@inflexa-ai/harness 0.45.0 → 0.46.0

package/dist/state/runs.js

@@ -9,7 +9,12 @@
  * `DbError`. Every other write maps SQLSTATE 23505/23503/23502/23514 to
  * `err(constraint_violation)` via `tryMutation`.
  */
+import { stripNulCharacters } from "../input-sanitization.js";
 import { tryMutation, tryQuery } from "../lib/db-result.js";
+import { parseJsonAs } from "../lib/parse-json.js";
+import { UnknownArraySchema } from "../lib/unknown-containers.js";
+import { z } from "zod";
+import { CortexRunRowSchema } from "./schema.js";
 export class RunIdentityCollisionError extends Error {
     runId;
     constructor(runId) {
@@ -44,13 +49,13 @@ export class RunDedupCollisionError extends Error {
  * the err channel as a `DbError`.
  */
 export function insertRun(pool, input) {
-    const now = new Date().toISOString();
+    const now = input.startedAt ?? new Date().toISOString();
     return tryMutation("runs.insertRun", async () => {
         await pool.query({
             text: `INSERT INTO cortex_runs
             (run_id, analysis_id, thread_id, workflow_name,
-             status, started_at, plan_id, mandate_jti, mandate_expires_at) -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-            VALUES ($1, $2, $3, $4, 'running', $5, $6, $7, $8)`,
+             status, started_at, plan_id, mandate_id) -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+            VALUES ($1, $2, $3, $4, 'running', $5, $6, $7)`,
             values: [
                 input.runId,
                 input.analysisId,
@@ -58,8 +63,7 @@ export function insertRun(pool, input) {
                 input.workflowName,
                 now,
                 input.planId ?? null,
-                input.mandateJti ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-                input.mandateExpiresAt ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                input.mandateId ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             ],
         });
     }).mapErr((e) => {
@@ -75,32 +79,23 @@ export function insertRun(pool, input) {
 }
 /** Reserve a deterministic run id, treating same-analysis PK conflict as redelivery. */
 export function reserveRunById(pool, input) {
-    const now = new Date().toISOString();
+    const now = input.startedAt ?? new Date().toISOString();
     return tryMutation("runs.reserveRunById", async () => {
         const result = await pool.query({
             text: `INSERT INTO cortex_runs
             (run_id, analysis_id, thread_id, workflow_name,
-             status, started_at, plan_id, mandate_jti, mandate_expires_at)
-            VALUES ($1, $2, $3, $4, 'running', $5, $6, $7, $8)
+             status, started_at, plan_id, mandate_id)
+            VALUES ($1, $2, $3, $4, 'running', $5, $6, $7)
             ON CONFLICT (run_id) DO NOTHING
             RETURNING run_id`,
-            values: [
-                input.runId,
-                input.analysisId,
-                input.threadId ?? null,
-                input.workflowName,
-                now,
-                input.planId ?? null,
-                input.mandateJti ?? null,
-                input.mandateExpiresAt ?? null,
-            ],
+            values: [input.runId, input.analysisId, input.threadId ?? null, input.workflowName, now, input.planId ?? null, input.mandateId ?? null],
         });
         return (result.rowCount ?? 0) > 0;
     }).andThen((inserted) => tryQuery("runs.reserveRunById.reload", async () => {
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                        status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                       mandate_jti, mandate_expires_at, plan_id
+                       mandate_id, plan_id
                 FROM cortex_runs
                 WHERE run_id = $1`,
             values: [input.runId],
@@ -112,11 +107,11 @@ export function reserveRunById(pool, input) {
         return { row: mapRunRow(row), inserted };
     }));
 }
+/** The two pg error fields a dedup collision is read from; a driver error is an `Error` carrying them as own fields. */
+const PgErrorIdentitySchema = z.object({ code: z.string(), constraint: z.string() });
 function isPartialUniqueViolation(err) {
-    if (err === null || typeof err !== "object")
-        return false;
-    const e = err;
-    return e.code === "23505" && e.constraint === "idx_cortex_runs_active_plan";
+    const parsed = PgErrorIdentitySchema.safeParse(err);
+    return parsed.success && parsed.data.code === "23505" && parsed.data.constraint === "idx_cortex_runs_active_plan";
 }
 /**
  * Recover the active run row for `(analysisId, planId)` after `insertRun`
@@ -128,7 +123,7 @@ export function queryActiveRun(pool, analysisId, planId) {
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                   mandate_id, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE analysis_id = $1
               AND plan_id IS NOT DISTINCT FROM $2
@@ -139,6 +134,20 @@ export function queryActiveRun(pool, analysisId, planId) {
         return row ? mapRunRow(row) : null;
     });
 }
+/**
+ * The SQL condition of the text filter `q` for the bound placeholder `placeholder`. A run matches when its id holds the
+ * text, or when the `title` of the plan of the same analysis holds it. `strpos` is the test, because `LIKE` would turn
+ * `%` and `_` of the input into wildcards. The `analysis_id` condition keeps the plan of a different analysis out, the
+ * same scope as `loadPlan`.
