@finchip.ai/foga 0.0.0-stage → 0.6.0-alpha.4

package/dist/node/migrate.js

@@ -0,0 +1,173 @@
+import { getAddress, parseEther } from "ethers";
+import { AID } from "../core/aid.js";
+import { agentDescriptor, kindId } from "../core/ard.js";
+import { Enforcement, Rights, accountSubjectKey, oneClause, scopeKeyOf } from "../core/asf.js";
+import { accountRef, keccakJcs } from "../core/canonical.js";
+import { cellUnitDefinition } from "../core/units.js";
+import { operatorScope } from "../genesis/operator-scope.js";
+import { Cell } from "../kernel/cell.js";
+import { saveCellConfig } from "./config.js";
+import { NODE_SCOPE_GROUPS } from "./init.js";
+import { ROLE } from "./node.js";
+/**
+ * Move a cell to a new account, the way T9 moves A to A-prime (design memo, Phase 3: the OG instance leaves its
+ * revision-1 body for a revision-2 one and keeps its identity line). The owner deploys the new account, configures
+ * it, adopts a binding for it, moves the ERC-8004 agent through the old account (an asset: the owner's act), binds
+ * the anchor in the new account (the takeover), retires the old anchor naming its successor, publishes the new
+ * record, document and unit, and moves the skill tokens, recommitting their records. Every step is a keyed
+ * operation in the old cell's store; the new cell starts with a config and a fresh store of its own.
+ */
+export async function cellMigrate(node, opts) {
+    const k = node.kernel;
+    const cfg = node.config;
+    const log = opts.log ?? node.log;
+    if (!node.hasKey("owner"))
+        throw new Error("cell migrate is the owner's act: load the owner key (FOGA_OWNER_KEY or FOGA_OWNER_KEY_FILE)");
+    const old = node.body;
+    const chainId = node.chainId;
+    const owner = cfg.identity.owner;
+    const guardian = cfg.identity.guardian;
+    const operator = getAddress(opts.operator ?? cfg.identity.operator);
+    const agentId = BigInt(cfg.identity.agentId ?? (() => { throw new Error("the config names no agentId"); })());
+    const spec = cfg.identity.safety;
+    if (!spec.specId || !spec.contentHash)
+        throw new Error("the config names no specification (identity.safety.specId/contentHash)");
+    const P = `migrate.${agentId}`;
+    const operations = [];
+    const op = (key) => operations.push(key);
+    // 1. the new body
+    const requirement = (predicted) => oneClause({ specRegistry: k.asf.specRegistryAddress, specId: spec.specId, versions: [spec.version], adopter: predicted, subjectKey: accountSubjectKey(chainId, predicted), scopeKey: scopeKeyOf({ ref: accountRef(chainId, predicted) }), enforcement: Enforcement.account | Enforcement.contract, interveners: [{ account: guardian, rights: Rights.suspend | Rights.resume }] });
+    let predictedFor = null;
+    const { address } = await k.deploy(`${P}.deploy`, ROLE.owner, "foga:FogaCellAccount", [], (predicted) => {
+        predictedFor = predicted;
+        return [k.asf.bindingRegistryAddress, owner, operator, guardian, cfg.identity.recovery ?? owner, requirement(predicted)];
+    });
+    op(`${P}.deploy`);
+    if (predictedFor && predictedFor.toLowerCase() !== address.toLowerCase())
+        throw new Error(`deployed at ${address} but the requirement was built for ${predictedFor}`);
+    const next = new Cell(k, `${cfg.name}-next`, address, { owner: ROLE.owner, operator: ROLE.operator, guardian, recovery: cfg.identity.recovery });
+    log(`  successor: account ${address} (operator ${operator})`);
+    // 2. funds: sweep the old body to the owner, give the new one its capital
+    if (opts.sweep ?? true) {
+        const balance = await old.balance();
+        if (balance > 0n || k.store.get(`${P}.sweep`)) {
+            await old.admin(`${P}.sweep`, "sweep", ["0x0000000000000000000000000000000000000000", await k.memo(`${P}.sweep.amount`, () => balance.toString()).then(BigInt)]);
+            op(`${P}.sweep`);
+        }
+    }
+    const capital = opts.capitalWei ?? (k.isLocalChain ? parseEther("0.01") : parseEther("0.002"));
+    if (capital > 0n) {
+        await k.transfer(`${P}.fund`, ROLE.owner, address, capital);
+        op(`${P}.fund`);
+    }
+    // 3. configuration of the new account (as init does)
+    await next.admin(`${P}.setOperator`, "setOperator", [operator, 0, BigInt(cfg.policy.budget.dailyValueWei)]);
+    op(`${P}.setOperator`);
+    const scope = operatorScope(k, NODE_SCOPE_GROUPS);
+    await next.admin(`${P}.scope`, "setOperatorAllowedBatch", [scope.targets, scope.selectors, true]);
