@effect-agent/testing 0.1.0-beta.9 → 0.1.0-beta.91

package/dist/Certification.mjs

@@ -0,0 +1,633 @@
+import { Cause, Clock, DateTime, Duration, Effect, Exit, Layer, Option, Ref, Schema, Stream } from "effect";
+import { LanguageModel, Model, Tool, Toolkit } from "effect/unstable/ai";
+import * as Agent from "effect-agent/agent";
+import { AgentPolicy } from "effect-agent/agent-policy";
+import { DurableWorkerBinding } from "effect-agent/agent-registration";
+import { DurableAgentRuntime, DurableRuntimeConfig } from "effect-agent/durable-agent-runtime";
+import { DurableRuntimeFailpointError, DurableRuntimeFailpointLocation } from "effect-agent/durable-failpoint";
+import { DurableStep, DurableStepError } from "effect-agent/durable-step";
+import { IdGenerator } from "effect-agent/id-generator";
+import { RunId, ThreadId, ToolCallId, TurnId } from "effect-agent/identifiers";
+import { DefinitionDigests, DeploymentId, Digest, ProducerId } from "effect-agent/records";
+import { childThreadIdFor } from "effect-agent/run-journal";
+import { RunToolAuthorization } from "effect-agent/run-options";
+import * as Subagent from "effect-agent/subagent";
+import { SubagentPolicy } from "effect-agent/subagent";
+import { SubagentReservationsMemoryLive } from "effect-agent/subagent-reservations";
+import { ApprovalDecisionCommand, DEFAULT_OWNERSHIP_LEASE_DURATION, IdempotencyKey, Principal, ResolutionSafeToRetry, SubmissionLedger, SubmissionLookupById, UnknownResolutionCommand } from "effect-agent/submission-ledger";
+import { CertificationReport, CertificationSweepResult, CertificationTierThreeReport, CertifiedAdapterIdentity, certifyPorts } from "effect-agent/testing/certification";
+import { DurableRuntimeFailpointTestControl } from "effect-agent/testing/durable-failpoint-test-control";
+import { verifyThreadInvariants } from "effect-agent/thread-invariants";
+import { LoadCheckpointRequest, ThreadExportRequest, ThreadStore } from "effect-agent/thread-store";
+import { ToolReconciler } from "effect-agent/tool-reconciler";
+import { WakeScheduler } from "effect-agent/wake-scheduler";
+import { TestClock } from "effect/testing";
+//#region src/internal/certification-report.ts
+/** Fold executed results without acquiring adapters or claiming coverage from citations. */
+const makeCertificationReport = (results) => {
+	const { adapter, tier1, tier2, tier3 } = results;
+	const ok = tier1.every((result) => result.status === "passed") && tier2.every((result) => result.status !== "failed") && tier3.cases.every((result) => result.status === "passed");
+	return CertificationReport.make({
+		format: "effect-agent/certification@2",
+		...results,
+		ok,
+		fullyCertified: ok && adapter.durability !== "non-durable" && tier3.status === "exercised" && tier3.cases.length > 0 && tier3.cases.every((result) => result.suite === "real-loss")
+	});
+};
+//#endregion
+//#region src/Certification.ts
+/** The six Tier-2 scenario shapes in sweep order. */
+const CERTIFICATION_SCENARIOS = [
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+];
+/**
+* Coordinator failpoint locations that none of the six scenario shapes can reach, recorded
+* honestly instead of silently claimed. These require operator, compaction, reservation,
+* background-worker, or Agent-update paths the shapes do not take. They are pinned in-process
+* by the P5/S2 suites (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
+* intent failpoint", `durable-runtime.test.ts` abort rows,
+* `durable-subagents.test.ts` abort propagation) and by the process-kill/eviction crash
+* matrices. Runner tests assert the observed never-fired set equals EXACTLY this list, so a
+* protocol change that silently stops exercising a location fails the certification.
