@intx/workflow-host 0.2.2 → 0.3.0

package/dist/child/verified-definition-loader.d.ts

@@ -0,0 +1,33 @@
+import type { WorkflowDefinition } from "@intx/workflow";
+export interface LoadVerifiedWorkflowDefinitionFromClosureOpts {
+    /**
+     * Sidecar-local directory of the materialized workflow-definition closure:
+     * the package dir holding `package.json` (with `interchange.workflow`) and
+     * its laid-out `node_modules/`. The sidecar computes this when it applies
+     * the frozen closure and threads it through the child's spawn env.
+     */
+    packageDir: string;
+    /**
+     * Hub-approved wire hash the re-verify must match. Sourced from the hub
+     * authority (`SpawnTimeEnv.definitionHash`). The recompute projects the
+     * evaluated LIVE definition back to its inert form and hashes that; a value
+     * that differs throws.
+     */
+    approvedHash: string;
+    /**
+     * Test seam forwarded to `loadWorkflowDefinitionFromClosure` for the
+     * workflow entry's dynamic import. Production omits it and the entry is
+     * imported natively.
+     */
+    importModule?: (importUrl: string) => Promise<unknown>;
+}
+/**
+ * Evaluate a source-ref deployment's pinned code closure to a live
+ * `WorkflowDefinition` and re-verify it by project-then-hash before returning
+ * it. The inert projection is a non-executable approval surface, so the runtime
+ * needs the live definition the closure evaluates to. The re-verify projects
+ * that live definition back to its inert form and hashes it
+ * (`computeLiveDefinitionHash`), matching the hub-approved wire hash by byte
+ * equality; a divergent closure fails closed here and never runs.
+ */
+export declare function loadVerifiedWorkflowDefinitionFromClosure(opts: LoadVerifiedWorkflowDefinitionFromClosureOpts): Promise<WorkflowDefinition>;

package/dist/child/verified-definition-loader.js

@@ -0,0 +1,43 @@
+// Source-ref definition load + re-verify barrier for the workflow-process child.
+//
+// A source-ref deployment's runnable definition is the evaluated pinned code
+// closure, not an on-disk `workflow.json`. `loadVerifiedWorkflowDefinitionFromClosure`
+// evaluates that closure to a live `WorkflowDefinition` and re-verifies it by
+// project-then-hash: it projects the live definition back to its inert form,
+// hashes it (`computeLiveDefinitionHash`), and refuses to return a definition
+// whose recompute does not match the hub-approved hash. A mismatch throws --
+// fail closed, no fallback and no coercion.
+//
+// The re-verify barrier is load-bearing because the approved hash arrives
+// OUT-OF-BAND from the bytes being checked (a signed spawn env the closure
+// materializer cannot forge). It lives at the LOAD boundary, not at run start:
+// a resumed run reuses the definition this loader returned at child boot, so
+// gating the load covers fresh runs, resumed runs, and referenced onTrigger
+// bodies (which the child extracts from the same re-verified closure) with a
+// single check. `RunStarted.definitionHash` is deliberately NOT the barrier: it
+// hashes a different projection and never fires when the run log already carries
+// a `RunStarted`, so it is skipped on resume.
+import { computeLiveDefinitionHash } from "@intx/workflow";
+import { loadWorkflowDefinitionFromClosure } from "../workflow-definition-loader.js";
+/**
+ * Evaluate a source-ref deployment's pinned code closure to a live
+ * `WorkflowDefinition` and re-verify it by project-then-hash before returning
+ * it. The inert projection is a non-executable approval surface, so the runtime
+ * needs the live definition the closure evaluates to. The re-verify projects
+ * that live definition back to its inert form and hashes it
+ * (`computeLiveDefinitionHash`), matching the hub-approved wire hash by byte
+ * equality; a divergent closure fails closed here and never runs.
+ */
+export async function loadVerifiedWorkflowDefinitionFromClosure(opts) {
+    const definition = await loadWorkflowDefinitionFromClosure({
+        packageDir: opts.packageDir,
+        ...(opts.importModule !== undefined
+            ? { importModule: opts.importModule }
+            : {}),
+    });
+    const recomputed = await computeLiveDefinitionHash(definition);
+    if (recomputed !== opts.approvedHash) {
+        throw new Error(`workflow-host verified-definition loader: recomputed wire hash ${recomputed} for the source-ref closure at ${opts.packageDir} does not match the approved hash ${opts.approvedHash}; refusing to run a definition that no longer projects to the hub-approved content`);
+    }
+    return definition;
+}

