@ixo/oracle-runtime-workers 0.18.0 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixo/oracle-runtime-workers",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "QiForge oracle runtime for Cloudflare Workers — Durable Object per user (SQLite in WASM over DO storage), Matrix E2EE gateway Durable Object, Hono HTTP/SSE shell.",
   "private": false,
   "publishConfig": {
@@ -58,9 +58,9 @@
     "wa-sqlite": "1.0.0",
     "yjs": "13.6.32",
     "zod": "^4.4.3",
+    "@ixo/ixo-transaction": "0.1.0",
     "@ixo/ucan": "2.2.1",
-    "@ixo/common": "1.6.0",
-    "@ixo/ixo-transaction": "0.1.0"
+    "@ixo/common": "1.7.0"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.22.0",

package/src/channels/auth.ts

@@ -41,7 +41,8 @@ export const ChannelInvoke = defineCapability({
 
 export interface ChannelAuthConfig {
   oracleDid: string;
-  channelDid: string;
+  /** Every channel service DID allowed to invoke this deployment. */
+  channelDids: readonly string[];
   didResolver: DIDKeyResolver;
 }
 
@@ -85,12 +86,16 @@ export async function authenticateChannel(
   );
   const chain = result.proofChain;
   const userDid = chain?.[0];
+  // The invoker is the one listed channel service that signed this
+  // invocation; the user's grant must be addressed to that same service.
+  const channelDid = result.invoker;
   if (
     !result.ok ||
     !userDid?.startsWith('did:ixo:') ||
     chain?.length !== 2 ||
-    chain[1] !== config.channelDid ||
-    result.invoker !== config.channelDid
+    !channelDid ||
+    !config.channelDids.includes(channelDid) ||
+    chain[1] !== channelDid
   )
     throw new ChannelError(
       401,
@@ -106,7 +111,7 @@ export async function authenticateChannel(
     !('issuer' in proof) ||
     proof.proofs.length !== 0 ||
     proof.issuer.did() !== userDid ||
-    proof.audience.did() !== config.channelDid ||
+    proof.audience.did() !== channelDid ||
     proof.capabilities.length !== 1 ||
     proof.capabilities[0]?.can !== 'ixo:channel/invoke' ||
     proof.capabilities[0]?.with !== `ixo:channel:${input.bindingId}` ||
@@ -159,7 +164,7 @@ export async function authenticateChannel(
   return {
     userDid,
     channel: {
-      callerDid: config.channelDid,
+      callerDid: channelDid,
       provider: input.provider,
       bindingId: input.bindingId,
       bindingRevision: input.bindingRevision,
@@ -176,13 +181,30 @@ const channelWebResolver = createWebDIDResolver({
   cacheTtlMs: IXO_DID_RESOLUTION_CACHE_TTL_MS,
 });
 
+/**
+ * `CHANNEL_SERVICE_DID` is one DID or a comma-separated list (one channel
+ * service per messaging provider, or a rotation overlap): entries are
+ * trimmed, empty ones dropped and duplicates removed, order kept.
+ */
+export function parseChannelServiceDids(raw: string | undefined): string[] {
+  return [
+    ...new Set(
+      (raw ?? '')
+        .split(',')
+        .map((did) => did.trim())
+        .filter((did) => did !== ''),
+    ),
+  ];
+}
+
 export function channelAuthConfig(
   env: Pick<
     OracleWorkerEnv,
     'CHANNEL_SERVICE_DID' | 'BLOCKSYNC_GRAPHQL_URL' | 'ORACLE_DID'
   >,
 ): ChannelAuthConfig {
-  if (!env.CHANNEL_SERVICE_DID)
+  const channelDids = parseChannelServiceDids(env.CHANNEL_SERVICE_DID);
+  if (channelDids.length === 0)
     throw new ChannelError(
       503,
       'Channels are not configured',
@@ -194,10 +216,10 @@ export function channelAuthConfig(
   ]);
   return {
     oracleDid: env.ORACLE_DID,
-    channelDid: env.CHANNEL_SERVICE_DID,
+    channelDids,
     didResolver: async (did) => {
       if (
-        did === env.CHANNEL_SERVICE_DID ||
+        channelDids.includes(did) ||
         did === env.ORACLE_DID ||
         did.startsWith('did:ixo:')
       )

package/src/channels/contract.ts

@@ -1,22 +1,34 @@
 import { z } from 'zod';
 import type { ReplyPlan } from '../delivery/types';
 
