@jungjaehoon/mama-os 0.53.1 → 0.58.0

package/dist/operator/task-ledger.d.ts

@@ -1,879 +0,0 @@
-/**
- * TaskLedger - the operator-owned native work-item ledger (M8 Task 0.1).
- *
- * Extends the shape of Kagemusha's proven task store with assignment,
- * idempotency, temporal scheduling, durable generation, effect receipt, and
- * workorder state. Implements the pre-existing `TaskSource` interface
- * (operator-interfaces.ts) so the board projects one task model, not two.
- *
- * Owner conversations create rows through task_create. Reconcile runs update or
- * reclassify existing rows through the task_update/task_reclassify gateway
- * tools; the pipeline board slot is a projection of `list({order:
- * 'deadline_priority'})`. The agent proposes task changes, while this ledger
- * enforces revisions, temporal ownership, idempotency, and atomic receipts.
- *
- * Schema-extension note: CREATE TABLE IF NOT EXISTS is a no-op on existing
- * tables. Any post-ship column addition needs an explicit ALTER TABLE guarded
- * by a PRAGMA table_info check, added to runMigration().
- *
- * The db handle is SHARED with TriggerRegistry and owned by the caller
- * (start.ts opens and closes it once) - deliberately no close() here.
- */
-import type { OwnerActionContext } from './owner-action-effects.js';
-import { type ChangeCoverage, type EffectQuery, type EffectRecord, type EffectTarget } from '../evidence/effects.js';
-import type { SQLiteDatabase } from '../sqlite.js';
-import type { OperatorTask, TaskSource } from './operator-interfaces.js';
-import { type TemporalEffectReceipt, type TemporalEvidenceAttestation, type TemporalReconcileInput, type TemporalWorkContext } from './temporal-effect.js';
-import { type TemporalState, type DueBucket } from './task-temporal.js';
-import type { BindingCandidate, CandidateTaskSnapshot, ExistingExternalBindingSnapshot, ExternalCandidateSource, ExternalLifecycleCandidateSet, LifecycleCandidate, OwnerAttestedCandidateSummary, TaskHintLookup } from './external-lifecycle.js';
-export declare const TASK_STATUSES: readonly ["pending", "in_progress", "review", "blocked", "done", "cancelled", "failed"];
-export type TaskStatus = (typeof TASK_STATUSES)[number];
-export declare const TASK_PRIORITIES: readonly ["high", "normal", "low"];
-export type TaskPriority = (typeof TASK_PRIORITIES)[number];
-export declare const TASK_KINDS: readonly ["owner", "system"];
-export type TaskKind = (typeof TASK_KINDS)[number];
-export declare const WORKORDER_KINDS: readonly ["board", "wiki", "memory-curation", "temporal", "self-check"];
-export type WorkOrderKind = (typeof WORKORDER_KINDS)[number];
-/**
- * Ledger-managed payload key holding the delegation timestamp. Like `attempts`, it is never
- * valid publisher input (validateWorkOrderPayload rejects unknown fields at enqueue) and it
- * is stripped from a requeued replacement, which has delegated nothing.
- */
-export declare const WORKORDER_DELEGATED_AT_KEY = "delegated_at";
-/**
- * Publisher-shaped view of a STORED workorder payload.
- *
- * Stored rows carry ledger-managed keys (`attempts`, `delegated_at`) that the enqueue
- * validator rejects by design. Revalidating a stored row must therefore check only what a
- * publisher could have supplied; validating the raw stored payload turned a
- * delegated-and-verified board attempt into a permanently "unresolved" receipt state
- * (live, 2026-09-09, workorder #4765). Enqueue input is still rejected loudly.
- */
-export declare function publisherPayloadOfStoredWorkOrder(payload: Record<string, unknown>): Record<string, unknown>;
-export declare const TEMPORAL_WORKORDER_MAX_ATTEMPTS = 3;
-/** source_channel namespace for workorder rows: 'workorder:<workKind>'. */
-export declare const WORKORDER_CHANNEL_PREFIX = "workorder:";
-export interface EnqueueWorkOrderInput {
-    workKind: WorkOrderKind;
-    /** Per-occurrence idempotency key (schedule slot / event batch / manual ts). */
-    idempotencyKey: string;
-    /** Kind-specific payload; `attempts` is managed by the ledger (starts at 1). */
-    input: Record<string, unknown>;
-    priority?: TaskPriority;
-}
-export interface EnqueueTemporalGenerationInput {
-    generationKey: string;
-    taskId: number;
-    temporalEpoch: number;
-    occurrenceKey: string;
-    checkAt: number;
-    sourceChannel: string | null;
-    sourceEventId: string | null;
-    priority?: TaskPriority;
-}
-export interface WorkOrderRecord {
-    id: number;
-    workKind: WorkOrderKind;
-    status: TaskStatus;
-    priority: TaskPriority;
-    idempotencyKey: string;
-    /** Parsed payload; always carries `attempts` (>= 1). */
-    payload: Record<string, unknown> & {
-        attempts: number;
-    };
-    /**
-     * When this attempt handed its remaining work to a native subagent, or null.
-     *
-     * `delegated` is a WORK-ORDER state, not a task status: the row stays `in_progress`
-     * (it IS still claimed and open) and this timestamp is what distinguishes an attempt
-     * waiting on a child from one still inside its own run. It deliberately does not enter
-     * the shared `status` CHECK, which owner tasks share - a new owner-visible status would
-     * ripple through every board projection to record something only the work-order consumer
-     * can act on.
