@iowarp/clio-coder 0.4.0 → 0.4.2

package/src/domains/dispatch/path-scope.ts

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import {
 	asDirectoryPathBoundary,
 	normalizePathBoundaryEntry,
@@ -14,6 +15,7 @@ const POSIX_ABSOLUTE_TOKEN_RE = /(?:^|[\s("'])((?:\/[\w.~+-]+)+)/gu;
 const WINDOWS_ABSOLUTE_TOKEN_RE = /(?:^|[\s("'])([A-Za-z]:[\\/][^\s"']+)/gu;
 const BACKSLASH_PATH_RE = /\b[A-Za-z_.-][\w.-]*\\(?:(?:[\w.-]+\\)+[\w.-]+|[\w-]+\.[A-Za-z0-9]{1,8})\b/gu;
 const DOUBLE_SEPARATOR_PATH_RE = /\b[\w.-]+\/\/[\w./-]+/gu;
+const PARENT_PREFIX_RE = /^(?:\.\.\/)+/u;
 
 export type DispatchPathProvenanceKind = "declared" | "derived" | "inferred";
 export type DispatchPathConfidence = "certain" | "high" | "medium" | "low";
@@ -49,11 +51,24 @@ export interface DispatchPathScopeProvenance {
 	writeBoundaries: DispatchPathProvenanceEntry[];
 }
 
+/**
+ * A prose token whose leading "../" run inference had to reinterpret, kept so
+ * the notice can name the raw token beside the scope it produced. `resolved` is
+ * the repository path the stripped remainder anchored to, or null when nothing
+ * under the dispatch root carried it and the token took no part in scope.
+ */
+export interface DispatchInferredParentToken {
+	token: string;
+	resolved: string | null;
+	source: "task" | "briefing";
+}
+
 export interface DispatchPathScope {
 	source: "declared" | "inferred";
 	workingContextPaths: ReadonlyArray<string>;
 	writeBoundaries: ReadonlyArray<string>;
 	inferredOnlyPaths: ReadonlyArray<string>;
+	parentTokens: ReadonlyArray<DispatchInferredParentToken>;
 	provenance: DispatchPathScopeProvenance;
 }
 
@@ -64,15 +79,15 @@ export interface DeclaredScopeReplacementNotice {
 	message: string;
 }
 
-export interface LegacyScopeInferenceNotice {
-	code: "legacy_scope_inferred" | "legacy_scope_empty";
+export interface InferredScopeParentTokenNotice {
+	code: "legacy_scope_inferred";
 	level: "warning";
 	paths: ReadonlyArray<{
 		path: string;
-		policy: "working-context" | "write-boundary";
-		provenance: DispatchPathProvenanceKind;
-		source: DispatchPathProvenanceSource;
-		confidence: DispatchPathConfidence;
+		policy: "working-context";
+		provenance: "inferred";
+		source: "task" | "briefing";
+		confidence: "low";
 	}>;
 	message: string;
 }
@@ -152,19 +167,78 @@ export function declaredIntentPathProvenance(input: {
 	return sortedEntries(entries);
 }
 
-function inferredPaths(req: Pick<DispatchRequest, "task" | "briefing">): string[] {
+/** One prose token read as a repository path, as an anchored "../" quote, or as neither. */
+type InferredPathToken =
+	| { kind: "token"; token: string }
+	| { kind: "anchored"; token: string; resolved: string }
+	| { kind: "dropped"; token: string };
+
+function inferredPaths(
+	req: Pick<DispatchRequest, "task" | "briefing">,
+	root: string,
+): { paths: string[]; droppedTokens: string[] } {
 	const paths = new Set<string>();
+	const droppedTokens = new Set<string>();
 	const text = `${req.task}\n${req.briefing ?? ""}`;
 	for (const match of text.matchAll(DISPATCH_PATH_TOKEN_RE)) {
-		const token = inferredPathToken(match[0]);
+		const inferred = inferredPathToken(match[0], root);
+		if (inferred.kind === "dropped") {
+			droppedTokens.add(inferred.token);
+			continue;
+		}
+		const token = inferred.kind === "anchored" ? inferred.resolved : inferred.token;
 		if (token.startsWith("http://") || token.startsWith("https://")) continue;
 		paths.add(token);
 	}
-	return [...paths];
+	return { paths: [...paths], droppedTokens: [...droppedTokens] };
 }
 