+*/
+const TIER2_UNREACHED_LOCATIONS = [
+	"checkpoint:before-save",
+	"checkpoint:after-save",
+	"abort:after-intent",
+	"compaction:before-canonical-append",
+	"compaction:after-canonical-append",
+	"policy:before-reservation-append",
+	"policy:after-reservation-append",
+	"resolve:after-intent",
+	"subagent:after-child-abort-intent",
+	"worker:before-source-append",
+	"worker:after-source-append",
+	"worker:before-origin-append",
+	"worker:after-origin-append",
+	"worker:before-completion-append",
+	"worker:after-completion-append",
+	"worker:before-subtree-append",
+	"worker:after-subtree-append",
+	"worker:before-report-append",
+	"worker:after-report-append",
+	"worker:before-report-delivery",
+	"worker:after-report-delivery",
+	"update:before-canonical-append",
+	"update:after-canonical-append",
+	"update:before-delivery-insert",
+	"update:after-delivery-insert"
+];
+/** Locations of `tier2` rows whose armed fault never fired in ANY scenario, sorted. */
+const tier2NeverFiredLocations = (tier2) => {
+	const fired = /* @__PURE__ */ new Set();
+	for (const row of tier2) if (row.failpointFired) fired.add(row.location);
+	return DurableRuntimeFailpointLocation.literals.filter((location) => !fired.has(location)).sort();
+};
+const SHA_A = Schema.decodeSync(Digest)("a".repeat(64));
+const DIGESTS = DefinitionDigests.make({
+	agent: SHA_A,
+	model: SHA_A,
+	tools: SHA_A
+});
+const CHILD_DIGEST_STRINGS = {
+	agent: "b".repeat(64),
+	model: "c".repeat(64),
+	tools: "d".repeat(64)
+};
+const CHILD_DIGESTS = DefinitionDigests.make({
+	agent: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.agent),
+	model: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.model),
+	tools: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.tools)
+});
+const PRINCIPAL = Schema.decodeSync(Principal)("principal-certification");
+const decodeThreadId = Schema.decodeSync(ThreadId);
+const decodeIdempotencyKey = Schema.decodeSync(IdempotencyKey);
+const decodeToolCallId = Schema.decodeSync(ToolCallId);
+const usage = {
+	inputTokens: {},
+	outputTokens: {}
+};
+const finalParts = (text) => [
+	{
+		type: "text-start",
+		id: "answer"
+	},
+	{
+		type: "text-delta",
+		id: "answer",
+		delta: text
+	},
+	{
+		type: "text-end",
+		id: "answer"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage
+	}
+];
+const toolCallPart = (id, name, params) => ({
+	type: "tool-call",
+	id,
+	name,
+	params,
+	providerExecuted: false
+});
+const toolTurn = (...calls) => [...calls, {
+	type: "finish",
+	reason: "tool-calls",
+	usage
+}];
+/**
+* Stateless scripted model that decides by PROMPT SHAPE instead of call count: while the
+* prompt carries no committed tool result the model declares `toolParts` (when given),
+* otherwise it answers with the final text. Deciding on the canonical prompt keeps every cell
+* deterministic regardless of where the injected fault fell — a re-invoked Turn re-declares
+* the same batch and a resumed batch flows into the final answer, so every scenario always
+* exercises its tool path and always converges.
+*/
+const promptShapeModel = (name, finalText, toolParts) => Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (request) => {
+		const hasToolResult = request.prompt.content.some((message) => message.role === "tool");
+		const parts = toolParts === void 0 || hasToolResult ? finalParts(finalText) : toolParts;
+		return Stream.fromIterable(parts);
+	}
+})));
+const CERTIFICATION_MAX_DURATION = "10 minutes";
+const policy = AgentPolicy.make({
+	maxTurns: 4,
+	maxToolCalls: 4,
+	maxDuration: CERTIFICATION_MAX_DURATION,
+	toolConcurrency: 2
+});
+const QuestionInput = Schema.Struct({ question: Schema.String });
+const AnswerOutput = Schema.Struct({ answer: Schema.String });
+/** plain / join: no tools — the pure Turn/submission/join seams. */
+const plainDefinition = Agent.make("certify-plain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy
+});
+/** uncertain-tool: unannotated → fail-closed `uncertain`, enters the prepared/settled protocol. */
+const Book = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String })
+});
+const bookToolkit = Toolkit.make(Book);
+const uncertainDefinition = Agent.make("certify-uncertain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book it.",
+	toolkit: bookToolkit,
+	policy
+});