+    op(`${P}.scope`);
+    await next.admin(`${P}.setAIDRegistry`, "setAIDRegistry", [k.aid.address]);
+    op(`${P}.setAIDRegistry`);
+    const sel = (id, fn) => node.world.iface(id).getFunction(fn).selector;
+    const classes = [
+        ["class.8414.submitFulfillment", k.tenders.address, sel("8414/TaskToken", "submitFulfillment"), "setCommitmentClass"],
+        ["class.8447.join", node.world.address("8447/SwarmRegistry"), sel("8447/SwarmRegistry", "join"), "setCommitmentClass"],
+        ["class.8447.applyToJoin", node.world.address("8447/SwarmRegistry"), sel("8447/SwarmRegistry", "applyToJoin"), "setCommitmentClass"],
+        ["class.8454.assertStatement", node.world.address("8454/AUFAssertionRegistry"), sel("8454/AUFAssertionRegistry", "assertStatement"), "setCommitmentClass"],
+        ["class.8436.castBallot", k.acdf.registryAddress, sel("8436/ACDFRegistry", "castBallot"), "setCommitmentClass"],
+        ["derisk.8414.withdrawCredit", k.tenders.address, sel("8414/TaskToken", "withdrawCredit"), "setDeriskAllowed"],
+        ["derisk.8414.reclaimEscrow", k.tenders.address, sel("8414/TaskToken", "reclaimEscrow"), "setDeriskAllowed"],
+        ["derisk.8447.leave", node.world.address("8447/SwarmRegistry"), sel("8447/SwarmRegistry", "leave"), "setDeriskAllowed"],
+        ["derisk.8471.withdrawBalance", k.adrf.escrowAddress, sel("8471/ADRFServiceEscrow", "withdrawBalance"), "setDeriskAllowed"],
+    ];
+    for (const [name, target, selector, fn] of classes) {
+        await next.admin(`${P}.${name}`, fn, [target, selector, true]);
+        op(`${P}.${name}`);
+    }
+    // 4. the successor's own binding
+    const params = { profile: "foga-cell/1", cell: cfg.name, successorOf: accountRef(chainId, old.address), operatorScope: NODE_SCOPE_GROUPS };
+    const authority = { kind: "owner", owner: accountRef(chainId, owner), guardian: accountRef(chainId, guardian) };
+    const input = k.asf.cellBindingInput({ chainId, cell: address, specId: spec.specId, version: spec.version, contentHash: spec.contentHash, guardian, params, authority });
+    const { bindingId } = await next.adoptBinding(`${P}.adopt`, input, 0);
+    op(`${P}.adopt`);
+    // 5. the identity moves through the old account: the owner's act (an asset leaves the cell)
+    await old.execute(`${P}.8004.transfer`, k.identity.address, k.identity.encodeTransfer(old.address, address, agentId), { by: "owner" });
+    op(`${P}.8004.transfer`);
+    // 6. the takeover: the new anchor binds the agent in every registry; the old one retires naming its successor
+    const bindCall = k.aid.encodeBind(k.identity.address, agentId);
+    await next.execute(`${P}.aid.bind`, k.aid.address, bindCall, { by: "owner" });
+    op(`${P}.aid.bind`);
+    await next.execute(`${P}.aid.heartbeat`, k.aid.address, k.aid.encodeHeartbeat(), { by: "owner" });
+    op(`${P}.aid.heartbeat`);
+    if (k.aid.backing) {
+        await next.execute(`${P}.aid.backing.bind`, k.aid.backing.address, bindCall, { by: "owner" });
+        op(`${P}.aid.backing.bind`);
+    }
+    await old.execute(`${P}.aid.retire`, k.aid.address, k.aid.encodeRetire(address), { by: "owner" });
+    op(`${P}.aid.retire`);
+    if (k.aid.backing) {
+        await old.execute(`${P}.aid.backing.retire`, k.aid.backing.address, k.aid.encodeRetire(address), { by: "owner" });
+        op(`${P}.aid.backing.retire`);
+    }
+    // 7. the new record and document
+    const registration = {
+        type: "https://eips.ethereum.org/EIPS/eip-8004#registration-v1",
+        name: cfg.presence.name,
+        description: cfg.presence.description,
+        services: [],
+        x402Support: false,
+        active: true,
+        supportedTrust: ["reputation"],
+        "x-foga": { cell: cfg.name, anchor: accountRef(chainId, address), predecessor: accountRef(chainId, old.address), binding: bindingId },
+    };
+    const descriptor = agentDescriptor({ chainId, anchor: address, slug: `cell-${cfg.name.toLowerCase()}`, name: cfg.presence.name, description: cfg.presence.description, url: cfg.presence.homepage, capabilities: ["erc8414:fulfiller", "erc8338:holder"], registration: { registry: `eip155:${chainId}:${k.identity.address.toLowerCase()}`, agentId: agentId.toString() } });
+    const ard = await next.execute(`${P}.ard.register`, k.ard.address, k.ard.encodeRegister(kindId("agent"), address, 0n, descriptor), { by: "owner" });