-function inferredPathToken(token: string): string {
-	return token.replace(/\.+$/u, "");
+/**
+ * A leading "./" is how prose quotes an import specifier ("./parser.js"); it
+ * names the same repository path without the prefix, and the boundary grammar
+ * would otherwise refuse the whole dispatch for a dot segment.
+ *
+ * A leading "../" run is that same quote copied out of a file whose location
+ * this function never sees. Both callers, strictInferredPaths and
+ * inferredPaths, are handed the task or briefing text and nothing else, so the
+ * origin the run is measured against is unknowable here and no arithmetic on
+ * the run's length can decide whether it escapes. What is decidable is whether
+ * the remainder names something under the dispatch root, so the run is
+ * stripped and the remainder probed: "../src/store.js" quoted out of
+ * test/store.test.ts anchors to src/store.js, and "../../../etc/passwd"
+ * anchors to nothing in a checkout that holds no etc/passwd.
+ *
+ * That is a deliberate reading of issue #266, recorded here because it is the
+ * one place the choice is made. Criterion 1 ("never rejects the dispatch") and
+ * criterion 2 ("a prose token whose .. segments would leave the repository
+ * root is still refused") ask for opposite answers on a leading run, and only
+ * criterion 1 is decidable without an origin, so a run that names nothing is
+ * dropped rather than refused. Neither outcome widens authority: an inferred
+ * path selects project rules and compiles context but never becomes a write
+ * boundary, and an anchored remainder carries no ".." so path.resolve keeps it
+ * under the root. Both outcomes are named to the operator by
+ * inferredScopeParentTokenNotice, so the reinterpretation is never silent.
+ *
+ * The probe costs one existsSync per "../"-leading token (3 microseconds on a
+ * hit and 2 on a miss over 5,000 warm calls on this checkout) and no stat at
+ * all for the ordinary token, which the grammar matches dozens of per dispatch
+ * (the 27 tokens per task measured for REPORTABLE_OMITTED_PATH_RE below).
+ *
+ * A ".." or "." outside the leading run ("../src/../../b.ts", "../src/./b.ts")
+ * walks back out of a segment it already anchored, which is decidable without
+ * an origin, so it falls through to the boundary grammar and keeps its
+ * refusal, as does a run that leaves no remainder at all ("../..").
+ */
+function inferredPathToken(raw: string, root: string): InferredPathToken {
+	const token = raw.replace(/^\.\//u, "").replace(/\.+$/u, "");
+	const parents = PARENT_PREFIX_RE.exec(token)?.[0];
+	if (parents === undefined) return { kind: "token", token };
+	const rest = token.slice(parents.length);
+	const segments = rest.split("/");
+	if (rest.length === 0 || segments.includes("..") || segments.includes(".")) return { kind: "token", token };
+	return existsSync(resolvePathBoundary(root, rest))
+		? { kind: "anchored", token, resolved: rest }
+		: { kind: "dropped", token };
 }
 
