@eir-labs/coltrane 0.8.0 → 0.8.1

package/dist/src/server.d.ts

@@ -60,6 +60,7 @@ export interface ServerDeps {
     reuse?: ReuseStore | undefined;
     toolProviders?: Map<string, ToolProvider> | undefined;
     mcpServerConfigs?: Record<string, unknown> | undefined;
+    output_write_mode?: "seal" | "validate" | undefined;
     hooks?: readonly ToolHook[] | undefined;
     output_mirror?: OutputMirror | undefined;
 }
@@ -91,6 +92,12 @@ export interface ToolSurfaceDeps extends ServerDeps {
      *  passes through, the store authorizes (an agent token is refused there). Without it, hosted
      *  gig_approve is an honest typed error. */
     approveGig?: ((args: Record<string, unknown>) => Promise<Record<string, unknown>>) | undefined;
+    /** Hosted gig cancel: cancel a QUEUED gig before a drain worker claims it (e.g.
+     *  postgrestCancelGig(ctx) → coltrane_gig_cancel for a member, or rpcCancelGig(ctx) →
+     *  coltrane_mcp_gig_cancel for an agent token). Parallel to queueGig — the engine passes
+     *  through, the store authorizes and refuses a claimed/running row. Without it, hosted
+     *  gig_cancel is an honest typed error. */
+    cancelGig?: ((args: Record<string, unknown>) => Promise<Record<string, unknown>>) | undefined;
     /** Hosted genome persistence: a successful define/compose/register also upserts through
      *  this store (the governed RPC), or the definition evaporates at end-of-request. */
     store?: GenomeStore | undefined;

