@dsh-enhanced/assistant-delivery 0.1.65 → 0.1.67

package/lib/service.d.ts

@@ -1,3 +1,6 @@
+import { type OwnerWorkItemEngineeringContextLocator, type OwnerWorkItemEngineeringContextExpectation, type OwnerWorkItemEngineeringContextReadInput, type OwnerWorkItemEngineeringContextPage, type OwnerWorkItemEngineeringContext, type OwnerWorkItemEngineeringContextSource } from './work-item-engineering-context.js';
+import type { OwnerWorkItemLearningTask, OwnerLearningSourceExpectation, OwnerLearningSourceSnapshot, OwnerWorkItemLearningTaskFenceInput } from './work-item-feedback.js';
+import { type WorkItemReplySource, type WorkItemReplyConsumerRegistration, type WorkItemReplyReadInput, type WorkItemReplyListInput } from './work-item-replies.js';
 import { Context, Service } from '@deepseek-ai/cordis';
 import type { Agent } from '@deepseek-ai/dsh-agent';
 import type { ToolDefinition, ToolExecution } from '@deepseek-ai/dsh-tools';
@@ -5,7 +8,7 @@ import Schema from '@deepseek-ai/schemastery';
 import { type RestartRecord } from './restart-store.js';
 import { type RestartConfig } from './restart-runtime.js';
 import { type ApprovalDispatchRouteV2, type AssistantPolicyService } from '@dsh-enhanced/assistant-policy';
-import type { TrustedTaskLearningProjectionReceipt, TrustedDeliveryEvaluationRegistration } from '@dsh-enhanced/assistant-evaluation';
+import type { TrustedTaskLearningProjectionReceipt, TrustedDeliveryEvaluationClaims, TrustedDeliveryEvaluationRegistration } from '@dsh-enhanced/assistant-evaluation';
 import { type GrowthWorkflowTraceSourceRegistration, type ResolvedWorkflowAutomationTemplate, type WorkflowAutomationTemplate, type WorkflowScope, type WorkflowTraceSink } from '@dsh-enhanced/assistant-growth-contract';
 import { type InboundMessageProcessor } from './coordinator.js';
 import { DeliveryStore, type CommitOwnerAnchoredWorkflowTraceResult } from './store.js';
@@ -13,9 +16,12 @@ import type { OwnerApprovalStatusRead } from './approval-status-context.js';
 import { type NativeWebOwnerConfig, type NativeWebOwnerAccess } from './native-web-owner.js';
 import { type DeliveryGoalWakeInput, type DeliveryGoalWakeResult } from './goal-wake-types.js';
 import type { AcceptanceContract, TaskAcceptanceRegistration } from './acceptance.js';
-import { type ForegroundTaskObservationRegistration, type ForegroundToolCallAttestation } from './foreground-observation.js';
+import { type ForegroundTaskObservationRegistration, type ForegroundToolCallAttestation, type OwnerForegroundToolInput } from './foreground-observation.js';
+import { NOTIFICATION_OUTCOME_FACTS_PROTOCOL, type AttentionAuditEntry, type AttentionEnvelope, type NotificationOutcomeFact } from './attention.js';
+import { type ProgressAttentionAuditPage } from './progress-attention.js';
+import { type AttentionRejectionEntry, type AttentionRejectionPage, type AttentionRejectionReason } from './attention-enforcement.js';
 import { type ReplyReplayBlockConfig, type ReplyReplayBlockHandle } from './reply-replay.js';
-import type { ConversationBinding, DeliveryAdapter, DeadLetterResolutionResult, DeliveryPreferenceRegistration, DeliveryPreferenceProducer, DeliveryPreferencePrincipalAttestation, DeliveryPreferenceTurnAttestation, ExternalPrincipalKey, InboundEnvelope, InboxRecord, ModelPickerIntent, ModelPickerState, ModelRouteRef, ModelSelectionResult, ModelSelectionSettlementInput, ModelSelectionTerminalResult, OwnerRouteAuthority, OwnerForegroundTaskSourceScope, OwnerForegroundTaskSource, OwnerForegroundTaskSourceCursor, OwnerForegroundTaskSourcePage, OwnerForegroundTaskSourceContent, OwnerForegroundTaskSourceRef, OwnerApprovalForPreferenceInput, OwnerApprovalForPreferenceResult, OwnerRouteValidationReceipt, OutboxRecord, PairingChallenge, PermissionPickerIntent, ResolvedOwnerRoute, StoredDeliveryPresentation, TrustedDeliveryPresentationRegistration } from './types.js';
+import type { ConversationBinding, DeliveryAdapter, DeadLetterResolutionResult, DeliveryPreferenceRegistration, DeliveryPreferenceProducer, DeliveryPreferencePrincipalAttestation, DeliveryPreferenceTurnAttestation, DeliveryInboundIntakeObserver, ExternalPrincipalKey, InboundEnvelope, InboxRecord, ModelPickerIntent, ModelPickerState, ModelRouteRef, ModelSelectionResult, ModelSelectionSettlementInput, ModelSelectionTerminalResult, OwnerRouteAuthority, OwnerForegroundTaskSourceScope, OwnerForegroundTaskSource, OwnerForegroundTaskSourceCursor, OwnerForegroundTaskSourcePage, OwnerForegroundTaskSourceContent, OwnerForegroundTaskInput, OwnerForegroundTaskSourceRef, OwnerApprovalForPreferenceInput, OwnerApprovalForPreferenceResult, OwnerAliasForegroundToolCallAttestation, OwnerAliasReceipt, OwnerRouteStateInspection, OwnerRouteValidationReceipt, OwnerRouteBindingReceipt, OutboxRecord, PairingChallenge, PermissionPickerIntent, ResolvedOwnerRoute, StoredDeliveryPresentation, TrustedDeliveryPresentationRegistration } from './types.js';