-     */
-    delegatedAt: number | null;
-    createdAt: number;
-    updatedAt: number;
-}
-/** Extended record: satisfies OperatorTask (numeric deadline) and carries the ISO original. */
-export interface TaskRecord extends OperatorTask {
-    status: TaskStatus;
-    priority: TaskPriority;
-    kind: TaskKind;
-    /** ISO YYYY-MM-DD as stored; `deadline` (OperatorTask) is its UTC-midnight epoch ms. */
-    deadlineIso: string | null;
-    assignee: string | null;
-    sourceChannel: string | null;
-    sourceEventId: string | null;
-    latestEvent: string | null;
-    autoCreated: boolean;
-    confirmed: boolean;
-    dueAt: number | null;
-    deadlineOffsetMinutes: number | null;
-    revision: number;
-    temporalEpoch: number;
-    temporalReconciledOccurrenceKey: string | null;
-    lastTemporalCheckedAt: number | null;
-    nextTemporalCheckAt: number | null;
-    lastTemporalAttemptId: number | null;
-    temporalState: TemporalState;
-    reviewStartedAt: number | null;
-    reviewAnchorEventId: string | null;
-    reviewAnchorSourceChannel?: string | null;
-    /**
-     * The concrete, finite condition under which this row is finished. What makes a
-     * row a TASK rather than a record; null on rows that predate the policy and on
-     * internal/system seeding.
-     */
-    completionCriteria: string | null;
-    /** Semantic terminal reason, set by task_reclassify; null while open. */
-    resolutionKind: TaskResolutionKind | null;
-}
-/**
- * Why a row reached its terminal state. Without this the agent cannot tell
- * completed work from an item that was never a task, which is how connector
- * observations, principles and open questions accumulated as owner rows.
- */
-export declare const TASK_RESOLUTION_KINDS: readonly ["completed_evidence", "completed_no_issue", "non_task_record", "non_task_memory"];
-export type TaskResolutionKind = (typeof TASK_RESOLUTION_KINDS)[number];
-/** The recorrection an agent may apply to an existing owner row. */
-export declare const TASK_RECLASSIFY_DISPOSITIONS: readonly ["completed_evidence", "completed_no_issue", "non_task_record", "non_task_memory", "reopen"];
-export type TaskReclassifyDisposition = (typeof TASK_RECLASSIFY_DISPOSITIONS)[number];
-/** Upper bound on the preserved reason, matching latest_event's practical size. */
-export declare const TASK_RECLASSIFY_REASON_MAX_LENGTH = 2000;
-export declare const TASK_COMPLETION_CRITERIA_MAX_LENGTH = 500;
-export interface ReclassifyTaskInput {
-    disposition: TaskReclassifyDisposition;
-    /** Non-empty, bounded; preserved as the row's latest_event. */
-    reason: string;
-    /** Always required: a reclassification is a lifecycle judgment. */
-    expected_revision: number;
-}
-export interface TaskLedgerOptions {
-    now?: () => number;
-    timeZone?: string;
-    onOwnerTaskChangeCommitted?: (generation: string) => void;
-}
-/**
- * Who is making a change, supplied by the host rather than by the caller's arguments.
- *
- * Kept out of CreateTaskInput/UpdateTaskInput on purpose: those are agent-authored, and an
- * agent that can write its own run id into the effect ledger can attribute its work to
- * someone else's run. Same reason the temporal path takes its identity from trusted runtime
- * context instead of from the tool call.
- */
-export interface ChangeOrigin {
-    /** The model run behind this write, or null when the host itself made it. */
-    runId?: string | null;
-    /**
-     * Host-issued work-order attempt (any kind). This is deliberately separate
-     * from agent-authored update input: it lets the ledger verify that a carried
-     * attempt is still current for direct and nested gateway execution alike, and
-     * keeps receipted external binding/lifecycle decisions candidate-scoped. A
-     * scheduler's reclassificationCandidates page is a bounded-read SELECTION
-     * hint, not the owner's authorization: an ordinary owner decision on a row
-     * discovered outside that page is still the owner's decision.
-     */
-    workOrderAttemptId?: number;
-    /** Direct task_update ABI guard; internal receipted lifecycle primitives validate separately. */
-    requiresExpectedRevision?: boolean;
-    /**
-     * WHY an id-less change happened (S2 closed set). Ignored when
-     * causeEventIds carry - ids always mean 'event'. Callers state it;
-     * the ledger's only fallback is 'owner_message' (the human-adjacent
-     * bucket - a wrong 'clock' fabricates a schedule that never fired).
-     */
-    causeKind?: import('../evidence/effects.js').UnattributedCauseKind;
-    /**
-     * The events this write responds to.
-     *
-     * A SET, because a cause is one: a reconcile run is handed a channel's delta batch and
-     * everything it changes rests on that batch. The system knows the batch before the run
-     * starts, so it does not have to ask the agent to restate it - which is what a single
-     * agent-supplied id was, and why 375 of 381 unattributed changes were updates.
-     */
-    causeEventIds?: readonly string[];
-    /**
-     * Owner-event task reclassification must rest on real causal events: every
-     * id in causeEventIds has to be carried by a durable owner-event inbox batch,
-     * so the effect receipt's provenance is host-attested rather than invented
-     * from connector text. Which channel the batch arrived on is host selection
-     * context, not the owner's authorization; visibility of the target row is the
-     * authenticated gateway's boundary.