+/** durable-steps: declaring `DurableStep` as a dependency is what makes the Tool durable. */
+const Itinerary = Tool.make("itinerary", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ state: Schema.String }),
+	failure: DurableStepError,
+	dependencies: [DurableStep]
+});
+const itineraryToolkit = Toolkit.make(Itinerary);
+const stepsDefinition = Agent.make("certify-steps", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Reserve the itinerary.",
+	toolkit: itineraryToolkit,
+	policy
+});
+/** approval: fail-closed — no `DurableApprovalResolver` Layer, so undecided approvals suspend. */
+const BookApproval = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String }),
+	needsApproval: true
+});
+const approvalToolkit = Toolkit.make(BookApproval);
+const approvalDefinition = Agent.make("certify-approval", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book after approval.",
+	toolkit: approvalToolkit,
+	policy
+});
+/** delegation: durable attached child plus an ordinary uncertain sibling in ONE batch. */
+const childDefinition = Agent.make("certify-child", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: CERTIFICATION_MAX_DURATION,
+		toolConcurrency: 1
+	})
+});
+var CertifyDelegationFailed = class extends Schema.TaggedError()("CertifyDelegationFailed", { childErrorTag: Schema.String }) {};
+const researchDelegation = Subagent.define("delegate_research", {
+	description: "Research one bounded question and return findings.",
+	target: childDefinition,
+	parameters: Schema.Struct({ topic: Schema.String }),
+	success: Schema.Struct({ summary: Schema.String }),
+	failure: CertifyDelegationFailed,
+	prepareInput: ({ topic }) => Effect.succeed({ question: `research:${topic}` }),
+	projectResult: (output) => Effect.succeed({ summary: `finding:${output.answer}` }),
+	policy: SubagentPolicy.make({
+		maxChildren: 2,
+		maxConcurrency: 2,
+		maxTurns: 4,
+		maxToolCalls: 4,
+		maxDuration: CERTIFICATION_MAX_DURATION
+	})
+});
+const Lookup = Tool.make("lookup", {
+	parameters: Schema.Struct({ key: Schema.String }),
+	success: Schema.Struct({ value: Schema.String })
+});
+const coordinatorDefinition = Agent.make("certify-coordinator", {
+	input: Schema.Struct({ mission: Schema.String }),
+	output: Schema.Struct({ report: Schema.String }),
+	instructions: "Delegate and look up, then answer as JSON.",
+	toolkit: Toolkit.make(researchDelegation.tool, Lookup),
+	policy: AgentPolicy.make({
+		maxTurns: 4,
+		maxToolCalls: 3,
+		maxDuration: CERTIFICATION_MAX_DURATION,
+		toolConcurrency: 2
+	})
+});
+const mapChildFailure = (failure) => CertifyDelegationFailed.make({ childErrorTag: failure._tag });
+const DELEGATE_CALL = decodeToolCallId("delegate-1");
+/** Fixture-only identity source consumed by the delegation Layer's ephemeral capture. */
+const identifiers = Layer.effect(IdGenerator, Effect.gen(function* () {
+	const counter = yield* Ref.make(0);
+	const next = (decode, prefix) => Ref.getAndUpdate(counter, (value) => value + 1).pipe(Effect.map((value) => decode(`${prefix}-${value}`)));
+	return {
+		nextThreadId: next(decodeThreadId, "certify-fixture-thread"),
+		nextRunId: next(Schema.decodeSync(RunId), "certify-fixture-run"),
+		nextTurnId: next(Schema.decodeSync(TurnId), "certify-fixture-turn")
+	};
+}));
+const delegationSupport = Layer.mergeAll(SubagentReservationsMemoryLive, identifiers);
+const submitOptionsFor = (slug, threadId) => ({
+	threadId,
+	principal: PRINCIPAL,
+	idempotencyKey: decodeIdempotencyKey(`certify-key-${slug}`),
+	definitions: DIGESTS
+});
+/** One single-agent cell: one lane, one Submission, one registered exact-digest binding. */
+const makeSingleAgentCell = (definition, resolved, slug) => {
+	const threadId = decodeThreadId(`certify-${slug}`);
+	const submit = Effect.gen(function* () {
+		return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+			id: definition.id,
+			input: definition.input
+		} }, { question: `certify ${slug}` }, submitOptionsFor(slug, threadId))];
+	});
+	return {
+		bindings: [resolved],
+		submit,
+		lanes: () => [threadId]
+	};
+};
+const makeCell = Effect.fn("Certification.makeCell")(function* (scenario, slug) {
+	switch (scenario) {
+		case "plain": {