 /** A wake finalizes an already-flushed native Web reply, or creates one external outbox intent. */
 export type DeliveryGoalWakeResultPublication = OutboxRecord | Readonly<{
     kind: 'native-session';
@@ -63,6 +69,18 @@ export interface OwnerForegroundLearningTask {
         }>;
     }>;
 }
+/**
+ * One explicitly allowlisted provider bot. The exact channel/account/tenant/user
+ * tuple is the trust anchor; `senderIsBot` only labels the provider's declaration.
+ * A peer keeps its own Policy subject and conversation binding, so it never
+ * inherits the owner's tools, memory, work-item feedback or continuation lanes.
+ */
+export interface PeerAgentAuthority {
+    readonly channel: string;
+    readonly account: string;
+    readonly tenant: string;
+    readonly user: string;
+}
 export interface Config {
     databasePath: string;
     spoolPath: string;
@@ -96,6 +114,52 @@ export interface Config {
     toolApprovalPreparationTimeoutMs?: number;
     /** Host-owned stable routes. They are never exposed as Agent tools or prompt input. */
     ownerRoutes?: readonly OwnerRouteAuthority[];
+    /**
+     * WP19 stage 2b opt-in (default off): over-cap background/owner notices are
+     * queued as a short body plus a text attachment, and a burst of inline
+     * notices that together exceed the cap is rejected as split evasion.
+     */
+    attentionAttachOverCap?: boolean;
+    /**
+     * WP19 stage 3 opt-in (default off): background/owner notices whose purpose
+     * is missing or fails the Host checks are rejected before they are queued,
+     * as are over-cap notices unless `attentionAttachOverCap` attaches them.
+     */
+    attentionEnforce?: boolean;
+    /**
+     * Opt-in (default off): `routeWorkItemReport` keeps a report on the route of
+     * the same item's earlier still-unsettled report, so one lane orders both.
+     */
+    ownerReportRouting?: {
+        orderAcrossLanes?: boolean;
+    };
+    /**
+     * Opt-in (default off): widen the deterministic grammar for authenticated
+     * owner replies to one exact result. Off means the legacy exact-phrase parser
+     * and its admission fences are unchanged.
+     * - `coverage`: accept synonym/multilingual result assertions plus an
+     *   untrusted trailing reason/evidence clause. Questions, hypotheticals,
+     *   quoted prose, negated reports, contradictions, hedges and withdrawal
+     *   commands still abstain.
+     * - `mixedIntent`: when one authenticated work-item report reply carries a
+     *   result assertion and an explicit continuation request, record the
+     *   canonical result and admit the continuation as two independent decisions
+     *   (each with its own permission, idempotency, budget fence and target). If
+     *   one lane is not permitted the other still proceeds and the partial
+     *   admission is recorded. Ignored unless `coverage` is also on.
+     */
+    naturalFeedback?: {
+        coverage?: boolean;
+        mixedIntent?: boolean;
+    };
+    /**
+     * Opt-in peer-agent allowlist (default empty). A group message whose provider
+     * envelope carries `senderIsBot=true` and whose exact principal tuple is
+     * listed here is admitted into its own linked-principal lane. The peer keeps a
+     * distinct Policy subject and never inherits owner tools, memory, work-item
+     * feedback or continuation lanes. No peer is trusted by default.
+     */
+    peerAgents?: readonly PeerAgentAuthority[];
 }
 export interface DeliveryInboundRuntime extends InboundMessageProcessor {
     canRequestRestart?(agent: Agent): boolean;
@@ -119,10 +183,90 @@ export interface DeliveryInboundRuntime extends InboundMessageProcessor {
     cancelActive?(binding: Readonly<ConversationBinding>, cause: 'new' | 'stop'): boolean | Promise<boolean>;
 }
 export type AssistantDeliveryErrorCode = 'disposed' | 'missing-binding' | 'policy-denied' | 'runtime-conflict' | 'runtime-unavailable';
+/**
+ * Send-time withdrawal check for owner notices queued with `withdrawable`.
