@hotmeshio/long-tail 0.1.8 → 0.1.10

package/build/api/escalations.js

@@ -664,7 +664,42 @@ async function resolveEscalation(input, auth) {
         if (escalation.status !== 'pending') {
             return { status: 409, error: 'Escalation not available for resolution' };
         }
-        // 2. waitFor signal escalation -- signal the paused workflow directly
+        // 2. Lightweight signal path: metadata.signal_id + escalation fields
+        //    The workflow called `await conditionLT(signalId)` and created its
+        //    own escalation with the signal_id in metadata. On resolution, we
+        //    inject $escalation_id into the payload and signal the running
+        //    workflow. The workflow is responsible for resolving the escalation
+        //    (conditionLT handles this automatically via a durable activity).
+        const metadataSignalId = escalation.metadata?.signal_id;
+        if (metadataSignalId && escalation.workflow_id && escalation.task_queue && escalation.workflow_type) {
+            const client = (0, workers_1.createClient)();
+            const handle = await client.workflow.getHandle(escalation.task_queue, escalation.workflow_type, escalation.workflow_id);
+            await handle.signal(metadataSignalId, {
+                ...resolverPayload,
+                $escalation_id: escalation.id,
+            });
+            (0, publish_1.publishEscalationEvent)({
+                type: 'escalation.resolved',
+                source: 'api',
+                workflowId: escalation.workflow_id,
+                workflowName: escalation.workflow_type,
+                taskQueue: escalation.task_queue,
+                taskId: escalation.task_id,
+                escalationId: escalation.id,
+                originId: escalation.origin_id ?? undefined,
+                status: 'resolved',
+            });
+            return {
+                status: 200,
+                data: {
+                    signaled: true,
+                    escalationId: escalation.id,
+                    workflowId: escalation.workflow_id,
+                },
+            };
+        }
+        // 3. waitFor signal escalation -- signal the paused workflow directly
+        //    (full signal_routing object from interceptor/MCP tool)
         const signalRouting = escalation.metadata?.signal_routing;
         if (signalRouting?.signalId) {
             // Replace password fields with ephemeral tokens so plaintext never enters the signal store
@@ -716,7 +751,7 @@ async function resolveEscalation(input, auth) {
                 },
             };
         }
-        // 3. Reconstruct the original envelope from the escalation or task
+        // 4. Reconstruct the original envelope from the escalation or task
         let envelope = {};
         if (escalation.envelope) {
             try {
@@ -733,7 +768,7 @@ async function resolveEscalation(input, auth) {
                 catch { /* use empty */ }
             }
         }
-        // 4. Check escalation strategy for triage routing
+        // 5. Check escalation strategy for triage routing
         const strategy = escalation_strategy_1.escalationStrategyRegistry.current;
         if (strategy) {
             const directive = await strategy.onResolution({
@@ -793,12 +828,12 @@ async function resolveEscalation(input, auth) {
                 };
             }
         }
-        // 5. If no workflow_type, this is a notification-only escalation -- acknowledge and close
+        // 6. If no workflow_type, this is a notification-only escalation -- acknowledge and close
         if (!escalation.workflow_type || !escalation.task_queue) {
             await escalationService.resolveEscalation(escalation.id, resolverPayload);
             return { status: 200, data: { acknowledged: true, escalationId: escalation.id } };
         }
-        // 6. Standard re-run: inject resolver data and start original workflow
+        // 7. Standard re-run: inject resolver data and start original workflow
         envelope.resolver = resolverPayload;
         envelope.lt = {
             ...envelope.lt,