+    op(`${P}.ard.register`);
+    const recordId = k.ard.recordIdFromReceipt(ard.receipt);
+    const doc = {
+        version: "aid-document/v1",
+        aid: accountRef(chainId, address),
+        did: `did:aid:${accountRef(chainId, address)}`,
+        binding: { registry: k.identity.address, agentId: Number(agentId) },
+        livenessWindow: cfg.identity.livenessWindow ?? Number(node.world.file.params.aid.defaultLivenessWindow),
+        facets: [{ facetType: "aid:core/identity/v1", provenance: "SELF", issuer: accountRef(chainId, address), validUntil: 0, digest: keccakJcs(registration), access: { mode: "PUBLIC" }, resolver: { kind: "erc8004-identity", chainId, registry: k.identity.address, agentId: Number(agentId) } }],
+    };
+    const commitment = AID.documentCommitment(doc);
+    await next.execute(`${P}.aid.document`, k.aid.address, k.aid.encodeSetDocumentURI(commitment.uri, commitment.digest), { by: "owner" });
+    op(`${P}.aid.document`);
+    // the registration file stays the one the agent carries; setAgentURI to a served URL is the documents step (3d)
+    // 8. the skills follow: each token moves through the old account (owner), each record is recommitted by the new controller
+    const skills = [];
+    for (const [name, h] of Object.entries(cfg.skills.held)) {
+        const tokenId = BigInt(h.tokenId);
+        const holder = await k.skills.ownerOf(tokenId);
+        if (getAddress(holder) === getAddress(old.address)) {
+            await old.execute(`${P}.skill.${name}.transfer`, k.skills.address, k.skills.encodeSafeTransfer(old.address, address, tokenId), { by: "owner" });
+            op(`${P}.skill.${name}.transfer`);
+        }
+        const recordId = h.recordId ?? k.ard.recordIdOf(k.skills.address, tokenId);
+        const rec = await k.ard.recordOf(recordId);
+        if (rec.kind !== "0x" + "00".repeat(32)) {
+            await next.execute(`${P}.skill.${name}.adopt`, k.ard.address, k.ard.encodeRecommit(recordId, { descriptorHash: rec.descriptorHash, descriptorURI: rec.descriptorURI, urn: rec.urn }), { by: "owner" });
+            op(`${P}.skill.${name}.adopt`);
+        }
+        skills.push(name);
+    }
+    // 9. the successor's own unit (the old unit stays the old body's)
+    const unit = await next.execute(`${P}.auf.unit`, k.units.registryAddress, k.units.encodeRegisterUnit(address, cellUnitDefinition({ chainId, cell: address, name: cfg.presence.name }), []), { by: "owner" });
+    op(`${P}.auf.unit`);
+    const unitId = k.units.unitIdFromReceipt(unit.receipt);
+    // the new config: the same cell, a new body, a fresh store
+    const nextCfg = JSON.parse(JSON.stringify(cfg));
+    nextCfg.store = opts.toStorePath;
+    nextCfg.identity = { ...cfg.identity, account: getAddress(address), operator, bindingId, recordId, unitId: unitId.toString(), documentDigest: commitment.digest };
+    nextCfg.skills.held = Object.fromEntries(Object.entries(cfg.skills.held).map(([n, h]) => [n, { tokenId: h.tokenId, recordId: h.recordId, packageHash: h.packageHash }]));
+    saveCellConfig(opts.toConfigPath, nextCfg);
+    k.setFact(`${P}.successor`, { account: address, config: opts.toConfigPath });
+    k.evidence("migrate", cfg.name, { from: old.address, to: address, agentId: agentId.toString(), operator, bindingId, recordId, unitId: unitId.toString(), skills, operations });
+    const [oldState, newState, holder] = await Promise.all([k.aid.stateName(old.address), k.aid.stateName(address), k.identity.ownerOf(agentId)]);
+    log(`  moved: agent ${agentId} held by ${holder}; old anchor ${oldState}, new anchor ${newState}; config ${opts.toConfigPath}`);
+    if (oldState !== "RETIRED" || newState !== "ACTIVE" || getAddress(holder) !== getAddress(address))
+        throw new Error(`the move is incomplete: old ${oldState}, new ${newState}, agent held by ${holder}`);
+    return { from: old.address, to: address, agentId: agentId.toString(), bindingId, recordId, unitId: unitId.toString(), skills, operations, configPath: opts.toConfigPath };
+}

package/dist/node/model/anthropic.js

@@ -0,0 +1,97 @@
+import { ModelError } from "./types.js";
+export const ANTHROPIC_VERSION = "2023-06-01";
+export class AnthropicAdapter {
+    model;
+    provider = "anthropic";
+    key;
+    baseUrl;
+    maxTokens;
+    timeoutMs;
+    retries;
+    fetchImpl;
+    constructor(model, opts = {}) {
+        this.model = model;
+        if (!model)
