAX_PARKED_ATTEMPTS = 5;
+/**
+ * Parked-work resume selection at a safe boundary (ADP-024). Total,
+ * deterministic, pure: partitions the parked list by resumability without
+ * consulting health (routing re-decides with fresh health per attempt).
+ */
+export function selectResumable(records, context) {
+    const attempt = [];
+    const hold = [];
+    const drop = [];
+    const byAge = [...records].sort((a, b) => a.parkedAt - b.parkedAt);
+    for (const record of byAge) {
+        if (!context.sessionAlive(record.sessionID)) {
+            drop.push(record);
+            continue;
+        }
+        if ((record.attempts ?? 0) >= MAX_PARKED_ATTEMPTS) {
+            drop.push(record);
+            continue;
+        }
+        if (!context.tierConfigured(record.tier)) {
+            hold.push(record);
+            continue;
+        }
+        attempt.push(record);
+    }
+    return { attempt, hold, drop };
+}
+//# sourceMappingURL=plan.js.map

package/dist/execution/parking/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/execution/parking/plan.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AA8BpC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgC,EAChC,OAAsB;IAEtB,MAAM,OAAO,GAAmB,EAAE,CAAA;IAClC,MAAM,IAAI,GAAmB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAmB,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,mBAAmB,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAChC,CAAC","sourcesContent":["import type { ParkedRecord } from \"../../state/parked-work/types.js\"\n\n/**\n * Resume-attempt budget (ADP-011): a record whose continuation prompt kept\n * failing is dropped once its attempts reach this count — the idle loop\n * must be provably bounded, not \"as long as idle events keep firing\".\n */\nexport const MAX_PARKED_ATTEMPTS = 5\n\n/**\n * Predicates supplied by the wiring at each safe boundary. Kept as\n * injected predicates so this module stays host-agnostic and fully\n * unit-testable with fakes.\n */\nexport interface ResumeContext {\n  /** Whether the parked record's tier still has configured resources. */\n  tierConfigured(tier: ParkedRecord[\"tier\"]): boolean\n  /** Whether the session the record belongs to still exists. */\n  sessionAlive(sessionID: string): boolean\n}\n\nexport interface ResumePlan {\n  /**\n   * Records worth a fresh routing attempt now, oldest parked first (ties\n   * keep park order). The wiring re-runs routing for each; a successful\n   * route pops the record via the store and starts a clean continuation.\n   */\n  readonly attempt: readonly ParkedRecord[]\n  /** Tier no longer configured — keep parked until the user configures it. */\n  readonly hold: readonly ParkedRecord[]\n  /**\n   * Session gone, or the record exhausted its resume-attempt budget — the\n   * record can never (or may no longer) resume; the wiring drops it.\n   */\n  readonly drop: readonly ParkedRecord[]\n}\n\n/**\n * Parked-work resume selection at a safe boundary (ADP-024). Total,\n * deterministic, pure: partitions the parked list by resumability without\n * consulting health (routing re-decides with fresh health per attempt).\n */\nexport function selectResumable(\n  records: readonly ParkedRecord[],\n  context: ResumeContext,\n): ResumePlan {\n  const attempt: ParkedRecord[] = []\n  const hold: ParkedRecord[] = []\n  const drop: ParkedRecord[] = []\n  const byAge = [...records].sort((a, b) => a.parkedAt - b.parkedAt)\n  for (const record of byAge) {\n    if (!context.sessionAlive(record.sessionID)) {\n      drop.push(record)\n      continue\n    }\n    if ((record.attempts ?? 0) >= MAX_PARKED_ATTEMPTS) {\n      drop.push(record)\n      continue\n    }\n    if (!context.tierConfigured(record.tier)) {\n      hold.push(record)\n      continue\n    }\n    attempt.push(record)\n  }\n  return { attempt, hold, drop }\n}\n"]}