package/build/api/tasks.d.ts

@@ -1,4 +1,28 @@
-import type { LTApiResult } from '../types/sdk';
+import type { LTApiResult, LTApiAuth } from '../types/sdk';
+/**
+ * Create a task record.
+ *
+ * Tasks represent workflow executions tracked by the LT interceptor.
+ * Required fields: `workflow_id`, `workflow_type`, `lt_type`,
+ * `signal_id`, `parent_workflow_id`, and `envelope`.
+ *
+ * @returns `{ status: 201, data: <task record> }`
+ */
+export declare function createTask(input: {
+    workflow_id: string;
+    workflow_type: string;
+    lt_type: string;
+    task_queue?: string;
+    signal_id: string;
+    parent_workflow_id: string;
+    origin_id?: string;
+    parent_id?: string;
+    envelope?: string;
+    metadata?: Record<string, any>;
+    priority?: number;
+    trace_id?: string;
+    span_id?: string;
+}, auth: LTApiAuth): Promise<LTApiResult>;
 /**
  * List tasks with optional filters.
  *

package/build/api/tasks.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTask = createTask;
 exports.listTasks = listTasks;
 exports.getProcessStats = getProcessStats;
 exports.listProcesses = listProcesses;
@@ -40,6 +41,54 @@ exports.getProcess = getProcess;
 exports.getTask = getTask;
 const taskService = __importStar(require("../services/task"));
 const escalationService = __importStar(require("../services/escalation"));
+/**
+ * Create a task record.
+ *
+ * Tasks represent workflow executions tracked by the LT interceptor.
+ * Required fields: `workflow_id`, `workflow_type`, `lt_type`,
+ * `signal_id`, `parent_workflow_id`, and `envelope`.
+ *
+ * @returns `{ status: 201, data: <task record> }`
+ */
+async function createTask(input, auth) {
+    try {
+        const { workflow_id, workflow_type, lt_type, signal_id, parent_workflow_id } = input;
+        if (!workflow_id || typeof workflow_id !== 'string') {
+            return { status: 400, error: 'workflow_id is required' };
+        }
+        if (!workflow_type || typeof workflow_type !== 'string') {
+            return { status: 400, error: 'workflow_type is required' };
+        }
+        if (!lt_type || typeof lt_type !== 'string') {
+            return { status: 400, error: 'lt_type is required' };
+        }
+        if (!signal_id || typeof signal_id !== 'string') {
+            return { status: 400, error: 'signal_id is required' };
+        }
+        if (!parent_workflow_id || typeof parent_workflow_id !== 'string') {
+            return { status: 400, error: 'parent_workflow_id is required' };
+        }
+        const task = await taskService.createTask({
+            workflow_id,
+            workflow_type,
+            lt_type,
+            task_queue: input.task_queue,
+            signal_id,
+            parent_workflow_id,
+            origin_id: input.origin_id,
+            parent_id: input.parent_id,
+            envelope: input.envelope ?? '{}',
+            metadata: input.metadata,
+            priority: input.priority,
+            trace_id: input.trace_id,
+            span_id: input.span_id,
+        });
+        return { status: 201, data: task };
+    }
+    catch (err) {
+        return { status: 500, error: err.message };
+    }
+}
 /**
  * List tasks with optional filters.
  *

package/build/api/workflows.js

@@ -72,7 +72,7 @@ function isResolveError(err) {
  */
 async function invokeWorkflow(input, auth) {
     try {
-        await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId);
+        await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
         const result = await (0, workflow_invocation_1.invokeWorkflow)({
             workflowType: input.type,
             data: input.data || {},
@@ -81,6 +81,8 @@ async function invokeWorkflow(input, auth) {
             options: input.options,
             auth: {
                 userId: auth.userId,
+                role: auth.role,
+                scopes: auth.scopes,
             },
         });
         return {
@@ -260,9 +262,14 @@ async function listDiscoveredWorkflows(input) {
             .map((workflowType) => {
             const config = configMap.get(workflowType);
             const worker = activeWorkers.get(workflowType);
+            const hasCertification = !!(config &&
+                ((config.roles?.length ?? 0) > 0 ||
+                    (config.consumes?.length ?? 0) > 0));
+            const tier = !config ? 'durable' : hasCertification ? 'certified' : 'configured';
             return {
                 workflow_type: workflowType,
                 task_queue: config?.task_queue ?? worker?.taskQueue ?? null,
+                tier,
                 registered: !!config,
                 active: !!worker,
                 invocable: config?.invocable ?? !!worker,

