@lucern/contracts 1.0.56 → 1.0.57

package/dist/manifests/operation-manifest.js

@@ -0,0 +1,306 @@
+import { z } from 'zod';
+
+// src/manifests/operation-manifest.ts
+var OPERATION_VERBS = [
+  // read plane
+  "get",
+  "list",
+  "search",
+  "traverse",
+  "compile",
+  "diff",
+  "replay",
+  // write plane
+  "create",
+  "refine",
+  "append",
+  "fork",
+  "transition",
+  "evaluate",
+  "graduate",
+  // governance plane
+  "declare",
+  "bind",
+  "grant"
+];
+var OPERATION_KINDS = [
+  "node",
+  "edge",
+  "container",
+  "slice",
+  "record",
+  "policy",
+  "unresolved"
+];
+var OPERATION_AXES = [
+  "scope",
+  "horizon",
+  "lens",
+  "policy",
+  "strategy",
+  "carrier"
+];
+var PROJECTION_CLASSES = [
+  "canonical_public",
+  "internal_backing",
+  "extension",
+  "compat",
+  "client_local"
+];
+var SURFACE_EXPOSURE = ["public", "internal", "absent"];
+var OPERATION_SOURCES = [
+  "registry",
+  "kernelApi",
+  "mcp_extension",
+  "cli_bespoke"
+];
+var operationRowSchema = z.object({
+  /** Canonical operation identity. Snake_case for graph operations; dotted
+   *  `domain.method` for kernelApi host bindings; `domain subcommand` for CLI
+   *  bespoke handlers. Unique across the manifest. */
+  name: z.string().min(1),
+  /** SC.2 verb. */
+  verb: z.enum(OPERATION_VERBS),
+  /** SC.2 target: the kind, and an optional type that narrows it. */
+  target: z.object({
+    kind: z.enum(OPERATION_KINDS),
+    type: z.string().min(1).optional()
+  }),
+  /** SC.2 axes this operation accepts. */
+  axes: z.array(z.enum(OPERATION_AXES)).readonly(),
+  /** Projection class (design doc): where in the surface taxonomy this row
+   *  lives. `internal_backing` is a class, not a second language. */
+  projection: z.object({
+    class: z.enum(PROJECTION_CLASSES),
+    /** Per-surface exposure. `kernelApi` is present so the shadow surface is
+     *  expressible; the four public surfaces mirror the registry map. */
+    surfaces: z.object({
+      sdk: z.enum(SURFACE_EXPOSURE),
+      rest: z.enum(SURFACE_EXPOSURE),
+      mcp: z.enum(SURFACE_EXPOSURE),
+      cli: z.enum(SURFACE_EXPOSURE),
+      host: z.enum(SURFACE_EXPOSURE),
+      kernelApi: z.enum(SURFACE_EXPOSURE)
+    }),
+    /** Compat rows carry an alias + exit-criteria doc pointer. */
+    compat: z.object({ aliasOf: z.string(), exitCriteria: z.string() }).optional()
+  }),
+  /** Where this row was expressed from (census population). */
+  source: z.enum(OPERATION_SOURCES),
+  /** Concrete source binding: the code location this row projects. For registry
+   *  rows, the registry entry name; for kernelApi rows, the `api.*` ref path and
+   *  its `components.lucern.*` component path; for extension/bespoke rows, the
+   *  wiring symbol / command path. */
+  binding: z.object({
+    /** The primary source identifier (registry name, api ref path, tool name,
+     *  or CLI command path). */
+    ref: z.string().min(1),
+    /** kernelApi component path (`components.lucern.*`) when source=kernelApi. */
+    componentPath: z.string().optional(),
+    /** For extension/bespoke rows that back a registry op, the registry op name
+     *  they are a projection of (so census facts about registry ops are
+     *  expressed on the row, not double-counted as phantom operations). */
+    backsRegistryOp: z.string().optional()
+  }),
+  /** Lifecycle status. `active` for served operations; `compat` for legacy
+   *  aliases awaiting deletion criteria. */
+  status: z.enum(["active", "compat"]),
+  /** M2-derivation pointers, named-but-null in M1 (see file header). */
+  derivation: z.object({
+    /** Arg/returns schema derived in M2. Null in M1. */
+    schema: z.null(),
+    /** Legality-matrix row derived in M2. Null in M1. */
+    legality: z.null(),
+    /** Receipt shape derived in M2. Null in M1. */
+    receipt: z.null()
+  }),
+  /** Human-readable provenance from the census/registry. */
+  rationale: z.string()
+});
+var operationManifestSchema = z.object({
+  schemaVersion: z.literal("operation_manifest.m1.v1"),
+  generatedAt: z.string(),
+  /** Census reconciliation block: the counts this manifest expresses, keyed by
+   *  the SC.1 disposition dimensions, so the derivability test can assert them
+   *  against the disposition doc and surface any point-in-time delta. */
+  census: z.object({
+    total: z.number(),
+    bySource: z.object({
+      registry: z.number(),