+            throw new ModelError("runtime.model.model names no model; set it in the cell configuration (provider anthropic)");
+        const key = opts.apiKey ?? process.env.ANTHROPIC_API_KEY;
+        if (!key)
+            throw new ModelError("ANTHROPIC_API_KEY is not set; the anthropic provider needs it in the node's environment");
+        this.key = key;
+        this.baseUrl = (opts.baseUrl ?? process.env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com").replace(/\/+$/, "");
+        this.maxTokens = opts.maxTokens ?? 2048;
+        this.timeoutMs = opts.timeoutMs ?? 120_000;
+        this.retries = opts.retries ?? 2;
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async propose(req) {
+        const body = {
+            model: this.model,
+            max_tokens: this.maxTokens,
+            system: req.system,
+            tools: req.tools.map((t) => ({ name: t.name, description: t.description, input_schema: inputSchema(t.inputSchema) })),
+            messages: req.messages.map((m) => ({ role: m.role, content: m.content.map(toWire) })),
+        };
+        let attempt = 0;
+        for (;;) {
+            let res;
+            try {
+                res = await this.fetchImpl(`${this.baseUrl}/v1/messages`, {
+                    method: "POST",
+                    headers: { "content-type": "application/json", "x-api-key": this.key, "anthropic-version": ANTHROPIC_VERSION },
+                    body: JSON.stringify(body),
+                    signal: AbortSignal.timeout(this.timeoutMs),
+                });
+            }
+            catch (e) {
+                if (attempt++ < this.retries) {
+                    await pause(attempt);
+                    continue;
+                }
+                throw new ModelError(`the Messages API could not be reached: ${e.message}`);
+            }
+            if (res.status === 429 || res.status >= 500) {
+                if (attempt++ < this.retries) {
+                    const after = Number(res.headers.get("retry-after"));
+                    await pause(attempt, Number.isFinite(after) && after > 0 ? after * 1000 : undefined);
+                    continue;
+                }
+                throw new ModelError(`the Messages API answered ${res.status} after ${attempt} attempts`, res.status);
+            }
+            if (!res.ok) {
+                let detail = "";
+                try {
+                    const err = (await res.json());
+                    detail = err.error ? `${err.error.type ?? "error"}: ${err.error.message ?? ""}` : "";
+                }
+                catch {
+                    detail = "";
+                }
+                throw new ModelError(`the Messages API answered ${res.status}${detail ? ` (${detail})` : ""}`, res.status);
+            }
+            const data = (await res.json());
+            if (!Array.isArray(data.content))
+                throw new ModelError("the Messages API answered without a content array");
+            const content = [];
+            for (const raw of data.content) {
+                if (raw.type === "text" && typeof raw.text === "string")
+                    content.push({ type: "text", text: raw.text });
+                else if (raw.type === "tool_use" && typeof raw.id === "string" && typeof raw.name === "string")
+                    content.push({ type: "tool_use", id: raw.id, name: raw.name, input: (raw.input ?? {}) });
+            }
+            return { content, stopReason: data.stop_reason ?? "end_turn", usage: { inputTokens: data.usage?.input_tokens ?? 0, outputTokens: data.usage?.output_tokens ?? 0 } };
+        }
+    }
+}
+/** The API wants a plain object schema; the catalog's `$schema` marker is dropped. */
+function inputSchema(schema) {
+    const { $schema: _s, ...rest } = schema;
+    return rest.type ? rest : { type: "object", ...rest };
+}
+function toWire(b) {
+    if (b.type === "tool_result")
+        return { type: "tool_result", tool_use_id: b.tool_use_id, content: b.content, ...(b.is_error ? { is_error: true } : {}) };
+    return b;
+}
+function pause(attempt, ms) {
+    return new Promise((r) => setTimeout(r, ms ?? 500 * 2 ** (attempt - 1)));
+}

package/dist/node/model/stub.js

@@ -0,0 +1,129 @@
+/**
+ * The deterministic stand-in for a model (design memo, Phase 3, section 8): a fixed decision table over the
+ * situation and the transcript of the tick so far, so the same situation always yields the same proposals and a
