@happyvertical/smrt-ingestion 0.55.11 → 0.55.13

package/FEEDBACK.md

@@ -154,3 +154,9 @@ cohort demonstrates contract-level influence, not provider quality or measured
 production improvement. Real-provider evaluation belongs to #3677. There are no
 sampled automatic outcomes in this feature; reporting that stratum as unavailable
 avoids inventing correctness labels from successful jobs.
+
+When interpretation requests optional examples, an explicit denial of feedback
+retrieval degrades to generation without examples or feedback provenance. Direct
+`retrieveFeedback` calls still reject denied reads. Other authorization errors
+are not swallowed, and already selected examples must pass the normal live
+provider-boundary checks; revocation does not silently preserve selected data.

package/PROPOSALS.md

@@ -171,3 +171,11 @@ Generative responses and the separate injected PDF split boundaries establish
 deterministic orchestration, not model accuracy or OCR quality. No held-out routing
 evaluation or automatic approval is claimed. Missing/unknown AI completion remains
 explicit under [SDK #1381](https://github.com/happyvertical/sdk/issues/1381).
+
+Proposal limits are checked at `IngestionService` construction: positive safe
+integers, at most 20 handlers/candidates/suggestions and 2147483647 ms timeout.
+Interpretation output uses the exported `GenerationAnalysisOutput` wrapper at
+`analysis.result.output.proposals`; the published review host unwraps it.
+An explicit feedback `retrieve` denial omits optional examples and feedback
+provenance and continues generation. Item/execution denials, unexpected failures,
+and revocation after examples were selected still fail closed before disclosure.

package/README.md

@@ -179,6 +179,31 @@ limits.
 The recipe manifest registers those existing browser components as
 `/ingestion/inbox` and `/ingestion/review` routes for a host to mount. The route
 metadata does not supply a host, source, provider, or demo fixture, and it does
-not change the preview-only status. Both recipes declare `both` runtime: their
+not change the preview-only status. Neither recipe declares generic model
+navigation: the ingestion records have no generated screens, so hosts use the
+authenticated route surfaces instead. Both recipes declare `both` runtime: their
 components render in a browser, while the authenticated review host and package
 dependency closure require a server.
+
+## First analysis and host constraints
+
+`receive` retains evidence and queues the initial dispatch, but does not choose
+an extraction configuration. Before a worker can analyze a new item, the host must
+call `analyze(itemId, { stage: 'extract', extraction: { configurationRevision,
+limits } }, requestId)`, then claim that returned revision and run `extractAnalysis`.
+Use a stable request ID for retries. `repairDispatches` repairs queue delivery;
+it does not supply the missing extraction request. After extraction, use
+`prepareGeneration` and `analyze` to request interpretation.
+
+Retention requires `replayUntil >= expiresAt`; an earlier replay deadline rejects
+even a fresh delivery as `expired`. The replay tombstone must outlive retained
+source bytes. Set both deadlines explicitly before calling `receive`.
+
+Handler preview `normalizedArgs` must equal the submitted arguments exactly.
+It is an integrity assertion, not a normalization hook: defaults or tidying must
+happen before submitting args for preview, so review binds exactly what was sent.
+
+Proposal limits must be positive safe integers. `maxHandlers`, `maxCandidates`
+and `maxSuggestions` are each capped at 20; `timeoutMs` is capped at 2147483647.
+Invalid limits are rejected when constructing `IngestionService`, before receipt
+or interpretation. See [REVIEW.md](REVIEW.md) for the published server review host.