+      kernelApi: z.number(),
+      mcp_extension: z.number(),
+      cli_bespoke: z.number()
+    }),
+    byProjectionClass: z.object({
+      canonical_public: z.number(),
+      internal_backing: z.number(),
+      extension: z.number(),
+      compat: z.number(),
+      client_local: z.number()
+    }),
+    registryBySurfaceClass: z.record(z.string(), z.number())
+  }),
+  operations: z.array(operationRowSchema)
+});
+var SC1_CENSUS_TARGETS = {
+  /** 190 function-registry contracts (surface-manifest.json). Exact. */
+  registryContracts: 190,
+  /** Registry class split (161 canonical public + 25 internal + 4 compat). */
+  registryCanonicalPublic: 161,
+  registryPlatformInternal: 25,
+  registryLegacyCompat: 4,
+  /** kernelApi allowlist refs. Census recorded 124 post-#1651; the live
+   *  allowlist is the authority and the check tolerates a documented delta. */
+  kernelApiRefsCensus: 124,
+  /** MCP extension wirings the server hand-registers beyond the generated
+   *  build (census: 159 MCP tools − 144 generated = 15). Every extension tool
+   *  is *also* a registry contract, so these are expressed as projection facts
+   *  (mcp_extension source rows that `backsRegistryOp`), not new operations. */
+  mcpExtensions: 15,
+  /** CLI bespoke handlers (census: 19). Gateway-hitting bespoke verbs +
+   *  client-local tooling. Expressed as cli_bespoke rows; the gateway-hitting
+   *  subset backs a registry op or is a promotion candidate. */
+  cliBespoke: 19
+};
+var MCP_EXTENSION_WIRINGS = [
+  // bootstrap group (BOOTSTRAP_MCP_TOOLS)
+  "generate_session_handoff",
+  "begin_build_session",
+  // coordination group (COORDINATION_MCP_TOOLS) — the SC.1 session-runtime family
+  "register_session",
+  "heartbeat_session",
+  "end_session",
+  "list_active_sessions",
+  "send_agent_message",
+  "broadcast_message",
+  "get_agent_inbox",
+  "claim_files",
+  // epistemic-contract group (EPISTEMIC_CONTRACT_MCP_TOOLS)
+  "create_epistemic_contract",
+  "evaluate_contract",
+  "get_contract_status",
+  // MCP-only internal contract evaluators (manifest.ts MCP_ONLY_INTERNAL_OPERATION_NAMES)
+  "evaluate_engineering_contract",
+  "evaluate_research_contract"
+];
+var CLI_BESPOKE_HANDLERS = [
+  // gateway-hitting bespoke verbs (SC.1: the 5 promotion candidates + the
+  // reconciliation/capture verbs that also carry bespoke handlers)
+  {
+    command: "checkpoint",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: true
+  },
+  {
+    command: "evidence record-ci",
+    gatewayHitting: true,
+    backsRegistryOp: "create_evidence",
+    promotionCandidate: true
+  },
+  {
+    command: "dispatch record",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: true
+  },
+  {
+    command: "pivot record",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: true
+  },
+  {
+    command: "contradiction declare",
+    gatewayHitting: true,
+    backsRegistryOp: "flag_contradiction",
+    promotionCandidate: true
+  },
+  {
+    command: "campaign closeout",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "worktrees context",
+    gatewayHitting: true,
+    backsRegistryOp: "get_worktree",
+    promotionCandidate: false
+  },
+  {
+    command: "worktrees reconcile-gate",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "embeddings",
+    gatewayHitting: true,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  // client-local handlers (SC.1 §"Client-local ~10") — no server operation
+  {
+    command: "auth",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "profile",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "scope",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "doctor",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "completions",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "login",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "version",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "functions",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "replay",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  },
+  {
+    command: "local-workflow",
+    gatewayHitting: false,
+    backsRegistryOp: null,
+    promotionCandidate: false
+  }
+];
+
+export { CLI_BESPOKE_HANDLERS, MCP_EXTENSION_WIRINGS, OPERATION_AXES, OPERATION_KINDS, OPERATION_SOURCES, OPERATION_VERBS, PROJECTION_CLASSES, SC1_CENSUS_TARGETS, SURFACE_EXPOSURE, operationManifestSchema, operationRowSchema };