package/dist/conversation-text.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Extract the conversation body text from a raw inbound MIME message.
+ *
+ * Three on-wire shapes are handled, matching every producer the mail
+ * bus accepts:
+ *   1. The Interchange assembler's `multipart/signed` envelope whose
+ *      first part is a `multipart/mixed` body carrying the text at part
+ *      path `1.1`.
+ *   2. A `multipart/signed` envelope wrapping a bare `text/plain` part
+ *      (a sender that signs without the `multipart/mixed` wrapper); the
+ *      text is at part path `1`.
+ *   3. A flat top-level `text/plain` message (no multipart structure at
+ *      all); the body is the bytes after the header section.
+ *
+ * The top-level `Content-Type` selects the shape: only a `multipart/*`
+ * root walks into parts; anything else reads the single body directly.
+ * This mirrors the conversation branch of mail-memory's `fetchFull`
+ * while also tolerating the flat single-part case the in-process agent
+ * accepts, so a non-standard inbound mail still delivers its text to
+ * the agent rather than crashing the run. `messageId` is used only for
+ * error attribution.
+ */
+export declare function extractConversationText(raw: Uint8Array, messageId: string): string;

package/dist/conversation-text.js

@@ -0,0 +1,56 @@
+// Shared inbound-mail conversation-text extraction. Two call sites resolve a
+// run's mail input to the text the agent actually sees, each at the layer that
+// knows its bytes are inbound mail: the child's `resolveTriggerPayload` (turn
+// 1, the trigger) reads the mail from the substrate, and the supervisor's
+// dispatch loop (turn 2+, a mail delivered to a parked run as a signal) inlines
+// it. Both must produce the SAME shape -- extracted body text, not the raw MIME
+// envelope -- so the extractor lives here rather than in either caller.
+import { extractPartByPath, parseHeaderSection, parseMimePart, } from "@intx/mime";
+/**
+ * Extract the conversation body text from a raw inbound MIME message.
+ *
+ * Three on-wire shapes are handled, matching every producer the mail
+ * bus accepts:
+ *   1. The Interchange assembler's `multipart/signed` envelope whose
+ *      first part is a `multipart/mixed` body carrying the text at part
+ *      path `1.1`.
+ *   2. A `multipart/signed` envelope wrapping a bare `text/plain` part
+ *      (a sender that signs without the `multipart/mixed` wrapper); the
+ *      text is at part path `1`.
+ *   3. A flat top-level `text/plain` message (no multipart structure at
+ *      all); the body is the bytes after the header section.
+ *
+ * The top-level `Content-Type` selects the shape: only a `multipart/*`
+ * root walks into parts; anything else reads the single body directly.
+ * This mirrors the conversation branch of mail-memory's `fetchFull`
+ * while also tolerating the flat single-part case the in-process agent
+ * accepts, so a non-standard inbound mail still delivers its text to
+ * the agent rather than crashing the run. `messageId` is used only for
+ * error attribution.
+ */
+export function extractConversationText(raw, messageId) {
+    const { headers, bodyOffset } = parseHeaderSection(raw);
+    const rootMime = (headers.get("content-type") ?? "")
+        .split(";")[0]
+        ?.trim()
+        .toLowerCase();
+    if (rootMime === undefined || !rootMime.startsWith("multipart/")) {
+        // Flat single-part message: the body is everything after the
+        // header section.
+        return new TextDecoder("utf-8", { fatal: false }).decode(raw.subarray(bodyOffset));
+    }
+    let part1;
+    try {
+        part1 = parseMimePart(extractPartByPath(raw, "1"));
+    }
+    catch (cause) {
+        throw new Error(`conversation-text: cannot parse inbound mail part 1 for messageId ${messageId}`, { cause });
+    }
+    const part1Mime = (part1.contentType.split(";")[0] ?? "")
+        .trim()
+        .toLowerCase();
+    const bodyBytes = part1Mime.startsWith("multipart/")
+        ? parseMimePart(extractPartByPath(raw, "1.1")).body
+        : part1.body;
+    return new TextDecoder("utf-8", { fatal: false }).decode(bodyBytes);
+}

