@corca-org/ceal-host-linux-arm64 1.0.15 → 1.0.17

package/libexec/ceal-host/control.mjs

@@ -2251,7 +2251,7 @@ var client_wire_contract_default = {
       "prompt"
     ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v2",
+    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
@@ -2325,10 +2325,11 @@ var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
 var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
 var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
 var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
 var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
 var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
 var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
 var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
 var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
 var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
@@ -2338,6 +2339,17 @@ var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verifie
 var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
 var CEAL_PROTOCOL_VERSION = "1.4.0";
 var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
+  "audited_call_pending",
+  "continuation_read_pending",
+  "continuation_write_pending",
+  "provider_pacing_pending",
+  "corpus_replay_pending",
+  "corpus_append_pending",
+  "corpus_fence_pending",
+  "corpus_content_pending",
+  "corpus_transaction_pending"
+]);
 var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
 var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
 var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
@@ -2347,10 +2359,130 @@ var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
   "policy_decision_revision"
 ]);
 
+// packages/ceal-client-protocol/src/operation-next-actions.ts
+var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
+var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
+var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
+  "select_did_you_mean",
+  "choose_new_output_path",
+  "choose_new_idempotency_key",
+  "restart_search",
+  "repeat_original_arguments",
+  // The occurrence this call addressed is settled and cannot move again -- a
+  // denied effect approval, an expired continuation -- so the caller runs the
+  // same call again as a new request. The refusal names the re-request; this
+  // word is the re-request.
+  CEAL_REPEAT_REQUEST_NEXT_ACTION,
+  "choose_new_request_identity",
+  // A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
+  "correct_argument",
+  // A resolver-owned input must move from caller operands into the declared
+  // resolver selection field.
+  "supply_resolver_selections",
+  // The graph names an upstream node whose Operation produces the resolver's
+  // occurrence, and it has not produced one yet. The caller runs that node
+  // first; the refusal used to share a code with a malformed resolver result,
+  // which is not fixable, so neither could carry a remedy.
+  "run_resolver_dependency",
+  // A replay carries the input the occurrence durably admitted, and this one
+  // carries a different one. The caller fixes it by presenting the original
+  // invocation, so it is a remedy; the coordinator minted the word at the
+  // replay guard and never declared it, which read as unguided to the scorer.
+  "use_original_input",
+  // The same mismatch on the Request binding rather than the input: the
+  // occurrence was admitted under one binding and the replay presents another.
+  "use_original_request_binding",
+  // The client's own filesystem write was refused -- EACCES, EPERM, or a
+  // read-only mount -- which is how an agent sandbox fences writes outside its
+  // workspace. The caller reruns the same command with unsandboxed or escalated
+  // execution; re-adopting the session cannot help, because the sandbox refuses
+  // that write too.
+  "rerun_outside_agent_sandbox",
+  // The refusal names the one Operation to read next in `describe_command`:
+  // an absent Operation id with a sole catalog-ranked candidate, or a known
+  // Operation invoked without its input. Describing only reads the verified
+  // contract and dispatches nothing, and the caller then retries with the
+  // named Operation or input, so it is guidance the scorer counts.
+  "describe_operation",
+  // The refusal names the caller's own personal connect Operation in
+  // `required_action_sequence`: the Operation asked for, or the credential
+  // the call ran on, needs a personal connection the caller does not hold
+  // (never connected, revoked, or expired). The caller runs that exact
+  // Operation, completes the consent it hands back, and retries the same call.
+  "connect_personal_account",
+  // The provider or Gateway named a bounded wait; the caller waits that long
+  // and submits the same read again.
+  "retry_after",
+  // The ref names a container of rows (a Notion database or data source), which
+  // has no body of its own; the caller searches its rows instead of reading it.
+  "search_container_rows"
+];
+var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
+var NON_REMEDY_NEXT_ACTION_VALUES = [
+  // Only an administrator can take the named step -- approving a place for an
+  // Operation, granting a withheld capability -- so a non-administrator asks
+  // one. The refusal names the administrator step; this word is the ask.
+  "ask_admin",
+  "await_pending_approval",
+  "check_gateway",
+  "inspect_context_store",
+  "inspect_gateway",
+  "inspect_local_cache",
+  // The thin client prints these on its own behalf, before or after the wire.
+  // They were declared only as `CealClientLocalRemedy` keys and, for two of
+  // them, only as Go string literals -- a second and third vocabulary for one
+  // thing. `CealClientLocalRemedy` derives from this list now, so the client's
+  // remedies cannot drift from the words the protocol knows.
+  "inspect_local_client",
+  "inspect_local_command",
+  "inspect_local_output",
+  "inspect_local_route",
+  CEAL_INSPECT_RECEIPT_NEXT_ACTION,
+  "inspect_request",
+  "none",
+  // The provider refused because of its own configuration -- an API not
+  // enabled, an app scope missing -- which an operator changes in that
+  // provider's console. No caller edit and no retry fixes it.
+  "operator_action",
+  "recover",
+  "reconcile",
+  // Reconciliation of one named occurrence, not of the deployment: an
+  // occurrence with no admitted input commitment cannot be replayed safely and
+  // no edit to the call changes that. `reconcile` is the deployment-wide word.
+  "reconcile_occurrence",
+  "reduce_request_size",
+  // The Host's invocation context for this turn is stale or expired at the
+  // Gateway. The Host's next turn rebinds it and the same call then succeeds;
+  // nothing in the call changes, so it is not a remedy the scorer may count.
+  "refresh_host_invocation_context",
+  "repair_or_adopt_session",
+  "retry",
+  // The owner -- a correlation hook, an approval hook -- is not serving right
+  // now. The caller changes nothing and the same call succeeds once the owner
+  // is back, so this is not a remedy the scorer may count as guidance.
+  "retry_after_owner_recovery",
+  "retry_same_receipt_read",
+  "run_file_search_again",
+  "select_exact_approval"
+];
+var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
+var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
+var RETRY_PROMISE_NEXT_ACTIONS = ["retry", "retry_after"];
+var RETRY_PROMISE = new Set(RETRY_PROMISE_NEXT_ACTIONS);
+var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
+var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
+  provider_permission: "ask_admin",
+  access_level: "ask_admin",
+  personal_authorization_required: "connect_personal_account"
+});
+
+// packages/ceal-client-protocol/src/operation-withheld-cause.ts
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+
 // packages/ceal-client-protocol/src/operation-contract-types.ts
 var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
-var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
 var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
 var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
@@ -2614,6 +2746,8 @@ var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
 var CEAL_PROVIDER_BOUNDARY_EVIDENCE = vocabulary(["provider_readback", "operator_stated"]);
 var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
 var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
+var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
 var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
 var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
 var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
@@ -2722,8 +2856,6 @@ var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "insta
 var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
 var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
 var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
-var CEAL_OPERATION_RESULT_KEYS = vocabulary(["ok", "operation_id", "operation_receipt", "schema_version", "value"]);
-var CEAL_OPERATION_COMPACT_RESULT_KEYS = vocabulary(["ok", "operation_evidence", "operation_id", "schema_version", "value"]);
 
