@jungjaehoon/mama-os 0.53.1 → 0.58.0

package/dist/evidence/effects.js

@@ -1,409 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EffectWithoutCauseError = exports.EVIDENCE_EFFECTS_DDL = void 0;
-exports.isUsableCause = isUsableCause;
-exports.ensureEffectLedger = ensureEffectLedger;
-exports.payloadHash = payloadHash;
-exports.recordEffect = recordEffect;
-exports.recordUnattributedChange = recordUnattributedChange;
-exports.listEffects = listEffects;
-exports.changeCoverage = changeCoverage;
-/**
- * Every durable change, and what caused it.
- *
- * This is the half the system never had. Measured over ten days: 1,471 workorders ran,
- * 1,169 of them closed as `done`, and FIVE durable effect receipts exist - all five inside
- * one eleven-minute window a week earlier. `done` meant "the run finished", not "something
- * changed", and nothing downstream could tell the difference. The peer system recorded
- * 1,080 effects over the same kind of window, every one of them naming the events that
- * caused it, and its reports are projections of that table rather than prose assembled
- * from whatever a model happened to read.
- *
- * So the rule here is narrow and total:
- *
- * A CHANGE THAT CANNOT NAME ITS CAUSE IS NOT RECORDED AS ONE. `source_event_ids` is NOT
- * NULL and must be non-empty, enforced by the schema rather than by callers remembering.
- * The tempting softening - allow an empty array "for now" - is exactly how the effect
- * table becomes a second log: it would fill with rows that prove nothing, and the first
- * question anyone asks of it ("what made this happen?") would have no answer for most of
- * them. If a write genuinely has no observed cause, that is worth discovering, not
- * papering over.
- *
- * The kinds are a closed set for the same reason the peer's are: an open `effect_kind`
- * column drifts into free text within a month, and then counting what the system actually
- * did requires reading strings. Adding a kind should be a deliberate edit here.
- *
- * ONE TABLE, BOTH NUMBERS. A change that could not name a cause is still recorded here,
- * marked `unattributed` and holding an empty cause list that the schema forces to stay
- * empty. This is not the softening warned about above - `recordEffect` still refuses a
- * causeless effect, and a writer has to call `recordUnattributedChange` by name to admit
- * one. It is here because the failure this whole redesign keeps finding is a numerator
- * with no denominator. Split across two tables, "every effect names its cause" is true by
- * construction and means nothing; in one table the ratio is a single GROUP BY.
- *
- * WHAT THIS TABLE DOES NOT YET ANSWER, stated plainly so nobody reads more into the
- * number than it holds: the "1,169 done, five receipts" comparison needs RUNS beside
- * CHANGES, and runs still live in `operator_tasks`. `changeCoverage` answers "of the
- * changes recorded, how many rest on evidence" - not "how many runs changed anything".
- * The join that answers the second question needs the run id on both sides, and only one
- * side carries it today.
- *
- * Recording the unattributed change rather than refusing the write follows the operating
- * rule this system runs under: enforce only what is irreversible or externally visible,
- * and make everything else loud. A task row is neither, so the ledger observes it.
- *
- * A CAUSE IS AN EVENT ID, and the schema checks the shape rather than trusting the helper
- * to have filtered - `[""]`, `[null]`, `[0]` and a 200 KB string are all "non-empty
- * arrays" and all lies. What the schema still cannot check is whether the id names an
- * event that exists and is readable: the event index lives in a different database. A
- * cited cause that resolves to nothing is a fabricated citation, and catching those is the
- * next thing this needs.