+			const binding = Agent.withModel(plainDefinition, promptShapeModel("certify-plain", "{\"answer\":\"done\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			return makeSingleAgentCell(plainDefinition, resolved, slug);
+		}
+		case "uncertain-tool": {
+			const binding = Agent.withModel(uncertainDefinition, promptShapeModel("certify-uncertain", "{\"answer\":\"booked\"}", toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = bookToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(uncertainDefinition, resolved, slug);
+		}
+		case "durable-steps": {
+			const binding = Agent.withModel(stepsDefinition, promptShapeModel("certify-steps", "{\"answer\":\"reserved\"}", toolTurn(toolCallPart("itinerary-1", "itinerary", { ref: `trip-${slug}` }))));
+			const toolLayer = itineraryToolkit.toLayer({ itinerary: ({ ref }) => Effect.gen(function* () {
+				const step = yield* DurableStep;
+				return { state: `${yield* step.do("reserve-flight", Schema.String, Effect.succeed(`flight-${ref}`))}+${yield* step.do("reserve-lodging", Schema.String, Effect.succeed(`lodging-${ref}`))}` };
+			}) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(stepsDefinition, resolved, slug);
+		}
+		case "approval": {
+			const binding = Agent.withModel(approvalDefinition, promptShapeModel("certify-approval", "{\"answer\":\"approved\"}", toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = approvalToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(approvalDefinition, resolved, slug);
+		}
+		case "join": {
+			const binding = Agent.withModel(plainDefinition, promptShapeModel("certify-join", "{\"answer\":\"host answer\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			const threadId = decodeThreadId(`certify-${slug}`);
+			const submitOne = Effect.fn("Certification.submitOne")(function* (key, question) {
+				return yield* (yield* DurableAgentRuntime).submit({ definition: {
+					id: plainDefinition.id,
+					input: plainDefinition.input
+				} }, { question }, {
+					threadId,
+					principal: PRINCIPAL,
+					idempotencyKey: decodeIdempotencyKey(key),
+					definitions: DIGESTS
+				});
+			});
+			return {
+				bindings: [resolved],
+				submit: Effect.gen(function* () {
+					return [yield* submitOne(`certify-key-${slug}-host`, "host question"), yield* submitOne(`certify-key-${slug}-queued`, "queued question")];
+				}),
+				lanes: () => [threadId]
+			};
+		}
+		case "delegation": {
+			const childBinding = Agent.withModel(childDefinition, promptShapeModel("certify-child", "{\"answer\":\"child-answer\"}"));
+			const parentBinding = Agent.withModel(coordinatorDefinition, promptShapeModel("certify-parent", "{\"report\":\"done\"}", toolTurn(toolCallPart("delegate-1", "delegate_research", { topic: "paris" }), toolCallPart("lookup-1", "lookup", { key: "hotels" }))));
+			const delegationLayer = Subagent.layer(researchDelegation, childBinding, {
+				mapChildFailure,
+				durable: { targetDigests: CHILD_DIGEST_STRINGS }
+			}).pipe(Layer.provide(delegationSupport));
+			const lookupLayer = Toolkit.make(Lookup).toLayer({ lookup: ({ key }) => Effect.succeed({ value: `found-${key}` }) });
+			const parentResolved = yield* DurableWorkerBinding.make(parentBinding, DIGESTS).pipe(Effect.provide(Layer.mergeAll(delegationLayer, lookupLayer)));
+			const childResolved = yield* DurableWorkerBinding.make(childBinding, CHILD_DIGESTS);
+			const threadId = decodeThreadId(`certify-${slug}`);
+			return {
+				bindings: [parentResolved, childResolved],
+				submit: Effect.gen(function* () {
+					return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+						id: coordinatorDefinition.id,
+						input: coordinatorDefinition.input
+					} }, { mission: "plan" }, submitOptionsFor(slug, threadId))];
+				}),
+				lanes: (receipts) => {
+					const parent = receipts.at(0);
+					return parent === void 0 ? [threadId] : [threadId, childThreadIdFor(parent.submissionId, DELEGATE_CALL)];
+				}
+			};
+		}
+	}
+});
+/** Maximum recovery/drive/unblock rounds before a cell is reported non-convergent. */
+const MAX_REDRIVE_ROUNDS = 8;
+/**
+* Verify one lane after convergence: canonical export + every lane Submission the ledger or
+* the log names (the same collection rule as the admin `verify` member), fed to the shared
+* invariant checker in convergence mode WITH the captured per-batch producer directory, so
+* the digest chain is fully recomputed instead of skipped.