 // packages/ceal-client-protocol/src/operation-catalog.ts
 var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
@@ -2735,8 +2867,8 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.activation_transport.v1",
   CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
   CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
-  "ceal.client_refresh_request.v2",
-  "ceal.client_refresh_result.v2",
+  "ceal.client_refresh_request.v1",
+  "ceal.client_refresh_result.v1",
   "ceal.client_revoke_request.v1",
   "ceal.client_revoke_result.v1",
   CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
@@ -2765,7 +2897,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.gateway_call_result.v1",
   CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
-  "ceal.gateway_discovery.v3",
+  "ceal.gateway_discovery.v1",
   "ceal.gateway_handshake.v1",
   "ceal.gateway_installation_activation_code_issue_request.v1",
   "ceal.gateway_installation_activation_code_issue_result.v1",
@@ -2787,10 +2919,6 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.host_observation.v1",
   "ceal.host_registration_request.v1",
   "ceal.host_registration_result.v1",
-  "ceal.leased-resource-stream.v2",
-  "ceal.leased_consumer_attachment_stream_frame.v2",
-  "ceal.leased_consumer_attachment_stream_request.v2",
-  "ceal.leased_consumer_attachment_stream_transport.v2",
   "ceal.operation_descriptor.v1",
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
@@ -2798,7 +2926,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.operation_receipt.v1",
   "ceal.operation_result.v1",
   "ceal.operation_result.compact.v1",
-  "ceal.local_result_materialization.v2",
+  "ceal.local_result_materialization.v1",
   "ceal.local_result_root.v1",
   "ceal.owner_bootstrap_exchange_request.v1",
   "ceal.owner_bootstrap_exchange_result.v1",
@@ -2816,12 +2944,6 @@ var CEAL_SCHEMA_LITERAL_SET = new Set(CEAL_SCHEMA_LITERALS);
 // packages/ceal-client-protocol/src/bounded-series.ts
 import { join } from "node:path";
 var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
-  usage_record: (root) => join(root, "run-usage.jsonl"),
-  control_commit: (root) => join(root, "control-auto-commit.jsonl"),
-  engagement_signal: (root) => join(root, "runtime-state", "slack-feedback.jsonl"),
-  runtime_error: (root) => join(root, "runtime-state", "runtime-errors.jsonl"),
-  turn_bridge_request: (root) => join(root, ".ceal", "turn-bridge", "requests.jsonl"),
-  thread_run_events: (root) => join(root, "run-events.jsonl"),
   bounded_store_sidecar: (root) => `${root}.jsonl`,
   gateway_audit_archive: (root) => `${root}.jsonl`,
   gateway_access_group_connector_control_audit: (root) => `${root}.audit.jsonl`,
@@ -2855,146 +2977,8 @@ var CEAL_HOST_INSTALLATION_REF_PATTERN = new RegExp(`^host-installation:${CEAL_L
 var CEAL_HOST_SOURCE_REF_PATTERN = new RegExp(`^host-source:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
 var CEAL_HOST_ACCESS_TOKEN_PATTERN = /^ceal_host_[A-Za-z0-9_-]{43}$/u;
 