package/dist/src/server.js

@@ -512,6 +512,25 @@ async function runImpl(slug, args, deps, approval) {
                 const data_raw = args["data"];
                 // undefined → {} (caller never sent the field); null stays null so Ajv sees it.
                 const data = (data_raw === undefined ? {} : data_raw);
+                // THE WRITE BOUNDARY. In "validate" mode the caller is a spawned model chair sealing
+                // in-band: run the COMPLETE seal predicate (validateWrite === checkWritable: the substance
+                // floor via validateOutput + the domain schema via registry.validate + core agreement) and
+                // return the verdict WITHOUT persisting. On a violation the throw below becomes an in-band
+                // { ok:false, error } (dispatchTool's catch), so the STILL-RUNNING agent gets the exact
+                // reason and self-corrects by calling output_write again — no invoker re-prompt, and no
+                // subset check. The runtime (executeChair) is the one sealer, so validating-not-sealing
+                // here is what keeps the output sealed exactly once.
+                if (deps.output_write_mode === "validate") {
+                    const verdict = deps.outputs.validateWrite({ core_type, domain_type, data });
+                    if (!verdict.valid) {
+                        throw new Error(verdict.reason ??
+                            `output rejected: "${domain_type || core_type}" did not satisfy its output contract`);
+                    }
+                    return {
+                        ok: true, requires_approval: approval,
+                        data: { validated: true, validation_result: { valid: true } },
+                    };
+                }
                 const rec = deps.outputs.write({
                     core_type,
                     domain_type,
@@ -533,7 +552,12 @@ async function runImpl(slug, args, deps, approval) {
                 for (const r of refs) {
                     deps.outputs.addRef(rec.id, r.to, r.relation, primitive);
                 }
-                return { ok: true, requires_approval: approval, data: { output_id: rec.id, primitive, output: rec } };
+                // `validation_result` is declared on this tool AND load-bearing: the write validated
+                // (deps.outputs.write → checkWritable) before the row existed, so reaching here means it
+                // passed — an INVALID payload would have thrown and been returned as { ok:false, error }
+                // by dispatchTool's try/catch. Say so, in the same { valid } shape the define/compose
+                // tools use, rather than declaring a field and never returning it (#234 family).
+                return { ok: true, requires_approval: approval, data: { output_id: rec.id, primitive, output: rec, validation_result: { valid: true } } };
             }
             case "execution_history_read": {
                 // Read the append-only ledger — the genome's run history. Filterable by
@@ -1842,6 +1866,32 @@ async function runImpl(slug, args, deps, approval) {
                     data: { status, aborted, cancellable: aborted, cleanup_result: { reason } },
                 };
             }
+            case "gig_cancel": {
+                // gig_cancel stops a QUEUED gig — one in the org gig table that no drain worker has
+                // claimed yet — so no worker ever claims it. That queue is a HOSTED concept: the store's
+                // gig table. A LOCAL surface has no queue (a local gig_dispatch runs immediately, tracked
+                // in gig_runs), so there is nothing here to cancel. The hosted seam (deps.cancelGig) is
+                // intercepted in callSurfaceTool before this handler is reached; reaching this switch is a
+                // NON-hosted call. Two honest answers:
+                //   * a live RUNNING gig is the wrong door — cancel is pre-claim; a running gig is stopped
+                //     by gig_abort. Fail closed and say so.
+                //   * otherwise there is no local queue to cancel from — a typed hosted-only explanation.
+                const gid = String(args["gig_id"] ?? "");
+                const live = gid.length > 0 ? deps.gig_runs?.get(gid) : undefined;
+                if (live && live.status === "running") {
+                    return {
+                        ok: false, requires_approval: approval,
+                        error: `gig "${gid}" is already running — gig_cancel only stops a QUEUED gig before a worker ` +
+                            "claims it. Use gig_abort to stop a running gig.",
+                    };
+                }
+                return {
+                    ok: false, requires_approval: approval,
+                    error: "gig_cancel stops a QUEUED gig in the org gig table before a drain worker claims it. " +
+                        "A local surface has no queue — cancel over the hosted store (coltrane_gig_cancel for a " +
+                        "member, coltrane_mcp_gig_cancel for an agent token).",
+                };
+            }
             case "gig_approve": {
                 // Approval is a MEMBER act whose authority lives in the STORE (the coltrane_gig_approve RPC
                 // is member-JWT-only; an agent token is refused there — the enforcement belongs store-side,
@@ -2867,6 +2917,28 @@ async function callSurfaceTool(slug, args, deps) {
                     "parked gig over the wire.",
             };
         }
+        if (slug === "gig_cancel") {
+            // Cancelling a QUEUED gig reaches the org gig table, never a local run — so hosted cancel
+            // is a pure pass-through to the store's cancel RPC (member JWT → coltrane_gig_cancel;
+            // agent token → coltrane_mcp_gig_cancel). The store cancels only a queued row and REFUSES
+            // a claimed/running one — that refusal, naming gig_abort, surfaces as a failed cancel.
+            if (deps.cancelGig) {
+                try {
+                    const data = await deps.cancelGig(args);
+                    return { ok: true, data };
+                }
+                catch (e) {
+                    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+                }
+            }
+            return {
+                ok: false,
+                hosted_unsupported: true,
+                error: "hosted cancel goes through the cancel RPC (coltrane_gig_cancel for a member, " +
+                    "coltrane_mcp_gig_cancel for an agent token) — the gig table is the queue and the store " +
+                    "authorizes. Wire deps.cancelGig (parallel to deps.queueGig) to cancel the queued gig over the wire.",
+            };
+        }
     }
     const result = await dispatchTool(slug, args, deps);
     // Hosted persistence: without a genome_dir the handlers compute + validate + seal identity
@@ -3001,6 +3073,11 @@ export function bootstrapServerDeps(genomeRoot) {
         registry,
         toolProviders,
         mcpServerConfigs, // the SAME object handed to the invoker — the preflight guard resolves against it
+        // A chair's spawn sets COLTRANE_OUTPUT_WRITE_MODE=validate so this child's coltrane server
+        // adjudicates the chair's in-band output_write calls against the full seal predicate WITHOUT
+        // persisting — the runtime that captures the validated payload is the one that seals. A bare
+        // server start (no env) keeps "seal": a human/agent output_write durably writes as before.
+        ...(process.env["COLTRANE_OUTPUT_WRITE_MODE"] === "validate" ? { output_write_mode: "validate" } : {}),
         output_mirror,
         // PR #78 follow-up: persist outputs to disk so the audit chain survives an
         // MCP session close (Rob cold-trial requirement). COLTRANE_OUTPUTS_DIR
@@ -3024,8 +3101,20 @@ export function bootstrapServerDeps(genomeRoot) {
             // own server + any the deployment registers in .mcp.json). An unresolvable grant fails closed.
             mcpServerConfigs,
             toolProviders, // the genome→provider bridge (above) — makes in_house grants resolvable
+            // The production seal path: a model chair SEALS IN-BAND by calling output_write (validated at
+            // the full write boundary, corrected in-band), and the invoker captures what passed. The
+            // engine server config above is bridged into the spawn and its validate-mode env set, so the
+            // chair's output_write adjudicates-not-persists and the runtime seals exactly once.
+            sealVia: "output_write",
             // per-chair wall-clock bound; COLTRANE_CHAIR_TIMEOUT_MS overrides for slow deployments
             ...(process.env["COLTRANE_CHAIR_TIMEOUT_MS"] ? { timeout_ms: Number(process.env["COLTRANE_CHAIR_TIMEOUT_MS"]) } : {}),
+            // The reserve grant (#329) had no reachable caller: it was built, tested, and set by nothing,
+            // so a chair that spent its budget still died silently at the cap. This is the operator-level
+            // door to it. Absent = no reserve, which is the prior behaviour exactly — an extension nobody
+            // asked for is spend nobody authorised. The DURABLE fix is a per-chair `turn_reserve` declared
+            // in the standard (PR #331), because a budget is a property of the work rather than of the
+            // player; this env is the deployment-level stopgap until that lands, not a substitute for it.
+            ...(process.env["COLTRANE_TURN_RESERVE"] ? { turn_reserve: Number(process.env["COLTRANE_TURN_RESERVE"]) } : {}),
         }),
         model_version: process.env["COLTRANE_MODEL"] ?? "claude-cli-default",
         skills: genome.skills, // ← skill substrate — runGig resolves agent.skill_slugs into prompt