@happyvertical/smrt-ingestion 0.57.21 → 0.57.23

package/dist/chunks/{execution-9CfjxX8I.js → execution-BzVQax0n.js}

@@ -56,6 +56,12 @@ var HandlerArgumentsInvalidError = class extends Error {
 		this.name = "HandlerArgumentsInvalidError";
 	}
 };
+var ProposalsNotConfiguredError = class extends Error {
+	constructor() {
+		super("Intake proposals are not configured");
+		this.name = "ProposalsNotConfiguredError";
+	}
+};
 var GenerationSourceStaleError = class extends Error {
 	constructor() {
 		super("Generation source superseded");
@@ -69,6 +75,18 @@ var GenerationSnapshotStaleError = class extends Error {
 	}
 };
 //#endregion
+//#region src/redaction.ts
+var UNFINISHED_ACTION_STATES = ["executing", "outcome_unknown"];
+function redactedCeiling(ceiling, unfinishedActions) {
+	const execution = ceiling.execution;
+	if (unfinishedActions || !execution || typeof execution !== "object" || Array.isArray(execution) || !Object.hasOwn(execution, "principalId")) return ceiling;
+	const { principalId: _principal, ...rest } = execution;
+	return {
+		...ceiling,
+		execution: rest
+	};
+}
+//#endregion
 //#region ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
@@ -6401,6 +6419,7 @@ function resolveIntakePolicy(layers) {
 		providers: [],
 		access: [],
 		requireReview: false,
+		submitterReview: false,
 		maxAttempts: 1,
 		maxSteps: 10,
 		maxBytes: 65536,
@@ -6414,6 +6433,7 @@ function resolveIntakePolicy(layers) {
 	for (const key of lists) result[key] = [...app[key] ?? []];
 	for (const key of limits) result[key] = app[key] ?? result[key];
 	result.minimumCertainty = app.minimumCertainty ?? 1;
+	result.submitterReview = app.submitterReview === true;
 	result.automaticHandlers = [...app.automation?.handlers ?? []];
 	result.consequentialAutomation = app.automation?.consequential === true;
 	for (const [index, layer] of layers.entries()) {
@@ -6421,6 +6441,7 @@ function resolveIntakePolicy(layers) {
 		result.versions.push(layer.version);
 		result.enabled &&= layer.enabled !== false;
 		result.requireReview ||= layer.requireReview === true;
+		result.submitterReview &&= layer.submitterReview !== false;
 		for (const key of lists) {
 			const values = layer[key];
 			if (values !== void 0) {
@@ -6450,6 +6471,12 @@ function resolveIntakePolicy(layers) {
 }
 //#endregion
 //#region src/execution.ts
+var IntakeAccessDeniedError = class extends Error {
+	constructor() {
+		super("Intake unavailable");
+		this.name = "IntakeAccessDeniedError";
+	}
+};
 var RetentionExpired = class extends Error {
 	constructor(itemId, deadline) {
 		super("Intake retention expired");
@@ -6459,6 +6486,9 @@ var RetentionExpired = class extends Error {
 	itemId;
 	deadline;
 };
+var OWN_SCAN_BATCH = 50;
+var OWN_SCAN_CEILING = 1e3;
+var UUID_CURSOR = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function object(value) {
 	const parsed = typeof value === "string" ? JSON.parse(value) : value;
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid intake binding");
@@ -6484,7 +6514,7 @@ function strings(value) {
 function time(value) {
 	return new Date(value).getTime();
 }
-var IntakeExecutionService = class {
+var IntakeExecutionService = class IntakeExecutionService {
 	constructor(options, config) {
 		this.options = options;
 		this.db = options.db;
@@ -6525,7 +6555,7 @@ var IntakeExecutionService = class {
 	async restoreRetention(db, itemId, deadline) {
 		const expiry = new Date(deadline).toISOString();
 		const item = (await db.query("UPDATE intake_items SET expires_at=CASE WHEN expires_at>? THEN ? ELSE expires_at END WHERE id=? AND tenant_id=? AND confidential_scope_id=? RETURNING id,expires_at,visibility", expiry, expiry, itemId, this.scope.tenantId, this.scope.confidentialScopeId)).rows[0];
-		if (!item) throw new Error("Intake unavailable");
+		if (!item) throw new IntakeAccessDeniedError();
 		if (!this.retained(item)) await this.redactExecution(db, item);
 		return item;
 	}
@@ -6536,7 +6566,8 @@ var IntakeExecutionService = class {
 			"intake_review_decisions",
 			"intake_executions",
 			"intake_plans",
-			"intake_feedback"
+			"intake_feedback",
+			"intake_dispositions"
 		]) await db.query(`UPDATE ${table} SET data='{}' WHERE item_id=? AND tenant_id=? AND confidential_scope_id=?`, item.id, this.scope.tenantId, this.scope.confidentialScopeId);
 	}
 	async narrowRetention(db, item, deadline) {
@@ -6572,8 +6603,8 @@ var IntakeExecutionService = class {
 			operation: "read",
 			capturedCeiling: object(object(item.data).capturedCeiling),
 			db
-		})) throw new Error("Intake unavailable");
-		if (!expired && (item.visibility !== "active" || time(item.expires_at) <= this.now().getTime() || item.cancelled)) throw new Error("Intake unavailable");
+		})) throw new IntakeAccessDeniedError();
+		if (!expired && (item.visibility !== "active" || time(item.expires_at) <= this.now().getTime() || item.cancelled)) throw new IntakeAccessDeniedError();
 		return item;
 	}
 	ceiling(item) {
@@ -6639,11 +6670,12 @@ var IntakeExecutionService = class {