-// packages/ceal-client-protocol/src/agent-session-handoff.ts
-var CEAL_AGENT_ADMISSION_PHASES = vocabulary([
-  "incumbent_admitted",
-  "incumbent_draining",
-  "drained",
-  "candidate_admitted",
-  "candidate_draining",
-  "rollback_admitted"
-]);
-var CEAL_AGENT_SERVICE_SESSION_RECORD_KEYS = vocabulary([
-  "admission_fence",
-  "admission_state",
-  "admission_state_generation",
-  "bearer",
-  "consumer_ref",
-  "credential_generation",
-  "expires_at",
-  "gateway_instance",
-  "gateway_origin",
-  "gateway_serving_generation",
-  "issued_at",
-  "record_sha256",
-  "renew_after",
-  "renew_by",
-  "schema_version",
-  "session_revision"
-]);
-var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_session_revision", "session_revision"]);
-
-// packages/ceal-client-protocol/src/operation-next-actions.ts
-var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
-var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
-var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
-  "select_did_you_mean",
-  "choose_new_output_path",
-  "choose_new_idempotency_key",
-  "restart_search",
-  "repeat_original_arguments",
-  // The occurrence this call addressed is settled and cannot move again -- a
-  // denied effect approval, an expired continuation -- so the caller runs the
-  // same call again as a new request. The refusal names the re-request; this
-  // word is the re-request.
-  CEAL_REPEAT_REQUEST_NEXT_ACTION,
-  "choose_new_request_identity",
-  // A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
-  "correct_argument",
-  // A resolver-owned input must move from caller operands into the declared
-  // resolver selection field.
-  "supply_resolver_selections",
-  // The graph names an upstream node whose Operation produces the resolver's
-  // occurrence, and it has not produced one yet. The caller runs that node
-  // first; the refusal used to share a code with a malformed resolver result,
-  // which is not fixable, so neither could carry a remedy.
-  "run_resolver_dependency",
-  // A replay carries the input the occurrence durably admitted, and this one
-  // carries a different one. The caller fixes it by presenting the original
-  // invocation, so it is a remedy; the coordinator minted the word at the
-  // replay guard and never declared it, which read as unguided to the scorer.
-  "use_original_input",
-  // The same mismatch on the Request binding rather than the input: the
-  // occurrence was admitted under one binding and the replay presents another.
-  "use_original_request_binding",
-  // The client's own filesystem write was refused -- EACCES, EPERM, or a
-  // read-only mount -- which is how an agent sandbox fences writes outside its
-  // workspace. The caller reruns the same command with unsandboxed or escalated
-  // execution; re-adopting the session cannot help, because the sandbox refuses
-  // that write too.
-  "rerun_outside_agent_sandbox",
-  // The refusal names the one Operation to read next in `describe_command`:
-  // an absent Operation id with a sole catalog-ranked candidate, or a known
-  // Operation invoked without its input. Describing only reads the verified
-  // contract and dispatches nothing, and the caller then retries with the
-  // named Operation or input, so it is guidance the scorer counts.
-  "describe_operation",
-  // The refusal names the caller's own personal connect Operation in
-  // `required_action_sequence`: the Operation asked for, or the credential
-  // the call ran on, needs a personal connection the caller does not hold
-  // (never connected, revoked, or expired). The caller runs that exact
-  // Operation, completes the consent it hands back, and retries the same call.
-  "connect_personal_account",
-  // The provider or Gateway named a bounded wait; the caller waits that long
-  // and submits the same read again.
-  "retry_after"
-];
-var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
-var NON_REMEDY_NEXT_ACTION_VALUES = [
-  // Only an administrator can take the named step -- approving a place for an
-  // Operation, granting a withheld capability -- so a non-administrator asks
-  // one. The refusal names the administrator step; this word is the ask.
-  "ask_admin",
-  "await_pending_approval",
-  "check_gateway",
-  "inspect_context_store",
-  "inspect_gateway",
-  "inspect_local_cache",
-  // The thin client prints these on its own behalf, before or after the wire.
-  // They were declared only as `CealClientLocalRemedy` keys and, for two of
-  // them, only as Go string literals -- a second and third vocabulary for one
-  // thing. `CealClientLocalRemedy` derives from this list now, so the client's
-  // remedies cannot drift from the words the protocol knows.
-  "inspect_local_client",
-  "inspect_local_command",
-  "inspect_local_output",
-  "inspect_local_route",
-  CEAL_INSPECT_RECEIPT_NEXT_ACTION,
-  "inspect_request",
-  "none",
-  // The provider refused because of its own configuration -- an API not
-  // enabled, an app scope missing -- which an operator changes in that
-  // provider's console. No caller edit and no retry fixes it.
-  "operator_action",
-  "recover",
-  "reconcile",
-  // Reconciliation of one named occurrence, not of the deployment: an
-  // occurrence with no admitted input commitment cannot be replayed safely and
-  // no edit to the call changes that. `reconcile` is the deployment-wide word.
-  "reconcile_occurrence",
-  "reduce_request_size",
-  // The Host's invocation context for this turn is stale or expired at the
-  // Gateway. The Host's next turn rebinds it and the same call then succeeds;
-  // nothing in the call changes, so it is not a remedy the scorer may count.
-  "refresh_host_invocation_context",
-  "repair_or_adopt_session",
-  "retry",
-  // The owner -- a correlation hook, an approval hook -- is not serving right
-  // now. The caller changes nothing and the same call succeeds once the owner
-  // is back, so this is not a remedy the scorer may count as guidance.
-  "retry_after_owner_recovery",
-  "retry_same_receipt_read",
-  "run_file_search_again",
-  "select_exact_approval"
-];
-var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
-var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
-var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
-var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
-  provider_permission: "ask_admin",
-  access_level: "ask_admin",
-  personal_authorization_required: "connect_personal_account"
-});
+// packages/ceal-client-protocol/src/operation-result-completeness.ts
+var CEAL_READ_VALUE_CONTINUATION_KEYS = vocabulary(["continuation", "continuation_ref", "next_cursor"]);
 