+*/
+const verifyLane = Effect.fn("Certification.verifyLane")(function* (lane, batchProducers) {
+	const store = yield* ThreadStore;
+	const ledger = yield* SubmissionLedger;
+	const exported = yield* store.export(ThreadExportRequest.make({ threadId: lane }));
+	const rows = /* @__PURE__ */ new Map();
+	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+	for (const submission of nonterminal) if (submission.threadId === lane) rows.set(submission.submissionId, submission);
+	const named = /* @__PURE__ */ new Set();
+	for (const envelope of exported.records) {
+		const payload = envelope.record.payload;
+		if (payload._tag === "UserInputRecorded" || payload._tag === "SubmissionSettled" || payload._tag === "AbortRequested") {
+			if (payload.submissionId !== void 0) named.add(payload.submissionId);
+		}
+	}
+	for (const submissionId of named) {
+		if (rows.has(submissionId)) continue;
+		const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId }));
+		if (Option.isSome(found) && found.value.threadId === lane) rows.set(submissionId, found.value);
+	}
+	const checkpoint = store.checkpoints === void 0 ? Option.none() : yield* store.checkpoints.load(LoadCheckpointRequest.make({ threadId: lane }));
+	return yield* verifyThreadInvariants({
+		export: exported,
+		submissions: [...rows.values()],
+		batchProducers,
+		checkpoint: Option.getOrUndefined(checkpoint),
+		checkpointsSupported: store.checkpoints !== void 0,
+		requireAllSettled: true
+	});
+});
+const failureTagOf = (cause) => {
+	const failure = Cause.findErrorOption(cause);
+	if (Option.isSome(failure)) {
+		const error = failure.value;
+		if (typeof error === "object" && error !== null && "_tag" in error) return String(error._tag);
+		return String(error).slice(0, 256);
+	}
+	return "defect";
+};
+/** Discover a clean path, or arm one location; both drives converge and verify real storage. */
+const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (scenario, location, batchProducers, leaseAdvance, reached) {
+	const ledger = yield* SubmissionLedger;
+	const control = yield* DurableRuntimeFailpointTestControl;
+	const slug = `${scenario}-${location?.replaceAll(":", "-") ?? "discovery"}`;
+	const failed = (detail, fired) => ({
+		failpointFired: fired,
+		status: "failed",
+		digestChainVerified: false,
+		detail: detail.slice(0, 4096)
+	});
+	const cell = yield* makeCell(scenario, slug);
+	const runtime = yield* DurableAgentRuntime.pipe(Effect.provide(DurableAgentRuntime.layerWithBindings(cell.bindings).pipe(Layer.provide(RunToolAuthorization.allowAll))));
+	const submit = cell.submit.pipe(Effect.provideService(DurableAgentRuntime, runtime));
+	const fired = yield* Ref.make(false);
+	yield* control.setHandler((hit) => Effect.suspend(() => {
+		reached.add(hit);
+		return hit !== location ? Effect.void : Ref.getAndSet(fired, true).pipe(Effect.flatMap((already) => already ? Effect.void : Effect.fail(DurableRuntimeFailpointError.make({ location: hit }))));
+	}));
+	let receipts;
+	const firstSubmit = yield* Effect.exit(submit);
+	if (Exit.isSuccess(firstSubmit)) receipts = firstSubmit.value;
+	else {
+		const secondSubmit = yield* Effect.exit(submit);
+		if (Exit.isFailure(secondSubmit)) {
+			yield* control.clear;
+			return failed(`submission replay did not recover: ${failureTagOf(secondSubmit.cause)}`, yield* Ref.get(fired));
+		}
+		receipts = secondSubmit.value;
+	}
+	const lanes = cell.lanes(receipts);
+	const driveLane = (lane) => runtime.processThreadResolved(lane);
+	const allSettled = Effect.gen(function* () {
+		for (const receipt of receipts) {
+			const snapshot = yield* ledger.lookup(SubmissionLookupById.make({ submissionId: receipt.submissionId }));
+			if (Option.isNone(snapshot) || snapshot.value.state !== "settled") return false;
+		}
+		return true;
+	});
+	let converged = false;
+	for (let round = 0; round < MAX_REDRIVE_ROUNDS && !converged; round++) {
+		yield* TestClock.adjust(leaseAdvance);
+		yield* Effect.exit(runtime.runRecovery);
+		for (const lane of lanes) yield* Effect.exit(driveLane(lane));
+		for (const lane of lanes) {
+			const explains = yield* Effect.exit(runtime.explainThread(lane));
+			if (Exit.isFailure(explains)) continue;