+/**
+ * A channel provider id (`whatsapp`, later others): lower-case, starts with a
+ * letter, at most 32 characters. The runtime does not enumerate providers;
+ * the gateway and the Auth Hub do. An unknown provider is delivered with the
+ * default delivery profile.
+ */
+export const ChannelProviderId = z.string().regex(/^[a-z][a-z0-9_-]{0,31}$/);
+
 export const ChannelTurnBody = z.strictObject({
-  provider: z.literal('whatsapp'),
+  provider: ChannelProviderId,
   bindingId: z.string().regex(/^chb_[A-Za-z0-9_-]{1,120}$/),
   bindingRevision: z.number().int().positive().safe(),
   requestId: z.string().min(1).max(180),
   remoteMessageRef: z.string().regex(/^hmac:[a-f0-9]{64}$/),
   sessionId: z.string().min(1).max(255).optional(),
   message: z.string().min(1).max(16_000),
-  context: z.strictObject({ kind: z.literal('companion') }),
+  /**
+   * Which kind of oracle the gateway believes it addresses. `companion` is
+   * the legacy value; the gateway sends `oracle`. Both are accepted.
+   */
+  context: z.strictObject({ kind: z.enum(['companion', 'oracle']) }),
 });
 
 export type ChannelTurnInput = z.infer<typeof ChannelTurnBody>;
 
 export const ChannelOrigin = z.strictObject({
   v: z.literal(1),
-  transport: z.literal('whatsapp'),
+  transport: ChannelProviderId,
   binding_id: ChannelTurnBody.shape.bindingId,
   remote_ref: ChannelTurnBody.shape.remoteMessageRef,
 });
@@ -39,7 +51,7 @@ export function channelOrigin(
 
 export interface ChannelIdentity {
   callerDid: string;
-  provider: 'whatsapp';
+  provider: string;
   bindingId: string;
   bindingRevision: number;
 }
@@ -82,7 +94,7 @@ export type ChannelErrorStatus =
  * The machine-readable reason a channel turn was refused. The gateway maps
  * a refusal by `code` first and by HTTP status second. 428 (Precondition
  * Required) means a precondition on the user's side is missing: fix it
- * (authorize the oracle again, finish setting up the Companion room) and
+ * (authorize the oracle again, finish setting up the user's oracle room) and
  * retry; it is never a transient outage.
  *
  * | code                              | status | meaning                                               |
@@ -93,16 +105,17 @@ export type ChannelErrorStatus =
  * | `identity_mismatch`               | 403    | the channel identity does not match the request       |
  * | `identity_required`               | 403    | the binding check got no channel identity             |
  * | `binding_inactive`                | 403    | the Auth Hub reports the binding inactive             |
- * | `channel_grant_not_tool_authority`| 403    | a channel request carried a delegation header         | * | `storage_unauthorized`            | 403    | the user's file storage rejected the oracle (final)   |
- * | `session_not_found`               | 404    | the session is not the user's Companion session       |
+ * | `channel_grant_not_tool_authority`| 403    | a channel request carried a delegation header         |
+ * | `storage_unauthorized`            | 403    | the user's file storage rejected the oracle (final)   |
+ * | `session_not_found`               | 404    | the session is not the user's oracle session          |
  * | `request_conflict`                | 409    | the request id already belongs to another message     |
  * | `session_conflict`                | 409    | another session is bound, or the named one is gone:   |
  * |                                   |        | resend the same request without `sessionId`           |
- * | `room_not_encrypted`              | 409    | the Companion room is not end-to-end encrypted        |
- * | `room_unavailable`                | 409    | the oracle cannot use the Companion room (final)      |
+ * | `room_not_encrypted`              | 409    | the user's oracle room is not end-to-end encrypted    |
+ * | `room_unavailable`                | 409    | the oracle cannot use the user's oracle room (final)  |
  * | `response_expired`                | 410    | the run was pruned; the request cannot run again      |
  * | `request_too_large`               | 413    | the body is over 64 kB                                |
- * | `room_not_ready`                  | 428    | the user has no Companion room yet                    |
+ * | `room_not_ready`                  | 428    | the user has no oracle room yet                       |
  * | `delegation_required`             | 428    | no usable delegation to this oracle (see below)       |
  * | `rate_limited`                    | 429    | too many requests for this user                       |
  * | `not_configured`                  | 503    | channels or binding validation are not configured     |
@@ -161,7 +174,7 @@ export class ChannelError extends Error {
  * one at once).
  */
 export class StaleSessionError extends ChannelError {
-  constructor(message = 'Companion session not found') {
+  constructor(message = 'Oracle session not found') {
     super(404, message, 'session_not_found');
     this.name = 'StaleSessionError';
   }
@@ -195,7 +208,7 @@ export interface ChannelDelegation {
 export function delegationRequiredError(): ChannelError {
   return new ChannelError(
     428,
-    'Companion delegation required: the user must authorize this oracle again',
+    'Delegation required: the user must authorize this oracle again',
     'delegation_required',
   );
 }