 			onHostError?.(error);
 			throw error;
 		}
-		if (!current.allowed || current.mutationBoundary !== "serialized" || current.principalId !== ceiling.principalId) throw new Error("Intake unavailable");
+		if (!current.allowed || current.mutationBoundary !== "serialized" || current.principalId !== ceiling.principalId) throw new IntakeAccessDeniedError();
 		const policy = resolveIntakePolicy(current.policy);
 		const operationKey = "model" in handler.operation ? `${handler.operation.model}:${handler.operation.action}@${handler.operation.version}` : handler.operation.playbookKey;
-		if (!policy.enabled || !policy.handlers.includes(handler.id) || !ceiling.handlers.includes(handler.id) || !policy.operations.includes(operationKey) || !ceiling.operations.includes(operationKey) || !policy.access.includes(this.scope.confidentialScopeId)) throw new Error("Intake unavailable");
-		if (operation === "review" && (!current.reviewer || !policy.reviewers.includes(this.scope.actorId))) throw new Error("Intake unavailable");
+		if (!policy.enabled || !policy.handlers.includes(handler.id) || !ceiling.handlers.includes(handler.id) || !policy.operations.includes(operationKey) || !ceiling.operations.includes(operationKey) || !policy.access.includes(this.scope.confidentialScopeId)) throw new IntakeAccessDeniedError();
+		if (operation === "review" && (!current.reviewer || !policy.reviewers.includes(this.scope.actorId))) throw new IntakeAccessDeniedError();
+		if (operation === "review_own" && (current.submitter !== true || !policy.submitterReview || item.submitter_id !== this.scope.actorId || ceiling.principalId !== this.scope.actorId)) throw new IntakeAccessDeniedError();
 		const deadline = Math.min(time(item.expires_at), time(item.created_at) + policy.retentionMs);
 		return {
 			current,
@@ -6774,7 +6806,7 @@ var IntakeExecutionService = class {
 	}
 	async bound(db, actionId, lock = false, expired = false, proposalId) {
 		const [found] = await this.rows(db, "intake_actions", "id=?", [actionId]);
-		if (!found) throw new Error("Intake unavailable");
+		if (!found) throw new IntakeAccessDeniedError();
 		const item = await this.item(db, String(found.item_id), lock, expired);
 		const [action] = await this.rows(db, "intake_actions", "id=?", [actionId]);
 		const [proposal] = await this.rows(db, "intake_proposals", proposalId ? "action_id=? AND id=?" : "action_id=? AND revision=?", [actionId, proposalId ?? action.proposal_revision]);
@@ -6842,14 +6874,14 @@ var IntakeExecutionService = class {
 		const run = (executor) => this.discoveryContext(executor, itemId, handlerId, handlerVersion, work, false, revalidate);
 		return db ? run(db) : this.tx(run);
 	}
-	[feedbackActionTransaction](actionId, reviewer, work, executor, requiredProviders, proposalId) {
+	[feedbackActionTransaction](actionId, reviewer, work, executor, requiredProviders, proposalId, targetRevisions = true) {
 		const operation = async (db) => {
 			const load = async () => {
 				const bound = await this.bound(db, actionId, true, false, proposalId);
 				const { context, permissions } = await this.access(db, bound.item, bound.handler, reviewer ? "review" : "read");
 				if (requiredProviders?.some((provider) => !context.policy.providers.includes(provider))) throw new Error("Feedback source provider unavailable");
 				await this.verifyEvidence(db, bound);
-				for (const target of bound.binding.targetPreconditions) await context.assertTarget(target.model, target.id, bound.action.state === "succeeded" ? void 0 : target.revision);
+				for (const target of bound.binding.targetPreconditions) await context.assertTarget(target.model, target.id, bound.action.state === "succeeded" || !targetRevisions ? void 0 : target.revision);
 				if (bound.binding.plan) {
 					const plan = (await this.rows(db, "intake_plans", "item_id=? AND plan_key=?", [bound.item.id, bound.binding.plan.key])).sort((a, b) => Number(b.revision) - Number(a.revision))[0];
 					if (!plan || plan.digest !== bound.binding.plan.digest) throw new Error("Plan superseded");
@@ -6879,10 +6911,16 @@ var IntakeExecutionService = class {
 					configuration: input.configuration
 				}) !== analysis.input_digest) throw new Error("Analysis input integrity");
 				if (!this.retained(bound.item)) throw new Error("Feedback unavailable");
+				const resolved = !!await this.disposition(db, String(bound.item.id));
+				const state = String(bound.action.state);
+				const settled = !resolved && (["executing", "succeeded"].includes(state) || state === "authorized" && await this.approvalLive(db, bound.action));
+				const origin = object(bound.action.data).origin;
 				return {
 					db,
 					context,
 					permissions,
+					origin: typeof origin === "string" ? origin : "",
+					settled,
 					review: this.review(bound),
 					itemId: String(bound.item.id),
 					attemptId: String(attempt.id),
@@ -6915,7 +6953,7 @@ var IntakeExecutionService = class {
 				"leaseMs",
 				"retentionMs"
 			]) if (next[key] > prior[key]) throw new Error("Feedback cannot widen policy");