package/dist/proof-attestation.json

@@ -41,5 +41,5 @@
     "convex-validators",
     "proof-attestation"
   ],
-  "signedAt": 1782994689967
+  "signedAt": 1783073301464
 }

package/dist/schemas/index.js

@@ -2975,9 +2975,39 @@ var domainEvents = defineTable({
       name: "by_resource",
       columns: ["resourceType", "resourceId", "timestamp"]
     },
+    // OB.2: global chronological order for the Axiom forwarding scan. The
+    // forwarder pages events strictly by (timestamp, eventId) after its
+    // checkpoint cursor, so it needs a total time order independent of topic /
+    // type / tenant. The forwarder additionally tie-breaks on eventId in
+    // application code for events sharing a millisecond timestamp.
+    { kind: "index", name: "by_timestamp", columns: ["timestamp"] },
     { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
   ]
 });
+var domainEventForwardCheckpoints = defineTable({
+  name: "domainEventForwardCheckpoints",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    // Logical sink name. One checkpoint row per forwarding destination so a
+    // second sink (e.g. a future OTel path) never contends on this cursor.
+    sink: z.string(),
+    // Cursor: the timestamp of the last successfully forwarded event (ms epoch).
+    lastForwardedTimestamp: z.number(),
+    // Cursor tie-breaker: the eventId of the last successfully forwarded event.
+    lastForwardedEventId: z.string(),
+    // Running count of events forwarded through this sink (observability of the
+    // observer — lets an operator confirm the pump is moving without Axiom).
+    forwardedCount: z.number(),
+    // When this checkpoint row was last advanced (ms epoch).
+    updatedAt: z.number(),
+    // Last tick outcome, for at-a-glance health without querying Axiom.
+    lastStatus: z.enum(["ok", "empty", "export_failed"]).optional(),
+    // Redacted last-error summary when lastStatus is export_failed.
+    lastError: z.string().optional()
+  }),
+  indices: [{ kind: "index", name: "by_sink", columns: ["sink"] }]
+});
 var idempotencyTokens = defineTable({
   name: "idempotencyTokens",
   component: "kernel",
@@ -13505,6 +13535,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionRiskLedger,
   decisionSnapshots,
   domainEvents,
+  domainEventForwardCheckpoints,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,