-     */
-    reclassificationCauseBound?: boolean;
-    /** Internal marker: a duplicate-source task_create is using update semantics. */
-    taskCreateUpsert?: boolean;
-    /** Host-verified raw submission/delivery evidence. Never populated from model timestamps. */
-    verifiedReviewEvidence?: {
-        contextPacketId: string;
-        contextPacketSha256: string;
-        eventIndexId: string;
-        sourceTimestampMs: number;
-        sourceChannel: string;
-    };
-}
-export interface ExternalTaskBinding {
-    id: number;
-    revision: number;
-    taskId: number;
-    connector: 'kagemusha';
-    sourceType: 'kanban_card';
-    externalSourceId: string;
-    lastObservationSeq: number;
-    /** Board attempt that bound it, or null when a verified owner run did. */
-    createdByAttemptId: number | null;
-    createdByRunId: string | null;
-    createdByOwnerScope: string | null;
-    createdAt: number;
-}
-export interface ExternalBindingReceipt {
-    kind: 'binding';
-    candidateId: string;
-    /** Null when the decision was settled by a verified owner run (Task B2). */
-    workOrderAttemptId: number | null;
-    originRunId: string | null;
-    originOwnerScope: string | null;
-    taskId: number;
-    outcome: 'bound' | 'declined' | 'superseded';
-    reason: string;
-    bindingId?: number;
-}
-export interface ExternalLifecycleReceipt {
-    kind: 'lifecycle';
-    candidateId: string;
-    /** Null when the decision was settled by a verified owner run (Task B2). */
-    workOrderAttemptId: number | null;
-    originRunId: string | null;
-    originOwnerScope: string | null;
-    taskId: number;
-    outcome: 'applied' | 'retained' | 'superseded';
-    reason: string;
-    taskRevisionBefore: number;
-    taskRevisionAfter: number;
-}
-export type TemporalGenerationDisposition = 'active' | 'resolved' | 'final_no_update' | 'deferred' | 'exhausted' | 'superseded';
-export interface TemporalGenerationRecord {
-    generationKey: string;
-    taskId: number;
-    temporalEpoch: number;
-    occurrenceKey: string;
-    checkAt: number;
-    disposition: TemporalGenerationDisposition;
-    lastWorkOrderId: number | null;
-    reason: string | null;
-    createdAt: number;
-    updatedAt: number;
-}
-export type { TemporalWorkContext } from './temporal-effect.js';
-export interface TemporalGenerationEnqueueResult {
-    generation: TemporalGenerationRecord;
-    workOrder: WorkOrderRecord;
-    created: boolean;
-}
-/** Authoritative terminal-arbitration view for one temporal attempt. */
-export interface TemporalAttemptState {
-    workOrder: WorkOrderRecord;
-    generation: TemporalGenerationRecord;
-    receipt: TemporalEffectReceipt | null;
-}
-export type TemporalWorkFailureResult = {
-    disposition: 'requeued';
-    replacement: WorkOrderRecord;
-    attempt: number;
-    maxAttempts: number;
-} | {
-    disposition: 'exhausted';
-    attempt: number;
-    maxAttempts: number;
-    retrySuppressed?: boolean;
-} | {
-    disposition: 'superseded';
-    attempt: number;
-    maxAttempts: number;
-};
-/** Durable receipt view for one candidate-bearing board attempt. */
-export type BoardCandidateAttemptState = {
-    disposition: 'none';
-} | {
-    disposition: 'complete';
-    outcomes: readonly string[];
-} | {
-    disposition: 'partial';
-    missingCandidateIds: readonly string[];
-} | {
-    disposition: 'zero';
-};
-export interface CreateTaskInput {
-    title: string;
-    status?: TaskStatus;
-    priority?: TaskPriority;
-    assignee?: string;
-    /** ISO YYYY-MM-DD */
-    deadline?: string;
-    /** RFC 3339 with an explicit Z or numeric offset. */
-    due_at?: string;
-    /** channelKey: "<connector>:<channelId>" */
-    source_channel?: string;
-    /** Idempotency key from the connector event; duplicate (channel, event) UPSERTS. */
-    source_event_id?: string;
-    latest_event?: string;
-    confirmed?: boolean;
-    /** Required only when a Board workorder uses a duplicate source key as an update. */
-    expected_revision?: number;
-    /**
-     * The concrete, finite condition under which this row is finished. The PUBLIC
-     * task_create boundary requires it (gateway-tool-executor); the ledger keeps it
-     * optional so internal/system seeding stays backward compatible.
-     */
-    completion_criteria?: string;
-}
-export interface UpdateTaskInput {
-    status?: TaskStatus;
-    priority?: TaskPriority;
-    assignee?: string | null;
-    deadline?: string | null;
-    /** RFC 3339 with an explicit Z or numeric offset. */
-    due_at?: string | null;
-    latest_event?: string;
-    confirmed?: boolean;
-    title?: string;
-    expected_revision?: number;
-    /** Concrete finite exit condition; lets legacy rows become qualified tasks. */
-    completion_criteria?: string | null;
-    /**
-     * HOST-INTERNAL: written only by reclassify(). The public task_update surface
-     * rejects it (TASK_UPDATE_PUBLIC_FIELDS), so an agent cannot stamp a semantic
-     * terminal reason without going through the reclassification rules.