+ * `isWithdrawn` must be synchronous, side-effect free and keyed only by the
+ * notice's idempotency key. A withdrawable notice is never sent while no
+ * check is registered for its authority and source, or while the check
+ * throws; it is withdrawn (dead, never sent) once the check returns true.
+ *
+ * `authority` names the Cordis service slot that owns the check. Delivery
+ * accepts the registration only when the service currently in that slot
+ * vouches for this exact object through `ownsOwnerNotificationWithdrawal`
+ * (the same slot-anchored ownership proof the task-acceptance sink uses), so
+ * a plugin that does not occupy the slot cannot register for it.
+ */
+export interface OwnerNotificationWithdrawal {
+    readonly protocol: typeof ownerNotificationWithdrawalProtocol;
+    readonly authority: string;
+    readonly sourceId: string;
+    isWithdrawn(idempotencyKey: string): boolean;
+}
+export declare const ownerNotificationWithdrawalProtocol: "assistant-delivery/owner-notification-withdrawal/v1";
+/**
+ * Live registration returned to the owner. `handle` is an unguessable
+ * process-local capability: enqueueing a `withdrawable` notice and inspecting
+ * notices both require it. Notices are bound to the stable
+ * (authority, source) pair, not to the handle, so a restart or a later
+ * registration by the same authority takes over notices already queued.
+ */
+export interface OwnerNotificationWithdrawalBinding {
+    readonly handle: string;
+    unregister(): void;
+}
+/** Read-only view of an owner notice found by its idempotency key; carries no text. */
+export interface OwnerNotificationRecordView {
+    readonly outboxId: string;
+    readonly status: OutboxRecord['status'];
+}
+export declare const ownerNotificationReplyProtocol: "assistant-delivery/owner-notification-reply/v1";
+/**
+ * Slice 5: authenticated owner reply handed to the consumer registered for
+ * the owner-notice source that produced the quoted message. Delivery has
+ * already matched the unique accepted/delivered/read Outbox by provider
+ * message id, the notice source, its authority, the frozen owner lineage,
+ * the registration's idempotency-key prefix and an `allow` Policy decision.
+ */
+export interface OwnerNotificationReplyInput {
+    readonly inboxId: string;
+    readonly envelopeHash: string;
+    readonly outboxId: string;
+    readonly providerMessageId: string;
+    readonly idempotencyKey: string;
+    readonly sourceId: string;
+    readonly principalId: string;
+    readonly text: string;
+    readonly receivedAt: number;
+}
+/**
+ * `applied`: the consumer durably applied the reply; Delivery marks the Inbox
+ * processed. `ignored`: fall through to ordinary inbound handling. `transient`:
+ * the Inbox stays pending so the same reply is retried on provider redelivery
+ * or the next pending-inbound recovery.
+ */
+export type OwnerNotificationReplyOutcome = 'applied' | 'ignored' | 'transient';
+export interface OwnerNotificationReply {
+    readonly protocol: typeof ownerNotificationReplyProtocol;
+    /** Cordis slot that owns the consumer; Delivery vouches the exact object there. */
+    readonly authority: string;
+    readonly sourceId: string;
+    /** Only notices whose idempotency key starts with this prefix are matched. */
+    readonly idempotencyKeyPrefix: string;
+    consume(input: Readonly<OwnerNotificationReplyInput>): OwnerNotificationReplyOutcome;
+}
+export interface OwnerNotificationReplyBinding {
+    unregister(): void;
+}
 export declare class AssistantDeliveryError extends Error {
     readonly code: AssistantDeliveryErrorCode;
     constructor(code: AssistantDeliveryErrorCode, message: string);
 }
+/** WP19 stage 3 rejection: `policy-denied` with structured reason codes; nothing was queued. */
+export declare class AttentionRejectedError extends AssistantDeliveryError {
+    readonly rejection: Readonly<AttentionRejectionEntry>;
+    readonly reasons: readonly AttentionRejectionReason[];
+    constructor(rejection: Readonly<AttentionRejectionEntry>, message?: string);
+}
 /**
  * Structural mirrors of the Goals Host-only evidence shapes. Delivery must not
  * import `@dsh-enhanced/assistant-goals` types for this seam: goals' public
@@ -221,14 +365,34 @@ export declare class AssistantDeliveryService extends Service {
     private readonly preferenceProducerGeneration;
     private readonly acceptanceProducerGeneration;
     private acceptanceSink;
+    private workItemReplyConsumer;
+    private inboundIntakeObserver;
+    /** Send-time withdrawal checks for `withdrawable` owner notices, one per (authority, canonical source id). */
+    private readonly ownerNotificationWithdrawals;