package/dist/index.d.ts

@@ -1,10 +1,11 @@
+export { loadWorkflowDefinitionFromClosure, loadWorkflowDirectorRegistryFromClosure, loadWorkflowPluginFactoriesFromClosure, loadWorkflowPluginToolDefinitionsFromClosure, type LoadWorkflowDefinitionFromClosureArgs, type LoadWorkflowDirectorRegistryFromClosureArgs, type LoadWorkflowPluginsFromClosureArgs, } from "./workflow-definition-loader.js";
 export { createWorkflowRunRepoStore, type WorkflowRunRepoStoreOpts, } from "./adapters/repo-store.js";
 export { createWorkflowRunBlobSubstrate, type WorkflowRunBlobSubstrateOpts, } from "./adapters/blob-substrate.js";
 export { createWorkflowStepInvoker, type StepEnvBase, type WorkflowStepInvokerOpts, } from "./adapters/step-invoker.js";
-export { createWorkflowSpawnChild, type ChildTerminalStatus, type RunChildWorkflow, type WorkflowSpawnChildOpts, } from "./adapters/spawn-child.js";
-export { createWorkflowSupervisor, assembleCredentialsSnapshot, commitCancelRequested, createDrainTimeoutAccumulator, createRecyclePolicy, defaultStepRepoId, hashGrants, triggerRecycle, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_KILL_TIMEOUT_MS, DEFAULT_POLICY_INTERVAL_MS, DEFAULT_TERMINAL_WRITE_WATCHDOG_MS, MAX_BUFFERED_MAIL, STEP_GRANTS_PATH, STEP_GRANTS_REF, SUPERVISOR_PRINCIPAL_KIND, type AssembleCredentialsSnapshotOpts, type CancelCommitInfo, type CancelRequestOpts, type CommitCancelRequestedOpts, type CommitCancelRequestedResult, type CredentialsSnapshot, type CredentialsSnapshotStep, type DeliverSignalOpts, type DeliverSourcesOpts, type DeriveMailAuditRef, type DeriveStepAddress, type DeriveStepRepoId, type DrainOpts, type DrainTimeoutAccumulator, type DrainTimeoutAccumulatorFactory, type DrainTimeoutOpts, type InboxPrimitives, type MailAuditRef, type MailBusBindings, type PrincipalSigner, type RecycleAttempt, type RecycleContext, type RecycleOpts, type RecycleOrigin, type RecyclePolicy, type RecyclePolicyBounds, type RecyclePolicyOpts, type SignedPayload, type SpawnOpts, type SpawnResult, type SubprocessHandle, type SubprocessSpawner, type TerminalEventSource, type TerminalRunEvent, type TriggerRecycleOpts, type DispatchTimingMark, type DispatchStructuralCounters, type DispatchSubstrateLeg, type WorkflowSupervisor, type WorkflowSupervisorBindings, type WorkflowSupervisorPrincipalKind, } from "./supervisor/index.js";
+export { createInMemorySpawnChild, createInMemorySpawnSuspendableChild, type ChildTerminalStatus, type RunChildWorkflow, type RunSuspendableChild, } from "./adapters/spawn-child.js";
+export { createWorkflowSupervisor, assembleCredentialsSnapshot, isErrnoNotFound, commitCancelRequested, createDrainTimeoutAccumulator, createRecyclePolicy, defaultStepRepoId, hashGrants, triggerRecycle, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_KILL_TIMEOUT_MS, DEFAULT_POLICY_INTERVAL_MS, MAX_BUFFERED_MAIL, STEP_GRANTS_PATH, STEP_GRANTS_REF, SUPERVISOR_PRINCIPAL_KIND, type AssembleCredentialsSnapshotOpts, type CancelCommitInfo, type CancelRequestOpts, type CommitCancelRequestedOpts, type CommitCancelRequestedResult, type CredentialsSnapshot, type CredentialsSnapshotStep, type DeliverSignalOpts, type DeliverSourcesOpts, type DeriveMailAuditRef, type DeriveStepAddress, type DeriveStepRepoId, type DrainOpts, type DrainTimeoutAccumulator, type DrainTimeoutAccumulatorFactory, type DrainTimeoutOpts, type InboxPrimitives, type MailAuditRef, type MailBusBindings, type PrincipalSigner, type RecycleAttempt, type RecycleContext, type RecycleOpts, type RecycleOrigin, type RecyclePolicy, type RecyclePolicyBounds, type RecyclePolicyOpts, type SignedPayload, type SpawnOpts, type SpawnResult, type SubprocessHandle, type SubprocessSpawner, type SuspensionRegistration, type TerminalEventSource, type TerminalRunEvent, type TriggerRecycleOpts, type DispatchTimingMark, type DispatchStructuralCounters, type DispatchSubstrateLeg, type WorkflowSupervisor, type WorkflowSupervisorBindings, type WorkflowSupervisorPrincipalKind, } from "./supervisor/index.js";