 function failMalformedText(text: string, source: "task" | "briefing"): void {
@@ -201,18 +275,31 @@ function failMalformedText(text: string, source: "task" | "briefing"): void {
 function strictInferredPaths(
 	text: string,
 	source: "task" | "briefing",
-): Array<{ path: string; evidence: DispatchPathProvenanceEvidence }> {
+	root: string,
+): {
+	paths: Array<{ path: string; evidence: DispatchPathProvenanceEvidence }>;
+	parentTokens: DispatchInferredParentToken[];
+} {
 	failMalformedText(text, source);
 	const withoutUrls = text.replace(HTTP_URL_RE, (url) => " ".repeat(url.length));
 	const evidence: DispatchPathProvenanceEvidence =
 		source === "task"
 			? { provenance: "inferred", source, confidence: "medium", reason: "task_path_token" }
 			: { provenance: "inferred", source, confidence: "low", reason: "briefing_path_token" };
-	const result: Array<{ path: string; evidence: DispatchPathProvenanceEvidence }> = [];
+	const paths: Array<{ path: string; evidence: DispatchPathProvenanceEvidence }> = [];
+	const parentTokens: DispatchInferredParentToken[] = [];
 	for (const match of withoutUrls.matchAll(DISPATCH_PATH_TOKEN_RE)) {
-		const token = inferredPathToken(match[0]);
+		const inferred = inferredPathToken(match[0], root);
+		if (inferred.kind === "dropped") {
+			parentTokens.push({ token: inferred.token, resolved: null, source });
+			continue;
+		}
+		if (inferred.kind === "anchored") {
+			parentTokens.push({ token: inferred.token, resolved: inferred.resolved, source });
+		}
+		const token = inferred.kind === "anchored" ? inferred.resolved : inferred.token;
 		try {
-			result.push({ path: normalizePathBoundaryEntry(token), evidence });
+			paths.push({ path: normalizePathBoundaryEntry(token), evidence });
 		} catch (error) {
 			const code =
 				error instanceof PathBoundaryError && error.code === "absolute"
@@ -226,7 +313,7 @@ function strictInferredPaths(
 			);
 		}
 	}
-	return result;
+	return { paths, parentTokens };
 }
 
 function legacyPathScope(req: DispatchRequest, cwd: string): DispatchPathScope {
@@ -242,13 +329,21 @@ function legacyPathScope(req: DispatchRequest, cwd: string): DispatchPathScope {
 		addProvenance(workingEntries, root, writeEvidence);
 		addProvenance(writeEntries, asDirectoryPathBoundary(resolvePathBoundary(cwd, root)), writeEvidence);
 	}
-	for (const candidate of strictInferredPaths(req.task, "task")) {
-		addProvenance(workingEntries, candidate.path, candidate.evidence);
-	}
+	// One map across both fields, first field winning: an orchestrator that
+	// restates the file it is asking about quotes the same specifier in the task
+	// and in the briefing, and the notice must name it once rather than spend two
+	// of its twelve render slots on the same token.
+	const parentTokens = new Map<string, DispatchInferredParentToken>();
+	const recordParentTokens = (entries: ReadonlyArray<DispatchInferredParentToken>): void => {
+		for (const entry of entries) if (!parentTokens.has(entry.token)) parentTokens.set(entry.token, entry);
+	};
+	const taskScope = strictInferredPaths(req.task, "task", cwd);
+	for (const candidate of taskScope.paths) addProvenance(workingEntries, candidate.path, candidate.evidence);
+	recordParentTokens(taskScope.parentTokens);
 	if (req.briefing !== undefined) {
-		for (const candidate of strictInferredPaths(req.briefing, "briefing")) {
-			addProvenance(workingEntries, candidate.path, candidate.evidence);
-		}
+		const briefingScope = strictInferredPaths(req.briefing, "briefing", cwd);
+		for (const candidate of briefingScope.paths) addProvenance(workingEntries, candidate.path, candidate.evidence);
+		recordParentTokens(briefingScope.parentTokens);
 	}
 	const workingContext = [...workingEntries.values()].map((entry) => ({
 		path: entry.path,
@@ -263,6 +358,7 @@ function legacyPathScope(req: DispatchRequest, cwd: string): DispatchPathScope {
 		workingContextPaths: workingContext.map((entry) => entry.path),
 		writeBoundaries: writeBoundaries.map((entry) => entry.path),
 		inferredOnlyPaths: [],
+		parentTokens: [...parentTokens.values()],
 		provenance: {
 			version: 1,
 			mode: "legacy-inferred",
@@ -279,7 +375,15 @@ export function resolveDispatchPathScope(req: DispatchRequest): DispatchPathScop
 