+ */
+function runTextCondition(placeholder) {
+    return `(strpos(lower(run_id), lower(${placeholder}::text)) > 0
+              OR EXISTS (SELECT 1 FROM cortex_plans p
+                         WHERE p.plan_id = cortex_runs.plan_id
+                           AND p.analysis_id = cortex_runs.analysis_id
+                           AND jsonb_typeof(p.plan -> 'title') = 'string'
+                           AND strpos(lower(p.plan ->> 'title'), lower(${placeholder}::text)) > 0))`;
+}
 /**
  * Every NON-TERMINAL run of an analysis, newest-first and deliberately unbounded.
  *
@@ -155,18 +164,23 @@ export function queryActiveRun(pool, analysisId, planId) {
  * The status set is the one {@link queryActiveRun} uses — non-terminal means `running`. Keep the two
  * in step: a new non-terminal status added to one and not the other makes a live run invisible to
  * exactly one of its readers.
+ *
+ * With `q`, only the runs that the text filter selects are members.
  */
-export function queryActiveRunsByAnalysis(pool, analysisId) {
+export function queryActiveRunsByAnalysis(pool, analysisId, { q } = {}) {
     return tryQuery("runs.queryActiveRunsByAnalysis", async () => {
+        const values = [analysisId];
+        const text = q === undefined ? "" : `AND ${runTextCondition(`$${values.push(q)}`)}`;
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                   mandate_id, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE analysis_id = $1
               AND status = 'running'
+              ${text}
             ORDER BY started_at DESC`,
-            values: [analysisId],
+            values,
         });
         return result.rows.map(mapRunRow);
     });
@@ -207,16 +221,22 @@ export function reconcileOrphanedRuns(pool, opts = {}) {
         return result.rows.map((row) => row.run_id);
     });
 }
+/**
+ * Write a status to a run row that is still `running`, and report whether the row changed. The first terminal write
+ * of a run wins: a row that already holds a terminal status keeps its status, its `completed_at`, and its error.
+ * The error text loses each NUL character, because Postgres rejects a NUL in text and the write must not fail for its own value.
+ */
 export function updateRunStatus(pool, runId, status, error) {
     const now = new Date().toISOString();
-    const isTerminal = status === "completed" || status === "partial" || status === "failed" || status === "canceled" || status === "suspended_insufficient_funds";
+    const isTerminal = status === "completed" || status === "partial" || status === "failed" || status === "canceled";
     return tryMutation("runs.updateRunStatus", async () => {
-        await pool.query({
+        const result = await pool.query({
             text: `UPDATE cortex_runs
             SET status = $1, completed_at = $2, error = $3
-            WHERE run_id = $4`,
-            values: [status, isTerminal ? now : null, error ?? null, runId],
+            WHERE run_id = $4 AND status = 'running'`,
+            values: [status, isTerminal ? now : null, error === undefined || error === null ? null : stripNulCharacters(error), runId],
         });
+        return (result.rowCount ?? 0) > 0;
     });
 }
 /**
@@ -224,9 +244,8 @@ export function updateRunStatus(pool, runId, status, error) {
  * and recording `reason` in `error` (the same column `collectAndComplete`
  * stamps `external_cancel` into). Reports whether a row transitioned — false
  * means the run was already terminal (e.g. it completed concurrently with an
- * external cancel), and the caller MUST NOT fall back to `updateRunStatus`,
- * which would clobber that terminal status. The guarded set is the active set
- * `queryActiveRun` deduplicates on.