+ * CI run needs no key and no network. It does what a careful operator's model would — inspect a tender, pre-check
+ * it, run the skill, submit, settle, withdraw — and one thing a careful model would not: once per cell it proposes a
+ * tender whose reward is five times the per-operation cap, so the evidence shows the budget gate closing on a
+ * proposal (case g). It never looks for a way around a refusal: a refused pre-check ends its interest in that
+ * tender until the situation changes (a safety refusal is retried once the binding is Satisfied again).
+ *
+ * The stub is a pure function of the request: it keeps no state between calls. Everything it needs to know about
+ * what happened earlier in the tick is in the tool_use and tool_result blocks the runner put in the transcript.
+ */
+export const STUB_MODEL = "foga-stub/1";
+function firstUserText(req) {
+    for (const m of req.messages)
+        if (m.role === "user")
+            for (const b of m.content)
+                if (b.type === "text")
+                    return b.text;
+    throw new Error("the stub needs the situation as the first user message");
+}
+/** The tool calls of this tick so far, each with its result (parsed when it is JSON). */
+function transcript(req) {
+    const uses = new Map();
+    const out = [];
+    for (const m of req.messages) {
+        for (const b of m.content) {
+            if (b.type === "tool_use")
+                uses.set(b.id, { name: b.name, input: b.input });
+            if (b.type === "tool_result") {
+                const use = uses.get(b.tool_use_id);
+                if (!use)
+                    continue;
+                let result = b.content;
+                try {
+                    result = JSON.parse(b.content);
+                }
+                catch {
+                    /* text */
+                }
+                out.push({ name: use.name, input: use.input, result, isError: Boolean(b.is_error) });
+            }
+        }
+    }
+    return out;
+}
+const tokenOf = (d) => (typeof d.input.tokenId === "string" ? d.input.tokenId : undefined);
+/** Which tender to work on: the lowest id that still asks for something. */
+export function chooseTender(s) {
+    const satisfied = s.cell.safety.verdict === "Satisfied";
+    const actionable = s.tenders.filter((t) => {
+        if (t.status === "open" || t.status === "eligible")
+            return true;
+        if (t.status === "submitted")
+            return t.submission?.status === 0;
+        if (t.status === "settled")
+            return BigInt(t.creditWei) > 0n;
+        if (t.status === "refused")
+            return t.gate === "safety" && satisfied;
+        return false;
+    });
+    actionable.sort((a, b) => (BigInt(a.tokenId) < BigInt(b.tokenId) ? -1 : 1));
+    return actionable[0] ?? null;
+}
+export class StubAdapter {
+    provider = "stub";
+    model = STUB_MODEL;
+    async propose(req) {
+        const s = JSON.parse(firstUserText(req));
+        const done = transcript(req);
+        let n = done.length;
+        const call = (name, input) => ({ type: "tool_use", id: `stub-${++n}`, name, input });
+        const turn = (text, ...uses) => ({ content: [{ type: "text", text }, ...uses], stopReason: uses.length ? "tool_use" : "end_turn", usage: { inputTokens: 0, outputTokens: 0 } });
+        const has = (name) => req.tools.some((t) => t.name === name);
+        // g. once per cell: a tender above the per-operation cap, on purpose — the budget gate must refuse it
+        const triedBefore = s.recentDecisions.some((d) => d.capability === "tender_mint" && d.caller === "runner") || done.some((d) => d.name === "tender_mint");
+        if (!triedBefore && has("tender_mint") && s.skills.held.length) {
+            const probe = s.skills.held.find((h) => h.name === "foga-probe") ?? s.skills.held[0];
+            const reward = (BigInt(s.budget.perOperationValueWei) * 5n).toString();
+            return turn(`Proposing a tender for ${probe.name} with a reward of ${reward} wei, five times the per-operation cap of ${s.budget.perOperationValueWei} wei. The budget gate should refuse this; the refusal is the point.`, call("tender_mint", { skill: probe.name, packageHash: probe.packageHash, input: { purpose: "stub case g" }, answerHash: "0x" + "11".repeat(32), rewardWei: reward, submitIn: 86400, settleIn: 7 * 86400 }));
+        }
+        const t = chooseTender(s);
+        if (!t)