 	const declaredProvenance = declaredIntentPathProvenance(req.intent);
 	const declaredPaths = declaredProvenance.map((entry) => entry.path);
-	const inferredOnlyPaths = inferredPaths(req).filter((candidate) => !pathBoundaryCovers(declaredPaths, candidate));
+	const inferred = inferredPaths(req, cwd);
+	// A dropped token cannot be covered by a declaration, so it is always listed.
+	// An anchored one is listed under the path it anchored to and goes through
+	// the same coverage test the notice has always applied, which is why
+	// "../src/store.js" under a declared "src/" stops reading as an omitted path.
+	const inferredOnlyPaths = [
+		...inferred.paths.filter((candidate) => !pathBoundaryCovers(declaredPaths, candidate)),
+		...inferred.droppedTokens,
+	];
 	const writeEvidence = DECLARED_EVIDENCE.writeRoots;
 	const writeBoundaries = req.intent.writeRoots.map((root) => ({
 		path: resolvePathBoundary(cwd, root),
@@ -290,6 +394,11 @@ export function resolveDispatchPathScope(req: DispatchRequest): DispatchPathScop
 		workingContextPaths: declaredPaths,
 		writeBoundaries: writeBoundaries.map((entry) => entry.path),
 		inferredOnlyPaths,
+		// Empty on purpose: the declaration is the scope here, so no "../" token
+		// changed what the worker sees and there is nothing for the legacy notice
+		// to report. A dropped one still reaches the operator through
+		// inferredOnlyPaths above.
+		parentTokens: [],
 		provenance: {
 			version: 1,
 			mode: "declared",
@@ -299,72 +408,113 @@ export function resolveDispatchPathScope(req: DispatchRequest): DispatchPathScop
 	};
 }
 
+/**
+ * The prose token grammar also matches version numbers, ratios, and Latin
+ * abbreviations ("0.5", "v24.9", "e.g", "dead/raw"). Those never select a rule
+ * or a boundary, so the replacement notice names only tokens that read as
+ * repository paths: a segment with a source or document file extension, or
+ * a trailing directory separator. Method names (`Store.fromText`, `store.set`)
+ * share the dotted shape and are excluded by the extension list. A live three-task dispatch printed 27
+ * "omitted paths" per task, most of them numbers, three times over.
+ */
+const REPORTABLE_OMITTED_PATH_RE =
+	/\.(?:[cm]?[jt]sx?|json|ya?ml|md|txt|py|go|rs|c|h|cc|cpp|hpp|java|rb|sh|toml|css|html|sql|lock)(?:\/|$)|\/$/u;
+const OMITTED_PATH_REPORT_CAP = 12;
+
+/** Omitted prose paths worth telling the operator about, capped for the transcript. */
+function reportableOmittedPaths(scope: DispatchPathScope): string[] {
+	return scope.inferredOnlyPaths.filter((path) => REPORTABLE_OMITTED_PATH_RE.test(path));
+}
+
+function renderOmittedPaths(paths: ReadonlyArray<string>): string {
+	if (paths.length <= OMITTED_PATH_REPORT_CAP) return paths.join(", ");
+	return `${paths.slice(0, OMITTED_PATH_REPORT_CAP).join(", ")} and ${paths.length - OMITTED_PATH_REPORT_CAP} more`;
+}
+
 /** Render the named diagnostic for the declared-scope replacement tradeoff. */
 export function declaredScopeReplacementDiagnostic(scope: DispatchPathScope): string | null {
-	if (scope.source !== "declared" || scope.inferredOnlyPaths.length === 0) return null;
-	return `typed_scope_replaced_inferred_paths: typed intent omitted prose-inferred paths ${scope.inferredOnlyPaths.join(
-		", ",
+	if (scope.source !== "declared") return null;
+	const omitted = reportableOmittedPaths(scope);
+	if (omitted.length === 0) return null;
+	return `typed_scope_replaced_inferred_paths: typed intent omitted prose-inferred paths ${renderOmittedPaths(
+		omitted,
 	)}; those paths did not select project rules or expand worker authority`;
 }
 