package/REVIEW.md

@@ -135,3 +135,34 @@ page using fresh cursors, then publish the combined authorized set together. Old
 page payloads are cleared while loading; any unavailable page clears all payloads.
 This keeps plan controls and earlier steps visible across page boundaries without
 reusing a prior authorization decision.
+
+## Published server adapter
+
+Import `createIntakeReviewHost` and `IntakeReviewHostOptions` from
+`@happyvertical/smrt-ingestion/server`. Call `createIntakeReviewHost(service,
+options)` with a service constructed from the current authenticated session.
+The returned `IntakeReviewHost` implements inbox state projection across saved
+review pages, current generation loading, stable `ui:<index>` intention keys,
+action/plan preview CAS lookup, decisions, apply, corrections, candidates, split
+and feedback. Repeated preparation of an unchanged authorized suggestion retains
+its current review instead of creating a new revision. Changed arguments still
+require explicit re-preview and a fresh human decision.
+Lists scan 20 items per page; filtered pages may be empty with a `nextCursor`.
+Continue until the cursor is absent. Listing does not load original bytes.
+
+Supply four application adapters: `upload(files, requestId)` (authenticated
+receipt plus first extraction request), `assignment(itemId)` (durable read),
+`assign(input)` (manager authorization, eligible assignees, durable CAS and request
+replay protection), and `evidence(part)` (safe label/text or authenticated
+same-origin URL). Optional `label(item)` changes presentation. Optional
+`enableFeedback: true` exposes the optional feedback callback when the service
+has feedback configured. Optional `onSplit(itemId, revision)` wakes the host worker after the durable extraction
+request; repair dispatches if wakeup fails. The factory creates no assignment
+schema and grants no permissions. Create it per session, authenticate every HTTP
+call and enforce CSRF before dispatching a mutation.
+
+`GenerationAnalysisOutput` is exported by `/dto` and describes the interpretation
+wrapper `{ proposals: GenerationOutput }` under `analysis.result.output`.
+The factory unwraps this into `ItemReviewView.generation`. Stale generation is
+omitted while authorized saved reviews remain available; access denials propagate.
+The reference application still owns its fixture provisioning and HTTP transport.

package/agents/execution.md

@@ -15,7 +15,8 @@ Applications supply a trusted `IntakeExecutionOptions.handlers` catalog.
 schemas for arguments/results, allowlisted `resultModels`, `validate`, `preview`,
 a registered `{model, action, version}` operation and explicit effect/idempotency/
 open-world capability declaration. Preview returns display, exact normalized
-arguments and target revision preconditions. There is no arbitrary tool execution
+arguments and target revision preconditions. `normalizedArgs` must equal the
+submitted args exactly; default or normalize before submission, never in preview. There is no arbitrary tool execution
 or expression evaluation. Reviewer display wraps application fields under `preview`
 and symbolic metadata under `dependencies`; plan steps additionally wrap that
 object under `step` alongside the plan preview. Application display keys cannot

package/dist/chunks/{execution-C7sTFXFU.js → execution-TWeIv0o-.js}

@@ -6848,7 +6848,7 @@ var IntakeExecutionService = class {
 		if (!Array.isArray(references)) throw new Error("Feedback lineage unavailable");
 		if (references.length === 0) return;
 		if (!this.options.feedback) throw new Error("Feedback configuration unavailable");
-		const { IntakeFeedbackService } = await import("./feedback-C3OHD4sA.js").then((n) => n.n);
+		const { IntakeFeedbackService } = await import("./feedback-DmuvGO2o.js").then((n) => n.r);
 		await new IntakeFeedbackService(this.options, this).assertActionLineage(String(bound.action.id), db, String(bound.proposal.id));
 	}
 	async getAction(actionId) {
@@ -8028,4 +8028,4 @@ async function continueIntakeReview(service, actionId, task) {
 //#endregion
 export { feedbackActionTransaction as a, __exportAll as c, resolveIntakePolicy as i, __toESM as l, continueIntakeReview as n, feedbackDiscoveryContext as o, intakeBindingDigest as r, require_ajv as s, IntakeExecutionService as t };
 
-//# sourceMappingURL=execution-C7sTFXFU.js.map
+//# sourceMappingURL=execution-TWeIv0o-.js.map