+            return turn("Nothing to do: no open tender asks for a decision and nothing of mine is pending.");
+        const mine = done.filter((d) => tokenOf(d) === t.tokenId);
+        const last = mine.at(-1);
+        if (last?.isError)
+            return turn(`${last.name} on tender ${t.tokenId} answered an error; stopping here for this tick.`);
+        const by = (name) => mine.find((d) => d.name === name);
+        // a pending submission of mine: settle, then withdraw what was credited
+        if (t.status === "submitted" && t.submission?.status === 0) {
+            const settled = by("tender_settle");
+            if (!settled) {
+                if (!t.submission.answer)
+                    return turn(`Tender ${t.tokenId}: my submission is pending but no run of mine holds its answer; leaving it to the operator.`);
+                return turn(`Tender ${t.tokenId}: settling my pending submission ${t.submission.submissionId}.`, call("tender_settle", { tokenId: t.tokenId, submissionId: t.submission.submissionId, answer: t.submission.answer }));
+            }
+            const out = settled.result.output;
+            if (out?.creditWei && BigInt(out.creditWei) > 0n && !by("credit_withdraw"))
+                return turn(`Tender ${t.tokenId}: ${out.creditWei} wei were credited rather than paid; withdrawing.`, call("credit_withdraw", { tokenId: t.tokenId }));
+            return turn(`Tender ${t.tokenId}: settled.`);
+        }
+        if (t.status === "settled") {
+            if (!by("credit_withdraw"))
+                return turn(`Tender ${t.tokenId}: withdrawing the credited ${t.creditWei} wei.`, call("credit_withdraw", { tokenId: t.tokenId }));
+            return turn(`Tender ${t.tokenId}: credit withdrawn.`);
+        }
+        // a tender to judge: inspect, pre-check, run, submit — in that order, one step per turn
+        if (!by("tender_inspect"))
+            return turn(`Looking at tender ${t.tokenId} (${t.task?.skill ?? "no task document"}, reward ${t.rewardWei} wei).`, call("tender_inspect", { tokenId: t.tokenId }));
+        const pre = by("tender_precheck");
+        if (!pre)
+            return turn(`Pre-checking tender ${t.tokenId} against the cell's gates.`, call("tender_precheck", { tokenId: t.tokenId }));
+        const verdict = pre.result;
+        if (!verdict.eligible)
+            return turn(`Tender ${t.tokenId} is not for this cell: refused at ${verdict.gate ?? "?"} (${verdict.reason ?? "no reason given"}). Not looking for a way around it.`);
+        if (!t.task)
+            return turn(`Tender ${t.tokenId} passed the pre-check but has no readable task document; stopping.`);
+        const run = by("skill_run");
+        if (!run)
+            return turn(`Running ${t.task.skill} for tender ${t.tokenId}.`, call("skill_run", { skill: t.task.skill, input: t.task.input, tokenId: t.tokenId }));
+        const runOut = run.result.output;
+        if (!runOut?.resultHash)
+            return turn(`The run for tender ${t.tokenId} returned no result hash; stopping.`);
+        if (!by("tender_submit"))
+            return turn(`Submitting the result of tender ${t.tokenId}.`, call("tender_submit", { tokenId: t.tokenId, resultHash: runOut.resultHash, runReceipt: runOut.runReceipt }));
+        return turn(`Tender ${t.tokenId}: submitted; the settlement is the next tick's (or the watchers').`);
+    }
+}

package/dist/node/model/types.js

@@ -0,0 +1,9 @@
+/** A failure of the model layer (transport, quota, a malformed answer); never carries a credential. */
+export class ModelError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ModelError";
+    }
+}

package/dist/node/node.js

@@ -0,0 +1,198 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getAddress, Wallet } from "ethers";
+import { buildSkillPackage, readSkillDir } from "../core/pack/skillpack.js";
+import { Cell } from "../kernel/cell.js";
+import { Kernel } from "../kernel/kernel.js";
+import { configPath, loadCellConfig, saveCellConfig } from "./config.js";
+/** Signer names the node uses in the kernel. */
+export const ROLE = { operator: "operator", owner: "owner", guardian: "guardian" };
+/**
+ * The node: one cell's configuration, the kernel opened on the cell's world and store, the cell handle, and what
+ * the capability catalog needs to decide and act (design memo, Phase 3, section 2). It knows which keys this
+ * process holds and refuses an act whose signer is not here rather than looking for a key anywhere else.