+ * external cancel). The guarded set is the active set `queryActiveRun`
+ * deduplicates on.
  */
 export function markRunCanceledIfActive(pool, runId, reason) {
     const now = new Date().toISOString();
@@ -255,7 +274,7 @@ export function queryRun(pool, runId) {
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                   mandate_id, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE run_id = $1`,
             values: [runId],
@@ -264,20 +283,45 @@ export function queryRun(pool, runId) {
         return row ? mapRunRow(row) : null;
     });
 }
-export function queryRunsByAnalysis(pool, analysisId, { limit = 50, offset = 0 } = {}) {
+/**
+ * One window of the runs of an analysis, newest start first. With `q`, the window holds only the runs that the text
+ * filter selects: the filter applies before `limit` and `offset`, and it does not change the order.
+ */
+export function queryRunsByAnalysis(pool, analysisId, { limit = 50, offset = 0, q } = {}) {
     return tryQuery("runs.queryRunsByAnalysis", async () => {
+        const values = [analysisId, limit, offset];
+        const text = q === undefined ? "" : `AND ${runTextCondition(`$${values.push(q)}`)}`;
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                   mandate_id, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE analysis_id = $1
+              ${text}
             ORDER BY started_at DESC LIMIT $2 OFFSET $3`,
-            values: [analysisId, limit, offset],
+            values,
         });
         return result.rows.map(mapRunRow);
     });
 }
+/**
+ * The count of the runs of an analysis, in one statement. With `q`, the count holds only the runs that the text filter
+ * selects, thus it agrees with the windows of {@link queryRunsByAnalysis} for the same `q`.
+ */
+export function countRunsByAnalysis(pool, analysisId, { q } = {}) {
+    return tryQuery("runs.countRunsByAnalysis", async () => {
+        const values = [analysisId];
+        const text = q === undefined ? "" : `AND ${runTextCondition(`$${values.push(q)}`)}`;
+        const result = await pool.query({
+            text: `SELECT COUNT(*)::int AS total
+            FROM cortex_runs
+            WHERE analysis_id = $1
+              ${text}`,
+            values,
+        });
+        return result.rows[0]?.total ?? 0;
+    });
+}
 /**
  * The run ids of one plan of one analysis, newest start first, at most `limit`.
  * The run id breaks a tie of start times, highest first. A plan with no run gives
@@ -295,6 +339,23 @@ export function queryRunIdsByPlan(pool, opts) {
         return result.rows.map((row) => row.run_id);
     });
 }
+/**
+ * The newest run of one plan of one analysis, or `null` for a plan with no run. The order is the one of
+ * {@link queryRunIdsByPlan}: the latest start first, and the highest run id on a tie of start times.
+ */
+export function queryNewestPlanRun(pool, opts) {
+    return tryQuery("runs.queryNewestPlanRun", async () => {
+        const result = await pool.query({
+            text: `SELECT run_id, started_at FROM cortex_runs
+            WHERE analysis_id = $1 AND plan_id = $2
+            ORDER BY started_at DESC, run_id DESC
+            LIMIT 1`,
+            values: [opts.analysisId, opts.planId],
+        });
+        const row = result.rows[0];
+        return row ? { runId: row.run_id, startedAt: row.started_at } : null;
+    });
+}
 /**
  * Read the analysis's non-terminal run activity without coupling it to a
  * conversation thread. The total is counted before the detail limit so a
@@ -312,7 +373,7 @@ export function queryNonTerminalRunsByAnalysis(pool, analysisId, limit = 20) {
         const rowsResult = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id
+                   mandate_id, plan_id
             FROM cortex_runs
             WHERE analysis_id = $1
               AND status = 'running'
@@ -341,7 +402,7 @@ export function queryRunsForInspection(pool, analysisId, { limit = 50, offset =
         const rowsResult = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id
+                   mandate_id, plan_id
             FROM cortex_runs
             WHERE analysis_id = $1
             ORDER BY CASE status
@@ -359,35 +420,39 @@ export function queryRunsForInspection(pool, analysisId, { limit = 50, offset =
         };
     });
 }
-export function queryRunsByThread(pool, analysisId, threadId, { limit = 50, offset = 0 } = {}) {
+/** The runs of one thread of an analysis, newest start first. With `q`, the text filter applies before the window. */
+export function queryRunsByThread(pool, analysisId, threadId, { limit = 50, offset = 0, q } = {}) {
     return tryQuery("runs.queryRunsByThread", async () => {
+        const values = [analysisId, threadId, limit, offset];
+        const text = q === undefined ? "" : `AND ${runTextCondition(`$${values.push(q)}`)}`;
         const result = await pool.query({
             text: `SELECT run_id, analysis_id, thread_id, workflow_name,
                    status, started_at, completed_at, error, synthesis_status, synthesis_reason, parts,
-                   mandate_jti, mandate_expires_at, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+                   mandate_id, plan_id -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
             FROM cortex_runs
             WHERE analysis_id = $1 AND thread_id = $2
+              ${text}
             ORDER BY started_at DESC LIMIT $3 OFFSET $4`,
-            values: [analysisId, threadId, limit, offset],
+            values,
         });
         return result.rows.map(mapRunRow);
     });
 }
 /**
- * Persist the run mandate jti + expiry for a run. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
- * Called by `authorizeForRun` after a successful mint so the cancel
- * handler can revoke the mandate by `runId → jti` lookup. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
- * The JWT itself is NOT persisted — it rides in DBOS workflow input.