-			if (prior.requireReview && !next.requireReview || next.minimumCertainty < prior.minimumCertainty || !prior.consequentialAutomation && next.consequentialAutomation) throw new Error("Feedback cannot widen policy");
+			if (prior.requireReview && !next.requireReview || next.minimumCertainty < prior.minimumCertainty || !prior.consequentialAutomation && next.consequentialAutomation || !prior.submitterReview && next.submitterReview) throw new Error("Feedback cannot widen policy");
 			return result;
 		};
 		return executor ? operation(executor) : this.tx(operation);
@@ -6931,13 +6969,13 @@ var IntakeExecutionService = class {
 		if (!Array.isArray(references)) throw new Error("Feedback lineage unavailable");
 		if (references.length === 0) return;
 		if (!this.options.feedback) throw new Error("Feedback configuration unavailable");
-		const { IntakeFeedbackService } = await import("./feedback-CuUzWKzP.js").then((n) => n.r);
+		const { IntakeFeedbackService } = await import("./feedback-D3UTF8fm.js").then((n) => n.r);
 		await new IntakeFeedbackService(this.options, this).assertActionLineage(String(bound.action.id), db, String(bound.proposal.id));
 	}
 	async getAction(actionId) {
 		return this.tx(async (db) => {
 			const [action] = await this.rows(db, "intake_actions", "id=?", [actionId]);
-			if (!action) throw new Error("Intake unavailable");
+			if (!action) throw new IntakeAccessDeniedError();
 			const item = await this.item(db, String(action.item_id), true, true);
 			const expiredReview = async () => {
 				await this.redactExecution(db, item);
@@ -6973,7 +7011,7 @@ var IntakeExecutionService = class {
 	/** Bounded reload discovery. The cursor is an opaque action ID, never authority. */
 	async listReviews(itemId, input = {}) {
 		const limit = input.limit ?? 20;
-		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50 || input.cursor !== void 0 && !/^[0-9a-f-]{36}$/i.test(input.cursor)) throw new Error("Invalid review page");
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50 || input.cursor !== void 0 && !UUID_CURSOR.test(input.cursor)) throw new Error("Invalid review page");
 		return this.tx(async (db) => {
 			const item = await this.item(db, itemId, true, true);
 			const rows = (await db.query(`SELECT * FROM intake_actions WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?${input.cursor ? " AND id>?" : ""} ORDER BY id LIMIT ?`, this.scope.tenantId, this.scope.confidentialScopeId, itemId, ...input.cursor ? [input.cursor] : [], limit + 1)).rows;
@@ -7041,12 +7079,14 @@ var IntakeExecutionService = class {
 						if (attempt && ["completed", "partial"].includes(String(attempt.state)) && String(analysis.current_attempt_id) === String(attempt.id)) recoveryAttemptId = String(attempt.id);
 					}
 				}
+				const origin = object(action.data).origin;
 				const entry = {
 					review: this.review(bound),
 					args: structuredClone(bound.binding.args),
 					handlerId: bound.handler.id,
 					handlerVersion: bound.handler.version,
 					attemptId: String(proposal.analysis_attempt_id),
+					...typeof origin === "string" && origin ? { origin } : {},
 					dependencies: structuredClone(bound.binding.dependencies)
 				};
 				if (action.state === "succeeded") entry.result = await this.successful(db, action, item);
@@ -7212,7 +7252,7 @@ var IntakeExecutionService = class {
 		if (!this.retained(item)) throw new RetentionExpired(String(item.id), time(item.expires_at));
 		id(input.requestId);
 		const [action] = await this.rows(db, "intake_actions", "id=? AND item_id=?", [input.actionId, input.itemId]);
-		if (!action) throw new Error("Intake unavailable");
+		if (!action) throw new IntakeAccessDeniedError();
 		const prior = await this.rows(db, "intake_proposals", "action_id=?", [input.actionId]);
 		const requestHash = intakeBindingDigest(input);
 		const replay = prior.find((row) => object(row.data).requestId === input.requestId);
@@ -7234,6 +7274,7 @@ var IntakeExecutionService = class {
 			"executing",
 			"outcome_unknown"
 		].includes(String(action.state))) throw new Error("Proposal conflict");
+		if (await this.disposition(db, String(item.id))) throw new Error("Item resolved");
 		const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND item_id=?", [input.attemptId, input.itemId]);
 		const [analysis] = await this.rows(db, "intake_analyses", "id=?", [attempt.analysis_id]);
 		const bindingHash = intakeBindingDigest({
@@ -7275,10 +7316,24 @@ var IntakeExecutionService = class {
 		const frozen = JSON.parse(canonical(input));
 		return this.tx(async (db) => {
 			const item = await this.item(db, frozen.itemId, true);
+			await this.assertReviewerRevision(db, item, frozen);
 			const binding = await this.buildBinding(db, item, frozen, true);
 			return this.publish(db, item, frozen, binding);
 		});
 	}
+	/**
+	* A reviewer-selected action records a human routing choice: re-previewing it
+	* needs the reviewer grant (not just `preview`) and keeps its handler fixed,
+	* so only the arguments can be corrected.