-     */
-    resolution_kind?: TaskResolutionKind | null;
-}
-export interface ListTasksFilter {
-    status?: TaskStatus;
-    /** False narrows the result to active owner work; explicit status still wins. */
-    includeTerminal?: boolean;
-    channel?: string;
-    search?: string;
-    /** Exact assignee match (progressive overview/items filter). */
-    assignee?: string;
-    /** Exact priority match (progressive overview/items filter). */
-    priority?: TaskPriority;
-    /** Derived temporal partition. date_due belongs to upcoming. */
-    dueBucket?: DueBucket;
-    /** Internal snapshot instant used to keep derived membership stable across cursor pages. */
-    temporalAsOfMs?: number;
-    /** Exact due_at strictly before this epoch ms. Date-only-deadline rows (no due_at)
-     *  are NOT matched: an exact-time filter never invents a clock for a date-only row. */
-    dueBeforeMs?: number;
-    /** Exact due_at at or after this epoch ms. Same date-only exclusion as dueBeforeMs. */
-    dueAfterMs?: number;
-    /** updated_at at or after this epoch ms. */
-    updatedSinceMs?: number;
-    /** updated_at strictly before this epoch ms. */
-    updatedBeforeMs?: number;
-    /** Progressive migration filter for rows created before completion criteria existed. */
-    qualification?: 'qualified' | 'legacy_unqualified';
-    limit?: number;
-    /** 'deadline_priority' = deadline asc NULLS LAST, then high>normal>low, then id. */
-    order?: 'deadline_priority' | 'updated';
-}
-export interface ListTasksPageFilter extends ListTasksFilter {
-    /** Opaque keyset cursor from a previous page's nextCursor. */
-    cursor?: string;
-}
-/**
- * One page plus the numbers a caller needs to PROVE it read everything.
- *
- * `list()` alone cannot support a whole-situation claim: it clamps to 200 and
- * defaults to 50, so a caller reading a 150-row board saw a third of it and could
- * not tell. Accumulating pages until nextCursor is null, with the unique ids
- * collected equal to total, is that proof.
- */
-export interface ListTasksPage {
-    tasks: TaskRecord[];
-    /** Rows matching the filter, ignoring limit and cursor. */
-    total: number;
-    returned: number;
-    /** Cursor for the next page, or null when this page ends the set. */
-    nextCursor: string | null;
-}
-/**
- * Aggregate counts over the SAME owner predicate a page would return, plus the
- * due buckets derived from the identical temporal classification `items` uses,
- * under one captured `now`. Every facet partitions `total`, so a caller can add
- * up any facet and check it against the number it drew the page from.
- */
-export interface OverviewResult {
-    total: number;
-    /** Snapshot instant (ms) captured once for every bucket in this result. */
-    observedAt: number;
-    /** Conservative change signature; a cursor pinned to it is rejected after any owner write. */
-    readVersion: string;
-    status: Record<string, number>;
-    priority: Record<string, number>;
-    /** An unassigned source_channel is reported as a real null `channel`, not the string "null". */
-    channels: Array<{
-        channel: string | null;
-        count: number;
-    }>;
-    /** null assignee (unassigned) is reported with assignee: null. */
-    assignees: Array<{
-        assignee: string | null;
-        count: number;
-    }>;
-    /**
-     * Partition of `total` by temporal disposition under `observedAt`:
-     * missing = no due_at and no deadline; overdue/upcoming from the same
-     * deriveTemporalState `items` uses (date_due counts as upcoming); closed =
-     * done/cancelled. The four sum to `total`.
-     */
-    due: {
-        missing: number;
-        overdue: number;
-        upcoming: number;
-        closed: number;
-    };
-}
-export declare class TaskLedger implements TaskSource {
-    private db;
-    private now;
-    private timeZone;
-    private onOwnerTaskChangeCommitted?;
-    private pendingOwnerTaskGeneration;
-    private ownerTaskNotificationScheduled;
-    constructor(db: SQLiteDatabase, options?: TaskLedgerOptions);
-    private toRecord;
-    private toRecordAt;
-    temporalStateAt(task: TaskRecord, observedAt: number): TemporalState;
-    private runMigration;
-    /** Full current column set - single source for CREATE and the rebuild copy. */
-    private static readonly TABLE_COLUMNS_SQL;
-    private static readonly INDEXES_SQL;
-    /**
-     * Stage-2 in-place upgrade for pre-existing tables. Guards are re-checked
-     * INSIDE `BEGIN IMMEDIATE`: two connections construct TaskLedger (boot +
-     * lazy API handler) and both run this - the loser must see the winner's
-     * finished work, not rebuild an already-migrated table.
-     */
-    private upgradeSchema;
-    /** TaskSource conformance: open items in canonical board order. */
-    getTasks(): OperatorTask[];
-    countOpenUnconfirmed(): number;
-    list(filter?: ListTasksFilter): TaskRecord[];
-    private temporalAsOf;
-    /** Shared filter predicate. Owner surface only - system workorder rows never appear in
-     *  board/REST/gateway listings (Stage-2 kind filter; workorders have dedicated readers). */
-    private buildListPredicate;
-    /** ORDER BY for both list() and listPage(); the trailing id makes it a TOTAL order,
-     *  which is what lets a keyset cursor resume without skipping or repeating a row.