 // packages/ceal-client-protocol/src/operation-contract-artifact.ts
 var CATALOG_REVISION = new RegExp(CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN, "u");
@@ -3003,7 +2987,9 @@ var CEAL_OPERATION_INVOKE_COMMAND = "invoke";
 var CEAL_OPERATION_INPUT_FLAG = "--input";
 var CEAL_OPERATION_ID_PLACEHOLDER = "<operation-id>";
 var CEAL_OPERATION_INPUT_PLACEHOLDER = "<json-object>";
-var CEAL_MODEL_INVOCATION_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+var MODEL_INVOCATION_BASE_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER].join(" ");
+var CEAL_MODEL_INVOCATION_ARGUMENTS = [MODEL_INVOCATION_BASE_ARGUMENTS, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+var CEAL_MODEL_INPUT_SOURCE_GUIDANCE = `For caller-owned fields, add ${CEAL_OPERATION_INPUT_FLAG} ${shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)}. Use inline JSON for short input; for longer or generated input, put exactly one JSON object in a caller-owned regular non-symlink UTF-8 JSON file and pass --input @path; relative paths resolve from the command working directory.`;
 function shellSingleQuoted(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -3035,79 +3021,7 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
   }
 });
 
-// packages/ceal-client-protocol/src/bare-document.ts
-var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
-var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
-
-// packages/ceal-client-protocol/src/runtime-executable-paths.ts
-var CEAL_SYSTEMCTL_EXECUTABLE_PATH = "/usr/bin/systemctl";
-
-// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
-var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
-var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
-var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
-var CEAL_LEASED_MESSAGE_DELIVERY_OPERATION_IDS = vocabulary(["message.send", "message.update", "message.delete"]);
-var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
-var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
-var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
-var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
-var CEAL_ACTIVITY_GAP_CODES = vocabulary([
-  "provider_page_budget",
-  "call_deadline",
-  "related_item_budget",
-  "provider_cursor_unavailable",
-  "malformed_provider_page",
-  "visibility_incomplete",
-  "unsupported_event_kind"
-]);
-var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
-var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
-var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
-  "slack.message",
-  "slack.reply",
-  "slack.direct_message",
-  "github.commit.authored",
-  "github.issue.opened",
-  "github.pull_request.opened",
-  "github.review.submitted",
-  "github.issue_comment.created",
-  "github.review_comment.created",
-  "calendar.organized",
-  "calendar.accepted_invite",
-  "calendar.recorded",
-  "drive.file.created",
-  "drive.file.modified",
-  "drive.file.viewed",
-  "notion.page.created",
-  "notion.page.edited"
-]);
-var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
-  "message_created",
-  "commit_authored",
-  "resource_created",
-  "review_submitted",
-  "comment_created",
-  "event_start",
-  "all_day_start",
-  "file_created",
-  "file_modified",
-  "file_modified_by_me",
-  "file_viewed_by_me",
-  "page_created",
-  "page_last_edited",
-  "resource_modified"
-]);
-var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
-var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
-var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
-var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
-var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
-var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
-var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
-var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
+// packages/ceal-client-protocol/src/provider-operation-vocabulary.ts
 var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
 var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
 var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
@@ -3141,12 +3055,95 @@ var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
   "identity_unlinked"
 ]);
 var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
-var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
-var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
-var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
-var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
+
+// packages/ceal-client-protocol/src/opaque-reference.ts
+var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
+var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
+
+// packages/ceal-client-protocol/src/bare-document.ts
+var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
+var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
+
+// packages/ceal-client-protocol/src/runtime-executable-paths.ts
+var CEAL_SYSTEMCTL_EXECUTABLE_PATH = "/usr/bin/systemctl";
 
 // packages/ceal-client-protocol/src/resource-row.ts
+var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
+var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
+var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
+var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
+var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
+  "message_created",
+  "commit_authored",
+  "resource_created",
+  "review_submitted",
+  "comment_created",
+  "event_start",
+  "all_day_start",
+  "file_created",
+  "file_modified",
+  "file_modified_by_me",
+  "file_viewed_by_me",
+  "page_created",
+  "page_last_edited",
+  "resource_modified"
+]);
+var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
+var CEAL_ACTIVITY_GAP_CODES = vocabulary([
+  "provider_page_budget",
+  "call_deadline",
+  "related_item_budget",
+  "provider_cursor_unavailable",
+  "malformed_provider_page",
+  "visibility_incomplete",
+  "unsupported_event_kind",
+  "direct_messages_excluded"
+]);
+var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
+  "slack.message",
+  "slack.reply",
+  "slack.direct_message",
+  "github.commit.authored",
+  "github.issue.opened",
+  "github.pull_request.opened",
+  "github.issue.edited",
+  "github.pull_request.edited",
+  "github.review.submitted",
+  "github.issue_comment.created",
+  "github.review_comment.created",
+  "calendar.organized",
+  "calendar.accepted_invite",
+  "calendar.recorded",
+  "drive.file.created",
+  "drive.file.modified",
+  "drive.file.viewed",
+  "notion.page.created",
+  "notion.page.edited"
+]);
+var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
+  "slack.message": "message_created",
+  "slack.reply": "message_created",
+  "slack.direct_message": "message_created",
+  "github.commit.authored": "commit_authored",
+  "github.review.submitted": "review_submitted",
+  "github.issue_comment.created": "comment_created",
+  "github.review_comment.created": "comment_created",
+  "github.issue.opened": "resource_created",
+  "github.pull_request.opened": "resource_created",
+  "github.issue.edited": "resource_modified",
+  "github.pull_request.edited": "resource_modified",
+  "calendar.organized": "resource_created",
+  "drive.file.created": "file_created",
+  "drive.file.modified": "file_modified_by_me",
+  "drive.file.viewed": "file_viewed_by_me",
+  "notion.page.created": "page_created",
+  "notion.page.edited": "page_last_edited"
+});
+var CEAL_DATED_NOTE_BASES = vocabulary(["recording", "calendar_event", "created_time"]);
+var CEAL_DATED_NOTE_TRANSCRIPT_STATES = vocabulary(["present", "absent", "unestablished"]);
+var CEAL_READ_SEARCH_COST_CLASSES = vocabulary(["native_index", "scan"]);
 var RESOURCE_ROW_KEY_RULES = Object.freeze({
   schema_version: { required: true, timestamp: false },
   ref: { required: true, timestamp: false },
@@ -3159,6 +3156,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
+  attachments: { required: false, timestamp: false },
   created_at: { required: false, timestamp: true },
   created_at_local: { required: false, timestamp: true },
   modified_at: { required: false, timestamp: true },
@@ -3169,6 +3167,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   end: { required: false, timestamp: false },
   status: { required: false, timestamp: false },
   snippet: { required: false, timestamp: false },
+  dated_notes: { required: false, timestamp: false },
   state: { required: true, timestamp: false },
   timestamp_basis: { required: true, timestamp: false }
 });
@@ -3205,16 +3204,26 @@ var CEAL_WRITE_SAFETY_UNCHECKED_REASONS = vocabulary(["authority_unavailable"]);
 // packages/ceal-client-protocol/src/operation-occurrence.ts
 var MAX_RECEIPT_REVISION = Number.MAX_SAFE_INTEGER - 1;
 