package/src/channels/failures.ts

@@ -41,7 +41,7 @@ export function isRoomForbidden(error: unknown): boolean {
  * The final refusal for a failure retrying cannot fix, or null when the
  * failure stays a transient `503 unavailable`:
  *
- * - the Companion room refused the oracle → `409 room_unavailable`;
+ * - the user's oracle room refused the oracle → `409 room_unavailable`;
  * - the user's file storage rejected the oracle's credentials while the
  *   owner copy loaded (`VFS_AUTH_FAILED`; `NO_VFS_DELEGATION` is a
  *   `428 delegation_required` and is handled before this) →
@@ -51,13 +51,13 @@ export function classifyChannelFailure(error: unknown): ChannelError | null {
   if (parseOwnerCopyFailure(error)?.code === 'VFS_AUTH_FAILED')
     return new ChannelError(
       403,
-      "The user's file storage rejected the oracle; the Companion cannot load the user's data",
+      "The user's file storage rejected the oracle; the oracle cannot load the user's data",
       'storage_unauthorized',
     );
   if (isRoomForbidden(error))
     return new ChannelError(
       409,
-      'The oracle cannot use the Companion room (it is not a member or was refused)',
+      "The oracle cannot use the user's oracle room (it is not a member or was refused)",
       'room_unavailable',
     );
   return null;

package/src/channels/turns.ts

@@ -23,11 +23,11 @@ interface ReceiptRow extends Record<string, string | number | null> {
   /** 1 once the user message was mirrored (or there is none to mirror). */
   user_mirrored: number;
   /**
-   * 0 while the reply is owed, 1 once it was mirrored into the Companion
+   * 0 while the reply is owed, 1 once it was mirrored into the user's oracle
    * room, 2 when the run ended without a reply to mirror.
    */
   reply_mirrored: number;
-  /** 1 while a mirror of this request is owed to the Companion room. */
+  /** 1 while a mirror of this request is owed to the user's oracle room. */
   mirror_pending: number;
   /** Failed mirror attempts since the last success. */
   mirror_failures: number;
@@ -71,7 +71,7 @@ export interface ChannelTurnsHost {
   /**
    * Throws `StaleSessionError` when the object holds no such session (it
    * was deleted), any other `ChannelError` when it is not the user's
-   * session in the encrypted Companion room.
+   * session in the encrypted oracle room.
    */
   assertSession(identity: TurnIdentity, sessionId: string): Promise<void>;
   /**
@@ -86,7 +86,7 @@ export interface ChannelTurnsHost {
   begin(runId: string, request: TurnRequest): Promise<RunRecord>;
   /** The turn a run was admitted with, read back from its stored request. */
   requestOf(record: RunRecord): TurnRequest;
-  /** Post one message into the Companion room; rejects when it could not. */
+  /** Post one message into the user's oracle room; rejects when it could not. */
   mirror(
     request: TurnRequest,
     text: string,
@@ -119,7 +119,7 @@ type Received =
  *    (gateway RPCs and a homeserver read);
  * 3. under the lock again, SQLite only: bind the session and begin the run.
  *
- * The Companion room mirrors (the user message, then the reply) are owed by
+ * The user's oracle room mirrors (the user message, then the reply) are owed by
  * the receipt and sent in the background, never awaited by a turn or a poll.
  */
 export class ChannelTurns {
@@ -257,7 +257,7 @@ export class ChannelTurns {
         if (stale)
           throw new ChannelError(
             409,
-            'The Companion session of this channel no longer exists; send the request again without sessionId',
+            'The oracle session of this channel no longer exists; send the request again without sessionId',
             'session_conflict',
           );
         throw error;
@@ -294,7 +294,7 @@ export class ChannelTurns {
   }
 
   /**
-   * A run ended: mirror what it still owes the Companion room (its reply)
+   * A run ended: mirror what it still owes the user's oracle room (its reply)
    * in the background. The receipt records each mirror, so nothing is sent
    * twice; a failed one is retried by the housekeeping alarm.
    */
@@ -318,7 +318,7 @@ export class ChannelTurns {
 