 export { createWorkflowHostDrainController, type WorkflowHostDrainController, type CreateWorkflowHostDrainControllerOpts, } from "./drain-controller.js";
 export { wrapHubTransportAsMailBus, type HubTransportMailBusAdapter, } from "./mail-bus/index.js";
 export { ControlPayload, DEFAULT_EVENT_BUFFER_LIMIT, EventPayload, FrameEnvelope, IPC_CRYPTO, SourcesUpdatedData, MacedEnvelope, OutboundAttachmentPayload, OutboundMessagePayload, SignedEnvelope, createControlChannelSender, createEventChannelSender, decodeEnvelope, encodeEnvelope, generateChannelId, generateHmacKey, receiveControlChannel, receiveEventChannel, signEd25519, signHmac, verifyEd25519, verifyHmac, type ControlChannelReceiverOpts, type ControlChannelSender, type ControlChannelSenderOpts, type EventChannelReceiverOpts, type EventChannelSender, type EventChannelSenderOpts, type FrameReader, type FrameWriter, type NdjsonReader, type NdjsonWriter, } from "./ipc/index.js";
-export { EVENT_CHANNEL_FD, createChildOutboundMailBridge, createChildSubstrateWriteBridge, createCredentialsBackedAuthorize, createProxyWorkflowRunRepoStore, createSupervisorBackedTransport, createWarmAgentCache, discoverInFlightRuns, parseSpawnTimeEnv, runWorkflowChild, runWorkflowChildFromProcessEnv, type ChildOutboundMailBridge, type ChildStepInvoker, type ChildSubstrateWriteBridge, type CreateChildOutboundMailBridgeOpts, type CreateChildSubstrateWriteBridgeOpts, type CreateProxyWorkflowRunRepoStoreOpts, type CredentialsSnapshotRef, type DiscoverRunsOpts, type DiscoveredRun, type DrainController, type GrantEvaluator, type RunWorkflowChildBindings, type RunWorkflowChildFromProcessEnvOpts, type RunWorkflowChildOpts, type RunWorkflowChildResult, type SourcesSnapshotRef, type SpawnTimeEnv, type SubstrateFactory, type SubstrateFactoryEnv, type SubstrateWriteRequest, type SubstrateWriteResponseSink, type WarmAgentCache, type WarmEventSinkRef, } from "./child/index.js";
+export { EVENT_CHANNEL_FD, createChildOutboundMailBridge, createChildSubstrateWriteBridge, createCredentialsBackedAuthorize, createProxyWorkflowRunRepoStore, createSupervisorBackedTransport, createWarmAgentCache, discoverInFlightRuns, parseSpawnTimeEnv, runWorkflowChild, runWorkflowChildFromProcessEnv, type ChildOutboundMailBridge, type ChildStepInvoker, type ChildSubstrateWriteBridge, type CreateChildOutboundMailBridgeOpts, type CreateChildSubstrateWriteBridgeOpts, type CreateProxyWorkflowRunRepoStoreOpts, type CredentialsSnapshotRef, type CredentialWiring, type DiscoverRunsOpts, type DiscoveredRun, type DrainController, type GrantEvaluator, type LoadParkedApproval, type RunWorkflowChildBindings, type RunWorkflowChildFromProcessEnvOpts, type RunWorkflowChildOpts, type RunWorkflowChildResult, type SourcesSnapshotRef, type SpawnTimeEnv, type SubstrateFactory, type SubstrateFactoryEnv, type SubstrateWriteRequest, type SubstrateWriteResponseSink, type WarmAgentCache, type WarmEventSinkRef, } from "./child/index.js";
 export { adaptHostScheduler, createWorkflowHostScheduler, createWorkflowHostSignalChannel, SignalReceivedEnvelope, type SchedulerHandle, type SchedulerOpts, type SignalChannelHandle, type SignalChannelOpts, } from "./seams/index.js";