+			for (const explanation of explains.value) {
+				for (const unknown of explanation.evidence.unknownCalls) {
+					if (unknown.resolved) continue;
+					yield* Effect.exit(runtime.resolveUnknown(UnknownResolutionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: unknown.toolCallId,
+						author: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`,
+						resolution: ResolutionSafeToRetry.make()
+					})));
+				}
+				for (const pending of explanation.evidence.approvalsPending) {
+					if (explanation.evidence.approvalDecisions.some((decision) => decision.toolCallId === pending.toolCallId)) continue;
+					yield* Effect.exit(runtime.resolveApproval(ApprovalDecisionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: pending.toolCallId,
+						decision: "approved",
+						resolver: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`
+					})));
+				}
+			}
+		}
+		const settled = yield* Effect.exit(allSettled);
+		converged = Exit.isSuccess(settled) && settled.value;
+	}
+	yield* control.clear;
+	const wasFired = yield* Ref.get(fired);
+	if (!converged) return failed(`did not converge within ${MAX_REDRIVE_ROUNDS} re-drive rounds`, wasFired);
+	let digestChainVerified = true;
+	const failedChecks = [];
+	for (const lane of lanes) {
+		const verdict = yield* Effect.exit(verifyLane(lane, batchProducers));
+		if (Exit.isFailure(verdict)) return failed(`lane ${lane} could not be verified: ${failureTagOf(verdict.cause)}`, wasFired);
+		for (const check of verdict.value.checks) {
+			if (check.status === "failed") failedChecks.push(`${lane}:${check.name}${check.detail === void 0 ? "" : ` (${check.detail})`}`);
+			if (check.name === "digest-chain" && check.status !== "passed") digestChainVerified = false;
+		}
+	}
+	if (failedChecks.length > 0 || !digestChainVerified) return failed(failedChecks.length > 0 ? `invariant checks failed: ${failedChecks.join("; ")}` : "the digest chain was not fully recomputed", wasFired);
+	return {
+		failpointFired: wasFired,
+		status: wasFired ? "converged" : "not-triggered",
+		digestChainVerified
+	};
+});
+/**
+* Resolve the Tier-3 record honestly (plan §1): a non-durable reference adapter has no real
+* loss to exercise (`not-applicable`); a supplied lever runs NOW (`exercised`); committed
+* real-loss citations are recorded (`recorded-evidence`); otherwise the certificate says
+* `not-exercised` — a scoped statement, never a silent claim.
+*/
+const resolveTierThree = Effect.fn("Certification.resolveTierThree")(function* (durability, options) {
+	if (durability === "non-durable") return CertificationTierThreeReport.make({
+		status: "not-applicable",
+		evidence: [],
+		cases: [],
+		detail: "the adapter declares non-durable state (reference/conformance adapter); there is no real loss to exercise"
+	});
+	if (options.crashLever !== void 0) {
+		const cases = yield* options.crashLever;
+		return CertificationTierThreeReport.make({
+			status: cases.length === 0 ? "not-exercised" : "exercised",
+			evidence: options.tierThreeEvidence ?? [],
+			cases,
+			...cases.length === 0 ? { detail: "the supplied crash lever executed no real-loss cases" } : {}
+		});
+	}
+	if (options.tierThreeEvidence !== void 0 && options.tierThreeEvidence.length > 0) return CertificationTierThreeReport.make({
+		status: "recorded-evidence",
+		evidence: options.tierThreeEvidence,
+		cases: []
+	});
+	return CertificationTierThreeReport.make({
+		status: "not-exercised",
+		evidence: [],
+		cases: [],
+		detail: "no crash lever was supplied and no committed real-loss evidence was cited; Tier 3 is NOT discharged for this adapter"
+	});
+});
+const nowUtc = Effect.map(Clock.currentTimeMillis, (millis) => DateTime.toUtc(DateTime.makeUnsafe(millis)));
+/**
+* Certify one durable adapter pair (plan §1, §8 WP2). Runs Tier 2 FIRST over pristine
+* storage (each cell converges to all-settled before the next starts, so the recovery scan
+* never sees foreign leftovers), then Tier 1's port contract cases (whose lanes deliberately
+* end in every nonterminal shape), then records Tier 3. Requires `Crypto.Crypto` and a
+* TestClock-backed environment; the candidate Layers are built exactly once.