 /** Render the interactive warning for the declared-scope replacement tradeoff. */
 export function declaredScopeReplacementNotice(scope: DispatchPathScope): DeclaredScopeReplacementNotice | null {
-	if (scope.source !== "declared" || scope.inferredOnlyPaths.length === 0) return null;
-	const omittedPaths = [...scope.inferredOnlyPaths];
+	if (scope.source !== "declared") return null;
+	const omittedPaths = reportableOmittedPaths(scope);
+	if (omittedPaths.length === 0) return null;
 	return {
 		code: "typed_scope_replaced_inferred_paths",
 		level: "warning",
 		omittedPaths,
-		message: `[dispatch scope] typed intent replaced prose path inference; omitted paths: ${omittedPaths.join(
-			", ",
+		message: `[dispatch scope] typed intent replaced prose path inference; omitted paths: ${renderOmittedPaths(
+			omittedPaths,
 		)}. Those paths did not select project rules or expand worker authority.`,
 	};
 }
 
-function legacyNoticePaths(scope: DispatchPathScope): LegacyScopeInferenceNotice["paths"] {
-	const paths: Array<LegacyScopeInferenceNotice["paths"][number]> = [];
-	for (const [policy, entries] of [
-		["working-context", scope.provenance.workingContextPaths],
-		["write-boundary", scope.provenance.writeBoundaries],
-	] as const) {
-		for (const entry of entries) {
-			for (const evidence of entry.evidence) {
-				paths.push({
-					path: entry.path,
-					policy,
-					provenance: evidence.provenance,
-					source: evidence.source,
-					confidence: evidence.confidence,
-				});
-			}
-		}
-	}
-	return paths;
+/**
+ * A reinterpreted "../" token is the one legacy-mode scope fact worth the
+ * transcript. It fires only where a leading "../" run made inference choose
+ * between a path the prose never literally spelled and no path at all, which
+ * before this release failed the whole dispatch, so unlike a per-dispatch
+ * inference notice it cannot warn on the ordinary case that
+ * `publishDispatchPathScope` deliberately keeps quiet. The anchored token earns
+ * the line more than the dropped one: dropping subtracts from scope, while
+ * anchoring puts "src/store.js" in working context because prose said
+ * "../src/store.js", and a rewrite the operator cannot see is one nobody can
+ * check.
+ *
+ * Declared mode records none. The declaration is the scope there, and a prose
+ * token that never entered it is already the subject of
+ * `declaredScopeReplacementNotice`. That notice filters by
+ * REPORTABLE_OMITTED_PATH_RE, so a declared-mode drop of "../data/blob.bin" or
+ * "../src/helper" is in fact named nowhere; that is the accepted cost of not
+ * spending a second per-dispatch notice on a token that took no part in a scope
+ * the intent had already fixed.
+ *
+ * The legacy list is not filtered by REPORTABLE_OMITTED_PATH_RE, because the
+ * "../" prefix is itself the filter: the version numbers, ratios, and Latin
+ * abbreviations that filter exists for ("0.5", "v24.9", "e.g", "4/10") cannot
+ * carry one.
+ *
+ * Both notices render one `<raw token> -> <anchored path or "dropped">` pair
+ * per entry, under the same twelve-entry cap the replacement notice uses.
+ */
+function renderParentTokens(tokens: ReadonlyArray<DispatchInferredParentToken>): string {
+	return renderOmittedPaths(tokens.map((entry) => `${entry.token} -> ${entry.resolved ?? "dropped"}`));
 }
 