package/dist/schemas/manifest.d.ts

@@ -205,6 +205,14 @@ export declare const KERNEL_TABLE_CONTRACTS: readonly [import("../dsl.js").Table
     data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
     correlationId: import("zod").ZodOptional<import("zod").ZodString>;
     expiresAt: import("zod").ZodNumber;
+}>, import("../dsl.js").TableContract<{
+    sink: import("zod").ZodString;
+    lastForwardedTimestamp: import("zod").ZodNumber;
+    lastForwardedEventId: import("zod").ZodString;
+    forwardedCount: import("zod").ZodNumber;
+    updatedAt: import("zod").ZodNumber;
+    lastStatus: import("zod").ZodOptional<import("zod").ZodEnum<["ok", "empty", "export_failed"]>>;
+    lastError: import("zod").ZodOptional<import("zod").ZodString>;
 }>, import("../dsl.js").TableContract<{
     sessionId: import("../dsl.js").ConvexIdSchema<"deliberationSessions">;
     topicId: import("zod").ZodOptional<import("zod").ZodString>;
@@ -5650,6 +5658,14 @@ export declare const TABLE_CONTRACTS_BY_COMPONENT: {
         data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
         correlationId: import("zod").ZodOptional<import("zod").ZodString>;
         expiresAt: import("zod").ZodNumber;
+    }>, import("../dsl.js").TableContract<{
+        sink: import("zod").ZodString;
+        lastForwardedTimestamp: import("zod").ZodNumber;
+        lastForwardedEventId: import("zod").ZodString;
+        forwardedCount: import("zod").ZodNumber;
+        updatedAt: import("zod").ZodNumber;
+        lastStatus: import("zod").ZodOptional<import("zod").ZodEnum<["ok", "empty", "export_failed"]>>;
+        lastError: import("zod").ZodOptional<import("zod").ZodString>;
     }>, import("../dsl.js").TableContract<{
         sessionId: import("../dsl.js").ConvexIdSchema<"deliberationSessions">;
         topicId: import("zod").ZodOptional<import("zod").ZodString>;
@@ -11096,6 +11112,14 @@ export declare const ALL_TABLE_CONTRACTS: readonly [import("../dsl.js").TableCon
     data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
     correlationId: import("zod").ZodOptional<import("zod").ZodString>;
     expiresAt: import("zod").ZodNumber;
+}>, import("../dsl.js").TableContract<{
+    sink: import("zod").ZodString;
+    lastForwardedTimestamp: import("zod").ZodNumber;
+    lastForwardedEventId: import("zod").ZodString;
+    forwardedCount: import("zod").ZodNumber;
+    updatedAt: import("zod").ZodNumber;
+    lastStatus: import("zod").ZodOptional<import("zod").ZodEnum<["ok", "empty", "export_failed"]>>;
+    lastError: import("zod").ZodOptional<import("zod").ZodString>;
 }>, import("../dsl.js").TableContract<{
     sessionId: import("../dsl.js").ConvexIdSchema<"deliberationSessions">;
     topicId: import("zod").ZodOptional<import("zod").ZodString>;
@@ -17678,6 +17702,14 @@ export declare function listTableContractsByName(name: string): (import("../dsl.
     data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
     correlationId: import("zod").ZodOptional<import("zod").ZodString>;
     expiresAt: import("zod").ZodNumber;
+}> | import("../dsl.js").TableContract<{
+    sink: import("zod").ZodString;
+    lastForwardedTimestamp: import("zod").ZodNumber;
+    lastForwardedEventId: import("zod").ZodString;
+    forwardedCount: import("zod").ZodNumber;
+    updatedAt: import("zod").ZodNumber;
+    lastStatus: import("zod").ZodOptional<import("zod").ZodEnum<["ok", "empty", "export_failed"]>>;
+    lastError: import("zod").ZodOptional<import("zod").ZodString>;
 }> | import("../dsl.js").TableContract<{
     tenantId: import("zod").ZodString;
     fnName: import("zod").ZodString;
@@ -23120,6 +23152,14 @@ export declare function getTableContract(name: string, component?: string): impo
     data: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
     correlationId: import("zod").ZodOptional<import("zod").ZodString>;
     expiresAt: import("zod").ZodNumber;
+}> | import("../dsl.js").TableContract<{
+    sink: import("zod").ZodString;
+    lastForwardedTimestamp: import("zod").ZodNumber;
+    lastForwardedEventId: import("zod").ZodString;
+    forwardedCount: import("zod").ZodNumber;
+    updatedAt: import("zod").ZodNumber;
+    lastStatus: import("zod").ZodOptional<import("zod").ZodEnum<["ok", "empty", "export_failed"]>>;
+    lastError: import("zod").ZodOptional<import("zod").ZodString>;
 }> | import("../dsl.js").TableContract<{
     tenantId: import("zod").ZodString;
     fnName: import("zod").ZodString;

package/dist/schemas/manifest.js

@@ -2842,9 +2842,39 @@ var domainEvents = defineTable({
       name: "by_resource",
       columns: ["resourceType", "resourceId", "timestamp"]
     },
+    // OB.2: global chronological order for the Axiom forwarding scan. The
+    // forwarder pages events strictly by (timestamp, eventId) after its
+    // checkpoint cursor, so it needs a total time order independent of topic /
+    // type / tenant. The forwarder additionally tie-breaks on eventId in
+    // application code for events sharing a millisecond timestamp.
+    { kind: "index", name: "by_timestamp", columns: ["timestamp"] },
     { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
   ]
 });
+var domainEventForwardCheckpoints = defineTable({
+  name: "domainEventForwardCheckpoints",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    // Logical sink name. One checkpoint row per forwarding destination so a
+    // second sink (e.g. a future OTel path) never contends on this cursor.
+    sink: z.string(),
+    // Cursor: the timestamp of the last successfully forwarded event (ms epoch).
+    lastForwardedTimestamp: z.number(),
+    // Cursor tie-breaker: the eventId of the last successfully forwarded event.
+    lastForwardedEventId: z.string(),
+    // Running count of events forwarded through this sink (observability of the
+    // observer — lets an operator confirm the pump is moving without Axiom).
+    forwardedCount: z.number(),
+    // When this checkpoint row was last advanced (ms epoch).
+    updatedAt: z.number(),
+    // Last tick outcome, for at-a-glance health without querying Axiom.
+    lastStatus: z.enum(["ok", "empty", "export_failed"]).optional(),
+    // Redacted last-error summary when lastStatus is export_failed.
+    lastError: z.string().optional()
+  }),
+  indices: [{ kind: "index", name: "by_sink", columns: ["sink"] }]
+});
 var idempotencyTokens = defineTable({
   name: "idempotencyTokens",
   component: "kernel",
@@ -13486,6 +13516,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionRiskLedger,
   decisionSnapshots,
   domainEvents,
+  domainEventForwardCheckpoints,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,