package/dist/index.js

@@ -1,8 +1,9 @@
+export { loadWorkflowDefinitionFromClosure, loadWorkflowDirectorRegistryFromClosure, loadWorkflowPluginFactoriesFromClosure, loadWorkflowPluginToolDefinitionsFromClosure, } from "./workflow-definition-loader.js";
 export { createWorkflowRunRepoStore, } from "./adapters/repo-store.js";
 export { createWorkflowRunBlobSubstrate, } from "./adapters/blob-substrate.js";
 export { createWorkflowStepInvoker, } from "./adapters/step-invoker.js";
-export { createWorkflowSpawnChild, } from "./adapters/spawn-child.js";
-export { createWorkflowSupervisor, assembleCredentialsSnapshot, commitCancelRequested, createDrainTimeoutAccumulator, createRecyclePolicy, defaultStepRepoId, hashGrants, triggerRecycle, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_KILL_TIMEOUT_MS, DEFAULT_POLICY_INTERVAL_MS, DEFAULT_TERMINAL_WRITE_WATCHDOG_MS, MAX_BUFFERED_MAIL, STEP_GRANTS_PATH, STEP_GRANTS_REF, SUPERVISOR_PRINCIPAL_KIND, } from "./supervisor/index.js";
+export { createInMemorySpawnChild, createInMemorySpawnSuspendableChild, } from "./adapters/spawn-child.js";
+export { createWorkflowSupervisor, assembleCredentialsSnapshot, isErrnoNotFound, commitCancelRequested, createDrainTimeoutAccumulator, createRecyclePolicy, defaultStepRepoId, hashGrants, triggerRecycle, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_KILL_TIMEOUT_MS, DEFAULT_POLICY_INTERVAL_MS, MAX_BUFFERED_MAIL, STEP_GRANTS_PATH, STEP_GRANTS_REF, SUPERVISOR_PRINCIPAL_KIND, } from "./supervisor/index.js";
 export { createWorkflowHostDrainController, } from "./drain-controller.js";
 export { wrapHubTransportAsMailBus, } from "./mail-bus/index.js";
 export { ControlPayload, DEFAULT_EVENT_BUFFER_LIMIT, EventPayload, FrameEnvelope, IPC_CRYPTO, SourcesUpdatedData, MacedEnvelope, OutboundAttachmentPayload, OutboundMessagePayload, SignedEnvelope, createControlChannelSender, createEventChannelSender, decodeEnvelope, encodeEnvelope, generateChannelId, generateHmacKey, receiveControlChannel, receiveEventChannel, signEd25519, signHmac, verifyEd25519, verifyHmac, } from "./ipc/index.js";