-/** Render the operator-visible warning for a legacy scope resolution. */
-export function legacyScopeInferenceNotice(scope: DispatchPathScope): LegacyScopeInferenceNotice | null {
-	if (scope.source !== "inferred") return null;
-	const paths = legacyNoticePaths(scope);
-	if (paths.length === 0) {
-		return {
-			code: "legacy_scope_empty",
-			level: "warning",
-			paths,
-			message:
-				"[dispatch scope] legacy dispatch has no declared intent and inferred no policy-bearing paths. Path-scoped rules received no inferred match input, and worker authority did not expand.",
-		};
-	}
-	const rendered = paths
-		.map(
-			(entry) =>
-				`${entry.policy} ${entry.path} (provenance=${entry.provenance} source=${entry.source} confidence=${entry.confidence})`,
-		)
-		.join("; ");
+/** Render the named diagnostic for prose tokens whose leading "../" run was reinterpreted. */
+export function inferredScopeParentTokenDiagnostic(scope: DispatchPathScope): string | null {
+	const tokens = scope.parentTokens;
+	if (tokens.length === 0) return null;
+	return `legacy_scope_inferred: prose inference resolved path tokens carrying a leading '../' run against the dispatch root ${renderParentTokens(
+		tokens,
+	)}; an anchored token selects project rules without expanding worker authority and a dropped one took no part in scope`;
+}
+
+/** Render the interactive warning for prose tokens whose leading "../" run was reinterpreted. */
+export function inferredScopeParentTokenNotice(scope: DispatchPathScope): InferredScopeParentTokenNotice | null {
+	const tokens = scope.parentTokens;
+	if (tokens.length === 0) return null;
 	return {
 		code: "legacy_scope_inferred",
 		level: "warning",
-		paths,
-		message: `[dispatch scope] legacy dispatch resolved policy-bearing scope without declared intent: ${rendered}. Review this scope before execution.`,
+		// Every entry names the raw prose token, the one spelling both outcomes
+		// share; the message carries what each one resolved to.
+		paths: tokens.map((entry) => ({
+			path: entry.token,
+			policy: "working-context",
+			provenance: "inferred",
+			source: entry.source,
+			confidence: "low",
+		})),
+		message: `[dispatch scope] prose inference resolved path tokens carrying a leading '../' run against the dispatch root: ${renderParentTokens(
+			tokens,
+		)}. An anchored token selects project rules without expanding worker authority; a dropped one took no part in scope.`,
 	};
 }

package/src/domains/dispatch/placement.ts

@@ -61,9 +61,9 @@ function completedReroutes(
 
 function requestedNodeId(req: DispatchRequest, settings: Readonly<ClioSettings> | undefined): string | null {
 	if (req.node !== undefined && req.node.trim().length > 0) return req.node.trim();
-	const workers = settings?.workers;
+	const workers = settings?.fleet;
 	if (!workers) return null;
-	const profileName = req.workerProfile ?? workers.agentBindings?.[req.agentId];
+	const profileName = req.workerProfile ?? workers.agentProfiles?.[req.agentId];
 	if (!profileName) return null;
 	const pin = workers.profiles?.[profileName]?.node;
 	return pin !== undefined && pin.trim().length > 0 ? pin.trim() : null;

package/src/domains/dispatch/receipt-findings.ts

@@ -49,7 +49,7 @@ function canonicalJson(value: unknown): string {
 	throw new Error(`response schema digest cannot represent ${typeof value}`);
 }
 
-export function canonicalResponseSchemaDigest(schema: Record<string, unknown>): string {
+function canonicalResponseSchemaDigest(schema: Record<string, unknown>): string {
 	return createHash("sha256").update(canonicalJson(schema), "utf8").digest("hex");
 }
 

package/src/domains/dispatch/receipt-integrity.ts

@@ -123,7 +123,7 @@ export const RECEIPT_INTEGRITY_FIELD_COVERAGE = {
 	dynamicHash: true,
 	promptSignature: true,
 	toolSignature: true,
-	clioVersion: true,
+	clioCoderVersion: true,
 	piMonoVersion: true,
 	platform: true,
 	nodeVersion: true,
@@ -172,8 +172,14 @@ function selectedReceiptFields(
 	return result;
 }
 