+	*/
+	async assertReviewerRevision(db, item, input) {
+		const [action] = await this.rows(db, "intake_actions", "id=? AND item_id=?", [input.actionId, item.id]);
+		if (!action || object(action.data).origin !== "reviewer-selected") return;
+		const [current] = await this.rows(db, "intake_proposals", "action_id=? AND revision=?", [action.id, action.proposal_revision]);
+		const binding = current ? object(object(current.data).binding) : void 0;
+		if (!binding || binding.handlerId !== input.handlerId || binding.handlerVersion !== input.handlerVersion) throw new Error("Reviewer-selected handler is fixed");
+		await this.access(db, item, this.operation(this.handler(input.handlerId, input.handlerVersion)), "review");
+	}
 	/** Capture owner facts in the same transaction; these are never correctness labels. */
 	async feedbackEvent(db, bound, eventId, kind) {
 		if (!this.options.feedback || !this.retained(bound.item)) return;
@@ -7311,6 +7366,8 @@ var IntakeExecutionService = class {
 			handlerVersion: bound.handler.version,
 			signal,
 			reviewer: kind === "action_decision" ? eventData.reviewer : null,
+			decisionMode: kind === "action_decision" ? eventData.mode ?? "review" : null,
+			selfDecision: kind === "action_decision" && eventData.selfDecision === true,
 			observedBy: this.scope.actorId,
 			principalId: eventData.principalId ?? null,
 			reason: kind === "action_decision" ? eventData.reason ?? "" : "",
@@ -7335,7 +7392,7 @@ var IntakeExecutionService = class {
 			data: canonical(data)
 		});
 	}
-	async submitDecision(input) {
+	async submitDecision(input, mode = "review") {
 		const frozen = JSON.parse(canonical(input));
 		id(frozen.requestId);
 		if (![
@@ -7344,9 +7401,10 @@ var IntakeExecutionService = class {
 			"defer",
 			"correct"
 		].includes(frozen.decision) || (frozen.reason?.length ?? 0) > 2048) throw new Error("Invalid decision");
+		if (mode === "review_own" && frozen.decision === "correct") throw new Error("Invalid decision");
 		return this.tx(async (db) => {
 			const bound = await this.bound(db, frozen.actionId, true);
-			const { policy } = await this.access(db, bound.item, bound.handler, "review");
+			const { policy } = await this.access(db, bound.item, bound.handler, mode);
 			await this.feedbackLineage(db, bound);
 			const decisions = await this.rows(db, "intake_review_decisions", "action_id=?", [frozen.actionId]);
 			const requestHash = intakeBindingDigest(frozen);
@@ -7358,6 +7416,7 @@ var IntakeExecutionService = class {
 			}
 			if (bound.action.state !== "waiting_review" || Number(bound.proposal.revision) !== frozen.expectedRevision || Number(bound.action.review_version) !== frozen.expectedReviewVersion || bound.proposal.binding_hash !== frozen.bindingHash) throw new Error("Stale review");
 			await this.verifyEvidence(db, bound);
+			if (frozen.decision !== "reject" && await this.disposition(db, String(bound.item.id))) throw new Error("Item resolved");
 			const expiresAt = new Date(Math.min(time(bound.item.expires_at), this.now().getTime() + policy.approvalMs)).toISOString();
 			const decisionEvent = await this.insert(db, "intake_review_decisions", {
 				item_id: bound.item.id,
@@ -7374,7 +7433,9 @@ var IntakeExecutionService = class {
 					expiresAt,
 					policyVersions: policy.versions,
 					decidedAt: this.now().toISOString(),
-					kind: "human"
+					kind: "human",
+					mode,
+					selfDecision: bound.item.submitter_id === this.scope.actorId
 				})
 			});
 			await this.feedbackEvent(db, bound, String(decisionEvent.id), "action_decision");
@@ -7403,6 +7464,21 @@ var IntakeExecutionService = class {
 				defer: "deferred"
 			}[frozen.decision];
 			await db.query("UPDATE intake_actions SET state=? WHERE id=? AND tenant_id=? AND confidential_scope_id=?", state, frozen.actionId, this.scope.tenantId, this.scope.confidentialScopeId);
+			const provenance = object(bound.action.data);
+			if (frozen.decision === "approve" && mode === "review" && provenance.origin === "reviewer-selected") {
+				const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND item_id=?", [bound.proposal.analysis_attempt_id, bound.item.id]);
+				if (attempt) await this.routingFeedback(db, bound.item, attempt, {
+					requestId: frozen.requestId,
+					reason: typeof provenance.reason === "string" ? provenance.reason : "",
+					...typeof provenance.reviewer === "string" ? { startedBy: provenance.reviewer } : {},
+					handler: {
+						handlerId: bound.handler.id,
+						handlerVersion: bound.handler.version,
+						args: structuredClone(bound.binding.args),
+						review: this.review(bound)
+					}
+				});
+			}
 			return {
 				...this.review(bound),