package/build/examples/seed.js

@@ -137,6 +137,24 @@ const SEED_ENVELOPES = [
             },
         },
     },
+    // -- Process 6: Basic Signal
+    {
+        label: 'Process 6 — Basic Signal',
+        workflowName: 'basicSignal',
+        taskQueue: 'long-tail-examples',
+        envelope: {
+            data: {
+                message: 'Seed deployment needs approval before proceeding.',
+                role: 'reviewer',
+            },
+            metadata: {
+                certified: false,
+                source: 'seed',
+                process: 'basic-signal',
+                description: 'Lightweight signal-based escalation — workflow stays running, no interceptor. Claim the escalation, fill the form, and resolve to resume the workflow.',
+            },
+        },
+    },
 ];
 // Escalation chains: reviewer -> admin -> engineer (and cross-links)
 const SEED_CHAINS = [

package/build/examples/types/envelopes.d.ts

@@ -24,6 +24,13 @@ export interface BasicEchoEnvelopeData {
     /** Duration to sleep before echoing (seconds). */
     sleepSeconds?: number;
 }
+/** Basic signal — lightweight escalation via conditionLT. */
+export interface BasicSignalEnvelopeData {
+    /** Message shown to the reviewer in the escalation description. */
+    message?: string;
+    /** Role to assign the escalation to. */
+    role?: string;
+}
 /** Assembly line — durable orchestrator with sequential human task queues. */
 export interface AssemblyLineEnvelopeData {
     /** Product name for the assembly run. */
@@ -53,6 +60,7 @@ export type WorkflowEnvelopeMap = {
     reviewContent: ReviewContentEnvelopeData;
     kitchenSink: KitchenSinkEnvelopeData;
     basicEcho: BasicEchoEnvelopeData;
+    basicSignal: BasicSignalEnvelopeData;
     assemblyLine: AssemblyLineEnvelopeData;
     stepIterator: StepIteratorEnvelopeData;
     reverter: ReverterEnvelopeData;

package/build/examples/types/index.d.ts

@@ -5,6 +5,6 @@
  * Resolver types define the payload shape for resolving escalations.
  * Per-workflow types are re-exported for convenience.
  */
-export type { ReviewContentEnvelopeData, KitchenSinkEnvelopeData, BasicEchoEnvelopeData, AssemblyLineEnvelopeData, StepIteratorEnvelopeData, ReverterEnvelopeData, WorkflowEnvelopeMap, InvocableWorkflowType, } from './envelopes';
+export type { ReviewContentEnvelopeData, KitchenSinkEnvelopeData, BasicEchoEnvelopeData, BasicSignalEnvelopeData, AssemblyLineEnvelopeData, StepIteratorEnvelopeData, ReverterEnvelopeData, WorkflowEnvelopeMap, InvocableWorkflowType, } from './envelopes';
 export type { ResolverLTBlock, BaseResolverPayload, ReviewContentResolverPayload, } from './resolvers';
 export type { ReviewContentInput, ReviewAnalysis, ReviewContentReturnData, ReviewContentReturn, ReviewContentEscalationData, ReviewContentEscalation, } from '../workflows/review-content/types';

package/build/examples/workers.js

@@ -41,6 +41,7 @@ const assemblyLineWorkflow = __importStar(require("./workflows/assembly-line"));
 const workstationWorkflow = __importStar(require("./workflows/assembly-line/worker"));
 const stepIteratorWorkflow = __importStar(require("./workflows/assembly-line/iterator"));
 const reverterWorkflow = __importStar(require("./workflows/assembly-line/reverter"));
+const basicSignalWorkflow = __importStar(require("./workflows/basic-signal"));
 /**
  * Example workers that ship with Long Tail.
  * Pass these to `start({ workers: [...exampleWorkers] })` or enable
@@ -54,4 +55,5 @@ exports.exampleWorkers = [
     { taskQueue: 'long-tail-examples', workflow: workstationWorkflow.workstation },
     { taskQueue: 'long-tail-examples', workflow: stepIteratorWorkflow.stepIterator },
     { taskQueue: 'long-tail-examples', workflow: reverterWorkflow.reverter },
+    { taskQueue: 'long-tail-examples', workflow: basicSignalWorkflow.basicSignal },
 ];