- */
-const node_crypto_1 = require("node:crypto");
-const EFFECT_KINDS = [
-    'task_create',
-    'task_update',
-    'report_update',
-    'report_publish',
-    'memory_write',
-    'wiki_write',
-    'file_export',
-    'repair_request',
-    'run_budget_stop',
-];
-const EFFECT_TARGETS = [
-    'task',
-    'report_slot',
-    'memory',
-    'wiki_page',
-    'file',
-    'issue',
-    'run',
-];
-/** Long enough for any upstream id, short enough that the column cannot carry content. */
-const MAX_EVENT_ID_LENGTH = 200;
-const PAYLOAD_HASH_LENGTH = 32;
-/**
- * Whether a value can serve as a cause at all.
- *
- * Callers ask before writing rather than discovering it as a constraint violation,
- * because the answer changes what they record, not whether they may proceed: a malformed
- * cause makes a change unattributed, it does not make the change illegitimate. Legacy
- * rows really do carry 400-character source identifiers, and refusing to let the operator
- * update a work item because its upstream id is the wrong shape would be enforcement
- * bought with the owner's work.
- */
-function isUsableCause(value) {
-    if (typeof value !== 'string')
-        return false;
-    const trimmed = value.trim();
-    return trimmed.length > 0 && trimmed.length <= MAX_EVENT_ID_LENGTH;
-}
-const quoted = (values) => values.map((v) => `'${v}'`).join(', ');
-exports.EVIDENCE_EFFECTS_DDL = `
-  CREATE TABLE IF NOT EXISTS evidence_effects (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    run_id TEXT,
-    channel_id TEXT,
-    cause_state TEXT NOT NULL CHECK (cause_state IN ('attributed', 'unattributed')),
-    cause_kind TEXT NOT NULL
-      CHECK (cause_kind IN ('event', 'owner_message', 'clock', 'card_transition')),
-    source_event_ids_json TEXT NOT NULL
-      CHECK (
-        json_valid(source_event_ids_json)
-        AND (
-          (cause_state = 'attributed' AND json_array_length(source_event_ids_json) >= 1)
-          OR (cause_state = 'unattributed' AND json_array_length(source_event_ids_json) = 0)
-        )
-      ),
-    effect_kind TEXT NOT NULL CHECK (effect_kind IN (${quoted(EFFECT_KINDS)})),
-    target_type TEXT NOT NULL CHECK (target_type IN (${quoted(EFFECT_TARGETS)})),
-    target_id TEXT NOT NULL CHECK (length(trim(target_id)) > 0),
-    payload_hash TEXT NOT NULL CHECK (length(payload_hash) = ${PAYLOAD_HASH_LENGTH}),
-    created_at INTEGER NOT NULL CHECK (typeof(created_at) = 'integer' AND created_at >= 0)
-  )
-`;
-/**
- * Per-element shape of the cause list.
- *
- * A trigger rather than a CHECK because SQLite forbids subqueries in CHECK, and checking
- * each element needs `json_each`. Without this the column enforces only "non-empty array",
- * which `[""]` and `[null]` and `[0]` all satisfy while naming nothing.
- *
- * The length bound is not cosmetic: an unbounded cause id turns an audit ledger into a
- * content channel, which is the one thing the payload is hashed to avoid.
- */
-const EVIDENCE_EFFECTS_CAUSE_TRIGGER = `
-  CREATE TRIGGER IF NOT EXISTS evidence_effects_cause_shape
-  BEFORE INSERT ON evidence_effects
-  WHEN EXISTS (
-    SELECT 1 FROM json_each(NEW.source_event_ids_json)
-     WHERE json_each.type <> 'text'
-        OR trim(json_each.value) = ''
-        OR length(json_each.value) > ${MAX_EVENT_ID_LENGTH}
-  )
-  BEGIN
-    SELECT RAISE(ABORT, 'evidence_effects: a cause must be a non-empty event id');
-  END
-`;
-/**
- * kind <-> ids cross-shape. A trigger (not a table CHECK) so it applies
- * identically to fresh tables and ALTERed old ones: `event` must carry ids,
- * the id-less kinds must not - a clock that names events or an event that
- * names none is a fabricated cause either way.
