@eir-labs/coltrane 0.24.34 → 0.24.36

package/dist/src/server.js

@@ -24,7 +24,7 @@ import { createOutputMirror, defaultMirrorDir, outputPreview, mirrorStorageRef }
 import { FileLedger, SplitLedger, LedgerError, LEDGER_SCHEMA_VERSION, defaultLedgerPath, defaultGenomeLedgerPath, } from "./ledger.js";
 import { sealDrill } from "./seal_drill.js";
 import { standardSimulate } from "./simulate.js";
-import { runGig, BudgetExhausted, GigAborted, ResumeRefused, partialGigUsage, partialBudgetState } from "./runtime.js";
+import { runGig, BudgetExhausted, GigAborted, ResumeRefused, partialGigUsage, partialBudgetState, partitionGigInputKeys, unknownGigInputMessage } from "./runtime.js";
 import { assembleRunDeps, resolveWorkingRepo } from "./run_deps.js";
 import { createCheckpointStore, createReuseStore } from "./reuse.js";
 import { killLiveChairChildren } from "./claude_invoker.js";
@@ -3579,6 +3579,81 @@ async function callSurfaceTool(slug, args, deps) {
             // Hosted dispatch NEVER spawns. With a queue seam it queues (the gig table is the
             // queue; a drain worker claims and runs); without one it says so, typed.
             if (deps.queueGig) {
+                // contract-post-time-gig-input-v1 — validate the payload BEFORE it is queued, in the SAME
+                // words as runGig's preflight, so the caller who can still fix the key is the one who is told
+                // (not the worker, later). Everything below the guard queues exactly as today; a throw on this
+                // path would reach the caller as an opaque `tool failed`, so every refusal here is a typed JSON
+                // reply and NEVER an exception.
+                // DOT access on purpose (not a bracket-and-string index): the advertised_args_are_read parser
+                // slurps the last dispatchTool case (venue_credential_mint) to end-of-file, and a bracket read
+                // of a string-literal key here would be miscounted as that tool reading an arg it does not
+                // advertise — this comment must not spell that index pattern out either, or the parser counts
+                // the explanation as an instance of it. gig_dispatch advertises both keys; dot access keeps the
+                // read where it belongs. (Same reason org_hire above reads its args by dot.)
+                const input = args.input;
+                const isPayloadObject = typeof input === "object" && input !== null && !Array.isArray(input);
+                if (isPayloadObject) {
+                    const standard_slug = String(args.standard_slug ?? "");
+                    const payload = input;
+                    // (O4) declared inputs from deps.standards FIRST; only on a miss, exactly one narrow read of
+                    // the host-wired reader. The reader may throw or answer undefined — either means "unresolved".
+                    let declared;
+                    const held = deps.standards?.get(standard_slug);
+                    if (held) {
+                        declared = held.input_types ?? [];
+                    }
+                    else if (deps.declaredGigInputs) {
+                        try {
+                            declared = await deps.declaredGigInputs(standard_slug);
+                        }
+                        catch {
+                            declared = undefined; // a failed read is "could not check", never a guess or a refusal
+                        }
+                    }
+                    if (declared === undefined) {
+                        // (F1) neither source could supply the declared inputs. Do NOT guess and do NOT refuse:
+                        // queue as today and SAY the payload was not validated, so the reply never implies a check
+                        // it could not run. The preflight remains the backstop when the worker runs the gig.
+                        try {
+                            const data = await deps.queueGig(args);
+                            return {
+                                ok: true,
+                                data,
+                                input_validated: false,
+                                reason: `the payload was not validated at post time: standard "${standard_slug}" is not on this ` +
+                                    `surface (deps.standards) and no declaredGigInputs reader resolved its declared inputs. ` +
+                                    `The gig is queued and runGig's preflight validates it when the worker runs it.`,
+                            };
+                        }
+                        catch (e) {
+                            return { ok: false, error: e instanceof Error ? e.message : String(e) };
+                        }
+                    }
+                    // The SAME partition the preflight runs: a near miss refuses, other undeclared keys are named.
+                    const part = partitionGigInputKeys(Object.keys(payload), declared, (d) => payload[d] !== undefined);
+                    if (part.nearMiss !== undefined) {
+                        // (O1/O2) a typed refusal in the preflight's exact words — NOTHING is queued, nothing throws.
+                        return {
+                            ok: false,
+                            refusal: "unknown_gig_input",
+                            error: unknownGigInputMessage(part.nearMiss.key, part.nearMiss.declaredKey, standard_slug),
+                        };
+                    }
+                    // (O3/I2) no near miss: queue the UNCHANGED args, and name the harmless undeclared keys (sorted)
+                    // on the reply so the caller learns at post time what the engine will ignore. A clean payload
+                    // adds nothing — `undeclared_input_keys` is present only when there is at least one extra.
+                    try {
+                        const data = await deps.queueGig(args);
+                        return part.extras.length > 0
+                            ? { ok: true, data, undeclared_input_keys: part.extras }
+                            : { ok: true, data };
+                    }
+                    catch (e) {
+                        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+                    }
+                }
+                // (F2) an absent or non-object payload is a shape the door already handles — no new refusal,
+                // queued exactly as today.
                 try {
                     const data = await deps.queueGig(args);
                     return { ok: true, data };