+*/
+const certifyDurableAdapters = (options) => {
+	const batchProducers = /* @__PURE__ */ new Map();
+	const capturingStore = Layer.effect(ThreadStore)(Effect.gen(function* () {
+		const inner = yield* ThreadStore;
+		return ThreadStore.of({
+			...inner,
+			append: (request) => Effect.sync(() => {
+				batchProducers.set(request.batch.batchId, request.batch.producerId);
+			}).pipe(Effect.andThen(inner.append(request)))
+		});
+	})).pipe(Layer.provide(options.threadStore));
+	const environment = Layer.mergeAll(options.submissionLedger, capturingStore, options.wakeScheduler ?? WakeScheduler.layerNoop, DurableRuntimeFailpointTestControl.layer, ToolReconciler.uncertain, DurableRuntimeConfig.layer({
+		deploymentId: Schema.decodeSync(DeploymentId)("deployment-certification"),
+		producerId: Schema.decodeSync(ProducerId)("producer-certification"),
+		settlementPollInterval: Duration.millis(50),
+		leaseRenewalInterval: Duration.seconds(5),
+		abortPollInterval: Duration.millis(50)
+	}));
+	const leaseAdvance = Duration.millis(Duration.toMillis(options.ownershipLeaseDuration ?? DEFAULT_OWNERSHIP_LEASE_DURATION) + 1e3);
+	return Effect.gen(function* () {
+		const ledger = yield* SubmissionLedger;
+		const tier2 = [];
+		const discoveries = [];
+		for (const scenario of CERTIFICATION_SCENARIOS) {
+			const reached = /* @__PURE__ */ new Set();
+			const outcome = yield* runSweepCell(scenario, void 0, batchProducers, leaseAdvance, reached);
+			discoveries.push({
+				scenario,
+				outcome,
+				reached
+			});
+		}
+		const observed = new Set(discoveries.flatMap(({ reached }) => [...reached]));
+		const unaccounted = new Set(DurableRuntimeFailpointLocation.literals.filter((location) => !observed.has(location) && !TIER2_UNREACHED_LOCATIONS.includes(location)));
+		for (const discovery of discoveries) {
+			const { scenario, reached } = discovery;
+			const outcomes = /* @__PURE__ */ new Map();
+			if (discovery.outcome.status !== "failed") while (true) {
+				const location = DurableRuntimeFailpointLocation.literals.find((candidate) => !outcomes.has(candidate) && (reached.has(candidate) || unaccounted.has(candidate)));
+				if (location === void 0) break;
+				outcomes.set(location, yield* runSweepCell(scenario, location, batchProducers, leaseAdvance, reached));
+			}
+			for (const location of DurableRuntimeFailpointLocation.literals) {
+				const outcome = outcomes.get(location) ?? discovery.outcome;
+				tier2.push(CertificationSweepResult.make({
+					scenario,
+					location,
+					...outcome,
+					...outcomes.has(location) || outcome.status === "failed" ? {} : { detail: "verified clean scenario did not reach this location" }
+				}));
+			}
+		}
+		const tier1 = yield* certifyPorts();
+		const capabilities = yield* ledger.capabilities;
+		const tier3 = yield* resolveTierThree(capabilities.durability, options);
+		const generatedAt = yield* nowUtc;
+		return makeCertificationReport({
+			adapter: CertifiedAdapterIdentity.make({
+				name: options.adapter.name,
+				...options.adapter.version === void 0 ? {} : { version: options.adapter.version },
+				durability: capabilities.durability
+			}),
+			generatedAt,
+			tier1,
+			tier2,
+			tier3
+		});
+	}).pipe(Effect.provide(environment));
+};
+//#endregion
+export { CERTIFICATION_SCENARIOS, TIER2_UNREACHED_LOCATIONS, certifyDurableAdapters, resolveTierThree, tier2NeverFiredLocations };
+
+//# sourceMappingURL=Certification.mjs.map