+ */
+export class Node {
+    loaded;
+    kernel;
+    cell;
+    held;
+    rpc;
+    log;
+    constructor(loaded, kernel, cell, held, rpc, log) {
+        this.loaded = loaded;
+        this.kernel = kernel;
+        this.cell = cell;
+        this.held = held;
+        this.rpc = rpc;
+        this.log = log;
+    }
+    static async open(opts) {
+        const loaded = loadCellConfig(opts.configPath);
+        const cfg = loaded.config;
+        const keys = {};
+        for (const role of ["operator", "owner", "guardian"]) {
+            const pk = opts.keys[role];
+            if (!pk)
+                continue;
+            const address = new Wallet(pk).address;
+            const expected = cfg.identity[role];
+            if (getAddress(address) !== getAddress(expected))
+                throw new Error(`the ${role} key loaded here is ${address}; the config names ${expected} as ${role}. The key and the config disagree; nothing was done.`);
+            keys[ROLE[role]] = pk;
+        }
+        const worldPath = configPath(loaded, cfg.world);
+        const storePath = configPath(loaded, cfg.store);
+        const worldNetwork = JSON.parse(readFileSync(worldPath, "utf8")).network;
+        const rpc = opts.rpc ?? cfg.rpc ?? process.env.FOGA_RPC_URL ?? (worldNetwork === "anvil" ? "http://127.0.0.1:8545" : undefined);
+        if (!rpc)
+            throw new Error(`no RPC for cell ${cfg.name}: set "rpc" in the config, pass --rpc or set FOGA_RPC_URL`);
+        const kernel = await Kernel.open({ worldPath, rpc, bundlePath: cfg.bundle ? configPath(loaded, cfg.bundle) : undefined, storePath, keys, log: opts.log });
+        const log = opts.log ?? (() => { });
+        const known = kernel.store.getMeta("cellAccount");
+        if (known && cfg.identity.account && known.toLowerCase() !== cfg.identity.account.toLowerCase()) {
+            kernel.close();
+            throw new Error(`operation store ${storePath} belongs to cell account ${known}, not to ${cfg.identity.account} (${opts.configPath}). Point the config at its own store or start a fresh one.`);
+        }
+        let cell = null;
+        if (cfg.identity.account) {
+            cell = new Cell(kernel, cfg.name, cfg.identity.account, { owner: ROLE.owner, operator: ROLE.operator, guardian: cfg.identity.guardian, recovery: cfg.identity.recovery });
+            // the account must be there, be revision 2 or later, and name the roles the config names
+            const code = await kernel.world.provider.getCode(cfg.identity.account);
+            if (code === "0x") {
+                kernel.close();
+                throw new Error(`no contract at the cell account ${cfg.identity.account} on this chain (${opts.configPath}); is the config for this world?`);
+            }
+            let version = 1;
+            try {
+                version = Number(await cell.contract().ACCOUNT_VERSION());
+            }
+            catch {
+                version = 1;
+            }
+            // a revision-1 account has no operator allow-list: nothing holding the operator key may run on it. Reads, builds
+            // and the owner's own commands (the migration away from it, above all) are not what the refusal is about.