- */
-const EVIDENCE_EFFECTS_KIND_TRIGGER = `
-  CREATE TRIGGER IF NOT EXISTS evidence_effects_kind_shape
-  BEFORE INSERT ON evidence_effects
-  WHEN (NEW.cause_kind = 'event' AND json_array_length(NEW.source_event_ids_json) = 0)
-    OR (NEW.cause_kind <> 'event' AND json_array_length(NEW.source_event_ids_json) > 0)
-  BEGIN
-    SELECT RAISE(ABORT, 'evidence_effects: cause_kind and source_event_ids disagree');
-  END
-`;
-const INDEXES = [
-    `CREATE INDEX IF NOT EXISTS idx_evidence_effects_run
-     ON evidence_effects(run_id, created_at DESC)`,
-    `CREATE INDEX IF NOT EXISTS idx_evidence_effects_target
-     ON evidence_effects(target_type, target_id, created_at DESC)`,
-    `CREATE INDEX IF NOT EXISTS idx_evidence_effects_channel
-     ON evidence_effects(channel_id, created_at DESC)`,
-    // Coverage is meant to be cheap enough that nobody has an excuse not to look.
-    `CREATE INDEX IF NOT EXISTS idx_evidence_effects_coverage
-     ON evidence_effects(created_at DESC, cause_state)`,
-];
-function ensureEffectLedger(adapter) {
-    adapter.prepare(exports.EVIDENCE_EFFECTS_DDL).run();
-    migrateCauseKind(adapter);
-    widenClosedSets(adapter);
-    adapter.prepare(EVIDENCE_EFFECTS_CAUSE_TRIGGER).run();
-    adapter.prepare(EVIDENCE_EFFECTS_KIND_TRIGGER).run();
-    for (const sql of INDEXES) {
-        adapter.prepare(sql).run();
-    }
-}
-/**
- * S2 migration: add cause_kind to pre-existing ledgers and backfill by
- * DISCRIMINATOR, never blanket (review #3 - "104 -> clock" would stamp owner-
- * and API-driven changes with a fabricated clock cause):
- *   attributed                          -> event  (ids >= 1, DB-checked)
- *   unattributed + temporal-effect join -> clock  (a temporal check fired)
- *   unattributed + run_id present       -> clock  (scheduled board:full run)
- *   remaining unattributed              -> owner_message (console/API writes
- *                                          carry no run and no batch)
- * ALTER ADD COLUMN with CHECK is legal SQLite (verified 2026-07-31; the
- * prohibition covers PK/UNIQUE) - no table rebuild.
- */
-function migrateCauseKind(adapter) {
-    const columns = adapter.prepare(`PRAGMA table_info(evidence_effects)`).all();
-    if (columns.some((column) => column.name === 'cause_kind')) {
-        return;
-    }
-    adapter
-        .prepare(`ALTER TABLE evidence_effects ADD COLUMN cause_kind TEXT NOT NULL DEFAULT 'clock'
-         CHECK (cause_kind IN ('event', 'owner_message', 'clock', 'card_transition'))`)
-        .run();
-    adapter
-        .prepare(`UPDATE evidence_effects SET cause_kind = 'event' WHERE cause_state = 'attributed'`)
-        .run();
-    const hasTemporalTable = (adapter
-        .prepare(`SELECT 1 AS x FROM sqlite_master WHERE type='table' AND name='operator_temporal_effects'`)
-        .all().length ?? 0) > 0;
-    if (hasTemporalTable) {
-        adapter
-            .prepare(`UPDATE evidence_effects SET cause_kind = 'clock'
-          WHERE cause_state = 'unattributed'
-            AND EXISTS (SELECT 1 FROM operator_temporal_effects t
-                         WHERE CAST(t.task_id AS TEXT) = evidence_effects.target_id)`)
-            .run();
-    }
-    // run_id-bearing unattributed rows are scheduled runs (board:full and
-    // friends): the ALTER's DEFAULT already left them 'clock', which is the
-    // intended label - no UPDATE needed (a `cause_kind <> 'clock'` predicate
-    // here would be dead code, review).