+    /** Live handles issued by `registerOwnerNotificationWithdrawal`, mapped to their (authority, source) key. */
+    private readonly ownerNotificationWithdrawalHandles;
+    /** Slice-5 reply consumers, one per (authority, canonical owner-notice source id). */
+    private readonly ownerNotificationReplies;
     private foregroundObserver;
     /** Once a live verifier required acceptance, loss of that verifier must not silently bypass it. */
     private acceptanceRequired;
     private readonly preferenceTurns;
+    /** Claimed human turns of linked owner aliases; read-only alias inspection only. */
+    private readonly aliasTurns;
     private readonly goalWakeResults;
     private modelSelectionFlight;
     private presentationFlight;
     private workflowTraceFlight;
+    private workItemFeedbackFlight;
+    private workItemFeedbackCursor;
+    private workItemFeedbackAckCursor;
+    /** WP19 stage 1: audit writes never affect delivery; failures are counted in this process only (reset on restart). */
+    private attentionAuditWriteFailures;
+    /** WP19 stage 2c: process-local progress attention audit (no Delivery schema change). */
+    private readonly progressAttentionAudit;
+    private progressAttentionAuditFailures;
+    /** WP19 stage 3: process-local rejection log (rejected notices have no Outbox row). */
+    private readonly attentionRejections;
     private naturalObjectiveFlight;
     private preferenceProjectionFlight;
     private inboundAdmissionRecoveryFlight;
@@ -348,6 +512,17 @@ export declare class AssistantDeliveryService extends Service {
         toolName: string;
         argumentsJson: string;
     }>): Readonly<ForegroundToolCallAttestation> | undefined;
+    /** Read-only pages of this exact live owner's persisted human input. Callers
+     * cannot select an Inbox, path, owner, or replacement text through this API. */
+    readOwnerForegroundToolInput(input: Readonly<{
+        agent: Agent;
+        authorityId: string;
+        callId: string;
+        toolName: string;
+        argumentsJson: string;
+        offset?: number;
+        maxBytes?: number;
+    }>): Readonly<OwnerForegroundToolInput> | undefined;
     /** Host-only, read-only source proof for an owner's live memory or wiki tool call. */
     inspectOwnerRequestedChange(execution: ToolExecution, input: {
         sourceId: string;
@@ -429,6 +604,11 @@ export declare class AssistantDeliveryService extends Service {
     private assertCurrentPresentationProducer;
     private publishTrustedDeliveryPresentation;
     private progressAuthorized;
+    /**
+     * Exact owner-configured peer bot, or `undefined`. `senderIsBot` is only the
+     * provider's declaration; the allowlisted tuple is the actual authority.
+     */
+    private peerAgentAuthority;
     private isInboundAuthorized;
     private isPermissionController;
     private isOwnerFeedbackController;
@@ -439,6 +619,16 @@ export declare class AssistantDeliveryService extends Service {
     private dispatchLearningCommand;
     private completedPreferenceEvents;
     private dispatchWorkflowCommand;
+    /** Opt-in widened deterministic grammar; off keeps the legacy exact phrases. */
+    private widenedNaturalFeedbackCoverage;
+    /** Splitting one reply into result + continuation requires both opt-ins. */
+    private mixedNaturalFeedbackIntent;
+    /**
+     * One canonical selection for admission and its later re-derivation fences.
+     * The widened parser is a pure function, so a frozen intent keeps verifying
+     * even after a restart that toggles the opt-in.
+     */
+    private naturalObjectiveSelection;
     /**
      * Convert only an authenticated reply to one exact Automation delivery into
      * a trusted objective label. The original run timestamp is retained because
@@ -468,6 +658,129 @@ export declare class AssistantDeliveryService extends Service {
         inboxId: string;
         status: InboxRecord['status'];
     }>;
+    /**
+     * Deterministic backend classification of one authenticated owner reply to an
+     * exact report. The legacy closed whole-sentence grammar stays in force unless
+     * the widened coverage opt-in is on; no caller text is reinterpreted as an
+     * instruction, and no model is called.
+     */
+    private parseWorkItemFeedback;
+    private workItemFeedbackPermission;
+    /**
+     * Inspect one Inbox as an authenticated owner result reply to an exact report.
+     * `ready` carries the frozen source plus its live admission fence; `ordinary`
+     * keeps the historical "recognized result but separate feedback permission
+     * absent" outcome and never admits the result lane by itself. The
+     * `continuation` flag is a deterministic classification only.