-     *  LIMIT applies AFTER ordering, so a bounded read still returns the true top-N. */
-    private static orderSql;
-    private static cursorFor;
-    /**
-     * One page of the same ordered set, with the totals that make completeness provable.
-     *
-     * Keyset, not OFFSET: an offset page silently skips or repeats rows when the set
-     * changes between pages, which would leave a "whole situation" claim resting on a
-     * read that quietly lost items.
-     */
-    listPage(filter?: ListTasksPageFilter): ListTasksPage;
-    /**
-     * One `listPage`, with the read generation and observation instant captured
-     * in the SAME synchronous call so total/rows/version cannot straddle a write
-     * from this process. The progressive `items` view pins its cursor to this
-     * readVersion and restarts if a later page observes a different one.
-     */
-    itemsPage(filter?: ListTasksPageFilter): ListTasksPage & {
-        readVersion: string;
-        observedAt: number;
-    };
-    /** The ledger's clock (injected in tests); progressive views stamp observedAt with it. */
-    nowMs(): number;
-    /**
-     * Run a read-only body inside a single DEFERRED transaction so every statement
-     * shares one snapshot. better-sqlite3 nests via SAVEPOINT, so this is safe even
-     * if a caller is already inside a transaction.
-     */
-    private readSnapshot;
-    /**
-     * A conservative change signature for the whole owner board, derived from
-     * existing columns - no snapshot table. COUNT catches inserts/deletes,
-     * SUM(revision) catches every owner update (each bumps revision), MAX(id)
-     * catches inserts, MAX(updated_at) is a coarse tie-breaker. It is NOT an
-     * immutable snapshot id: it only lets a paged read reject its own cursor once
-     * ANY owner row has changed, so a "whole board" claim never spans a write.
-     * System workorder churn is deliberately excluded (kind='owner').
-     */
-    readGeneration(): string;
-    private notifyOwnerTaskCommit;
-    private flushOwnerTaskNotification;
-    /**
-     * Aggregate counts over the same owner predicate `listPage` filters by. Facets
-     * come from SQL GROUP BY (each partitions total); due buckets are computed in
-     * one JS pass over minimal rows using the SAME deriveTemporalState `items`
-     * uses, so an overview bucket and an item's temporal_state never disagree.
-     * readGeneration is captured in the same synchronous call as the counts.
-     */
-    overview(filter?: ListTasksFilter): OverviewResult;
-    private overviewInSnapshot;
-    /** Internal bounded page for temporal reconciliation; excludes rows that can never be candidates. */
-    listTemporalScanPage(input: {
-        limit: number;
-        afterId: number;
-    }): TaskRecord[];
-    /** Owner rows only - system workorder rows are invisible to external reads. */
-    getById(id: number): TaskRecord | null;
-    /** Internal fetch without the kind filter (guards and workorder paths). */
-    private getRowById;
-    /** Returns one active, explicitly receipted external identity for an owner task. */
-    getExternalBinding(taskId: number): ExternalTaskBinding | null;
-    /**
-     * Host-only lookup material for immutable external-lifecycle candidates.
-     * The caller supplies exact event/source ids obtained from the connector index;
-     * no connector prose is read through this ledger surface.
-     */
-    getExternalLifecycleCandidateSupport(eventIds: readonly string[], externalSourceIds: readonly string[]): {
-        taskHints: TaskHintLookup;
-        tasksById: ReadonlyMap<number, CandidateTaskSnapshot>;
-        bindings: readonly ExistingExternalBindingSnapshot[];
-    };
-    getReceiptedExternalCandidateIds(candidateIds: readonly string[]): ReadonlySet<string>;
-    /**
-     * Recover a candidate only from the payload of the exact currently claimed
-     * board attempt. Revalidate the serialized payload: database bytes are not
-     * a capability merely because they originated in a previous host process.
-     */
-    loadBoardCandidate(attemptId: number, candidateId: string, kind: 'binding' | 'lifecycle'): BindingCandidate | LifecycleCandidate;
-    /**
-     * Read the complete, immutable candidate set for a board attempt against
-     * its durable decision receipts. This deliberately works for stale claims
-     * as well as live in-progress attempts: recovery must never infer effects
-     * from a runner result when the database can answer exactly.
-     */
-    inspectBoardCandidateAttempt(attemptId: number): BoardCandidateAttemptState;
-    /**
-     * Resolve one candidate decision's authority (Task B2).
-     *
-     * A plain attempt id is the legacy Board wrapper. A discriminated source is
-     * either that same Board path or a verified owner run whose host-attested
-     * snapshot must match the caller's scope, run and envelope exactly. Both
-     * return the SAME decision inputs; the receipt records which one settled it.
-     */
-    private resolveExternalCandidateAuthority;
-    /** Same contract as loadBoardCandidate, for either authority source. */
-    loadExternalCandidate(source: number | ExternalCandidateSource, candidateId: string, kind: 'binding' | 'lifecycle'): BindingCandidate | LifecycleCandidate;
-    /**
-     * Persist host-built candidate snapshots under a verified owner run.
-     *
-     * Every snapshot is re-validated as host-built (exact shape, Kagemusha
-     * mapping, fixed evidence summary, content-derived id) before it is stored;
-     * model-authored bytes never enter this table. Rows are immutable. The same
-     * run attesting the same candidate again with identical bytes is a no-op;
-     * different bytes under the same id are a conflict, not a second row.