package/dist/schemas/tables/kernel/events.d.ts

@@ -22,3 +22,25 @@ export declare const domainEvents: import("../../../dsl.js").TableContract<{
     correlationId: z.ZodOptional<z.ZodString>;
     expiresAt: z.ZodNumber;
 }>;
+/**
+ * Axiom forwarding checkpoint — the OB.2 log-lake cursor.
+ *
+ * The scheduled `events:recordEvent` -> Axiom forwarder (OB.2) is cursor-based
+ * and idempotent: it persists, per sink, the `(timestamp, eventId)` of the last
+ * domain event it successfully forwarded. On each tick it reads events strictly
+ * after that cursor, forwards them through the transport-core Axiom exporter,
+ * and advances the checkpoint ONLY after a successful export. Forwarding is
+ * fail-open — an export failure leaves the checkpoint unadvanced so the same
+ * window is retried next tick, and it never touches the source `domainEvents`
+ * ledger. One row per `sink` (e.g. `axiom-events`); the row is upserted, never
+ * accreted, because it is operational cursor state, not epistemic state.
+ */
+export declare const domainEventForwardCheckpoints: import("../../../dsl.js").TableContract<{
+    sink: z.ZodString;
+    lastForwardedTimestamp: z.ZodNumber;
+    lastForwardedEventId: z.ZodString;
+    forwardedCount: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    lastStatus: z.ZodOptional<z.ZodEnum<["ok", "empty", "export_failed"]>>;
+    lastError: z.ZodOptional<z.ZodString>;
+}>;

package/dist/schemas/tables/kernel/events.js

@@ -50,8 +50,38 @@ var domainEvents = defineTable({
       name: "by_resource",
       columns: ["resourceType", "resourceId", "timestamp"]
     },
+    // OB.2: global chronological order for the Axiom forwarding scan. The
+    // forwarder pages events strictly by (timestamp, eventId) after its
+    // checkpoint cursor, so it needs a total time order independent of topic /
+    // type / tenant. The forwarder additionally tie-breaks on eventId in
+    // application code for events sharing a millisecond timestamp.
+    { kind: "index", name: "by_timestamp", columns: ["timestamp"] },
     { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
   ]
 });
+var domainEventForwardCheckpoints = defineTable({
+  name: "domainEventForwardCheckpoints",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    // Logical sink name. One checkpoint row per forwarding destination so a
+    // second sink (e.g. a future OTel path) never contends on this cursor.
+    sink: z.string(),
+    // Cursor: the timestamp of the last successfully forwarded event (ms epoch).
+    lastForwardedTimestamp: z.number(),
+    // Cursor tie-breaker: the eventId of the last successfully forwarded event.
+    lastForwardedEventId: z.string(),
+    // Running count of events forwarded through this sink (observability of the
+    // observer — lets an operator confirm the pump is moving without Axiom).
+    forwardedCount: z.number(),
+    // When this checkpoint row was last advanced (ms epoch).
+    updatedAt: z.number(),
+    // Last tick outcome, for at-a-glance health without querying Axiom.
+    lastStatus: z.enum(["ok", "empty", "export_failed"]).optional(),
+    // Redacted last-error summary when lastStatus is export_failed.
+    lastError: z.string().optional()
+  }),
+  indices: [{ kind: "index", name: "by_sink", columns: ["sink"] }]
+});
 