-function receiptDigestFields(receipt: RunReceipt | RunReceiptDraft): Record<string, unknown> {
+function receiptDigestFields(receipt: RunReceipt | RunReceiptDraft, legacyNaming = false): Record<string, unknown> {
 	const result = selectedReceiptFields(receipt, RECEIPT_FIELDS);
+	if (legacyNaming) {
+		const source = receipt as unknown as Record<string, unknown>;
+		const version = source.clioVersion ?? source.clioCoderVersion;
+		delete result.clioCoderVersion;
+		if (version !== undefined) result.clioVersion = version;
+	}
 	result.briefing = receipt.briefing ?? null;
 	result.outcomeCode = receipt.outcomeCode ?? null;
 	result.steering = receipt.steering ?? null;
@@ -227,24 +233,29 @@ function ledgerDigestFields(envelope: RunEnvelope): Record<string, unknown> {
 	};
 }
 
-function integrityPayload(receipt: RunReceipt | RunReceiptDraft, envelope: RunEnvelope): Record<string, unknown> {
+function integrityPayload(
+	receipt: RunReceipt | RunReceiptDraft,
+	envelope: RunEnvelope,
+	legacyNaming = false,
+): Record<string, unknown> {
 	return {
-		contract: "clio.runReceipt.integrity",
+		contract: legacyNaming ? "clio.runReceipt.integrity" : "clio-coder.runReceipt.integrity",
 		version: RUN_RECEIPT_INTEGRITY_VERSION,
 		sources: ["receipt", "run-ledger"],
-		receipt: receiptDigestFields(receipt),
+		receipt: receiptDigestFields(receipt, legacyNaming),
 		ledger: ledgerDigestFields(envelope),
 	};
 }
 
-export function computeReceiptIntegrity(
+function computeReceiptIntegrity(
 	receipt: RunReceipt | RunReceiptDraft,
 	envelope: RunEnvelope,
+	legacyNaming = false,
 ): RunReceiptIntegrity {
 	return {
 		version: RUN_RECEIPT_INTEGRITY_VERSION,
 		algorithm: RUN_RECEIPT_INTEGRITY_ALGORITHM,
-		digest: sha256(canonicalJson(integrityPayload(receipt, envelope))),
+		digest: sha256(canonicalJson(integrityPayload(receipt, envelope, legacyNaming))),
 	};
 }
 
@@ -385,7 +396,8 @@ export function verifyReceiptIntegrity(receipt: RunReceipt, envelope: RunEnvelop
 		return { ok: false, reason: `ledger mismatch: ${mismatch}` };
 	}
 	const expected = computeReceiptIntegrity(receipt, envelope);
-	if (expected.digest !== receipt.integrity.digest) {
+	const legacyExpected = computeReceiptIntegrity(receipt, envelope, true);
+	if (expected.digest !== receipt.integrity.digest && legacyExpected.digest !== receipt.integrity.digest) {
 		return { ok: false, reason: "integrity mismatch" };
 	}
 	return { ok: true };

package/src/domains/dispatch/reservation-store.ts

@@ -599,31 +599,8 @@ export function getDispatchReservation(ownerId: string): DispatchReservationReco
 	return record ? copyRecord(record) : null;
 }
 
-export function listDispatchReservations(): ReadonlyArray<DispatchReservationRecord> {
-	return readStore();
-}
-
 export function reservedBudgetUsd(): number {
 	return readStore()
 		.filter((record) => record.status === "active")
 		.reduce((sum, record) => sum + outstandingBudget(record), 0);
 }
-
-export function reservedCapacity(): {
-	globalSlots: number;
-	nodeSlots: Readonly<Record<string, number>>;
-	endpointSlots: Readonly<Record<string, number>>;
-} {
-	let globalSlots = 0;
-	const nodeSlots: Record<string, number> = {};
-	const endpointSlots: Record<string, number> = {};
-	for (const record of readStore().filter((entry) => entry.status === "active")) {
-		const allocation = reservationAllocation(outstandingTasks(record));
-		globalSlots += allocation.globalSlots;
-		for (const [nodeId, count] of Object.entries(allocation.nodeSlots))
-			nodeSlots[nodeId] = (nodeSlots[nodeId] ?? 0) + count;
-		for (const [endpointKey, count] of Object.entries(allocation.endpointSlots))
-			endpointSlots[endpointKey] = (endpointSlots[endpointKey] ?? 0) + count;
-	}
-	return { globalSlots, nodeSlots, endpointSlots };
-}