-    adapter
-        .prepare(hasTemporalTable
-        ? `UPDATE evidence_effects SET cause_kind = 'owner_message'
-             WHERE cause_state = 'unattributed' AND run_id IS NULL
-               AND NOT EXISTS (SELECT 1 FROM operator_temporal_effects t
-                                WHERE CAST(t.task_id AS TEXT) = evidence_effects.target_id)`
-        : `UPDATE evidence_effects SET cause_kind = 'owner_message'
-             WHERE cause_state = 'unattributed' AND run_id IS NULL`)
-        .run();
-}
-/**
- * Phase 3 migration: the effect_kind / target_type CHECKs are closed sets baked into the
- * table, and SQLite cannot alter a CHECK in place. When an installed ledger's CHECK is
- * narrower than the current constants, rebuild the table inside one transaction: copy every
- * row with identical ids and created_at, keep the cause_state CHECK and both triggers
- * byte-identical (they are the invariant the ledger rests on), recreate the indices.
- * Detection reads the stored DDL, so a ledger that already carries the current sets is
- * untouched on every later boot.
- */
-function widenClosedSets(adapter) {
-    const row = adapter
-        .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='evidence_effects'`)
-        .all()[0];
-    const storedDdl = row?.sql ?? '';
-    const missing = [...EFFECT_KINDS, ...EFFECT_TARGETS].filter((value) => !storedDdl.includes(`'${value}'`));
-    if (missing.length === 0) {
-        return;
-    }
-    const run = (sql) => adapter.prepare(sql).run();
-    run('BEGIN IMMEDIATE');
-    try {
-        run(exports.EVIDENCE_EFFECTS_DDL.replace('evidence_effects (', 'evidence_effects_new ('));
-        run(`INSERT INTO evidence_effects_new
-         (id, run_id, channel_id, cause_state, cause_kind, source_event_ids_json,
-          effect_kind, target_type, target_id, payload_hash, created_at)
-       SELECT id, run_id, channel_id, cause_state, cause_kind, source_event_ids_json,
-              effect_kind, target_type, target_id, payload_hash, created_at
-         FROM evidence_effects`);
-        run('DROP TABLE evidence_effects');
-        run('ALTER TABLE evidence_effects_new RENAME TO evidence_effects');
-        run(EVIDENCE_EFFECTS_CAUSE_TRIGGER);
-        run(EVIDENCE_EFFECTS_KIND_TRIGGER);
-        for (const sql of INDEXES) {
-            run(sql);
-        }
-        run('COMMIT');
-    }
-    catch (error) {
-        try {
-            run('ROLLBACK');
-        }
-        catch {
-            // BEGIN itself may have failed (busy lock, nested transaction): keep the original error.
-        }
-        throw error;
-    }
-}
-class EffectWithoutCauseError extends Error {
-    constructor(kind, targetId) {
-        super(`Refusing to record ${kind} on ${targetId} with no source events: a change that cannot name its cause is not an effect.`);
-        this.name = 'EffectWithoutCauseError';
-    }
-}
-exports.EffectWithoutCauseError = EffectWithoutCauseError;
-/** Stable hash of what was written. The ledger proves a change happened, not what it said. */
-function payloadHash(payload) {
-    return (0, node_crypto_1.createHash)('sha256')
-        .update(JSON.stringify(payload ?? null))
-        .digest('hex')
-        .slice(0, PAYLOAD_HASH_LENGTH);
-}
-/**
- * Record a durable change.
- *
- * Throws rather than returning a failure when the cause is missing. A caller that wrote
- * something and then could not say why must not proceed as if the write were accounted
- * for - silently skipping the ledger row is how 1,169 runs closed as `done` while five
- * receipts existed.