+     */
+    private inspectOwnerWorkItemFeedback;
+    /** One deterministic, non-durable record when a mixed reply could only admit one lane. */
+    private recordPartialMixedFeedbackAdmission;
+    /** Passing an explicit registration makes this the callback-free final local authority check. */
+    private workItemFeedbackFence;
+    private workItemFeedbackProof;
+    private drainWorkItemFeedback;
+    private runWorkItemFeedback;
+    private drainWorkItemFeedbackAcks;
+    withOwnerWorkItemFeedbackWriterFence<T>(registration: Readonly<TrustedDeliveryEvaluationRegistration>, claims: Readonly<TrustedDeliveryEvaluationClaims>, proofDigest: string, callback: () => T): T;
+    workItemReplyProtocolVersion(): 1;
+    private currentWorkItemReplyConsumer;
+    registerWorkItemReplyConsumer(registration: WorkItemReplyConsumerRegistration): () => void;
+    /**
+     * WP20 intake: one observer, owned by the current WorkItems service, receives
+     * a metadata-only signal per adapter observation. Delivery adds only the
+     * read-only allowlist and tracked-report-thread facts; it writes nothing.
+     */
+    registerInboundIntakeObserver(observer: DeliveryInboundIntakeObserver): () => void;
+    private currentInboundIntakeObserver;
+    /** Best-effort and side-effect free: any invalid input or observer failure is dropped. */
+    private observeInbound;
+    private inboundIntakeSignal;
+    private notifyWorkItemReplyPending;
+    private notifyWorkItemReplyCancellation;
+    private inspectWorkItemReport;
+    enqueueWorkItemReport(input: {
+        sourceId: string;
+        workspace: string;
+        bindingId: string;
+        idempotencyKey: string;
+        text: string;
+        format?: 'markdown' | 'plain';
+        metadata?: Readonly<Record<string, string>>;
+        itemId: string;
+        reportRevision: number;
+    }): OutboxRecord;
+    /**
+     * Host-only cross-channel route for one background work-item report.
+     *
+     * The origin binding always wins (default prefer): while it is active with an active
+     * principal this returns `{ route: 'origin' }` and enqueues nothing, so the
+     * caller keeps its existing origin path unchanged. Only when the origin is
+     * unavailable does the Host walk the owner's explicit `linkedFallback` list
+     * (Delivery principal ids, in order) and pick the first alias that is still
+     * an active `linked` row of the CURRENT owner record, with exactly one active
+     * binding in the origin workspace/preset, and that existing Policy already
+     * allows to receive this source's sends. The report is queued on the plain
+     * background lane, never the typed report lane, so a reply on the fallback
+     * channel can never continue or give feedback on the item. The queued row
+     * binds the owner and alias record versions plus the alias binding
+     * version/generation; the send-time guard drops it after any revoke or
+     * relink. A replay returns the first committed destination.
+     *
+     * Opt-in `prefer: 'recent'` instead ranks eligible aliases by the owner's
+     * newest inbound message (`inbox_messages.received_at`); an available origin
+     * still wins unless an eligible alias received strictly newer inbound, and
+     * also when that alias is refused before its linked row commits.
+     *
+     * Opt-in `ownerReportRouting.orderAcrossLanes` (Delivery config) keeps one
+     * item's reports in revision order across channels: when an earlier report
+     * of the same item is still unsettled, the new one sticks to that route
+     * (same origin, or same alias while it is still eligible and owner-listed)
+     * so the existing per-lane claim order sends it after. A sticky origin also
+     * overrides `prefer: 'recent'`. An unusable sticky route falls back to the
+     * rules above, so ordering never blocks delivery.
+     */
+    routeWorkItemReport(input: Readonly<{
+        sourceId: string;
+        workspace: string;
+        originBindingId: string;
+        idempotencyKey: string;
+        text: string;
+        format?: 'markdown' | 'plain';
+        itemId: string;
+        reportRevision: number;
+        linkedFallback: readonly string[];
+        prefer?: 'origin' | 'recent';
+    }>): Readonly<{
+        route: 'origin';
+    } | {
+        route: 'linked';
+        outbox: OutboxRecord;
+    }>;
+    private linkedReportSendAllowed;
+    /** Send-time re-check of a linked report route; any revoke, relink or Policy change drops it. */
+    private linkedReportGuard;
+    private workItemReplyPermission;
+    /**
+     * Validate the continuation lane of one reply to an exact report without
+     * writing it. Mixed-intent admission reuses this report inside its combined
+     * transaction; the ordinary path admits it through `admitWorkItemReply`.
+     */
+    private prepareWorkItemReply;
+    private admitWorkItemReply;
+    private workItemReplyFence;
+    private validateWorkItemReply;
+    listPendingWorkItemReplies(input: WorkItemReplyListInput): {
+        items: readonly WorkItemReplySource[];
+        hasMore: boolean;
+        nextAfterSequence: number | null;
+    };
+    readWorkItemReply(input: WorkItemReplyReadInput): WorkItemReplySource;
+    selectWorkItemReplyParent(input: WorkItemReplyReadInput): WorkItemReplySource;
+    acknowledgeWorkItemReply(input: WorkItemReplyReadInput & {
+        childItemId: string;
+        childPlanDigest: string;
+    }): WorkItemReplySource;
     enqueueBackground(input: {
         sourceId: string;
         workspace: string;
@@ -476,7 +789,79 @@ export declare class AssistantDeliveryService extends Service {
         text: string;
         format?: 'markdown' | 'plain';
         metadata?: Readonly<Record<string, string>>;
+        /** WP19 stage 1: audited only; omission records `missing-purpose`. */
+        attention?: AttentionEnvelope;
     }): OutboxRecord;
+    /**
+     * Record the WP19 stage-1 verdict for one queued Outbox record. Audit only:
+     * the record is returned unchanged and any audit failure is swallowed.