-     */
-    attestOwnerActionCandidates(context: OwnerActionContext, candidates: Pick<ExternalLifecycleCandidateSet, 'bindingCandidates' | 'lifecycleCandidates'>): {
-        attested: number;
-        alreadyAttested: number;
-    };
-    /** Bounded, intent-free listing of what one owner run attested. */
-    listOwnerActionCandidates(context: OwnerActionContext): OwnerAttestedCandidateSummary[];
-    /**
-     * Receipt view of one owner run's attested candidates, in the same shape as
-     * inspectBoardCandidateAttempt so recovery can treat both sources alike.
-     */
-    inspectOwnerActionCandidateRun(context: OwnerActionContext): BoardCandidateAttemptState;
-    loadOwnerActionCandidate(context: OwnerActionContext, candidateId: string, kind: 'binding' | 'lifecycle'): BindingCandidate | LifecycleCandidate;
-    /**
-     * Recover a candidate only from the attestation the exact owner run made.
-     * Stored bytes are revalidated: sha256 over the canonical JSON, exact shape,
-     * and the content-derived candidate id must all still agree.
-     */
-    private loadOwnerAttestedCandidate;
-    private candidateReceiptDisposition;
-    applyExternalBindingDecision(source: number | ExternalCandidateSource, input: {
-        candidate_id: string;
-        decision: 'bind' | 'decline';
-        reason: string;
-        expected_revision: number;
-    }, origin: ChangeOrigin): ExternalBindingReceipt;
-    applyExternalLifecycleDecision(source: number | ExternalCandidateSource, input: {
-        candidate_id: string;
-        decision: 'apply' | 'retain';
-        reason: string;
-        expected_revision: number;
-    }, origin: ChangeOrigin): ExternalLifecycleReceipt;
-    getExternalCandidateReceipt(candidateId: string): ExternalBindingReceipt | ExternalLifecycleReceipt | null;
-    private externalBindingFromRow;
-    private assertBindingReplayMatches;
-    private insertBindingReceipt;
-    private assertLifecycleReplayMatches;
-    private insertLifecycleReceipt;
-    /**
-     * Create a task. Idempotent under at-least-once delivery: a duplicate
-     * (source_channel, source_event_id) UPSERTS - the existing row gets the new
-     * latest_event (and title stays) instead of a near-duplicate row appearing.
-     */
-    create(input: CreateTaskInput, origin?: ChangeOrigin): TaskRecord;
-    /**
-     * Write the effect row for a task change.
-     *
-     * Called from inside the same transaction as the write it describes. The cause is the
-     * event the caller already recorded on the row - the tool has always accepted it, and
-     * 178 of the 179 owner tasks that carry one resolve to a real indexed event, so this is
-     * attribution that already exists rather than a new burden on the agent.
-     *
-     * When there is no cause the change is still recorded, marked unattributed. That is the
-     * honest reading of `task_update`, which has never had a cause field at all: the system
-     * has been changing owner work items without recording why, and the ledger's job is to
-     * show how often, not to pretend otherwise or to start refusing writes.
-     */
-    private recordTaskChange;
-    update(id: number, patch: UpdateTaskInput, origin?: ChangeOrigin): TaskRecord;
-    /**
-     * Recorrect an existing owner row with a NAMED disposition.
-     *
-     * Records and tasks are separate. Without a semantic terminal reason the agent
-     * could not distinguish completed work from an item that was never a task, so
-     * connector observations, principles, lessons and open questions accumulated as
-     * owner rows and could only be "closed" as if they had been done.
-     *
-     * Every path requires the exact current revision, a non-empty bounded reason
-     * preserved as `latest_event`, an OWNER row, and the same workorder-attempt
-     * currency and causal-provenance checks as task_update (TG-03/TG-04/TG-06) -
-     * a terminal attempt of any kind cannot mutate a row, and an owner-event
-     * decision cannot rest on a fabricated cause. Scheduler hint pages and the
-     * causal batch's channel select what the host READS; they do not narrow the
-     * authenticated owner's decisions. The whole transition, its
-     * `resolution_kind` and its effect receipt commit as ONE transaction.
-     */
-    reclassify(id: number, input: ReclassifyTaskInput, origin?: ChangeOrigin): TaskRecord;
-    private assertTaskReclassificationAuthorized;
-    /**
-     * A retained attempt context outlives its workorder: a late direct or nested
-     * tool call can still carry it after the row reached a terminal status. Any
-     * lifecycle judgment made under a carried attempt requires that attempt to be
-     * the claimed, in-progress one, whatever its work kind.
-     */
-    private assertWorkOrderAttemptActive;
-    private findCausalEventsWithoutInboxBatch;
-    private buildReclassifyPatch;
-    /** True when the row carries a deadline/due_at that has already passed. */
-    private isDeadlineInThePast;
-    /**
-     * The one mutation primitive for owner-task state. Callers own the outer
-     * transaction so lifecycle receipts, effects, generation ownership, and the
-     * row revision can commit or roll back as one unit.
-     */
-    private transitionTaskInTransaction;
-    private validateTaskUpdatePatch;
-    private transitionOwnerTaskRowInTransaction;
-    private assertCandidateTaskMutationAllowed;
-    private supersedeTemporalGenerationsInTransaction;
-    private supersedeAllActiveTemporalGenerationsInTransaction;
-    /**
-     * Stable hash over ordered OWNER rows - the Phase-2 verifier's ledger
-     * snapshot. kind filter keeps concurrent system enqueues from shaking the
-     * hash mid-bracket (evidence-only signal, but noise is noise).