- */
-function recordEffect(adapter, input) {
-    const sourceEventIds = [
-        ...new Set(input.sourceEventIds.filter(isUsableCause).map((id) => id.trim())),
-    ];
-    if (sourceEventIds.length === 0) {
-        throw new EffectWithoutCauseError(input.kind, input.targetId);
-    }
-    return insertChange(adapter, input, 'event', sourceEventIds);
-}
-/**
- * Record a durable change that could not name what caused it.
- *
- * Deliberately a separate function with an uncomfortable name. Every call is an admission
- * that the system changed something it cannot explain, and the point is that the count of
- * these is visible next to the count of real effects rather than absent from both.
- */
-function recordUnattributedChange(adapter, input, causeKind) {
-    return insertChange(adapter, input, causeKind, []);
-}
-function insertChange(adapter, input, causeKind, sourceEventIds) {
-    const result = adapter
-        .prepare(`INSERT INTO evidence_effects
-         (run_id, channel_id, cause_state, cause_kind, source_event_ids_json,
-          effect_kind, target_type, target_id, payload_hash, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(input.runId ?? null, input.channelId ?? null, causeKind === 'event' ? 'attributed' : 'unattributed', causeKind, JSON.stringify(sourceEventIds), input.kind, input.targetType, input.targetId, payloadHash(input.payload), input.atMs);
-    return Number(result.lastInsertRowid ?? 0);
-}
-/** Read effects back, newest first - the substrate a report projects from. */
-function listEffects(adapter, query = {}) {
-    const clauses = [];
-    const params = [];
-    if (query.runId !== undefined) {
-        clauses.push('run_id = ?');
-        params.push(query.runId);
-    }
-    if (query.targetType !== undefined) {
-        clauses.push('target_type = ?');
-        params.push(query.targetType);
-    }
-    if (query.targetId !== undefined) {
-        clauses.push('target_id = ?');
-        params.push(query.targetId);
-    }
-    if (query.causeState !== undefined) {
-        clauses.push('cause_state = ?');
-        params.push(query.causeState);
-    }
-    if (query.sinceMs !== undefined) {
-        clauses.push('created_at >= ?');
-        params.push(query.sinceMs);
-    }
-    params.push(Math.min(Math.max(query.limit ?? 200, 1), 1000));
-    const rows = adapter
-        .prepare(`SELECT * FROM evidence_effects
-        ${clauses.length > 0 ? `WHERE ${clauses.join(' AND ')}` : ''}
-        ORDER BY created_at DESC, id DESC
-        LIMIT ?`)
-        .all(...params);
-    return rows.map((row) => ({
-        id: Number(row.id),
-        runId: typeof row.run_id === 'string' ? row.run_id : null,
-        channelId: typeof row.channel_id === 'string' ? row.channel_id : null,
-        causeState: String(row.cause_state),
-        causeKind: String(row.cause_kind),
-        sourceEventIds: JSON.parse(String(row.source_event_ids_json)),
-        kind: String(row.effect_kind),
-        targetType: String(row.target_type),
-        targetId: String(row.target_id),
-        payloadHash: String(row.payload_hash),
-        atMs: Number(row.created_at),
-    }));
-}
-/**
- * How much of what the system changed rests on evidence.
- *
- * The single number this ledger exists to make answerable, and the one the previous shape
- * of the system could not produce at all.
- */
-function changeCoverage(adapter, sinceMs, targetType) {
-    // Coverage must describe the same population as the rows a caller is looking at, or the
-    // two halves of one answer disagree and the reader cannot tell which is wrong.