+            if (version < 2 && opts.keys.operator) {
+                kernel.close();
+                throw new Error(`the cell account ${cfg.identity.account} is a revision-${version} FogaCellAccount: it has no operator allow-list, so a node must not act on it. Move the cell to a revision-2 account first (foga cell migrate); reads and builds work without the operator key.`);
+            }
+            const [onchainOperator, onchainOwner] = await Promise.all([cell.operator(), cell.owner()]);
+            if (getAddress(onchainOperator) !== getAddress(cfg.identity.operator)) {
+                kernel.close();
+                throw new Error(`the account ${cfg.identity.account} names ${onchainOperator} as operator; the config names ${cfg.identity.operator}. Update the config (or rotate the operator) before running.`);
+            }
+            if (getAddress(onchainOwner) !== getAddress(cfg.identity.owner)) {
+                kernel.close();
+                throw new Error(`the account ${cfg.identity.account} is owned by ${onchainOwner}; the config names ${cfg.identity.owner} as owner.`);
+            }
+            if (!known)
+                kernel.store.setMeta("cellAccount", cfg.identity.account);
+        }
+        else if (!opts.allowUnborn) {
+            kernel.close();
+            throw new Error(`${opts.configPath} names no account: the cell has not been born. Run foga cell init first.`);
+        }
+        return new Node(loaded, kernel, cell, opts.keys, rpc, log);
+    }
+    close() {
+        this.kernel.close();
+        this.kernel.world.provider.destroy();
+    }
+    decisions = Promise.resolve();
+    /** Run `fn` after every earlier decision section of this node has finished: the catalog judges one act at a time, so a budget cap is read with what the act before it reserved. */
+    serialize(fn) {
+        const turn = this.decisions.catch(() => undefined).then(fn);
+        this.decisions = turn;
+        return turn;
+    }
+    get config() {
+        return this.loaded.config;
+    }
+    get store() {
+        return this.kernel.store;
+    }
+    get world() {
+        return this.kernel.world;
+    }
+    get chainId() {
+        return this.kernel.chainId;
+    }
+    /** The cell handle; an error when the cell has not been born. */
+    get body() {
+        if (!this.cell)
+            throw new Error(`cell ${this.config.name} has not been born (foga cell init)`);
+        return this.cell;
+    }
+    hasKey(role) {
+        return Boolean(this.held[role]);
+    }
+    /** The signer name of a role for the kernel, checked to be loaded. */
+    signerOf(role) {
+        if (!this.hasKey(role))
+            throw new Error(`this process holds no ${role} key for cell ${this.config.name}`);
+        return ROLE[role];
+    }
+    saveConfig() {
+        saveCellConfig(this.loaded.path, this.loaded.config);
+    }
+    /** Paths the probe worker needs. */
+    get worldPath() {
+        return configPath(this.loaded, this.config.world);
+    }
+    get bundlePath() {
+        return this.config.bundle ? configPath(this.loaded, this.config.bundle) : undefined;
+    }
+    /** FogaCellAccount revision of the cell's account (1 for accounts deployed before 0.6.0). */
+    async accountVersion() {
+        try {
+            return Number(await this.body.contract().ACCOUNT_VERSION());
+        }
+        catch {
+            return 1;
+        }
+    }
+    get skillsDir() {
+        return configPath(this.loaded, this.config.skills.dir);
+    }
+    get inputDir() {
+        return configPath(this.loaded, this.config.skills.inputDir);
+    }
+    get storePath() {
+        return configPath(this.loaded, this.config.store);
+    }
+    get acceptance() {
+        return { hashlock: this.kernel.tenders.hashlockAddress };
+    }
+    /** The skills the config says the cell holds, each rebuilt from its directory and checked against the chain's commitment. */
+    async heldSkills() {
+        const out = [];
+        for (const [name, h] of Object.entries(this.config.skills.held)) {
+            const pkg = buildSkillPackage(readSkillDir(join(this.skillsDir, name)));
+            const tokenId = BigInt(h.tokenId);
+            const onchain = await this.kernel.skills.skillOf(tokenId);
+            if (onchain.packageHash.toLowerCase() !== pkg.packageHash.toLowerCase())
+                throw new Error(`skill ${name}: the local package ${pkg.packageHash} differs from token ${tokenId}'s commitment ${onchain.packageHash}; the directory was changed since the mint`);
+            out.push({ name, tokenId, packageHash: pkg.packageHash, mdHash: pkg.mdHash, pkg });
+        }
+        return out;
+    }
+    /** What the cell spent and reserved in the last 24 hours, and how many commitments are open. */
+    budgetUse() {
+        const since = new Date(Date.now() - 24 * 3600 * 1000).toISOString();
+        const books = this.store.budgetBooks(ROLE.operator, since);
+        return { ...books, runningCommitments: this.store.countJobs("tender", ["accepted", "running"]) };
+    }
+    /** eth_estimateGas of a call: the decoded revert reason, or null when it would succeed. */
+    async wouldRevert(from, to, data, value = 0n) {
+        try {
+            await this.world.provider.estimateGas({ from, to, data, value });
+            return null;
+        }
+        catch (e) {
+            return this.kernel.tx.decoder.explain(e);
+        }
+    }
+    async now() {
+        return this.kernel.blockTimestamp();
+    }
+}