package/dist/ipc/control-channel.d.ts

@@ -51,6 +51,7 @@ export declare const SourcesUpdatedData: import("arktype/internal/variants/objec
             providerOptions?: Record<string, unknown>;
         };
         capabilities?: string[];
+        quirks?: Record<string, unknown>;
     }[];
     defaultSource: string;
 }, {}>;
@@ -158,9 +159,27 @@ export declare const ControlPayload: import("arktype/internal/variants/object.ts
                 providerOptions?: Record<string, unknown>;
             };
             capabilities?: string[];
+            quirks?: Record<string, unknown>;
         }[];
         defaultSource: string;
     };
+} | {
+    type: "credentials-updated";
+    data: {
+        delivery: {
+            bindings: {
+                handle: string;
+                credentialId: string;
+                consumer: string;
+            }[];
+            materials: {
+                credentialId: string;
+                providerKey: string;
+                origin: string;
+                secret: string;
+            }[];
+        };
+    };
 } | {
     type: "ready";
     data: {
@@ -269,6 +288,45 @@ export declare const ControlPayload: import("arktype/internal/variants/object.ts
             message: string;
         };
     };
+} | {
+    type: "park.notify";
+    data: {
+        runId: string;
+        correlationId: string;
+        parkKind: "approval" | "input" | "signal-relay";
+        snapshot?: {
+            name: string;
+            description: string;
+            inputSchema: Record<string, unknown>;
+            arguments: Record<string, unknown>;
+        };
+    };
+} | {
+    type: "parked-correlations.request";
+    data: {
+        requestId: string;
+    };
+} | {
+    type: "parked-correlations.response";
+    data: {
+        requestId: string;
+        parked: {
+            runId: string;
+            correlationId: string;
+            parkKind: "approval" | "input" | "signal-relay";
+            snapshot?: {
+                name: string;
+                description: string;
+                inputSchema: Record<string, unknown>;
+                arguments: Record<string, unknown>;
+            };
+        }[];
+    };
+} | {
+    type: "resumed.runs";
+    data: {
+        runIds: string[];
+    };
 }, {}>;
 export type ControlPayload = typeof ControlPayload.infer;
 export interface NdjsonWriter {

package/dist/ipc/control-channel.js

@@ -35,7 +35,8 @@
 // prevented at the type level by the disjoint discriminated union.
 import { type } from "arktype";
 import { hexDecode, hexEncode } from "@intx/types";
-import { InferenceSource, InterchangeType } from "@intx/types/runtime";
+import { BoundedApprovalSnapshot, ControlParkKind, InferenceSource, InterchangeType, } from "@intx/types/runtime";
+import { CredentialDelivery } from "@intx/types/sidecar";
 import { decodeEnvelope, encodeEnvelope, FrameEnvelope, SignedEnvelope, } from "./envelope.js";
 import { signEd25519, verifyEd25519 } from "./crypto.js";
 /**
@@ -150,6 +151,12 @@ export const ControlPayload = type({
         runId: "string",
         signalName: "string",
         signalId: "string",
+        // The resume decision in FINAL form -- the child commits it as the
+        // SignalReceived payload verbatim. Each sender owns any
+        // provenance-specific preparation BEFORE this frame: the dispatch loop
+        // resolves an inbound mail to conversation text (like the turn-1
+        // trigger), while `deliverSignal` ships a structured signal payload
+        // unchanged. Do NOT ship raw inbound mail bytes through here.
         payload: "unknown",
     },
 })
@@ -191,6 +198,18 @@ export const ControlPayload = type({
     .or({
     type: "'sources-updated'",
     data: SourcesUpdatedData,
+})
+    .or({
+    // Refreshed credential material for the deployment's tools. The child
+    // replaces its in-memory material cell wholesale on receive; a revoked
+    // credential arrives by omission (its material entry is absent) so the
+    // swap evicts it. Carried inline like the grants and sources snapshots --
+    // single-producer supervisor, single-consumer child. The secret rides
+    // this frame and the in-memory cell only; it is never persisted.
+    type: "'credentials-updated'",
+    data: {
+        delivery: CredentialDelivery,
+    },
 })
     .or({
     type: "'ready'",
@@ -377,6 +396,80 @@ export const ControlPayload = type({
             message: "string",
         },
     },
+})
+    .or({
+    // Child-initiated control-plane suspension notification. The
+    // workflow-process child emits this when a workflow agent step parks
+    // on a reserved `signalName(correlationId)` channel (`env.onPark`),
+    // so the supervisor can register the correlation out-of-band before
+    // the parked run can be resumed. The supervisor stamps the
+    // deployment identity it owns (`runId` + `agentAddress`) and
+    // forwards a `signal.correlation.register` frame to the hub, which
+    // co-writes the run's routing + approval rows. Mirrors
+    // `terminal.event`: a peer-channel notification the supervisor fans
+    // out, distinct from the substrate commit the run also produces.
+    //
+    // `signalName` is deliberately NOT carried: it is a pure function of
+    // `correlationId` (`signalName(correlationId)`), recomputed by every
+    // consumer that needs it, so the two cannot drift.
+    type: "'park.notify'",
+    data: {
+        runId: "string > 0",
+        correlationId: "string > 0",
+        parkKind: ControlParkKind,
+        // Approver-facing snapshot of the parked tool call, size-capped at this
+        // process boundary. Optional: only an ask-rail suspension carries one.
+        "snapshot?": BoundedApprovalSnapshot,
+    },
+})
+    .or({
+    // Supervisor-initiated request: enumerate the child's currently-parked
+    // approval correlations. The supervisor fires this after a
+    // re-establishment (child respawn, or hub-link reconnect fanned out to
+    // this deployment) so it can re-register at the hub every correlation
+    // whose original `park.notify`-driven register may have been lost while
+    // the hub was down. Modeled on `substrate.merge.request`: a
+    // supervisor->child request the child answers on `parked-correlations.
+    // response`, correlated by `requestId`. Carries no filter -- one child
+    // owns one deployment, so the child enumerates everything parked and the
+    // supervisor re-emits all; the hub co-write is idempotent.
+    type: "'parked-correlations.request'",
+    data: {
+        requestId: "string > 0",
+    },
+})
+    .or({
+    // Child's reply to `parked-correlations.request`. Each entry mirrors
+    // `park.notify`'s data -- the child-supplied half of a
+    // `SuspensionRegistration` the supervisor stamps its deployment identity
+    // onto -- so the supervisor's re-emit path shares one transform with the
+    // `park.notify` arm. Only reduced-state approval parks appear here: the
+    // child enumerates steps whose reduced phase is `awaiting-signal` on a
+    // control-plane `signalName(correlationId)` channel, each of which carries
+    // a durable snapshot by construction (a snapshot-less correlated suspend
+    // reduces to `failed`, not `awaiting-signal`). `snapshot` is therefore
+    // required, and size-capped at this process boundary like `park.notify`.
+    type: "'parked-correlations.response'",
+    data: {
+        requestId: "string > 0",
+        parked: type({
+            runId: "string > 0",
+            correlationId: "string > 0",
+            parkKind: ControlParkKind,
+            // Snapshot is required for approval parks and absent for input parks.
+            "snapshot?": BoundedApprovalSnapshot,
+        }).array(),
+    },
+})
+    .or({
+    // Child reports self-discovered runs after reconnect or recycle.
+    // The supervisor seeds its cohort tracking from these runIds so
+    // drain accumulators and dispatch routing account for runs the
+    // supervisor did not personally trigger.fire.
+    type: "'resumed.runs'",
+    data: {
+        runIds: type("string > 0").array(),
+    },
 });
 /**
  * Construct the supervisor-side control-channel sender. The