+ * Persist the run mandate reference for a run. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+ * Called by the host authorizer after it authorizes the run, so the cancel
+ * handler can revoke the mandate by `runId → mandate id` lookup. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+ * The reference has no expiry here: the run does not depend on a clock.
  */
-export function setRunMandate(pool, runId, jti, expiresAt) {
+export function setRunMandate(pool, runId, mandateId) {
     // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
     return tryMutation("runs.setRunMandate", async () => {
         // oss-core-managed-ok: run-mandate ledger op label
         await pool.query({
             text: `UPDATE cortex_runs
-            SET mandate_jti = $1, mandate_expires_at = $2 -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-            WHERE run_id = $3`,
-            values: [jti, expiresAt, runId],
+            SET mandate_id = $1 -- oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+            WHERE run_id = $2`,
+            values: [mandateId, runId],
         });
     });
 }
@@ -408,20 +473,19 @@ export function setRunSynthesisOutcome(pool, runId, synthesisStatus, synthesisRe
 }
 function mapRunRow(row) {
     // JSONB is parsed by `pg` into native arrays/objects. Treat legacy TEXT
-    // rows (if anything slipped through) as strings and parse them.
-    let parts = null;
-    if (Array.isArray(row.parts)) {
-        parts = row.parts;
-    }
-    else if (typeof row.parts === "string") {
+    // rows (if anything slipped through) as strings and parse them. A parts
+    // value that survives neither shape reads as null, like a row with no parts.
+    let parts = row.parts;
+    if (typeof parts === "string") {
         try {
-            parts = JSON.parse(row.parts);
+            parts = parseJsonAs(parts, z.json());
         }
         catch {
-            /* malformed — treat as null */
+            parts = null;
         }
     }
-    return {
+    const parsedParts = UnknownArraySchema.safeParse(parts);
+    return CortexRunRowSchema.parse({
         runId: row.run_id,
         analysisId: row.analysis_id,
         threadId: row.thread_id ?? null,
@@ -432,9 +496,8 @@ function mapRunRow(row) {
         error: row.error ?? null,
         synthesisStatus: row.synthesis_status ?? null,
         synthesisReason: row.synthesis_reason ?? null,
-        parts,
-        mandateJti: row.mandate_jti ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-        mandateExpiresAt: row.mandate_expires_at ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+        parts: parsedParts.success ? parsedParts.data : null,
+        mandateId: row.mandate_id ?? null, // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
         planId: row.plan_id ?? null,
-    };
+    });
 }

package/dist/state/schema.d.ts

@@ -10,10 +10,10 @@ export declare const AnalysisStateRowSchema: z.ZodObject<{
     status: z.ZodString;
     context: z.ZodNullable<z.ZodString>;
     dataProfileStatus: z.ZodEnum<{
+        completed: "completed";
         failed: "failed";
         pending: "pending";
         running: "running";
-        completed: "completed";
     }>;
     dataProfileError: z.ZodNullable<z.ZodString>;
     dataProfileStartedAt: z.ZodNullable<z.ZodString>;
@@ -46,31 +46,30 @@ export declare const ArtifactRowSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type ArtifactRow = z.infer<typeof ArtifactRowSchema>;
 export declare const RunStatus: z.ZodEnum<{
-    failed: "failed";
-    running: "running";
+    canceled: "canceled";
     completed: "completed";
+    failed: "failed";
     partial: "partial";
-    canceled: "canceled";
-    suspended_insufficient_funds: "suspended_insufficient_funds";
+    running: "running";
 }>;
 export type RunStatus = z.infer<typeof RunStatus>;
 /** A status that a run keeps once it ended: every status but `running`. */