 				state
@@ -7427,6 +7503,7 @@ var IntakeExecutionService = class {
 	async approved(db, bound) {
 		await this.feedbackLineage(db, bound);
 		await this.verifyEvidence(db, bound);
+		if (await this.disposition(db, String(bound.item.id))) throw new Error("Item resolved");
 		if (bound.binding.plan) {
 			const latest = (await this.rows(db, "intake_plans", "item_id=? AND plan_key=?", [bound.item.id, bound.binding.plan.key])).sort((a, b) => Number(b.revision) - Number(a.revision))[0];
 			if (!latest || latest.digest !== bound.binding.plan.digest || Number(latest.revision) !== bound.binding.plan.revision) throw new Error("Plan superseded");
@@ -7480,6 +7557,7 @@ var IntakeExecutionService = class {
 		]);
 		if (!decision || decision.decision !== "approve" || decision.binding_hash !== bound.proposal.binding_hash || time(object(decision.data).expiresAt) <= this.now().getTime()) throw new Error("Approval required");
 		const decisionData = object(decision.data);
+		if (decisionData.mode === "review_own" && (decisionData.reviewer !== bound.item.submitter_id || bound.item.submitter_id !== this.ceiling(bound.item).principalId)) throw new Error("Approval required");
 		if (decisionData.kind === "machine") {
 			const access = await this.access(db, bound.item, bound.handler, "execute");
 			const consequential = bound.handler.execution.kind === "external" || bound.handler.capability.effect === "destructive" || bound.handler.capability.openWorld;
@@ -7602,6 +7680,7 @@ var IntakeExecutionService = class {
 		};
 		if (!(await db.query("UPDATE intake_actions SET state='succeeded',result_digest=? WHERE id=? AND tenant_id=? AND confidential_scope_id=? AND fence=? AND state IN ('executing','outcome_unknown') RETURNING id", resultDigest, bound.action.id, this.scope.tenantId, this.scope.confidentialScopeId, execution.fence)).rows.length) throw new Error("Execution fence lost");
 		await db.query("UPDATE intake_executions SET state='succeeded',result_digest=?,data=? WHERE id=? AND tenant_id=? AND confidential_scope_id=?", resultDigest, canonical(data), execution.id, this.scope.tenantId, this.scope.confidentialScopeId);
+		await this.releaseRedactedPrincipal(db, String(bound.item.id));
 		await this.feedbackEvent(db, bound, String(execution.id), "downstream_outcome");
 		return {
 			state: "succeeded",
@@ -7615,7 +7694,7 @@ var IntakeExecutionService = class {
 		let reserved;
 		const result = await this.tx(async (db) => {
 			const [action] = await this.rows(db, "intake_actions", "id=?", [actionId]);
-			if (!action) throw new Error("Intake unavailable");
+			if (!action) throw new IntakeAccessDeniedError();
 			const item = await this.item(db, String(action.item_id), true, true);
 			const [current] = await this.rows(db, "intake_actions", "id=?", [actionId]);
 			if (current.state === "succeeded") return this.successful(db, current, item);
@@ -7832,6 +7911,7 @@ var IntakeExecutionService = class {
 				...object(execution.data),
 				reconciliation: observed.kind
 			}), execution.id, this.scope.tenantId, this.scope.confidentialScopeId);
+			await this.releaseRedactedPrincipal(db, String(item.id));
 			await this.feedbackEvent(db, {
 				...bound,
 				item
@@ -7849,7 +7929,7 @@ var IntakeExecutionService = class {
 			const bound = await this.bound(db, actionId, true);
 			const { current, policy, context } = await this.access(db, bound.item, bound.handler, "execute");
 			const consequential = bound.handler.execution.kind === "external" || bound.handler.capability.effect === "destructive" || bound.handler.capability.openWorld;
-			if (bound.action.state !== "waiting_review" || !policy.automaticHandlers.includes(bound.handler.id) || consequential && !policy.consequentialAutomation || !this.config.evaluateAutomatic) throw new Error("Automatic execution unavailable");
+			if (bound.action.state !== "waiting_review" || !policy.automaticHandlers.includes(bound.handler.id) || consequential && !policy.consequentialAutomation || !this.config.evaluateAutomatic || object(bound.action.data).origin === "reviewer-selected" || await this.disposition(db, String(bound.item.id))) throw new Error("Automatic execution unavailable");
 			await this.feedbackLineage(db, bound);
 			const evaluated = await this.config.evaluateAutomatic({
 				bindingHash: String(bound.proposal.binding_hash),
@@ -7882,6 +7962,226 @@ var IntakeExecutionService = class {
 			};
 		});
 	}
+	/**
+	* Whether an `authorized` action still holds an unexpired approval for its
+	* current review version. An expired one can be neither applied nor rejected,
+	* so it must not keep the item open; `approved()` refuses resolved items.