-     */
-    payloadHash(): string;
-    /**
-     * Enqueue a workorder. Idempotent per occurrence key: an open (pending or
-     * in_progress) keyed row dedups. Completed owner-event occurrences and
-     * scheduled promotion slots also dedup; other terminal rows free the key
-     * and a fresh row is inserted.
-     */
-    enqueueWorkOrder(order: EnqueueWorkOrderInput): WorkOrderRecord;
-    /** Read a durable workorder acceptance by its host-issued occurrence key. */
-    findWorkOrderByOccurrence(workKind: Exclude<WorkOrderKind, 'temporal'>, idempotencyKey: string): WorkOrderRecord | null;
-    /**
-     * The newest COMPLETED full-board-class run - the baseline the scheduled full-board producer
-     * gates against (board-delta-gate.ts). A `delta` run counts too: it publishes the same three
-     * judgment slots from the same accumulated state, so excluding it would leave the previous
-     * full run as the baseline forever and re-trigger a delta on every tick.
-     *
-     * Only `status='done'` full/delta rows count: an open or failed run has not
-     * discharged its interval. `watermark` is null when the run captured none
-     * (an owner-forced refresh), which makes the next scheduled tick enqueue
-     * rather than skip.
-     */
-    lastCompletedBoardFullRun(): {
-        watermark: string | null;
-        createdAt: number;
-        completedAt: number;
-    } | null;
-    /**
-     * The newest COMPLETED wiki run - the baseline the wiki daily-continuity
-     * planner gates against (wiki-continuity.ts). Only `status='done'` rows count.
-     *
-     * `ownerDate`/`sourceWatermark` are read straight from the completed run's
-     * payload and are null for a LEGACY row (one enqueued before the continuity
-     * fields existed): the planner treats a null-field baseline as "no baseline"
-     * and re-runs from the owner day's start rather than fabricating a boundary.
-     */
-    lastCompletedWikiRun(): {
-        ownerDate: string | null;
-        sourceWatermark: string | null;
-        coveredThroughMs: number | null;
-        completedAt: number;
-    } | null;
-    /**
-     * Board-input term for the NATIVE owner task ledger - the pipeline slot's
-     * projection source. Reuses payloadHash(): it already digests exactly the
-     * owner-row fields the pipeline slot renders, so a status or assignee edit
-     * moves the term even within the same millisecond as the row's creation,
-     * which a MAX(updated_at) marker would miss. System workorder rows are
-     * excluded by that same query - they are pipeline plumbing, not board truth.
-     */
-    ownerTaskTerm(): string;
-    private insertWorkOrder;
-    enqueueTemporalGeneration(input: EnqueueTemporalGenerationInput): TemporalGenerationEnqueueResult;
-    getTemporalGeneration(generationKey: string): TemporalGenerationRecord | null;
-    loadTemporalWorkContext(attemptId: number): TemporalWorkContext;
-    assertTemporalWorkContextActive(suppliedContext: TemporalWorkContext): TemporalWorkContext;
-    /**
-     * What this system changed, and what it changed it for.
-     *
-     * Reads live beside the writes because the effect ledger shares the tasks database on
-     * purpose. Exposed here rather than by handing out the connection: the ledger owns both
-     * halves, so a change and its account of itself cannot drift apart.
-     */
-    listChanges(query?: EffectQuery): EffectRecord[];
-    /** Owner rows created since `sinceMs` (the ledger stagnation probe's numerator). */
-    countOwnerTasksCreatedSince(sinceMs: number): number;
-    /** Receipt for a run the host stopped on its token budget; target is the run id. */
-    recordBudgetStop(input: {
-        modelRunId: string | null;
-        budgetTokens: number;
-        runTokenBudget: number;
-    }): void;
-    /** Receipt for a repair request filed by the self-check turn; target is the issue id. */
-    recordRepairRequest(input: {
-        issueId: string;
-        repairId: string;
-        runId: string | null;
-        causeEventIds: readonly string[] | undefined;
-    }): void;
-    /** Receipt for a deliverable file the owner can receive; target is the content hash. */
-    recordFileExport(input: {
-        sha256: string;
-        runId: string | null;
-        causeEventIds: readonly string[] | undefined;
-        channelId?: string | null;
-        payload: unknown;
-    }): void;
-    /**
-     * Receipt for a memory write made inside a bounded run. Without it a crash between
-     * mama_save and the batch ACK re-runs the batch and saves the decision twice; with it
-     * the crash-recovery resolver (effectsCausedBy) sees the write and ACKs without a run.
-     * Unattributed when the run had no cause: the count of those stays visible.
-     */
-    recordMemoryWrite(input: {
-        memoryRef: string;
-        runId: string | null;
-        causeEventIds: readonly string[] | undefined;
-        channelId?: string | null;
-        payload: unknown;
-    }): void;
-    /**
-     * Effect kinds this system recorded with ANY of the given events as cause.
-     * The owner-event crash-recovery receipt reads it: a ledger write that named
-     * the batch's events is a durable outcome even when the run died afterwards.