-// packages/ceal-client-protocol/src/leased-artifact-contract.ts
-var CEAL_LEASED_CONSUMER_ARTIFACT_CHUNK_MAX_BYTES = 12 * 1024;
-
-// packages/ceal-client-protocol/src/leased-resource-stream.ts
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAGIC = new Uint8Array([67, 69, 65, 76, 82, 83, 50, 0]);
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES = 8;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_HEADER_BYTES = 16 * 1024;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_CHUNK_BYTES = 64 * 1024;
-var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_RECORD_BYTES = CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES + CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAX_HEADER_BYTES + CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_CHUNK_BYTES;
-var CEAL_ATTACHMENT_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "digest_mismatch"]);
+// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
+var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
+  "access_group_ref",
+  "membership_ref",
+  "registration_ref",
+  "client_ref",
+  "subject_ref",
+  "instance_ref"
+]);
+var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
+var CEAL_REFRESH_FAILURE_CODES = vocabulary([
+  "refresh_invalid",
+  "refresh_expired",
+  "refresh_inactive",
+  "refresh_replayed",
+  "refresh_revoked",
+  "authority_replaced",
+  "refresh_recovery_unavailable",
+  "refresh_recovery_expired"
+]);
 
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -3300,7 +3309,7 @@ var CEAL_REQUEST_MAX_GRAPH_NODES = 128;
 
 // packages/ceal-client-protocol/src/request-run.ts
 var CEAL_REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA_VERSION = "ceal.request_node_standing_occurrence.v1";
-var CEAL_REQUEST_RUN_BATCH_SCHEMA_VERSION = "ceal.request_run_batch.v3";
+var CEAL_REQUEST_RUN_BATCH_SCHEMA_VERSION = "ceal.request_run_batch.v1";
 var REQUEST_ACTION_SAFE_REF_SCHEMA = { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source };
 var REQUEST_ACTION_DIGEST_SCHEMA = { type: "string", minLength: 64, maxLength: 64, pattern: "^[a-f0-9]{64}$" };
 var REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA = {
@@ -3383,6 +3392,10 @@ var CEAL_REQUEST_RUN_BATCH_JSON_SCHEMA = {
 
 // packages/ceal-client-protocol/src/host-observation.ts
 var CEAL_LOCAL_HOST_CAPABILITIES_SCHEMA_VERSION = "ceal.local_host_capabilities.v7";
+var CEAL_HOST_INPUT_KINDS = vocabulary(["human", "host_automatic"]);
+function isCealHostInputKind(value) {
+  return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
+}
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
 var HOST_OBSERVATION_PRODUCER = /^[a-z][a-z0-9]{0,31}$/u;
 var HOST_OBSERVATION_DIGEST = /^[a-f0-9]{8,64}$/u;
@@ -3445,12 +3458,6 @@ var OWNER_WRITE_STATES = Object.freeze(["attempt_started", "provider_acknowledge
 var OWNER_EFFECT_STATES = Object.freeze(["none", "applied", "failed", "unknown", "reconciled"]);
 var OWNER_RECEIPT_STATES = Object.freeze(["pending", "available", "failed", "unknown", "reconciled"]);
 
-// packages/ceal-client-protocol/src/thread-excerpt.ts
-var CEAL_THREAD_RECENT_WINDOW = 6;
-var CEAL_THREAD_LAST_APP_MESSAGES_WINDOW = 3;
-var CEAL_THREAD_OLDER_SUMMARY_WINDOW = 4;
-var CEAL_FED_THREAD_MESSAGE_LIMIT = CEAL_THREAD_RECENT_WINDOW + CEAL_THREAD_OLDER_SUMMARY_WINDOW + CEAL_THREAD_LAST_APP_MESSAGES_WINDOW;
-
 // packages/ceal-client-protocol/src/request-graph-readiness.ts
 var REQUEST_GRAPH_PRODUCER_TO_APPEND_SCHEMA = {
   type: "object",
@@ -3540,27 +3547,15 @@ var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().enc
 `).byteLength;
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
+var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
 var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
-var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "read_argv"]);
-var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "local_result_root", "continue_argv"]);
+var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id"]);
+var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "read_argv", "local_result_root", "continue_argv", "model_disclosure", "item_read_argv"]);
 