-    const clauses = [];
-    const params = [];
-    if (sinceMs !== undefined) {
-        clauses.push('created_at >= ?');
-        params.push(sinceMs);
-    }
-    if (targetType !== undefined) {
-        clauses.push('target_type = ?');
-        params.push(targetType);
-    }
-    const rows = adapter
-        .prepare(`SELECT cause_state, COUNT(*) AS n FROM evidence_effects
-        ${clauses.length > 0 ? `WHERE ${clauses.join(' AND ')}` : ''}
-        GROUP BY cause_state`)
-        .all(...params);
-    const coverage = { attributed: 0, unattributed: 0 };
-    for (const row of rows) {
-        if (row.cause_state === 'attributed')
-            coverage.attributed = Number(row.n);
-        if (row.cause_state === 'unattributed')
-            coverage.unattributed = Number(row.n);
-    }
-    return coverage;
-}
-//# sourceMappingURL=effects.js.map

package/dist/evidence/effects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"effects.js","sourceRoot":"","sources":["../../src/evidence/effects.ts"],"names":[],"mappings":";;;AA0KA,sCAIC;AAuFD,gDASC;AA2HD,kCAKC;AAUD,oCAQC;AASD,4DAMC;AAwCD,kCA+CC;AAeD,wCA8BC;AAnjBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,6CAAyC;AAmFzC,MAAM,YAAY,GAA0B;IAC1C,aAAa;IACb,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAEF,MAAM,cAAc,GAA4B;IAC9C,MAAM;IACN,aAAa;IACb,QAAQ;IACR,WAAW;IACX,MAAM;IACN,OAAO;IACP,KAAK;CACN,CAAC;AAEF,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,KAAgC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC;AACrE,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhF,QAAA,oBAAoB,GAAG;;;;;;;;;;;;;;;;uDAgBmB,MAAM,CAAC,YAAY,CAAC;uDACpB,MAAM,CAAC,cAAc,CAAC;;+DAEd,mBAAmB;;;CAGjF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,8BAA8B,GAAG;;;;;;;uCAOA,mBAAmB;;;;;CAKzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,6BAA6B,GAAG;;;;;;;;CAQrC,CAAC;AAEF,MAAM,OAAO,GAAG;IACd;kDACgD;IAChD;kEACgE;IAChE;sDACoD;IACpD,8EAA8E;IAC9E;uDACqD;CACtD,CAAC;AASF,SAAgB,kBAAkB,CAAC,OAAsB;IACvD,OAAO,CAAC,OAAO,CAAC,4BAAoB,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5C,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAE,CAAC;IACtD,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAExE,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,OAAO;SACJ,OAAO,CACN;sFACgF,CACjF;SACA,GAAG,EAAE,CAAC;IACT,OAAO;SACJ,OAAO,CAAC,mFAAmF,CAAC;SAC5F,GAAG,EAAE,CAAC;IACT,MAAM,gBAAgB,GACpB,CAAC,OAAO;SACL,OAAO,CACN,0FAA0F,CAC3F;SACA,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;aACJ,OAAO,CACN;;;qFAG6E,CAC9E;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,OAAO;SACJ,OAAO,CACN,gBAAgB;QACd,CAAC,CAAC;;;4FAGkF;QACpF,CAAC,CAAC;mEACyD,CAC9D;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,OAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,EAAE,CAAC,CAAC,CAAiC,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAC7C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxD,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,CAAC,4BAAoB,CAAC,OAAO,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAClF,GAAG,CACD;;;;;+BAKyB,CAC1B,CAAC;QACF,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACnC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QACnE,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACpC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,GAAG,CAAC,UAAU,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;QAC3F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,sBAAsB,IAAI,OAAO,QAAQ,+EAA+E,CACzH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAPD,0DAOC;AAED,8FAA8F;AAC9F,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,OAAsB,EAAE,KAAkB;IACrE,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;KAC9E,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,OAAsB,EACtB,KAAkB,EAClB,SAAgC;IAEhC,OAAO,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CACnB,OAAsB,EACtB,KAAkB,EAClB,SAAoB,EACpB,cAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CACN;;;6CAGuC,CACxC;SACA,GAAG,CACF,KAAK,CAAC,KAAK,IAAI,IAAI,EACnB,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,EACrD,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAC9B,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,QAAQ,EACd,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAC1B,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAWD,8EAA8E;AAC9E,SAAgB,WAAW,CAAC,OAAsB,EAAE,QAAqB,EAAE;IACzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CACN;UACI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;gBAEpD,CACX;SACA,GAAG,CAAC,GAAG,MAAM,CAAmC,CAAC;IAEpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACrE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAe;QACjD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAc;QAC9C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAa;QACzE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAe;QAC3C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAiB;QACnD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AASD;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,OAAsB,EACtB,OAAgB,EAChB,UAAyB;IAEzB,wFAAwF;IACxF,+EAA+E;IAC/E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CACN;UACI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;6BACvC,CACxB;SACA,GAAG,CAAC,GAAG,MAAM,CAAmC,CAAC;IACpD,MAAM,QAAQ,GAAmB,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,WAAW,KAAK,YAAY;YAAE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,WAAW,KAAK,cAAc;YAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evidence/read.d.ts

@@ -1,130 +0,0 @@
-/**
- * The live grant: which connectors and channels this system was told to look at.