package/dist/ipc/event-channel.d.ts

@@ -29,7 +29,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
         index?: number;
     };
 } | {
-    type: "inference.thinking.signature";
+    type: "inference.block.signature";
     seq: number;
     data: {
         signature: string;
@@ -155,6 +155,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
             content: ({
                 type: "text";
                 text: string;
+                signature?: string;
             } | {
                 type: "image";
                 source: {
@@ -170,6 +171,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                     mimeType: string;
                     url: string;
                 };
+                signature?: string;
             } | {
                 type: "audio";
                 source: {
@@ -215,6 +217,8 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                     mimeType: string;
                     url: string;
                 };
+                title?: string;
+                context?: string;
             } | {
                 type: "thinking";
                 thinking: string;
@@ -230,6 +234,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                 id: string;
                 name: string;
                 arguments: Record<string, unknown>;
+                signature?: string;
             } | {
                 type: "citation";
                 citedText: string;
@@ -249,11 +254,15 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                     start: number;
                     end: number;
                 };
+            } | {
+                type: "safety_rating";
+                blockReason: string;
             } | {
                 type: "code_execution_request";
                 id: string;
                 code: string;
                 language?: string;
+                signature?: string;
             } | {
                 type: "code_execution_result";
                 requestId: string;
@@ -269,6 +278,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                 content: ({
                     type: "text";
                     text: string;
+                    signature?: string;
                 } | {
                     type: "image";
                     source: {
@@ -284,6 +294,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                         mimeType: string;
                         url: string;
                     };
+                    signature?: string;
                 } | {
                     type: "audio";
                     source: {
@@ -329,6 +340,8 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                         mimeType: string;
                         url: string;
                     };
+                    title?: string;
+                    context?: string;
                 })[];
                 detail?: unknown;
                 isError?: boolean;
@@ -411,6 +424,15 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
         };
         index?: number;
     };
+} | {
+    type: "inference.safety_rating";
+    seq: number;
+    data: {
+        safetyRating: {
+            type: "safety_rating";
+            blockReason: string;
+        };
+    };
 } | {
     type: "inference.code_execution.start";
     seq: number;
@@ -420,6 +442,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
             id: string;
             code: string;
             language?: string;
+            signature?: string;
         };
         index?: number;
     };
@@ -466,6 +489,7 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
                 mimeType: string;
                 url: string;
             };
+            signature?: string;
         };
         index?: number;
     };
@@ -574,6 +598,13 @@ export declare const EventPayload: import("arktype/internal/variants/object.ts")
     data: {
         reason: "approval" | "payment" | "credential" | "budget" | "child_completion" | "message_response";
         gateId: string;
+        correlationId?: string;
+        approvalSnapshot?: {
+            name: string;
+            description: string;
+            inputSchema: Record<string, unknown>;
+            arguments: Record<string, unknown>;
+        };
     };
 } | {
     type: "reactor.gate.cleared";