+     */
+    private auditAttention;
+    /**
+     * WP19 stage 2b, only when `attentionAttachOverCap` is on: convert an
+     * over-cap notice to a short body plus one text attachment (never split),
+     * and reject an inline notice that, with recent inline notices from the same
+     * source, binding and lane, exceeds the cap of its purpose. Deterministic for
+     * one (input, audited history, clock). Off: the input is returned unchanged,
+     * except that a replay of an already converted key keeps its stored form.
+     * WP19 stage 3, only when `attentionEnforce` is on: a new notice with a
+     * missing or failed purpose, or over cap without the attachment path, is
+     * rejected with `AttentionRejectedError` and nothing is queued. Replays
+     * return above before any check, so an existing key stays idempotent.
+     */
+    private prepareAttentionDelivery;
+    /**
+     * Read-only WP19 stage-1 audit page in append order; never exposes message text.
+     * `processLocalWriteFailures` counts failed audit writes since this Host started;
+     * `unauditedOutbox` is derived from durable rows on every call (see
+     * `AttentionAuditStore.unauditedOutboxCount` for which lanes it can see).
+     */
+    inspectAttentionAudit(input?: Readonly<{
+        afterSequence?: number;
+        limit?: number;
+    }>): Readonly<{
+        entries: readonly AttentionAuditEntry[];
+        hasMore: boolean;
+        nextAfterSequence: number | null;
+        processLocalWriteFailures: number;
+        unauditedOutbox: number;
+    }>;
+    /**
+     * WP22 read adapter for Evaluation: per-notification durable facts (transport,
+     * owner reply, current owner judgement) keyed by audited Outbox id. Read-only,
+     * text-free, and classification-free. Pass `outboxIds` (max 500) to refresh
+     * known notifications, or `afterSequence`/`limit` to page new audit rows.
+     */
+    inspectNotificationOutcomeFacts(input?: Readonly<{
+        afterSequence?: number;
+        limit?: number;
+        outboxIds?: readonly string[];
+    }>): Readonly<{
+        protocol: typeof NOTIFICATION_OUTCOME_FACTS_PROTOCOL;
+        facts: readonly NotificationOutcomeFact[];
+        hasMore: boolean;
+        nextAfterSequence: number | null;
+    }>;
+    /**
+     * Read-only WP19 stage-2c progress audit page in append order; never exposes
+     * progress text. Entries are process-local (`durable: false`), bounded, and
+     * reset on Host restart; `processLocalWriteFailures` counts failed records.
+     */
+    inspectProgressAttentionAudit(input?: Readonly<{
+        afterSequence?: number;
+        limit?: number;
+    }>): Readonly<ProgressAttentionAuditPage & {
+        processLocalWriteFailures: number;
+    }>;
+    /**
+     * Read-only WP19 stage-3 rejection page in append order; never exposes
+     * message text. Entries are process-local (`durable: false`), bounded, and
+     * reset on Host restart. Empty while `attentionEnforce` is off.
+     */
+    inspectAttentionRejections(input?: Readonly<{
+        afterSequence?: number;
+        limit?: number;
+    }>): AttentionRejectionPage;
     private enqueueBackgroundAuthorized;
     /** Queue a typed owner notice. Accepted means queued; it never asserts user read. */
     enqueueOwnerNotification(input: {
@@ -493,7 +878,57 @@ export declare class AssistantDeliveryService extends Service {
         idempotencyKey: string;
         text: string;
         expiresAt: number;
+        attention?: AttentionEnvelope;
+        withdrawable?: boolean;
+        withdrawalHandle?: string;
     }): OutboxRecord;
+    /**
+     * Register the send-time withdrawal check for one owner-notice source (see
+     * `OwnerNotificationWithdrawal`). The service in the `authority` slot must
+     * vouch for the registration; one live check per (authority, source). A
+     * registration its authority no longer vouches for (owner restarted or
+     * replaced) is superseded by the next vouched one, so the legitimate owner
+     * regains control of notices already queued under its authority. After
+     * `unregister`, those notices wait instead of sending.