 // packages/ceal-client-protocol/src/session-start-affordance.ts
 var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
-var CEAL_LINK_RESOURCE_PRECEDENCE = `When the user asks to use Ceal or provides a link to information that may be available through installed organizational capabilities, run bare \`${CEAL_SESSION_ENTRY_INVOCATION}\`. The Host supplies the current user prompt without exposing it to the client command, and the Gateway returns the applicable entry in that one response. Treat a supplied link as a candidate Ceal resource rather than a public web-search target. Reach for a generic web fetch or web search only when the Gateway offered nothing.`;
 var HOST_HOOK_TIMEOUT_SECONDS = 1;
 
-// packages/ceal-client-protocol/src/conversation-contracts.ts
-var CEAL_APPROVAL_POLICY_KINDS = vocabulary(["requester_only", "named_users", "role_based"]);
-var CEAL_APPROVAL_TARGET_KINDS = vocabulary([
-  "repo_change",
-  "investigation",
-  "skill_creation",
-  "command_creation",
-  "connector_creation",
-  "generic"
-]);
-var CEAL_PROGRESS_PHASES = vocabulary(["request_review", "information_gathering", "work_execution", "result_check"]);
-
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 
@@ -3643,27 +3638,6 @@ var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "
 // packages/ceal-client-protocol/src/actor-kind.ts
 var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 
-// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
-var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
-  "access_group_ref",
-  "membership_ref",
-  "registration_ref",
-  "client_ref",
-  "subject_ref",
-  "instance_ref"
-]);
-var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
-var CEAL_REFRESH_FAILURE_CODES = vocabulary([
-  "refresh_invalid",
-  "refresh_expired",
-  "refresh_inactive",
-  "refresh_replayed",
-  "refresh_revoked",
-  "authority_replaced",
-  "refresh_recovery_unavailable",
-  "refresh_recovery_expired"
-]);
-
 // packages/ceal-client-protocol/src/device-enrollment.ts
 var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
@@ -3830,13 +3804,13 @@ function validTurn(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref"], ["model", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && optionalText(value.model, 256) && validObservations(value.observations);
 }
 function validInput(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "origin_input", "observations"], ["decision", "local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && typeof value.origin_input === "boolean" && validInputOptionals(value);
+  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "input_kind", "origin_input", "observations"], ["local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && isCealHostInputKind(value.input_kind) && typeof value.origin_input === "boolean" && validInputOptionals(value);
 }
 function validInputObservations(value) {
   return validObservations(value) && Array.isArray(value) && value.filter((item) => record(item) && item.observation_kind === "prompt").length === 1;
 }
 function validInputOptionals(value) {
-  return validDecision(value.decision) && optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
+  return optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
 }
 function validTerminal(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref", "terminal_state"], ["abort_reason", "duration_ms", "time_to_first_token_ms", "usage", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && validTerminalDisposition(value.terminal_state, value.abort_reason) && optionalNonNegative(value.duration_ms) && optionalNonNegative(value.time_to_first_token_ms) && (value.usage === void 0 || jsonValue(value.usage)) && validObservations(value.observations);
@@ -3847,9 +3821,6 @@ function validTerminalDisposition(state, reason) {
 function validStatus(value) {
   return exactOptional(value, ["status", "reason_code"], ["detail"]) && ["ready", "degraded", "stopping"].includes(String(value.status)) && safeRef(value.reason_code) && optionalText(value.detail, 4096);
 }
-function validDecision(value) {
-  return value === void 0 || record(value) && exactKeys(value, ["decision", "approval_ref"]) && (value.decision === "approved" || value.decision === "denied") && safeRef(value.approval_ref);
-}
 function optionalText(value, maxLength) {
   return value === void 0 || typeof value === "string" && value.length > 0 && value.length <= maxLength;
 }
@@ -5050,10 +5021,6 @@ var CodexOutboxStore = class {
     await removeOwnerState(this.registrationPath(registration.host_source_ref, registration.host_session_ref), "registration");
     await removeOwnerState(this.cursorPath(registration.host_source_ref, registration.host_session_ref), "cursor");
   }
-  async relayWakeDirectories() {
-    await this.prepare();
-    return { entries: this.entriesDirectory, registrations: this.registrationsDirectory };
-  }
   async listTranscriptRegistrations() {
     await this.prepare();
     const registrations = [];
@@ -5243,7 +5210,7 @@ async function readPrivateFile(path) {
 }
 function validateEnvelope(value) {
   if (!isRecord3(value)) throw storageError("Codex outbox entry is malformed.");
-  if (!sameKeys(value, ["schema_version", "identity", "host_input_ref", "prompt_ref", "observations", "origin_input", "submission_ref", "created_at", "expires_at"], ["request_ref", "codex_turn_id"])) throw storageError(`Codex outbox entry key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the outbox entry key set")}).`);
+  if (!sameKeys(value, ["schema_version", "identity", "host_input_ref", "input_kind", "prompt_ref", "observations", "origin_input", "submission_ref", "created_at", "expires_at"], ["request_ref", "codex_turn_id"])) throw storageError(`Codex outbox entry key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the outbox entry key set")}).`);
   if (value.schema_version !== CODEX_OUTBOX_SCHEMA_VERSION) throw storageError(`Codex outbox entry is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_OUTBOX_SCHEMA_VERSION}`)}).`);
   validateIdentity4(value.identity);
   validateEnvelopeReferences(value);
@@ -5252,6 +5219,7 @@ function validateEnvelope(value) {
 }
 function validateEnvelopeReferences(value) {
   if (!SAFE_REF6.test(String(value.host_input_ref))) throw storageError("Codex outbox input reference is malformed.");
+  if (!isCealHostInputKind(value.input_kind)) throw storageError("Codex outbox input provenance is malformed.");
   if (!SAFE_REF6.test(String(value.prompt_ref))) throw storageError("Codex outbox references are malformed.");
   if (!SAFE_REF6.test(String(value.submission_ref))) throw storageError("Codex outbox references are malformed.");
   if (value.request_ref !== void 0 && !SAFE_REF6.test(String(value.request_ref))) throw storageError("Codex outbox Request reference is malformed.");
@@ -5491,6 +5459,7 @@ var CodexProducer = class {
       local_session_ref: envelope.identity.host_session_ref,
       local_turn_ref: localTurnRef(envelope),
       local_input_ref: envelope.host_input_ref,
+      input_kind: envelope.input_kind,
       origin_input: envelope.origin_input,
       observations: [prompt],
       local_turn_aliases: envelope.codex_turn_id === void 0 ? void 0 : [envelope.codex_turn_id],
@@ -5738,18 +5707,24 @@ function decodeTokenUsage(value) {
 function decodeResponseItem(payload, ordinal, timestamp7) {
   if (payload.type !== "message" || payload.role !== "user") return { kind: "ignored", ordinal, timestamp: timestamp7 };
   const metadata = userMessageMetadata(payload.internal_chat_message_metadata_passthrough);
-  const kinds = metadata.content_item_kinds;
-  if (kinds.length !== 1 || kinds[0] !== "user.text") return { kind: "ignored", ordinal, timestamp: timestamp7 };
+  const inputKind = inputKindFromContentItems(metadata.content_item_kinds);
+  if (inputKind === void 0) return { kind: "ignored", ordinal, timestamp: timestamp7 };
   const prompt = userTextContent(payload.content);
   return {
     kind: "user_text",
     ordinal,
     timestamp: timestamp7,
     prompt,
+    input_kind: inputKind,
     message_id: safeRef5(payload.id, "Codex user message identity is invalid."),
     turn_id: safeRef5(metadata.turn_id, "Codex user message task identity is invalid.")
   };
 }
+function inputKindFromContentItems(kinds) {
+  if (kinds.length !== 1) return void 0;
+  if (kinds[0] === "user.text") return "human";
+  return kinds[0] === "goal.internal_context" ? "host_automatic" : void 0;
+}
 function userMessageMetadata(value) {
   if (!isRecord5(value) || !Array.isArray(value.content_item_kinds)) reject("Codex user message provenance is malformed.");
   return { ...value, content_item_kinds: value.content_item_kinds };
@@ -6334,6 +6309,7 @@ var CodexTranscriptWatcher = class {
       schema_version: "ceal.codex_observation_outbox.v1",
       identity,
       host_input_ref: hostInputRef,
+      input_kind: record8.input_kind,
       prompt_ref: promptRef,
       observations,
       codex_turn_id: record8.turn_id,
@@ -6360,6 +6336,7 @@ var CodexTranscriptWatcher = class {
       schema_version: "ceal.codex_observation_outbox.v1",
       identity,
       host_input_ref: activeTask.origin_host_input_ref,
+      input_kind: "host_automatic",
       prompt_ref: activeTask.prompt_ref,
       observations,
       codex_turn_id: record8.turn_id,
@@ -6766,9 +6743,9 @@ function hookDriftRemedy(reasons) {
 }
 