package/build/examples/workflows/basic-signal/activities.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Basic Signal Activities
+ *
+ * Simple activity for post-resolution processing. The escalation
+ * creation and resolution are handled via interceptor activities
+ * (ltCreateEscalation / ltResolveEscalation) proxied from the workflow.
+ */
+export declare function processApproval(input: {
+    approved: boolean;
+    notes: string;
+    message: string;
+}): Promise<{
+    message: string;
+    approved: boolean;
+    notes: string;
+    processedAt: string;
+}>;

package/build/examples/workflows/basic-signal/activities.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Basic Signal Activities
+ *
+ * Simple activity for post-resolution processing. The escalation
+ * creation and resolution are handled via interceptor activities
+ * (ltCreateEscalation / ltResolveEscalation) proxied from the workflow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.processApproval = processApproval;
+async function processApproval(input) {
+    return {
+        message: input.message,
+        approved: input.approved,
+        notes: input.notes,
+        processedAt: new Date().toISOString(),
+    };
+}

package/build/examples/workflows/basic-signal/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Basic Signal Workflow
+ *
+ * Lightweight signal-based escalation — the workflow stays running
+ * while waiting for human input. No interceptor, no certification.
+ *
+ *   1. Creates an escalation with `signal_id` in metadata
+ *   2. Pauses via `conditionLT(signalId)` — workflow stays alive
+ *   3. Dashboard resolver signals in with the form payload
+ *   4. `conditionLT` resolves the escalation via durable activity
+ *   5. Workflow continues with the clean resolver payload
+ *
+ * This demonstrates the lightweight alternative to the certified
+ * interceptor pattern — same escalation UX, simpler wiring.
+ */
+import type { LTEnvelope } from '../../../types';
+export declare function basicSignal(envelope: LTEnvelope): Promise<any>;

package/build/examples/workflows/basic-signal/index.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Basic Signal Workflow
+ *
+ * Lightweight signal-based escalation — the workflow stays running
+ * while waiting for human input. No interceptor, no certification.
+ *
+ *   1. Creates an escalation with `signal_id` in metadata
+ *   2. Pauses via `conditionLT(signalId)` — workflow stays alive
+ *   3. Dashboard resolver signals in with the form payload
+ *   4. `conditionLT` resolves the escalation via durable activity
+ *   5. Workflow continues with the clean resolver payload
+ *
+ * This demonstrates the lightweight alternative to the certified
+ * interceptor pattern — same escalation UX, simpler wiring.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basicSignal = basicSignal;
+const hotmesh_1 = require("@hotmeshio/hotmesh");
+const condition_1 = require("../../../services/orchestrator/condition");
+const interceptorActivities = __importStar(require("../../../services/interceptor/activities"));
+const activities = __importStar(require("./activities"));
+const LT_ACTIVITY_QUEUE = 'lt-interceptor';
+async function basicSignal(envelope) {
+    const { message = 'Please review and approve.', role = 'reviewer' } = envelope.data;
+    const { ltCreateEscalation } = hotmesh_1.Durable.workflow.proxyActivities({
+        activities: interceptorActivities,
+        taskQueue: LT_ACTIVITY_QUEUE,
+        retry: { maximumAttempts: 3 },
+    });
+    const { processApproval } = hotmesh_1.Durable.workflow.proxyActivities({
+        activities,
+    });
+    const ctx = hotmesh_1.Durable.workflow.workflowInfo();
+    const signalId = `approval-${ctx.workflowId}`;
+    // Create escalation with signal_id — dashboard knows to signal, not re-run.
+    //
+    // The resolver_schema registered in the workflow config provides the
+    // default form. To override per-instance, pass metadata.form_schema:
+    //
+    //   metadata: {
+    //     signal_id: signalId,
+    //     form_schema: {
+    //       properties: {
+    //         approved:    { type: 'boolean', default: false, description: 'Approve?' },
+    //         notes:       { type: 'string',  default: '',    description: 'Reviewer notes' },
+    //         environment: { type: 'string',  enum: ['staging', 'production'] },
+    //         api_key:     { type: 'string',  format: 'password', description: 'Deploy key (ephemeral)' },
+    //         confidence:  { type: 'number',  default: 0,     description: 'Confidence 0-1' },
+    //       },
+    //     },
+    //   },
+    //
+    // When form_schema is present it overrides the workflow config's
+    // resolver_schema for this specific escalation instance.
+    await ltCreateEscalation({
+        type: 'signal-approval',
+        subtype: 'basic-signal',
+        description: message,
+        role,
+        envelope: JSON.stringify(envelope),
+        workflowId: ctx.workflowId,
+        workflowType: 'basicSignal',
+        taskQueue: ctx.taskQueue,
+        metadata: {
+            signal_id: signalId,
+            // No form_schema here — the workflow config's resolver_schema is used.
+            // Pass form_schema to override per-instance (see comment above).
+        },
+    });
+    // Pause — conditionLT handles $escalation_id stripping and resolution
+    const decision = await (0, condition_1.conditionLT)(signalId);
+    // Continue with the clean resolver payload
+    const result = await processApproval({
+        approved: decision.approved,
+        notes: decision.notes || '',
+        message,
+    });
+    return {
+        type: 'return',
+        data: result,
+    };
+}