   /**
    * The session was deleted: release every binding that pointed at it, so
-   * the binding's next message opens a new Companion session. Returns
+   * the binding's next message opens a new oracle session. Returns
    * whether a binding was released.
    */
   forgetSession(sessionId: string): Promise<boolean> {
@@ -621,7 +621,7 @@ export class ChannelTurns {
       }
       return this.respond(input, receipt, session, record);
     }
-    // The run owes its user message to the Companion room from here on;
+    // The run owes its user message to the user's oracle room from here on;
     // the mirror pass sends it, the turn never waits for it.
     await this.db.run(
       `UPDATE channel_requests SET session_id = ?, user_mirrored = 0, reply_mirrored = 0,
@@ -710,7 +710,7 @@ export class ChannelTurns {
   }
 
   /**
-   * One mirror pass over the receipts that owe the Companion room a
+   * One mirror pass over the receipts that owe the user's oracle room a
    * message. Sessions are mirrored in parallel; within a session strictly
    * in receipt order, the user message before its reply, and a mirror that
    * fails holds the session's later ones back until it succeeds or is

package/src/core/capability-router.ts

@@ -222,6 +222,7 @@ export function createCapabilityRouter(
                 `capability=${verdict.capability ?? '-'} ` +
                 `capabilityConfidence=${verdict.capabilityConfidence?.toFixed(2) ?? '-'} ` +
                 `wouldPreload=${list(verdict.preload)} reason=${verdict.reason} ` +
+                `calibrationProfile=${verdict.calibrationProfileRef ?? '-'} ` +
                 `latencyMs=${now() - started} provider=${evaluation.provider} model=${evaluation.model}`,
             );
             turn.onShadowVerdict?.(verdict.preload);

package/src/delivery/profile.ts

@@ -135,7 +135,10 @@ export function resolveDeliveryProfile(
   const surface =
     turn.client === 'matrix'
       ? 'matrix'
-      : turn.channel?.provider && DEFAULT_LIMITS[turn.channel.provider]
+      : // An unknown provider id uses the generic profile. `hasOwn`: a
+        // provider id such as `constructor` must not hit the prototype.
+        turn.channel?.provider &&
+          Object.hasOwn(DEFAULT_LIMITS, turn.channel.provider)
         ? turn.channel.provider
         : 'generic';
   const merged: ChatLimits = {

package/src/delivery/schema.ts

@@ -46,7 +46,7 @@ function linkLabel(title: string): string {
 }
 
 /**
- * The plan as one Markdown message: what the Companion room mirror of a
+ * The plan as one Markdown message: what the user's oracle room mirror of a
  * channel turn and gateways that predate plans receive. Never stored as a
  * run's text, which stays the model's own.
  */

package/src/do/contracts.ts

@@ -8,7 +8,10 @@ import type {
   ChannelTurnOutcome,
 } from '../channels/contract';
 import type { TaskExecutionProfile } from '../core/execution-profile';
-import type { CapabilityRouterMode } from '@ixo/common/ai/decisions';
+import type {
+  CapabilityRouterMode,
+  DecisionProviderName,
+} from '@ixo/common/ai/decisions';
 import type { TranscriptPageOptions } from './transcript';
 import type { TurnUsage } from '../core/turn-budget';
 import type { BotStatus, EncryptedFileInfo } from '@ixo/matrix-bot-workers-sdk';
@@ -62,6 +65,7 @@ export interface OracleWorkerEnv {
   UCAN_AUTH_MAX_TTL_SECONDS?: string;
   /** `true` restores the legacy bare-delegation authentication (off by default). */
   UCAN_ALLOW_BARE_DELEGATION_AUTH?: string;
+  /** The channel service DID, or a comma-separated list of them. */
   CHANNEL_SERVICE_DID?: string;
   AUTH_HUB?: Fetcher;
   AUTH_HUB_URL?: string;
@@ -273,10 +277,16 @@ export interface OracleWorkerEnv {
   NEBIUS_API_KEY?: string;
 