+     */
+    registerOwnerNotificationWithdrawal(registration: OwnerNotificationWithdrawal): OwnerNotificationWithdrawalBinding;
+    /** The service now in `authority`'s slot vouches for this exact registration object. */
+    private withdrawalVouched;
+    /** Live, still-vouched registration behind `handle`, for exactly `sourceId`. */
+    private liveWithdrawal;
+    /**
+     * Read-only lookup of an owner notice by idempotency key. The caller
+     * presents its withdrawal handle; the lookup is scoped to that handle's
+     * source and authority. A key held by another source, another authority,
+     * a non-withdrawable notice or a non-notice record reads as absent. Never
+     * returns text or metadata.
+     */
+    inspectOwnerNotification(input: Readonly<{
+        sourceId: string;
+        idempotencyKey: string;
+        withdrawalHandle: string;
+    }>): Readonly<OwnerNotificationRecordView> | undefined;
+    /**
+     * Register the slice-5 reply consumer for one owner-notice source (see
+     * `OwnerNotificationReply`). The service in the `authority` slot must vouch
+     * for the exact object; one live consumer per (authority, source). A
+     * registration its authority no longer vouches for is superseded by the
+     * next vouched one, so a restarted owner regains its replies without a new
+     * notice. Registering never sends anything and grants no send authority.
+     */
+    registerOwnerNotificationReply(registration: OwnerNotificationReply): OwnerNotificationReplyBinding;
+    /** The service now in `authority`'s slot vouches for this exact reply registration. */
+    private replyVouched;
+    /**
+     * Slice 5 matcher: bind one authenticated inbound text reply to exactly one
+     * accepted/delivered/read owner notice through `replyToProviderMessageId`,
+     * require the live registered consumer's source and idempotency-key prefix,
+     * an active owner binding/principal with the notice's frozen owner lineage,
+     * and an `allow` external `answer-attention-question` Policy decision. On
+     * `applied` the Inbox is marked processed; `transient` leaves it pending for
+     * a retry. Everything else falls through to ordinary inbound handling.
+     */
+    inspectOwnerQuestionReply(inbox: InboxRecord, binding: ConversationBinding): 'none' | 'handled' | 'transient';
     /**
      * Dedicated Automation result lane. Every learning field is derived from an
      * authoritative Automations receipt; callers cannot supply metadata,
@@ -508,6 +943,16 @@ export declare class AssistantDeliveryService extends Service {
     }): OutboxRecord;
     /** Resolve the current generation of one exact Host-owned owner route. */
     resolveOwnerRoute(authorityIdInput: string): ResolvedOwnerRoute;
+    /**
+     * Read-only Host observation of the configured owner, even after its binding
+     * has been revoked. Missing routes and transient failures are not revocation.
+     */
+    inspectOwnerRouteState(input: {
+        authorityId: string;
+        principalId: string;
+        workspace: string;
+        agentPreset: string;
+    }): OwnerRouteStateInspection;
     /**
      * Revalidate Recovery/other Host work against the live owner route without
      * exposing a session id, conversation id, user message or delivery content.
@@ -518,8 +963,44 @@ export declare class AssistantDeliveryService extends Service {
         workspace: string;
         agentPreset: string;
     }): Readonly<OwnerRouteValidationReceipt>;
+    /**
+     * Host-only: the same receipt as `validateOwnerRoute`, plus the id of the
+     * exact active binding it was resolved from (one resolve, so both describe
+     * the same route state). Not an Agent tool; same `missing-binding` errors.
+     */
+    inspectOwnerRouteBinding(input: {
+        authorityId: string;
+        principalId: string;
+        workspace: string;
+        agentPreset: string;
+    }): Readonly<OwnerRouteBindingReceipt>;
+    private ownerRouteReceipt;
     /** Host-only proof that the live caller Agent belongs to the current owner route. */
     validateOwnerAgentForRoute(agent: Agent, authorityId: string): ReturnType<AssistantDeliveryService['validateOwnerRoute']> | undefined;
+    /**
+     * Host-only, READ-ONLY proof that the live caller Agent is bound to an
+     * active `linked` principal whose `linked_to_id` is the CURRENT owner row of
+     * this owner route. The receipt has a distinct protocol and no
+     * `receiptVersion`, so v2 owner checks reject it; it never grants owner,
+     * approval, continuation or mutation authority. Every call re-reads the
+     * route, the root owner, the alias binding and the alias principal twice.
+     */
+    inspectOwnerAliasRoute(agent: Agent, authorityId: string): Readonly<OwnerAliasReceipt> | undefined;
+    /**
+     * Host-only proof of one live, unsettled native tool call in the alias's
+     * exact claimed human Inbox turn. Read-only; it is NOT an owner foreground
+     * proof (`assistant-delivery/foreground-tool-call/v1`) and must never be
+     * accepted where one is required.