+	*/
+	async approvalLive(db, action) {
+		return (await this.rows(db, "intake_review_decisions", "action_id=? AND review_version=? AND decision='approve'", [action.id, action.review_version])).some((row) => time(object(row.data).expiresAt) > this.now().getTime());
+	}
+	/** Current terminal reviewer disposition, if any. */
+	async disposition(db, itemId) {
+		const [row] = await this.rows(db, "intake_dispositions", "item_id=? ORDER BY id LIMIT 1", [itemId]);
+		return row;
+	}
+	dispositionDTO(row) {
+		const data = object(row.data);
+		return {
+			kind: "resolved_no_action",
+			reviewer: typeof data.reviewer === "string" ? data.reviewer : "",
+			reason: typeof data.reason === "string" ? data.reason : "",
+			decidedAt: typeof data.decidedAt === "string" ? data.decidedAt : ""
+		};
+	}
+	/** The current revision's completed/partial attempt; failed revisions need reprocessing. */
+	async currentAttempt(db, item) {
+		const [analysis] = await this.rows(db, "intake_analyses", "item_id=? AND revision=?", [item.id, item.analysis_revision]);
+		if (!analysis?.current_attempt_id) throw new Error("Analysis unavailable");
+		const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND item_id=?", [analysis.current_attempt_id, item.id]);
+		if (!attempt || !["completed", "partial"].includes(String(attempt.state)) || !attempt.output_digest) throw new Error("Analysis unavailable");
+		return attempt;
+	}
+	/** Reviewer authority under a handler this item's captured ceiling offers; no new grant. */
+	async reviewerAccess(db, item) {
+		const handlers = [...this.config.handlers].sort((a, b) => `${a.id}@${a.version}`.localeCompare(`${b.id}@${b.version}`));
+		for (const handler of handlers) try {
+			return await this.access(db, item, handler, "review");
+		} catch (error) {
+			if (error instanceof RetentionExpired) throw error;
+		}
+		throw new Error("Intake unavailable");
+	}
+	/** Extracted text for routing examples: the attempt's own results or its pinned extraction. */
+	async extractedQuery(db, item, attempt) {
+		let source = attempt;
+		const output = object(object(attempt.data).output);
+		if (output.proposals) {
+			const pin = object(object(output.proposals).source);
+			const [row] = await this.rows(db, "intake_analysis_attempts", "id=? AND item_id=?", [pin.attemptId, item.id]);
+			if (!row || row.output_digest !== pin.outputDigest) throw new Error("Feedback source unavailable");
+			source = row;
+		}
+		const results = object(object(source.data).output).results;
+		if (!Array.isArray(results)) return "";
+		return results.flatMap((entry) => {
+			const segments = object(entry).segments;
+			return Array.isArray(segments) ? segments.map((segment) => String(object(segment).text ?? "")) : [];
+		}).join("\n").slice(0, 4096);
+	}
+	/** Optional explicit routing projection; the reviewer's action or disposition stays authoritative. */
+	async routingFeedback(db, item, attempt, choice) {
+		if (!this.options.feedback || !this.retained(item)) return;
+		if (!await this.options.feedback.authorize({
+			db,
+			scope: this.scope,
+			itemId: String(item.id),
+			operation: "capture"
+		})) return;
+		const key = `routing:${choice.requestId}`;
+		const [replay] = await this.rows(db, "intake_feedback", "item_id=? AND request_key=?", [item.id, key]);
+		if (replay) return;
+		let data;
+		try {
+			const [analysis] = await this.rows(db, "intake_analyses", "id=?", [attempt.analysis_id]);
+			const inputs = object(analysis.data).inputs;
+			if (!Array.isArray(inputs)) throw new Error("Invalid evidence");
+			const body = {
+				version: 1,
+				choice: choice.handler ? "handler" : "none",
+				handlerId: choice.handler?.handlerId ?? null,
+				handlerVersion: choice.handler?.handlerVersion ?? null,
+				args: choice.handler?.args ?? null,
+				actionId: choice.handler?.review.actionId ?? null,
+				proposalId: choice.handler?.review.proposalId ?? null,
+				revision: choice.handler?.review.revision ?? null,
+				bindingHash: choice.handler?.review.bindingHash ?? null,
+				attemptId: String(attempt.id),
+				attemptDigest: String(attempt.output_digest),
+				analysisRevision: Number(analysis.revision),
+				evidence: inputs,
+				query: await this.extractedQuery(db, item, attempt),
+				reviewer: this.scope.actorId,
+				startedBy: choice.startedBy ?? null,
+				approvedBy: choice.handler ? this.scope.actorId : null,
+				reason: choice.reason,
+				requestId: choice.requestId,
+				decidedAt: this.now().toISOString()
+			};
+			data = {
+				...body,
+				digest: intakeBindingDigest(body)
+			};
+		} catch {
+			return;
+		}
+		if (Buffer.byteLength(canonical(data)) > this.options.feedback.maxBytes) return;
+		await this.insert(db, "intake_feedback", {
+			item_id: item.id,
+			request_key: key,
+			supersedes_id: null,
+			kind: "reviewer_routing",
+			data: canonical(data)
+		});
+	}
+	/** Human-chosen handler for any item. Same preview/approval path; never automation-eligible. */
+	async startAction(input) {
+		const frozen = JSON.parse(canonical(JSON.parse(JSON.stringify(input))));
+		id(frozen.requestId);
+		if (frozen.reason !== void 0 && (typeof frozen.reason !== "string" || frozen.reason.length > 2048) || !frozen.args || typeof frozen.args !== "object" || Array.isArray(frozen.args)) throw new Error("Invalid reviewer action");