   // --- decisions ----------------------------------------------------------
-  /** Bounded semantic Decision provider; unset leaves Decisions unconfigured. `openrouter-jev` reuses `OPEN_ROUTER_API_KEY`. */
-  DECISION_PROVIDER?: 'cloudflare-jev' | 'openrouter-jev';
-  /** Jev model id override (`typesafe/jev` on Workers AI, `typesafe/jev-1.13` on OpenRouter). */
+  /** Bounded semantic Decision provider; unset leaves Decisions unconfigured. `openrouter-jev` reuses `OPEN_ROUTER_API_KEY`; the Databricks lanes need `DATABRICKS_WORKSPACE_URL` + `DATABRICKS_TOKEN`. */
+  DECISION_PROVIDER?: DecisionProviderName;
+  /** Model id override (`typesafe/jev` on Workers AI, `typesafe/jev-1.13` on OpenRouter, the Unity Catalog model service `system.ai.openjev-qwen35-4b` for `databricks-systemone`); not used by `databricks-ai-decide`. */
   DECISION_MODEL?: string;
+  /** Databricks workspace origin (`https://<host>`, no path or query) for both Databricks lanes. */
+  DATABRICKS_WORKSPACE_URL?: string;
+  /** Secret. Databricks workspace token for both Databricks lanes (sent as HTTP Basic `token:<token>`). */
+  DATABRICKS_TOKEN?: string;
+  /** `ai_decide` function API version for `databricks-ai-decide` (default and only accepted value `1.0`). */
+  DATABRICKS_AI_DECIDE_VERSION?: string;
   /** Cloudflare account for `cloudflare-jev` over the REST API; not needed when the `AI` binding is declared. */
   CLOUDFLARE_ACCOUNT_ID?: string;
   /** Workers AI token for `cloudflare-jev` over the REST API; not needed when the `AI` binding is declared. */
@@ -354,7 +364,8 @@ export interface TurnIdentity {
 /** Request the shell / gateway sends to `UserOracleDO` to run one turn. */
 export interface TurnRequest {
   channel?: {
-    provider: 'whatsapp';
+    /** A provider id (`/^[a-z][a-z0-9_-]{0,31}$/`), e.g. `whatsapp`. */
+    provider: string;
     bindingId: string;
     remoteMessageRef: string;
   };

package/src/do/room-mirror.ts

@@ -43,7 +43,7 @@ export interface MirrorSend {
   threadId: string;
   txnId: string;
   origin?: {
-    provider: 'whatsapp';
+    provider: string;
     bindingId: string;
     remoteMessageRef: string;
   };

package/src/do/user-oracle-do.ts

@@ -1734,7 +1734,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           if (!roomId)
             throw new ChannelError(
               428,
-              'Companion room is not ready',
+              "The user's oracle room is not ready",
               'room_not_ready',
             );
           return (await this.createSession(identity, { roomId, markerTxnId }))
@@ -1753,13 +1753,13 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           )
             throw new ChannelError(
               404,
-              'Companion session not found',
+              'Oracle session not found',
               'session_not_found',
             );
           if (!(await this.roomIsEncrypted(roomId)))
             throw new ChannelError(
               409,
-              'Companion room must be encrypted',
+              "The user's oracle room must be encrypted",
               'room_not_encrypted',
             );
         },
@@ -2352,7 +2352,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         if (next !== null) deadlines.push(Math.max(next, now + 1000));
       }
 
-      // Channel requests: retry the Companion room mirrors that are due, and
+      // Channel requests: retry the user's oracle room mirrors that are due, and
       // prune (bounded) receipts that never started a run and old run
       // tombstones (channels/turns.ts).
       if (this.channelTurns) {
@@ -4763,7 +4763,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       outcome: RunOutcome,
     ): Promise<void> {
       // A channel run's reply (or the end of a run without one) is mirrored
-      // into the Companion room in the background: never awaited here, so
+      // into the user's oracle room in the background: never awaited here, so
       // the session's next queued run starts at once. Without the handle (a
       // reset dropped it mid-run) the next poll or alarm mirrors it.
       if (record.client === 'channel') this.channelTurns?.deliverReply();

package/src/shell/app.ts

@@ -2,6 +2,7 @@ import {
   authenticateChannel,
   assertActiveChannelBindingCached,
   channelAuthConfig,
+  parseChannelServiceDids,
 } from '../channels/auth';
 import {
   ChannelError,
@@ -418,7 +419,7 @@ export function createShell(
 
   app.post('/channels/turn', async (c) => {
     try {
-      if (!c.env.CHANNEL_SERVICE_DID)
+      if (parseChannelServiceDids(c.env.CHANNEL_SERVICE_DID).length === 0)
         throw new ChannelError(
           503,
           'Channels are not configured',