package/build/index.d.ts

@@ -2,6 +2,7 @@ export { start } from './start';
 export { registerLT, createLTInterceptor } from './services/interceptor';
 export { createLTActivityInterceptor } from './services/interceptor/activity-interceptor';
 export { executeLT } from './services/orchestrator';
+export { conditionLT } from './services/orchestrator/condition';
 export type { ExecuteLTOptions } from './services/orchestrator/types';
 export { JwtAuthAdapter, createAuthMiddleware, requireAuth, requireAdmin, signToken } from './modules/auth';
 export * from './types';

package/build/index.js

@@ -36,7 +36,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.api = exports.createClient = exports.CallbackEventAdapter = exports.seedSystemMcpServers = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
+exports.createClient = exports.CallbackEventAdapter = exports.seedSystemMcpServers = exports.builtinMcpServerFactories = exports.getSystemWorkers = exports.registerMcpTool = exports.getToolContext = exports.getActivityIdentity = exports.seedExamples = exports.exampleWorkers = exports.McpEscalationStrategy = exports.DefaultEscalationStrategy = exports.escalationStrategyRegistry = exports.McpVisionServer = exports.McpTranslationServer = exports.McpServer = exports.McpClient = exports.McpService = exports.BuiltInMcpAdapter = exports.mcpRegistry = exports.defaultMaintenanceConfig = exports.maintenanceRegistry = exports.PinoLoggerAdapter = exports.loggerRegistry = exports.HoneycombTelemetryAdapter = exports.telemetryRegistry = exports.publishWorkflowEvent = exports.publishEscalationEvent = exports.publishTaskEvent = exports.publishMilestoneEvent = exports.SocketIOEventAdapter = exports.InMemoryEventAdapter = exports.NatsEventAdapter = exports.eventRegistry = exports.ltConfig = exports.UserService = exports.ConfigService = exports.EscalationService = exports.TaskService = exports.signToken = exports.requireAdmin = exports.requireAuth = exports.createAuthMiddleware = exports.JwtAuthAdapter = exports.conditionLT = exports.executeLT = exports.createLTActivityInterceptor = exports.createLTInterceptor = exports.registerLT = exports.start = void 0;
+exports.api = void 0;
 const config_1 = require("./modules/config");
 const logger_1 = require("./lib/logger");
 const start_1 = require("./start");
@@ -50,6 +51,8 @@ var activity_interceptor_1 = require("./services/interceptor/activity-intercepto
 Object.defineProperty(exports, "createLTActivityInterceptor", { enumerable: true, get: function () { return activity_interceptor_1.createLTActivityInterceptor; } });
 var orchestrator_1 = require("./services/orchestrator");
 Object.defineProperty(exports, "executeLT", { enumerable: true, get: function () { return orchestrator_1.executeLT; } });
+var condition_1 = require("./services/orchestrator/condition");
+Object.defineProperty(exports, "conditionLT", { enumerable: true, get: function () { return condition_1.conditionLT; } });
 var auth_1 = require("./modules/auth");
 Object.defineProperty(exports, "JwtAuthAdapter", { enumerable: true, get: function () { return auth_1.JwtAuthAdapter; } });
 Object.defineProperty(exports, "createAuthMiddleware", { enumerable: true, get: function () { return auth_1.createAuthMiddleware; } });