package/dist/execution/retry/decide.d.ts

@@ -0,0 +1,29 @@
+import type { OperatingMode } from "../../core/scheduler/types.js";
+import type { RetryCoreDecision, RetryInput, RetryDecision } from "./types.js";
+/**
+ * Retry-hook policy (ADP-013/014). Total, deterministic, side-effect free.
+ *
+ * Veto (take ownership of horizontal recovery) only when ALL hold:
+ * - the classification is failover-eligible (infrastructure failure —
+ *   capability problems and host decisions never veto);
+ * - the evidence is definitive — ambiguous evidence (Retry-After headers
+ *   alone, bounded-textual matches) conservatively leaves OpenCode's native
+ *   retry, which the host schedules with its parsed `retryAfterMs` (ADP-012);
+ * - a same-tier recovery candidate exists AND differs from the resource that
+ *   just failed — without one, the native retry of the same resource IS the
+ *   preferred horizontal recovery (vetoing onto the failed resource would
+ *   discard the host's backoff and re-prompt it immediately). A breaker-probe
+ *   recovery is exempt: its target IS the failed resource by design, and the
+ *   veto is what starts the probe episode;
+ * - the host still wants to retry (`retry: true`) — an already-vetoed or
+ *   exhausted lifecycle is never resurrected; recovery defers to the next
+ *   safe boundary (ADP-014, ADP-023);
+ * - the per-unit veto budget has room left.
+ */
+export declare function decideRetry(input: RetryInput): RetryCoreDecision;
+/**
+ * Mode wrapper — the same core decision for Observe and Control; Observe
+ * wraps it for receipt recording without intervening; OFF never touches
+ * execution (the hook is not even registered, this keeps the union closed).
+ */
+export declare function forMode(decision: RetryCoreDecision, mode: OperatingMode): RetryDecision;

package/dist/execution/retry/decide.js

@@ -0,0 +1,75 @@
+import { MAX_VETOES_PER_UNIT } from "./types.js";
+import { sameModelRef } from "../../core/work-unit/types.js";
+/**
+ * Retry-hook policy (ADP-013/014). Total, deterministic, side-effect free.
+ *
+ * Veto (take ownership of horizontal recovery) only when ALL hold:
+ * - the classification is failover-eligible (infrastructure failure —
+ *   capability problems and host decisions never veto);
+ * - the evidence is definitive — ambiguous evidence (Retry-After headers
+ *   alone, bounded-textual matches) conservatively leaves OpenCode's native
+ *   retry, which the host schedules with its parsed `retryAfterMs` (ADP-012);
+ * - a same-tier recovery candidate exists AND differs from the resource that
+ *   just failed — without one, the native retry of the same resource IS the
+ *   preferred horizontal recovery (vetoing onto the failed resource would
+ *   discard the host's backoff and re-prompt it immediately). A breaker-probe
+ *   recovery is exempt: its target IS the failed resource by design, and the
+ *   veto is what starts the probe episode;
+ * - the host still wants to retry (`retry: true`) — an already-vetoed or
+ *   exhausted lifecycle is never resurrected; recovery defers to the next
+ *   safe boundary (ADP-014, ADP-023);
+ * - the per-unit veto budget has room left.
+ */
+export function decideRetry(input) {
+    if (!input.classification.failoverEligible) {
+        return { kind: "leave" };
+    }
+    if (!input.classification.definitive) {
+        return { kind: "leave" };
+    }
+    const recovery = input.recovery;
+    if (recovery.kind === "none") {
+        return { kind: "leave" };
+    }
+    // A probe recovery targets the very resource that just failed (the
+    // half-open probe re-admits it); the veto is what starts the probe episode,
+    // so the same-resource exemption below must not swallow it.
+    // The host reports base-model calls with variant "default" (verified on
+    // 2.2.5, same fact refKey normalizes in the supervisor), so the sameness
+    // check must not treat that spelling as a different resource.
+    const sameResource = recovery.probeId === undefined &&
+        sameModelRef({
+            ...recovery.model,
+            variant: recovery.model.variant === "default" ? undefined : recovery.model.variant,
+        }, {
+            ...input.failingModel,
+            variant: input.failingModel.variant === "default" ? undefined : input.failingModel.variant,
+        });
+    if (sameResource) {
+        return { kind: "leave" };
+    }
+    const native = input.native;
+    if (!native.retry) {
+        return { kind: "leave" };
+    }
+    if (input.vetoesUsed >= MAX_VETOES_PER_UNIT) {
+        return { kind: "leave" };
+    }
+    return { kind: "veto", model: recovery.model };
+}
+/**
+ * Mode wrapper — the same core decision for Observe and Control; Observe
+ * wraps it for receipt recording without intervening; OFF never touches
+ * execution (the hook is not even registered, this keeps the union closed).
+ */
+export function forMode(decision, mode) {
+    switch (mode) {
+        case "active":
+            return decision;
+        case "observe":
+            return { kind: "observe-only", would: decision };
+        case "off":
+            return { kind: "leave" };
+    }
+}
+//# sourceMappingURL=decide.js.map