 export type TerminalRunStatus = Exclude<RunStatus, "running">;
 export declare const StepExecutionStatus: z.ZodEnum<{
+    blocked: "blocked";
+    canceled: "canceled";
+    completed: "completed";
     failed: "failed";
     pending: "pending";
     running: "running";
-    completed: "completed";
-    canceled: "canceled";
     skipped: "skipped";
-    blocked: "blocked";
 }>;
 export type StepExecutionStatus = z.infer<typeof StepExecutionStatus>;
 export declare const SynthesisStatus: z.ZodEnum<{
     failed: "failed";
     produced: "produced";
-    skipped_no_summaries: "skipped_no_summaries";
     skipped_blocker: "skipped_blocker";
+    skipped_no_summaries: "skipped_no_summaries";
 }>;
 export type SynthesisStatus = z.infer<typeof SynthesisStatus>;
 export declare const CortexRunRowSchema: z.ZodObject<{
@@ -79,12 +78,11 @@ export declare const CortexRunRowSchema: z.ZodObject<{
     threadId: z.ZodNullable<z.ZodString>;
     workflowName: z.ZodString;
     status: z.ZodEnum<{
-        failed: "failed";
-        running: "running";
+        canceled: "canceled";
         completed: "completed";
+        failed: "failed";
         partial: "partial";
-        canceled: "canceled";
-        suspended_insufficient_funds: "suspended_insufficient_funds";
+        running: "running";
     }>;
     startedAt: z.ZodString;
     completedAt: z.ZodNullable<z.ZodString>;
@@ -92,13 +90,12 @@ export declare const CortexRunRowSchema: z.ZodObject<{
     synthesisStatus: z.ZodNullable<z.ZodEnum<{
         failed: "failed";
         produced: "produced";
-        skipped_no_summaries: "skipped_no_summaries";
         skipped_blocker: "skipped_blocker";
+        skipped_no_summaries: "skipped_no_summaries";
     }>>;
     synthesisReason: z.ZodNullable<z.ZodString>;
-    parts: z.ZodNullable<z.ZodArray<z.ZodAny>>;
-    mandateJti: z.ZodNullable<z.ZodString>;
-    mandateExpiresAt: z.ZodNullable<z.ZodString>;
+    parts: z.ZodNullable<z.ZodArray<z.ZodJSONSchema>>;
+    mandateId: z.ZodNullable<z.ZodString>;
     planId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type CortexRunRow = z.infer<typeof CortexRunRowSchema>;
@@ -123,13 +120,13 @@ export declare const StepExecutionRowSchema: z.ZodObject<{
     wave: z.ZodNumber;
     agentId: z.ZodString;
     status: z.ZodEnum<{
+        blocked: "blocked";
+        canceled: "canceled";
+        completed: "completed";
         failed: "failed";
         pending: "pending";
         running: "running";
-        completed: "completed";
-        canceled: "canceled";
         skipped: "skipped";
-        blocked: "blocked";
     }>;
     startedAt: z.ZodNullable<z.ZodString>;
     completedAt: z.ZodNullable<z.ZodString>;
@@ -155,7 +152,7 @@ export type StepExecutionRow = z.infer<typeof StepExecutionRowSchema>;
 export declare const CortexPlanRowSchema: z.ZodObject<{
     planId: z.ZodString;
     analysisId: z.ZodString;
-    plan: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    plan: z.ZodRecord<z.ZodString, z.ZodJSONSchema>;
     parentPlanId: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
 }, z.core.$strip>;

package/dist/state/schema.js

@@ -33,7 +33,7 @@ export const ArtifactRowSchema = z.object({
     fileType: z.string().nullable(),
 });
 // ── Run & Step Execution Schemas ─────────────────────────────────────
-export const RunStatus = z.enum(["running", "completed", "partial", "failed", "canceled", "suspended_insufficient_funds"]);
+export const RunStatus = z.enum(["running", "completed", "partial", "failed", "canceled"]);
 export const StepExecutionStatus = z.enum(["pending", "running", "completed", "failed", "skipped", "canceled", "blocked"]);
 // Run-level synthesis outcome, distinct from RunStatus: a run can reach
 // status="completed" while synthesis produced nothing. "produced" is the only
@@ -53,9 +53,8 @@ export const CortexRunRowSchema = z.object({
     // synthesis never recorded an outcome.