 // host/host-entry-links.ts
-import { lstat as lstat7, mkdir as mkdir6, readlink, rename as rename5, rm as rm2, symlink } from "node:fs/promises";
+import { lstat as lstat7, mkdir as mkdir6, readlink, realpath, rename as rename5, rm as rm2, stat, symlink } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename, dirname as dirname5, isAbsolute as isAbsolute2, join as join7 } from "node:path";
+import { basename, dirname as dirname5, isAbsolute as isAbsolute2, join as join7, normalize, parse } from "node:path";
 var HOST_ENTRY_RUNTIME_LINK = "runtime";
 var HOST_ENTRY_SERVICES_LINK = "services";
 var HOST_ENTRY_DIRECTORY = [".ceal", "host-entry"];
@@ -7327,9 +7304,7 @@ function validateOptionalInstallerPaths(options) {
 }
 var CODEX_LOCAL_CAPABILITY_OWNER = CODEX_HOOK_OWNER;
 function resolveCodexLocalCapabilityPath(configPath) {
-  const configDirectory = dirname7(configPath);
-  const userRoot = basename2(configDirectory) === ".codex" ? dirname7(configDirectory) : configDirectory;
-  return join10(userRoot, ".ceal", "local-capabilities", "codex.json");
+  return join10(resolveHostEntryRoot(dirname7(configPath), ".codex"), "..", "local-capabilities", "codex.json");
 }
 function resolveLocalCapabilityInstallation(options, configPath) {
   return { authenticationCommand: { executable: options.invocation_authentication_executable ?? resolveRepoCodexInvocationAuthenticationExecutable(), args: options.invocation_authentication_arguments ?? [] }, localCapabilityPath: options.local_capability_path ?? resolveCodexLocalCapabilityPath(configPath) };
@@ -7756,8 +7731,8 @@ function hostBundleComponentsForProducers(producers) {
 // host/lifecycle/src/host-runtime-control.ts
 import { Buffer as Buffer2 } from "node:buffer";
 import { join as join11 } from "node:path";
-var HOST_RUNTIME_CONTROL_REQUEST_SCHEMA = "ceal.host_runtime_control_request.v3";
-var HOST_RUNTIME_CONTROL_RESULT_SCHEMA = "ceal.host_runtime_control_result.v3";
+var HOST_RUNTIME_CONTROL_REQUEST_SCHEMA = "ceal.host_runtime_control_request.v1";
+var HOST_RUNTIME_CONTROL_RESULT_SCHEMA = "ceal.host_runtime_control_result.v1";
 var HOST_RUNTIME_CONTROL_MAX_INPUT_BYTES = 64 * 1024;
 var HOST_RUNTIME_CONTROL_MAX_OUTPUT_BYTES = 16 * 1024;
 var CANDIDATE_REF = /^[a-f0-9]{64}$/u;
@@ -8147,7 +8122,7 @@ import { createHash as createHash9 } from "node:crypto";
 