package/dist/mail-bus/hub-transport-adapter.d.ts

@@ -10,14 +10,19 @@ import type { MailBusBindings } from "../supervisor/types.js";
  */
 export interface HubTransportMailBusAdapter extends MailBusBindings {
     /**
-     * Fan a delivered message out to every handler subscribed at
-     * `address`. Returns immediately if no handler is registered --
-     * the supervisor's lifecycle (`subscribeMailForAddress` returns a
-     * disposer the supervisor calls on teardown) is the authoritative
-     * source of which addresses are live; addresses without an active
-     * subscriber drop the message silently.
+     * Fan a delivered message out to every handler subscribed at `address` and
+     * return the combined durable settlement: the promise resolves once every
+     * subscribed handler has durably accepted the message and rejects if any
+     * handler rejected. The host propagates that settlement to the wire, so
+     * resolution is the durable-receipt ACK signal and rejection is WITHHOLD.
+     *
+     * An address with NO active subscriber rejects rather than resolving. The
+     * supervisor's lifecycle (`subscribeMailForAddress` returns a disposer it
+     * calls on teardown) is the authoritative source of which addresses are
+     * live; a message routed to an address with no live handler was not
+     * durably accepted, so it must withhold-and-be-redelivered, never ack.
      */
-    routeInbound(address: string, message: Uint8Array): void;
+    routeInbound(address: string, message: Uint8Array): Promise<void>;
 }
 /**
  * Wrap an existing `HubTransport` instance as the supervisor-facing

package/dist/mail-bus/hub-transport-adapter.js

@@ -50,12 +50,16 @@ export function wrapHubTransportAsMailBus(transport) {
                 current?.delete(handler);
             };
         },
-        routeInbound(address, message) {
+        async routeInbound(address, message) {
             const set = subscribers.get(address);
-            if (set === undefined)
-                return;
-            for (const handler of set)
-                handler(message);
+            if (set === undefined || set.size === 0) {
+                // No live handler accepted the message, so it was not durably
+                // received. Reject so the caller withholds the ack and the hub
+                // redelivers, rather than silently dropping (which under the ack
+                // model would be an acked loss).
+                throw new Error(`no active mail subscriber for ${address}; message not durably accepted`);
+            }
+            await Promise.all([...set].map((handler) => handler(message)));
         },
         async sendOutbound(senderAddress, message) {
             // OUTBOUND half of mailbox ownership (§3a): route the agent's

package/dist/seams/scheduler.d.ts

@@ -11,12 +11,10 @@ import type { Principal, RepoId, RepoStore } from "@intx/hub-sessions/substrate"
 export declare const TimerEventEnvelope: import("arktype/internal/variants/object.ts").ObjectType<{
     seq: number;
     type: "TimerSet" | "TimerFired";
-    data: {
-        timerId: string;
-        fireAt?: string;
-        stepId?: string | null;
-        cron?: string | null;
-    };
+    timerId: string;
+    fireAt?: string;
+    stepId?: string | null;
+    cron?: string | null;
 }, {}>;
 export type TimerEventEnvelope = typeof TimerEventEnvelope.infer;
 export type SchedulerOpts = {