-export { domainEvents };
+export { domainEventForwardCheckpoints, domainEvents };

package/dist/schemas.values.js

@@ -2975,9 +2975,39 @@ var domainEvents = defineTable({
       name: "by_resource",
       columns: ["resourceType", "resourceId", "timestamp"]
     },
+    // OB.2: global chronological order for the Axiom forwarding scan. The
+    // forwarder pages events strictly by (timestamp, eventId) after its
+    // checkpoint cursor, so it needs a total time order independent of topic /
+    // type / tenant. The forwarder additionally tie-breaks on eventId in
+    // application code for events sharing a millisecond timestamp.
+    { kind: "index", name: "by_timestamp", columns: ["timestamp"] },
     { kind: "index", name: "by_expiresAt", columns: ["expiresAt"] }
   ]
 });
+var domainEventForwardCheckpoints = defineTable({
+  name: "domainEventForwardCheckpoints",
+  component: "kernel",
+  category: "events",
+  shape: z.object({
+    // Logical sink name. One checkpoint row per forwarding destination so a
+    // second sink (e.g. a future OTel path) never contends on this cursor.
+    sink: z.string(),
+    // Cursor: the timestamp of the last successfully forwarded event (ms epoch).
+    lastForwardedTimestamp: z.number(),
+    // Cursor tie-breaker: the eventId of the last successfully forwarded event.
+    lastForwardedEventId: z.string(),
+    // Running count of events forwarded through this sink (observability of the
+    // observer — lets an operator confirm the pump is moving without Axiom).
+    forwardedCount: z.number(),
+    // When this checkpoint row was last advanced (ms epoch).
+    updatedAt: z.number(),
+    // Last tick outcome, for at-a-glance health without querying Axiom.
+    lastStatus: z.enum(["ok", "empty", "export_failed"]).optional(),
+    // Redacted last-error summary when lastStatus is export_failed.
+    lastError: z.string().optional()
+  }),
+  indices: [{ kind: "index", name: "by_sink", columns: ["sink"] }]
+});
 var idempotencyTokens = defineTable({
   name: "idempotencyTokens",
   component: "kernel",
@@ -13505,6 +13535,7 @@ var KERNEL_TABLE_CONTRACTS = [
   decisionRiskLedger,
   decisionSnapshots,
   domainEvents,
+  domainEventForwardCheckpoints,
   deliberationContributions,
   deliberationSessions,
   stakeholderGroups,

package/dist/tenant-bootstrap-seed.contract.d.ts

@@ -181,6 +181,12 @@ export declare const TENANT_BOOTSTRAP_TABLE_REQUIREMENTS: readonly [{
     readonly prepopulation: "runtime_data";
     readonly copyMode: "none";
     readonly description: "Deliberation sessions are created by tenant workflows.";
+}, {
+    readonly component: "kernel";
+    readonly table: "domainEventForwardCheckpoints";
+    readonly prepopulation: "runtime_data";
+    readonly copyMode: "none";
+    readonly description: "Per-forwarder cursor checkpoints for domain-event log shipping; created at runtime by the log-lake forwarder.";
 }, {
     readonly component: "kernel";
     readonly table: "domainEvents";
@@ -815,6 +821,12 @@ export declare const TENANT_BOOTSTRAP_SEED_MANIFEST: {
         readonly prepopulation: "runtime_data";
         readonly copyMode: "none";
         readonly description: "Deliberation sessions are created by tenant workflows.";
+    }, {
+        readonly component: "kernel";
+        readonly table: "domainEventForwardCheckpoints";
+        readonly prepopulation: "runtime_data";
+        readonly copyMode: "none";
+        readonly description: "Per-forwarder cursor checkpoints for domain-event log shipping; created at runtime by the log-lake forwarder.";
     }, {
         readonly component: "kernel";
         readonly table: "domainEvents";

package/dist/tenant-bootstrap-seed.contract.js

@@ -186,6 +186,13 @@ var TENANT_BOOTSTRAP_TABLE_REQUIREMENTS = [
     copyMode: "none",
     description: "Deliberation sessions are created by tenant workflows."
   },
+  {
+    component: "kernel",
+    table: "domainEventForwardCheckpoints",
+    prepopulation: "runtime_data",
+    copyMode: "none",
+    description: "Per-forwarder cursor checkpoints for domain-event log shipping; created at runtime by the log-lake forwarder."
+  },
   {
     component: "kernel",
     table: "domainEvents",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucern/contracts",
-  "version": "1.0.56",
+  "version": "1.0.57",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",