-     */
-    effectsCausedBy(eventIds: readonly string[], sinceMs?: number): string[];
-    /** Of what this system changed, how much rests on evidence. */
-    changeCoverage(sinceMs?: number, targetType?: EffectTarget): ChangeCoverage;
-    getTemporalEffect(attemptId: number): TemporalEffectReceipt | null;
-    /**
-     * Read and validate the durable state that decides a temporal attempt's
-     * terminal outcome. This intentionally does not require an active attempt:
-     * consumers must be able to arbitrate committed, superseded, and exhausted
-     * attempts after runner/auditor failures and daemon restarts.
-     */
-    inspectTemporalAttempt(attemptId: number): TemporalAttemptState;
-    applyTemporalEffect(suppliedContext: TemporalWorkContext, input: TemporalReconcileInput, evidence: TemporalEvidenceAttestation, now?: number): TemporalEffectReceipt;
-    requeueTemporalWorkOrder(attemptId: number, reason: string): WorkOrderRecord;
-    exhaustTemporalWorkOrder(attemptId: number, reason: string): void;
-    failTemporalWorkOrder(attemptId: number, reason: string, allowRetry?: boolean): TemporalWorkFailureResult;
-    private repairClosedTemporalOwnershipInTransaction;
-    /** Repair pre-fix databases where a terminal owner still has active temporal ownership. */
-    repairClosedTemporalGenerations(): number;
-    /** Control-plane pause: cancel open attempts but keep generations resumable. */
-    pauseActiveTemporalWork(reason: string): number;
-    /** Resume paused active generations without spending another model attempt. */
-    resumePausedTemporalWork(): WorkOrderRecord[];
-    private requeueTemporalWorkOrderInTransaction;
-    private exhaustTemporalWorkOrderInTransaction;
-    supersedeTemporalGenerations(taskId: number, currentEpoch: number, excludeGenerationKey?: string): void;
-    private validateTemporalGenerationInput;
-    /**
-     * Workorder payloads carry only bounded references to owner-source identifiers.
-     * Owner rows created by older releases may contain empty or arbitrarily long
-     * connector identifiers; hashing preserves exact identity without making one
-     * legacy row able to abort temporal boot or inflate every retry payload.
-     */
-    private temporalSourceIdentifierRef;
-    private validateTemporalEffectInput;
-    private assertTemporalContextMatches;
-    private loadTemporalWorkContextInternal;
-    private assertTemporalPayloadMatches;
-    private requirePayloadString;
-    private requireNullablePayloadString;
-    private requirePayloadInteger;
-    private assertTemporalReason;
-    private temporalAuditText;
-    /**
-     * Claim the next pending workorder: priority high>normal>low, then id ASC
-     * (plan D2/E2 - CASE mapping, never lexicographic on the TEXT enum).
-     * pending -> in_progress. Single serial consumer; transaction for atomicity.
-     */
-    claimNextWorkOrder(): WorkOrderRecord | null;
-    /**
-     * Atomic fail-and-requeue (PR bot round): the failure mark and the
-     * replacement row commit together - a crash between the two would lose
-     * the retry (the old row terminal, the new one never inserted). The
-     * replacement can only be inserted AFTER the old row leaves the partial
-     * unique index, hence one transaction, not two calls.
-     */
-    requeueWorkOrder(wo: WorkOrderRecord, reason: string): WorkOrderRecord;
-    /**
-     * Record that a claimed attempt is waiting on a native subagent.
-     *
-     * The status stays `in_progress`, which is the truth: the attempt is open and its
-     * idempotency slot is still held, so nothing re-enqueues the same occurrence underneath
-     * the child. Only the durable verification (or the consumer's timeout) moves it on.
-     */
-    markWorkOrderDelegated(id: number, delegatedAt: number): void;
-    completeWorkOrder(id: number): void;
-    failWorkOrder(id: number, reason: string): void;
-    countPendingWorkOrders(): number;
-    countOpenWorkOrders(kind?: WorkOrderKind): number;
-    findTemporalGenerationKeys(generationKeys: readonly string[]): Set<string>;
-    /** In-progress system rows at boot = crash artifacts (single serial consumer). */
-    listStaleClaims(): WorkOrderRecord[];
-    /**
-     * Boot cleanup (plan D3 + review N4): open system rows -> cancelled. A
-     * rollback is not a failure - excluded from failed counters/alarms; caller
-     * logs ONE summary line with the returned count. `onlyKinds` scopes the
-     * cancellation.
-     */
-    cancelOpenWorkOrders(reason: string, onlyKinds?: WorkOrderKind[]): number;
-    /** Per-kind last run and failure counts of the system lanes (operator UI and tests). */
-    workOrderStats(): Array<{
-        workKind: WorkOrderKind;
-        lastRunAt: number | null;
-        lastStatus: TaskStatus | null;
-        failedCount: number;
-        lastFailureReason: string | null;
-    }>;
-    getWorkOrderById(id: number): WorkOrderRecord | null;
-    private transitionWorkOrder;
-    private rowToWorkOrder;
-    /** contract_no_update: silence as a verifiable judgment, scoped to one reconcile run. */
-    recordNoUpdate(scope: string, reason: string): {
-        id: number;
-    };
-    private insertNoUpdateNote;
-    /** Max no-update note id, optionally scoped - the verifier's note snapshot. */
-    maxNoUpdateId(scope?: string): number;
-}
-//# sourceMappingURL=task-ledger.d.ts.map