 // host/service-log.ts
 import { constants as constants3 } from "node:fs";
-import { copyFile as copyFile3, open as open10, stat, truncate } from "node:fs/promises";
+import { copyFile as copyFile3, open as open10, stat as stat2, truncate } from "node:fs/promises";
 var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
 var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
 function hostServiceLogPreviousPath(path) {
@@ -8902,11 +8877,10 @@ function createLinuxUserSystemdAdapter(options) {
       const previousByComponent = serviceMap(previous);
       const targetByComponent = serviceMap(target);
       await ensurePrivateUnitDirectory(unitDirectory);
-      const ownedUnits = await ownedHostUnits(unitDirectory);
+      const removableUnits = await ownedHostUnits(unitDirectory, identity);
       for (const service of target.services) await replaceOwnedUnit(unitDirectory, identity, service);
-      const removableUnits = target.services.length === 0 ? ownedUnits.filter((unit) => unit.identity === identity) : ownedUnits;
       for (const unit of removableUnits) {
-        if (unit.identity === identity && targetByComponent.has(unit.component)) continue;
+        if (targetByComponent.has(unit.component)) continue;
         await invokeSystemctl(run, systemctl, ["--user", "disable", "--now", unitName(unit.identity, unit.component)]);
         await removeOwnedUnit(unitDirectory, unit.identity, unit.component);
       }
@@ -8917,7 +8891,7 @@ function createLinuxUserSystemdAdapter(options) {
         if (previousByComponent.has(service.component)) await invokeSystemctl(run, systemctl, ["--user", "restart", name]);
         await requireExpectedReadback(run, systemctl, unitDirectory, identity, service, "running");
       }
-      for (const unit of removableUnits) if (unit.identity !== identity || !targetByComponent.has(unit.component)) await requireAbsentReadback(run, systemctl, unitDirectory, unit.identity, unit.component);
+      for (const unit of removableUnits) if (!targetByComponent.has(unit.component)) await requireAbsentReadback(run, systemctl, unitDirectory, unit.identity, unit.component);
     },
     async restart({ target, service }) {
       const identity = prefixIdentity(target.prefix);
@@ -8967,15 +8941,15 @@ function unitPath(directory, identity, component) {
 function serviceMap(set) {
   return new Map(set.services.map((service) => [service.component, service]));
 }
-async function ownedHostUnits(directory) {
+async function ownedHostUnits(directory, identity) {
   const owned = [];
   for (const name of await readdir3(directory)) {
     const match = /^ceal-host-([a-f0-9]{64})-(lifecycle|relay|codex|claude)\.service$/u.exec(name);
     if (match === null) continue;
-    const identity = match[1];
+    const unitIdentity = match[1];
     const component = match[2];
-    if (identity === void 0 || !UNIT_ID_PATTERN.test(identity) || !isHostRuntimeServiceComponent(component)) continue;
-    if (await ownedUnitPresent(unitPath(directory, identity, component), identity, component)) owned.push({ identity, component });
+    if (unitIdentity !== identity || !UNIT_ID_PATTERN.test(unitIdentity) || !isHostRuntimeServiceComponent(component)) continue;
+    if (await ownedUnitPresent(unitPath(directory, unitIdentity, component), unitIdentity, component)) owned.push({ identity: unitIdentity, component });
   }
   return owned.sort((left, right) => unitName(left.identity, left.component).localeCompare(unitName(right.identity, right.component)));
 }
@@ -8985,8 +8959,8 @@ function isHostRuntimeServiceComponent(value) {
 async function ensurePrivateUnitDirectory(directory) {
   try {
     await mkdir10(directory, { recursive: true, mode: 448 });
-    const stat2 = await lstat12(directory);
-    if (!stat2.isDirectory() || stat2.isSymbolicLink() || typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw projectionError();
+    const stat3 = await lstat12(directory);
+    if (!stat3.isDirectory() || stat3.isSymbolicLink() || typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw projectionError();
     await chmod3(directory, 448);
   } catch (error) {
     if (isAdapterError(error)) throw error;
@@ -8995,8 +8969,8 @@ async function ensurePrivateUnitDirectory(directory) {
 }
 async function ownedUnitPresent(path, identity, component) {
   try {
-    const stat2 = await lstat12(path);
-    if (!stat2.isFile() || stat2.isSymbolicLink() || (stat2.mode & 63) !== 0 || typeof process.getuid === "function" && stat2.uid !== process.getuid()) throw projectionError();
+    const stat3 = await lstat12(path);
+    if (!stat3.isFile() || stat3.isSymbolicLink() || (stat3.mode & 63) !== 0 || typeof process.getuid === "function" && stat3.uid !== process.getuid()) throw projectionError();
     const bytes = await readFile6(path);
     if (bytes.byteLength > MAX_COMMAND_OUTPUT_BYTES) throw projectionError(refusalFact("unit_bytes", bytes.byteLength, `at most ${MAX_COMMAND_OUTPUT_BYTES}`));
     if (!bytes.toString("utf8").startsWith(ownerPreamble(identity, component))) throw projectionError(refusalFact("owner_preamble", ownerPreamble(identity, component), "the first line of the projected unit"));