package/build/lib/db/schemas/002_seed.sql

@@ -55,7 +55,14 @@ VALUES
    'Kitchen sink — demonstrates sleep, signals, parallel activities, escalation, and every durable primitive',
    '{}',
    '{"data": {"name": "World", "mode": "full"}, "metadata": {"source": "dashboard"}}'::jsonb,
-   NULL)
+   NULL),
+
+  -- Basic signal (configured, NOT certified — no escalation roles)
+  ('basicSignal', 'long-tail-examples', 'reviewer', true,
+   'Signal-based escalation — workflow stays running while waiting for human input via conditionLT',
+   '{}',
+   '{"data": {"message": "Deployment approval needed for v2.1.0", "role": "reviewer"}, "metadata": {"certified": false, "source": "dashboard"}}'::jsonb,
+   '{"properties": {"approved": {"type": "boolean", "default": false, "description": "Approve this deployment?"}, "notes": {"type": "string", "default": "", "description": "Reviewer notes — visible to the workflow author"}}}'::jsonb)
 ON CONFLICT (workflow_type) DO NOTHING;
 
 -- ─── Assign roles to all workflows ──────────────────────────────────────────
@@ -63,5 +70,6 @@ ON CONFLICT (workflow_type) DO NOTHING;
 INSERT INTO lt_config_roles (workflow_type, role)
 SELECT workflow_type, unnest(ARRAY['reviewer', 'engineer', 'admin'])
 FROM lt_config_workflows
+WHERE workflow_type != 'basicSignal'
 ON CONFLICT (workflow_type, role) DO NOTHING;
 

package/build/modules/ltconfig.d.ts

@@ -14,7 +14,14 @@ declare class LTConfigCache {
     getProviderData(name: string, originId: string): Promise<LTProviderData>;
     /** Force cache reload on next access. Call after config mutations. */
     invalidate(): void;
-    /** Get the full resolved config for a workflow (used by interceptor activities). */
+    /**
+     * Get the resolved config for a workflow, but only if certified.
+     *
+     * The interceptor uses this to decide whether to wrap the workflow
+     * with task tracking, escalation handling, and re-run detection.
+     * Configured-but-not-certified workflows (no roles, no consumes)
+     * return null so the interceptor skips them.
+     */
     getResolvedConfig(name: string): Promise<LTResolvedConfig | null>;
 }
 export declare const ltConfig: LTConfigCache;

package/build/modules/ltconfig.js

@@ -101,10 +101,20 @@ class LTConfigCache {
         this.loadedAt = 0;
         this.loadPromise = null;
     }
-    /** Get the full resolved config for a workflow (used by interceptor activities). */
+    /**
+     * Get the resolved config for a workflow, but only if certified.
+     *
+     * The interceptor uses this to decide whether to wrap the workflow
+     * with task tracking, escalation handling, and re-run detection.
+     * Configured-but-not-certified workflows (no roles, no consumes)
+     * return null so the interceptor skips them.
+     */
     async getResolvedConfig(name) {
         const config = await this.get(name);
-        return config ?? null;
+        if (!config)
+            return null;
+        const isCertified = (config.roles?.length ?? 0) > 0 || (config.consumes?.length ?? 0) > 0;
+        return isCertified ? config : null;
     }
 }
 exports.ltConfig = new LTConfigCache();