- *
- * This file used to also carry a boolean visibility predicate and a SQL reader of its own -
- * a third and fourth compiled copy of a rule whose whole point was that there be one. Both
- * had zero callers, which is worse than a live copy rather than better: nothing exercises
- * them, so nothing notices when they drift, and they sit there looking authoritative until
- * someone reads one and believes it. They are deleted. The rule lives in mama-core's
- * channel-grant.ts, where its two used forms sit adjacent with a differential between them.
- *
- * What remains here is the part that is genuinely local: turning the owner's connector
- * config into a grant, and narrowing that grant to what one envelope may read.
- *
- * WHY A GRANT AT ALL. The path it replaced returned ZERO rows out of 30,671 in production,
- * blocked four separate ways at once: a project window whose column was null on every row,
- * a tenant partition with exactly one value, a scope-id namespace that shared nothing with
- * the one callers hold, and a legacy escape hatch gated shut whenever any specific scope
- * was present - which is always. Each was individually fatal, so this is a replacement and
- * not a repair.
- *
- * An event is visible when the caller was granted its connector and its channel. Both come
- * from `(source_connector, channel)`, which every indexed row carries with no nulls, and
- * which is the SAME key the connector config declares its channels under. The old path
- * invented a third naming layer on top of that key, populated it 37% of the time, and then
- * filtered on it.
- */
-import type { ChannelGrant } from '@jungjaehoon/mama-core/context-compile';
-/**
- * Build a grant from the connector config, which already names every channel.
- *
- * A connector present with an EMPTY channel list is denied rather than granted everything -
- * that rule is stated and enforced in `isChannelGranted`, which is the only place it lives.
- */
-export declare function grantFromConnectorConfig(config: unknown): ChannelGrant;
-/**
- * The live grant, read fresh on every call.
- *
- * Not cached at boot: the owner adds and removes channels while the daemon runs, and a
- * grant captured once would keep reading a channel after it was removed - the failure
- * mode where turning something off does not turn it off.
- */
-export declare function liveBoundaryChannels(): ChannelGrant;
-/**
- * The channel grant, as MEMORY scopes.
- *
- * Memories extracted from a channel are stored under `channel:<connector>:<channelId>` -
- * the SAME key the grant declares.
- */
-export declare function channelMemoryScopesFromGrant(grant: ChannelGrant, connectors: readonly string[]): Array<{
-    kind: 'channel';
-    id: string;
-}>;
-/**
- * The READ allowance a run's raw grant implies for memory: a run allowed to read a
- * channel's raw events may recall the memories extracted from it. This was the dominant
- * compile failure S2 named (memory_scope_out_of_scope, 2,700+ violations/morning):
- * envelopes carry identity scopes while retrieval asks for the real channels memories
- * are stored under.