     synthesisStatus: SynthesisStatus.nullable(),
     synthesisReason: z.string().nullable(),
-    parts: z.array(z.any()).nullable(),
-    mandateJti: z.string().nullable(), // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
-    mandateExpiresAt: z.string().nullable(), // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+    parts: z.array(z.json()).nullable(),
+    mandateId: z.string().nullable(), // oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
     planId: z.string().nullable(),
 });
 /**
@@ -98,7 +97,7 @@ export const StepExecutionRowSchema = z.object({
 export const CortexPlanRowSchema = z.object({
     planId: z.string(),
     analysisId: z.string(),
-    plan: z.record(z.string(), z.unknown()),
+    plan: z.record(z.string(), z.json()),
     parentPlanId: z.string().nullable(),
     createdAt: z.string(),
 });

package/dist/state/snapshot-parse.d.ts

@@ -14,10 +14,10 @@ import { type Result } from "neverthrow";
 import { z } from "zod";
 import type { ReportSnapshot } from "../report-model/reference-resolver.js";
 /** One reduced schema issue -- the dotted path and the message, without the rest. */
-export interface SchemaIssue {
+export type SchemaIssue = {
     readonly path: string;
     readonly message: string;
-}
+};
 /** Reduce a zod error to the dotted path and the message of each issue. */
 export declare function reduceIssues(error: z.ZodError): SchemaIssue[];
 /**

package/dist/state/snapshot-parse.js

@@ -11,6 +11,7 @@
  * value on its own, thus the two stores agree on the key set.
  */
 import { err, ok } from "neverthrow";
+import { nullProtoRecord } from "../lib/null-proto.js";
 import { z } from "zod";
 /**
  * One pinned artifact of a stored snapshot. The value carries the content hash, an
@@ -42,7 +43,13 @@ function prefixIssues(prefix, issues) {
         message: issue.message,
     }));
 }
-/** A stored map is a plain object. An array and a null carry no own key that a map read can use. */
+/**
+ * A stored map is a plain object. An array and a null carry no own key that a map read can use.
+ *
+ * The check stays a hand predicate because the walk below must address the ORIGINAL object: a
+ * zod record parse rebuilds the value through string-keyed assignment, and a `__proto__` own key
+ * does not survive that rebuild — the pin contract this module keeps.
+ */
 function isPlainRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -72,9 +79,7 @@ export function parseSnapshot(stored) {
     if (!citationRecords.success) {
         return err(prefixIssues("citationRecords", reduceIssues(citationRecords.error)));
     }
-    // The map takes a null prototype, the same as the pin, thus a path such as
-    // `__proto__` stays an ordinary entry and never reaches a prototype slot.
-    const artifacts = Object.create(null);
+    const artifacts = nullProtoRecord();
     const issues = [];
     for (const [path, value] of Object.entries(stored.artifacts)) {
         const parsed = ArtifactSnapshotSchema.safeParse(value);
@@ -87,11 +92,12 @@ export function parseSnapshot(stored) {
     if (issues.length > 0) {
         return err(issues);
     }
-    // An absent part stays absent in the parsed value. Thus a reload gives the same shape that the pin
-    // wrote, and an equality test over a stored snapshot holds across the round trip.
+    // An absent part comes back as an own key that holds `undefined`, because the literal below always
+    // sets the three keys. An equality that ignores `undefined` members holds across the round trip; a
+    // check that counts the own keys does not.
     return ok({
         artifacts,
-        ...(citations.data === undefined ? {} : { citations: citations.data }),
-        ...(citationRecords.data === undefined ? {} : { citationRecords: citationRecords.data }),
+        citations: citations.data,
+        citationRecords: citationRecords.data,
     });
 }