+     */
+    inspectOwnerAliasForegroundToolCall(input: Readonly<{
+        agent: Agent;
+        authorityId: string;
+        callId: string;
+        toolName: string;
+        argumentsJson: string;
+    }>): Readonly<OwnerAliasForegroundToolCallAttestation> | undefined;
+    private currentAliasTurn;
+    private captureAliasTurn;
     /** Host-only durable ordinary-turn metadata; never registered as a model tool. */
     listOwnerForegroundTaskSources(input: OwnerForegroundTaskSourceScope & {
         after?: Readonly<OwnerForegroundTaskSourceCursor>;
@@ -536,6 +1017,13 @@ export declare class AssistantDeliveryService extends Service {
         maxInputBytes?: number;
         maxReplyBytes?: number;
     }): Readonly<OwnerForegroundTaskSourceContent> | undefined;
+    /** Host-only bounded original input, independent of successful reply evidence. */
+    readOwnerForegroundTaskInput(input: OwnerForegroundTaskSourceScope & {
+        inboxId: string;
+        expectedSourceDigest: string;
+        offset?: number;
+        maxBytes?: number;
+    }): Readonly<OwnerForegroundTaskInput> | undefined;
     /** Hold Delivery's owner/source writer fence across synchronous downstream adoption. */
     withOwnerForegroundTaskSourceFence<T>(input: OwnerForegroundTaskSourceScope & {
         inboxId: string;
@@ -547,6 +1035,12 @@ export declare class AssistantDeliveryService extends Service {
     withOwnerForegroundTaskSourcesFence<T>(input: OwnerForegroundTaskSourceScope & {
         sources: readonly Readonly<OwnerForegroundTaskSourceRef>[];
     }, callback: (sources: readonly (Readonly<OwnerForegroundTaskSourceContent> | undefined)[]) => T): T;
+    /** One Delivery → Evaluation → WorkItems source fence; callback must be local and synchronous. */
+    withOwnerLearningSourcesFence<T>(input: OwnerForegroundTaskSourceScope & {
+        sources: readonly OwnerLearningSourceExpectation[];
+    }, callback: (sources: readonly OwnerLearningSourceSnapshot[]) => T): T;
+    /** Strict single-source wrapper: unavailable or changed sources never invoke the callback. */
+    withOwnerWorkItemLearningTaskFence<T>(input: OwnerWorkItemLearningTaskFenceInput, callback: (task: Readonly<OwnerWorkItemLearningTask>) => T): T;
     /** Host-only snapshot of the model selected for this owner's external conversation. */
     inspectOwnerModelSelection(input: {
         authorityId: string;
@@ -556,10 +1050,24 @@ export declare class AssistantDeliveryService extends Service {
         sourceAgent?: Agent;
     }): Readonly<ModelRouteRef>;
     /**
-     * Resolve one canonical foreground result against its actual owner lineage.
+     * Resolve one canonical work-item result against its actual owner lineage.
      * Evaluation's workspace/preset scope alone does not establish ownership.
      * Historical Sessions remain eligible after /new, but not after owner ABA.
      */
+    inspectOwnerWorkItemLearningTask(input: {
+        authorityId: string;
+        principalId: string;
+        workspace: string;
+        agentPreset: string;
+        outcomeId: string;
+    }): Readonly<OwnerWorkItemLearningTask> | undefined;
+    private ownerWorkItemLearningTaskState;
+    /** Host-only complete historical objective; old feedback and Memory identities are not reinterpreted. */
+    inspectOwnerWorkItemEngineeringContext(input: OwnerWorkItemEngineeringContextLocator): Readonly<OwnerWorkItemEngineeringContext> | undefined;
+    /** Every page, including the last, revalidates the entire exact source frame. */
+    readOwnerWorkItemEngineeringContext(input: OwnerWorkItemEngineeringContextReadInput): Readonly<OwnerWorkItemEngineeringContextPage> | undefined;
+    withOwnerWorkItemEngineeringContextFence<T>(input: OwnerWorkItemEngineeringContextExpectation, callback: (source: Readonly<OwnerWorkItemEngineeringContextSource>) => T): T;
+    private withOwnerWorkItemEngineeringContextSource;
     inspectOwnerForegroundLearningTask(input: {
         authorityId: string;
         principalId: string;
@@ -579,6 +1087,8 @@ export declare class AssistantDeliveryService extends Service {
         idempotencyKey: string;
         text: string;
         format?: 'markdown' | 'plain';
+        /** WP19 stage 1: audited only; omission records `missing-purpose`. */
+        attention?: AttentionEnvelope;
     }): OutboxRecord;
     enqueueApproval(input: {
         route: Readonly<ApprovalDispatchRouteV2>;
@@ -660,6 +1170,7 @@ export declare class AssistantDeliveryService extends Service {
     private recoverPendingInbound;
     private runConversationTransition;
     private rotateBinding;
+    private clearSchedulerTimers;
     private stopInternal;
     private drainPreferenceProjections;
     private runPreferenceProjection;