+		return this.tx(async (db) => {
+			const item = await this.item(db, frozen.itemId, true);
+			const handler = this.handler(frozen.handlerId, frozen.handlerVersion);
+			if (!("execution" in handler)) throw new Error("Handler unavailable");
+			await this.access(db, item, handler, "review");
+			const evidence = await this.rows(db, "intake_evidence", "item_id=? AND state='durable'", [item.id]);
+			if (!handler.discovery?.mediaTypes.some((type) => evidence.some((entry) => entry.media_type === type))) throw new Error("Handler unavailable");
+			if (await this.disposition(db, String(item.id))) throw new Error("Item resolved");
+			const attempt = await this.currentAttempt(db, item);
+			const actionKey = `reviewer:${frozen.requestId}`;
+			const provenance = canonical({
+				origin: "reviewer-selected",
+				intentionKey: actionKey,
+				reviewer: this.scope.actorId,
+				reason: frozen.reason ?? ""
+			});
+			let [action] = await this.rows(db, "intake_actions", "item_id=? AND action_key=?", [item.id, actionKey]);
+			if (action && canonical(object(action.data)) !== provenance) throw new Error("Action identity conflict");
+			action ??= await this.insert(db, "intake_actions", {
+				item_id: item.id,
+				action_key: actionKey,
+				state: "proposed",
+				proposal_revision: 0,
+				review_version: 0,
+				execution_attempt: 0,
+				fence: 0,
+				result_digest: "",
+				data: provenance
+			});
+			const replayed = (await this.rows(db, "intake_proposals", "action_id=?", [action.id])).find((row) => object(row.data).requestId === frozen.requestId);
+			const preview = {
+				itemId: String(item.id),
+				actionId: String(action.id),
+				attemptId: String(attempt.id),
+				expectedRevision: replayed ? Number(replayed.revision) - 1 : Number(action.proposal_revision),
+				requestId: frozen.requestId,
+				handlerId: handler.id,
+				handlerVersion: handler.version,
+				args: frozen.args
+			};
+			const binding = await this.buildBinding(db, item, preview);
+			return this.publish(db, item, preview, binding);
+		});
+	}
+	/** The full disposition (reviewer, reason) under the current reviewer authority. */
+	async getItemDisposition(itemId) {
+		return this.tx(async (db) => {
+			const item = await this.item(db, itemId);
+			await this.reviewerAccess(db, item);
+			const row = await this.disposition(db, String(item.id));
+			return row ? this.dispositionDTO(row) : void 0;
+		});
+	}
+	/** Close an item as handled without an action. Terminal; replay returns the same disposition. */
+	async resolveItem(input) {
+		const frozen = JSON.parse(canonical(JSON.parse(JSON.stringify(input))));
+		id(frozen.requestId);
+		if (frozen.disposition !== "resolve_no_action" || frozen.reason !== void 0 && (typeof frozen.reason !== "string" || frozen.reason.length > 2048)) throw new Error("Invalid disposition");
+		return this.tx(async (db) => {
+			const item = await this.item(db, frozen.itemId, true);
+			const { policy } = await this.reviewerAccess(db, item);
+			const requestHash = intakeBindingDigest(frozen);
+			const key = `disposition:${frozen.requestId}`;
+			const existing = await this.disposition(db, String(item.id));
+			if (existing) {
+				const data = object(existing.data);
+				if (existing.request_key === key && data.requestHash === requestHash && data.reviewer === this.scope.actorId) return this.dispositionDTO(existing);
+				throw new Error("Item resolved");
+			}
+			const pending = [];
+			for (const action of await this.rows(db, "intake_actions", "item_id=? AND state IN ('authorized','executing','outcome_unknown','succeeded')", [item.id])) if (action.state !== "authorized" || await this.approvalLive(db, action)) pending.push(action);
+			if (pending.length) throw new Error("Item has pending or applied actions");
+			if (!this.retained(item)) throw new RetentionExpired(String(item.id), time(item.expires_at));
+			let attempt;
+			try {
+				attempt = await this.currentAttempt(db, item);
+			} catch {
+				attempt = void 0;
+			}
+			for (const table of ["intake_analysis_attempts", "intake_analyses"]) await db.query(`UPDATE ${table} SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')`, this.scope.tenantId, this.scope.confidentialScopeId, item.id);
+			await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state<>'completed'", this.scope.tenantId, this.scope.confidentialScopeId, item.id);
+			const row = await this.insert(db, "intake_dispositions", {
+				item_id: item.id,
+				request_key: key,
+				disposition: "resolved_no_action",
+				data: canonical({
+					reviewer: this.scope.actorId,
+					reason: frozen.reason ?? "",
+					requestId: frozen.requestId,
+					requestHash,
+					decidedAt: this.now().toISOString(),
+					attemptId: attempt ? String(attempt.id) : null,
+					attemptDigest: attempt ? String(attempt.output_digest) : null,
+					policyVersions: policy.versions
+				})
+			});
+			if (attempt) await this.routingFeedback(db, item, attempt, {
+				requestId: frozen.requestId,
+				reason: frozen.reason ?? ""
+			});
+			return this.dispositionDTO(row);
+		});
+	}
 	async previewPlan(input) {
 		const frozen = JSON.parse(canonical(input));
 		id(frozen.planKey);
@@ -8085,6 +8385,104 @@ var IntakeExecutionService = class {
 		}
 		return results;