package/build/routes/tasks.js

@@ -36,6 +36,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const api = __importStar(require("../api/tasks"));
 const router = (0, express_1.Router)();
+/**
+ * POST /api/tasks
+ * Create a new task record.
+ * Body: { workflow_id, workflow_type, lt_type, signal_id, parent_workflow_id, envelope, ... }
+ */
+router.post('/', async (req, res) => {
+    const result = await api.createTask({
+        workflow_id: req.body?.workflow_id,
+        workflow_type: req.body?.workflow_type,
+        lt_type: req.body?.lt_type,
+        task_queue: req.body?.task_queue,
+        signal_id: req.body?.signal_id,
+        parent_workflow_id: req.body?.parent_workflow_id,
+        origin_id: req.body?.origin_id,
+        parent_id: req.body?.parent_id,
+        envelope: req.body?.envelope,
+        metadata: req.body?.metadata,
+        priority: req.body?.priority,
+        trace_id: req.body?.trace_id,
+        span_id: req.body?.span_id,
+    }, { userId: req.auth?.userId ?? '', role: req.auth?.role, scopes: req.auth?.scopes });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
 /**
  * GET /api/tasks
  * List tasks with optional filters.

package/build/routes/workflows/invocation.js

@@ -60,7 +60,7 @@ router.post('/:type/invoke', async (req, res) => {
         metadata,
         execute_as,
         options: Object.keys(options).length > 0 ? options : undefined,
-    }, { userId: req.auth?.userId ?? '' });
+    }, { userId: req.auth?.userId ?? '', role: req.auth?.role, scopes: req.auth?.scopes });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Workflow observation ────────────────────────────────────────────────────

package/build/sdk/index.d.ts

@@ -47,6 +47,21 @@ export interface LTClientOptions {
  */
 export declare function createClient(options?: LTClientOptions): {
     tasks: {
+        create: (input: {
+            workflow_id: string;
+            workflow_type: string;
+            lt_type: string;
+            task_queue?: string;
+            signal_id: string;
+            parent_workflow_id: string;
+            origin_id?: string;
+            parent_id?: string;
+            envelope?: string;
+            metadata?: Record<string, any>;
+            priority?: number;
+            trace_id?: string;
+            span_id?: string;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         list: typeof tasksApi.listTasks;
         get: typeof tasksApi.getTask;
         listProcesses: typeof tasksApi.listProcesses;

package/build/sdk/index.js

@@ -100,6 +100,7 @@ function createClient(options = {}) {
     return {
         // ── Tasks ──────────────────────────────────────────────────────────────
         tasks: {
+            create: bindAuth(tasksApi.createTask, auth),
             list: tasksApi.listTasks,
             get: tasksApi.getTask,
             listProcesses: tasksApi.listProcesses,

package/build/services/interceptor/index.js

@@ -98,14 +98,20 @@ function createLTInterceptor(options) {
                 taskQueue: activityTaskQueue,
                 retry: { maximumAttempts: 3 },
             });
-            // 2. Load config — unregistered workflows still get ToolContext
+            const envelope = (0, state_1.extractEnvelope)(ctx);
+            // 2. Fast path: envelope.metadata.certified === false skips the DB
+            //    lookup entirely. Use this for configured (non-certified) workflows
+            //    that manage their own escalation lifecycle via conditionLT.
+            if (envelope?.metadata?.certified === false) {
+                const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
+                return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
+            }
+            // 3. Load config — unregistered/uncertified workflows get ToolContext only
             const wfConfig = await activities.ltGetWorkflowConfig(wf.workflowName);
             if (!wfConfig) {
-                const envelope = (0, state_1.extractEnvelope)(ctx);
                 const toolCtx = (0, envelope_1.buildToolContextFromEnvelope)(envelope, wf.workflowId, wf.workflowTrace, wf.workflowSpan);
                 return toolCtx ? (0, context_2.runWithToolContext)(toolCtx, next) : next();
             }
-            const envelope = (0, state_1.extractEnvelope)(ctx);
             const taskQueue = (0, lifecycle_1.deriveTaskQueue)(wf);
             // 3. Find existing task and handle re-run escalation resolution
             const existingTask = await activities.ltGetTaskByWorkflowId(wf.workflowId);