package/dist/execution/retry/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../../src/execution/retry/decide.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAU5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAmB,KAAK,CAAC,QAAQ,CAAA;IAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,mEAAmE;IACnE,4EAA4E;IAC5E,4DAA4D;IAC5D,wEAAwE;IACxE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,YAAY,GAChB,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,YAAY,CACV;YACE,GAAG,QAAQ,CAAC,KAAK;YACjB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;SACnF,EACD;YACE,GAAG,KAAK,CAAC,YAAY;YACrB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO;SAC3F,CACF,CAAA;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,MAAM,MAAM,GAAwB,KAAK,CAAC,MAAM,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,QAA2B,EAAE,IAAmB;IACtE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAA;QACjB,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;QAClD,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;AACH,CAAC","sourcesContent":["import { MAX_VETOES_PER_UNIT } from \"./types.js\"\nimport { sameModelRef } from \"../../core/work-unit/types.js\"\nimport type { OperatingMode } from \"../../core/scheduler/types.js\"\nimport type {\n  NativeRetryDecision,\n  RecoveryOption,\n  RetryCoreDecision,\n  RetryInput,\n  RetryDecision,\n} from \"./types.js\"\n\n/**\n * Retry-hook policy (ADP-013/014). Total, deterministic, side-effect free.\n *\n * Veto (take ownership of horizontal recovery) only when ALL hold:\n * - the classification is failover-eligible (infrastructure failure —\n *   capability problems and host decisions never veto);\n * - the evidence is definitive — ambiguous evidence (Retry-After headers\n *   alone, bounded-textual matches) conservatively leaves OpenCode's native\n *   retry, which the host schedules with its parsed `retryAfterMs` (ADP-012);\n * - a same-tier recovery candidate exists AND differs from the resource that\n *   just failed — without one, the native retry of the same resource IS the\n *   preferred horizontal recovery (vetoing onto the failed resource would\n *   discard the host's backoff and re-prompt it immediately). A breaker-probe\n *   recovery is exempt: its target IS the failed resource by design, and the\n *   veto is what starts the probe episode;\n * - the host still wants to retry (`retry: true`) — an already-vetoed or\n *   exhausted lifecycle is never resurrected; recovery defers to the next\n *   safe boundary (ADP-014, ADP-023);\n * - the per-unit veto budget has room left.\n */\nexport function decideRetry(input: RetryInput): RetryCoreDecision {\n  if (!input.classification.failoverEligible) {\n    return { kind: \"leave\" }\n  }\n  if (!input.classification.definitive) {\n    return { kind: \"leave\" }\n  }\n  const recovery: RecoveryOption = input.recovery\n  if (recovery.kind === \"none\") {\n    return { kind: \"leave\" }\n  }\n  // A probe recovery targets the very resource that just failed (the\n  // half-open probe re-admits it); the veto is what starts the probe episode,\n  // so the same-resource exemption below must not swallow it.\n  // The host reports base-model calls with variant \"default\" (verified on\n  // 2.2.5, same fact refKey normalizes in the supervisor), so the sameness\n  // check must not treat that spelling as a different resource.\n  const sameResource =\n    recovery.probeId === undefined &&\n    sameModelRef(\n      {\n        ...recovery.model,\n        variant: recovery.model.variant === \"default\" ? undefined : recovery.model.variant,\n      },\n      {\n        ...input.failingModel,\n        variant: input.failingModel.variant === \"default\" ? undefined : input.failingModel.variant,\n      },\n    )\n  if (sameResource) {\n    return { kind: \"leave\" }\n  }\n  const native: NativeRetryDecision = input.native\n  if (!native.retry) {\n    return { kind: \"leave\" }\n  }\n  if (input.vetoesUsed >= MAX_VETOES_PER_UNIT) {\n    return { kind: \"leave\" }\n  }\n  return { kind: \"veto\", model: recovery.model }\n}\n\n/**\n * Mode wrapper — the same core decision for Observe and Control; Observe\n * wraps it for receipt recording without intervening; OFF never touches\n * execution (the hook is not even registered, this keeps the union closed).\n */\nexport function forMode(decision: RetryCoreDecision, mode: OperatingMode): RetryDecision {\n  switch (mode) {\n    case \"active\":\n      return decision\n    case \"observe\":\n      return { kind: \"observe-only\", would: decision }\n    case \"off\":\n      return { kind: \"leave\" }\n  }\n}\n"]}

package/dist/execution/retry/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./decide.js";

package/dist/execution/retry/index.js

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./decide.js";
+//# sourceMappingURL=index.js.map

package/dist/execution/retry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/retry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA","sourcesContent":["export * from \"./types.js\"\nexport * from \"./decide.js\"\n"]}