 	}
+	/** The recorded submitter decides their own proposal under `review_own`
+	* authority. Apply remains the ordinary once-only path under live grants. */
+	async submitOwnDecision(input) {
+		return this.submitDecision(input, "review_own");
+	}
+	/** Bounded listing of this actor's own active submissions with their saved
+	* reviews. The submitter column is the authenticated receipt actor recorded by
+	* the server; every page reloads current item/handler/target authority. */
+	async listOwnProposals(input = {}) {
+		const limit = input.limit ?? 20;
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50 || input.cursor !== void 0 && !UUID_CURSOR.test(input.cursor)) throw new Error("Invalid review page");
+		const readable = [];
+		let more = false;
+		let after = input.cursor;
+		let hidden = 0;
+		scan: for (;;) {
+			const batch = (await this.db.query(`SELECT * FROM intake_items WHERE tenant_id=? AND confidential_scope_id=? AND submitter_id=? AND visibility='active' AND expires_at>?${after ? " AND id>?" : ""} ORDER BY id LIMIT ?`, this.scope.tenantId, this.scope.confidentialScopeId, this.scope.actorId, this.now().toISOString(), ...after ? [after] : [], OWN_SCAN_BATCH)).rows;
+			for (const row of batch) if (await this.readableOwn(row)) {
+				if (readable.length === limit) {
+					more = true;
+					break scan;
+				}
+				readable.push(row);
+			} else if (++hidden >= OWN_SCAN_CEILING) throw new Error("Own proposal scan limit");
+			if (batch.length < OWN_SCAN_BATCH) break;
+			after = String(batch[batch.length - 1].id);
+		}
+		const reviews = new IntakeExecutionService(this.options, {
+			...this.config,
+			assertTarget: async (target) => {
+				try {
+					return await this.config.assertTarget(target);
+				} catch {
+					throw new IntakeAccessDeniedError();
+				}
+			}
+		});
+		const items = [];
+		for (const row of readable) {
+			const item = {
+				id: String(row.id),
+				receiptState: String(row.receipt_state),
+				processingState: String(row.processing_state),
+				analysisRevision: Number(row.analysis_revision),
+				cancelled: !!row.cancelled,
+				traceId: String(row.trace_id)
+			};
+			try {
+				items.push({
+					item,
+					reviews: await reviews.listReviews(item.id, { limit: 50 })
+				});
+			} catch (error) {
+				if (!(error instanceof IntakeAccessDeniedError)) throw error;
+				items.push({
+					item,
+					reviews: null,
+					unavailable: true
+				});
+			}
+		}
+		return {
+			items,
+			...more && items.length ? { nextCursor: items[items.length - 1].item.id } : {}
+		};
+	}
+	/** Once a privacy-redacted item has no external action left to reconcile,
+	* drop the principal that redaction had to retain for it. Caller holds the
+	* item lock. */
+	async releaseRedactedPrincipal(db, itemId) {
+		const [item] = await this.rows(db, "intake_items", "id=?", [itemId]);
+		if (!item || item.visibility === "active") return;
+		if ((await this.rows(db, "intake_actions", `item_id=? AND state IN (${UNFINISHED_ACTION_STATES.map(() => "?").join(",")})`, [itemId, ...UNFINISHED_ACTION_STATES])).length) return;
+		const data = object(item.data);
+		const ceiling = object(data.capturedCeiling ?? {});
+		const released = redactedCeiling(ceiling, false);
+		if (canonical(released) === canonical(ceiling)) return;
+		await db.query("UPDATE intake_items SET data=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", canonical({
+			...data,
+			capturedCeiling: released
+		}), this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+	}
+	/** Only an explicit denial hides a row; a failing grant store propagates
+	* instead of silently shrinking the list. */
+	async readableOwn(row) {
+		const capturedCeiling = object(object(row.data).capturedCeiling ?? {});
+		try {
+			return await this.options.authorize({
+				scope: this.scope,
+				operation: "read",
+				capturedCeiling,
+				db: this.db
+			}) === true;
+		} catch (error) {
+			if (error instanceof IntakeAccessDeniedError) return false;
+			throw error;
+		}
+	}
 };
 async function continueIntakeReview(service, actionId, task) {
 	await task.assertAuthorized();
@@ -8112,6 +8510,6 @@ async function continueIntakeReview(service, actionId, task) {
 	return service.applyAction(actionId);
 }
 //#endregion
-export { feedbackActionTransaction as a, GenerationSnapshotStaleError as c, discoveryTransaction as d, generationSnapshotRead as f, __toESM as h, resolveIntakePolicy as i, GenerationSourceStaleError as l, __exportAll as m, continueIntakeReview as n, feedbackDiscoveryContext as o, listReadGate as p, intakeBindingDigest as r, require_ajv as s, IntakeExecutionService as t, HandlerArgumentsInvalidError as u };
+export { listReadGate as _, resolveIntakePolicy as a, require_ajv as c, GenerationSnapshotStaleError as d, GenerationSourceStaleError as f, generationSnapshotRead as g, discoveryTransaction as h, intakeBindingDigest as i, UNFINISHED_ACTION_STATES as l, ProposalsNotConfiguredError as m, IntakeExecutionService as n, feedbackActionTransaction as o, HandlerArgumentsInvalidError as p, continueIntakeReview as r, feedbackDiscoveryContext as s, IntakeAccessDeniedError as t, redactedCeiling as u, __exportAll as v, __toESM as y };
 
-//# sourceMappingURL=execution-9CfjxX8I.js.map
+//# sourceMappingURL=execution-BzVQax0n.js.map