package/src/domains/dispatch/route-decision.ts

@@ -597,7 +597,7 @@ function readinessHashProjection(report: RouteReadinessReport): readonly [boolea
  * `decisionDurationMs`, which is a measurement of the decision rather than an
  * input to it, so a replay on a faster machine still reproduces the hash.
  */
-export function routeDecisionHash(input: RouteDecisionInput): string {
+function routeDecisionHash(input: RouteDecisionInput): string {
 	// Arrays give every field an explicit position, so native JSON serialization
 	// is deterministic without recursively sorting hundreds of short-lived
 	// objects at the maximum universe bound. Candidate identity uses the same

package/src/domains/dispatch/route-history.ts

@@ -137,7 +137,7 @@ function retireHistory(path: string, version: unknown): void {
 	const retired = `${path}.v${String(version)}.${stamp}.retired`;
 	renameSync(path, retired);
 	process.stderr.write(
-		`[clio:dispatch] route history v${String(version)} is retired; starting empty at v${ROUTE_HISTORY_VERSION}. Prior observations: ${retired}\n`,
+		`[clio-coder:dispatch] route history v${String(version)} is retired; starting empty at v${ROUTE_HISTORY_VERSION}. Prior observations: ${retired}\n`,
 	);
 }
 

package/src/domains/dispatch/route-policy.ts

@@ -146,7 +146,7 @@ function rate(values: ReadonlyArray<boolean>, fallback = 0): number {
 }
 
 /** Conservative 95% Wilson lower confidence bound for a Bernoulli success rate. */
-export function wilsonLowerBound(successes: number, observations: number, z = 1.96): number {
+function wilsonLowerBound(successes: number, observations: number, z = 1.96): number {
 	if (observations <= 0) return 0;
 	const proportion = successes / observations;
 	const z2 = z * z;

package/src/domains/dispatch/route-readiness.ts

@@ -90,31 +90,3 @@ export function evaluateRouteReadiness(input: RouteReadinessInput): RouteReadine
 		labelsNeeded: Math.max(0, MINIMUM_ACTIVE_QUALITY_LABELS - estimate.qualityLabeledCount),
 	};
 }
-
-/**
- * Human-readable one-liners for a refusal message. The wording names the
- * missing evidence, so an operator who sees an active refusal can tell whether
- * to wait for measurements or to fix a stale fact.
- */
-export function describeReadinessGap(gap: ReadinessGap): string {
-	switch (gap) {
-		case "hard-constraint-validity-below-one":
-			return "hard-constraint evaluation was not consistently valid over the retained window";
-		case "integrity-failures-in-window":
-			return "the retained window contains receipt or source integrity failures";
-		case "insufficient-quality-labels":
-			return `fewer than ${MINIMUM_ACTIVE_QUALITY_LABELS} quality-labeled outcomes for this route and role`;
-		case "quality-lower-bound-below-posture-floor":
-			return "the conservative quality lower bound is below the posture floor";
-		case "quality-lower-bound-below-requested-minimum":
-			return "the conservative quality lower bound is below the request's minimumQuality";
-		case "reliability-below-posture-floor":
-			return "route-attributable reliability is below the posture floor";
-		case "cost-upper-bound-unknown":
-			return "the route has no conservative cost upper bound";
-		case "route-facts-stale":
-			return "node, endpoint, resource, capacity, or settings facts are stale";
-		case "decision-latency-above-budget":
-			return `shadow decision p95 exceeds ${DECISION_LATENCY_BUDGET_MS} ms at the configured universe bound`;
-	}
-}