- *
- * This is an ENFORCEMENT-LAYER allowance, never issued into the envelope. Envelope
- * channel scopes double as the raw-narrowing input (`narrowGrantToEnvelope`) and as
- * `mama_save`'s write binding - issuing the mirror widened a chat's raw reads back to
- * every sibling channel and bound every saved memory to all of them (PR #217 review,
- * blocking #2/#3). Read acceptance widens READS only, computed against the LIVE grant
- * at check time.
- *
- * A connector the envelope already narrows with an identity channel scope (a chat's own
- * channel, a temporal run's binding) keeps that narrowing: per-channel isolation is the
- * point of those scopes, and the mirror must not dissolve it.
- */
-export declare function mirrorReadScopes(envelope: {
-    scope: {
-        raw_connectors: readonly string[];
-        memory_scopes: ReadonlyArray<{
-            kind: string;
-            id: string;
-        }>;
-    };
-}, grant?: ChannelGrant): Array<{
-    kind: 'channel';
-    id: string;
-}>;
-/**
- * Narrow the configured grant to what THIS envelope may read.
- *
- * Two independent narrowings, and the second is the whole reason this exists rather than a
- * one-line filter:
- *
- * 1. Connector - the envelope's `raw_connectors` is the standing permission.
- *
- * 2. CHANNEL - when the envelope names channel scopes, only those channels are readable.
- *    Raw visibility used to be decided by the scope columns, so a per-message envelope
- *    scoped to one channel could not reach another. Deciding it by connector alone silently
- *    dropped that isolation: reactive envelopes for two channels of the same connector
- *    carry identical `raw_connectors`, so every such run could have compiled 500-character
- *    excerpts out of every other configured channel of that connector. The scope columns
- *    were the wrong mechanism - populated on 37% of rows in three namespaces - but the
- *    isolation they attempted is real, and it belongs here, where the envelope's own
- *    channel scopes state it exactly.
- *
- * An envelope with no channel scope is a run that was never bound to one (a report, a
- * scheduled worker), and it keeps the connector-level ceiling.
- *
- * CALLERS MUST PASS THE ENVELOPE'S OWN SCOPES, never a caller-requested subset. A request
- * may narrow what it asks for; it must not be able to widen its grant by asking for less.
- * Two surfaces got that wrong before it was written down here.
- */
-export declare function narrowGrantToEnvelope(configured: ChannelGrant, visibility: {
-    connectors: readonly string[];
-    scopes: readonly {
-        kind: string;
-        id: string;
-    }[];
-}): ChannelGrant;
-/**
- * WRITE authority never widens past the envelope. A context packet's scopes may
- * carry the READ allowance (the compile boundary defaults to it), but a save
- * binds permanently - one memory_scope_bindings row per scope - so only the
- * packet scopes the envelope itself names are write-eligible (PR #217
- * re-review, blocking #4: finding #3 through the packet back door). Pre-mirror
- * packets satisfied packet ⊆ envelope, so this is the identity for them.
- */
-export declare function writeEligiblePacketScopes<T extends {
-    kind: string;
-    id: string;
-}>(packetScopes: readonly T[], envelopeScopes: ReadonlyArray<{
-    kind: string;
-    id: string;
-}>): T[];
-//# sourceMappingURL=read.d.ts.map

package/dist/evidence/read.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/evidence/read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAG3E;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,CAqBtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAMnD;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,KAAK,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CASxC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE;IACR,KAAK,EAAE;QACL,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,aAAa,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5D,CAAC;CACH,EACD,KAAK,GAAE,YAAqC,GAC3C,KAAK,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAYxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,YAAY,EACxB,UAAU,EAAE;IACV,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD,GACA,YAAY,CA0Bd;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EAC9E,YAAY,EAAE,SAAS,CAAC,EAAE,EAC1B,cAAc,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,CAAC,EAAE,CAGL"}