@mindot/will 0.7.0 → 0.9.0

package/src/stem/policy/rule.table.ts

@@ -37,7 +37,7 @@ export interface ParamConstraint {
  *
  * `require` is meaningful with `decision: 'allow'` only: the scope matched, and
  * these constraints must hold for the allow to stand. A violation flips the
- * verdict to deny — carrying the counterfactual — with finality 'instance',
+ * verdict to deny — carrying the counterfactual — with finality 'parameter',
  * because the ability itself was permitted and only these arguments were not.
  *
  * A rule with `decision: 'deny'` and no `require` is a flat class-level ban;
@@ -94,7 +94,7 @@ export class RuleTableArbiter implements PolicyArbiter {
         return {
           decision:       'deny',
           reasonCode:     rule.reasonCode ?? violation.reasonCode,
-          finality:       rule.finality ?? 'instance',
+          finality:       rule.finality ?? 'parameter',
           counterfactual: violation.counterfactual,
         }
 

package/src/stem/tracts/effector.controller.ts

@@ -24,7 +24,8 @@
 import { logger } from '#core/logger'
 import { reconcileInvocation } from '#agency/reconcile.learning'
 import { NULL_ARBITER, isNullArbiter } from '#stem/policy/arbiter'
-import type { PolicyArbiter, PolicyInvocation, Verdict } from '#stem/policy/arbiter'
+import type { PolicyArbiter, PolicyInvocation, Verdict, DenialFinality, PolicyCounterfactual } from '#stem/policy/arbiter'
+import { finalityOf, asFinality } from '#stem/policy/arbiter'
 import {
   getVerdictRecorder, getVerdictSource, type PolicyVerdictRecord,
 } from '#stem/policy/verdict.recorder'
@@ -36,9 +37,38 @@ interface PendingRefusal {
   intentId:   string
   schema:     string
   reasonCode: string
-  finality:   string
+  finality:   DenialFinality
+  /** ENVELOPE_NARROWING P0 — what WOULD have been allowed, carried through to
+   *  the outcome the mind learns from. Absent on refusals that have no bound to
+   *  report (a flat ban, a fault, an unanswered escalation). */
+  counterfactual?: PolicyCounterfactual
 }
 
+/**
+ * The verdict a fault produces (POLICY_REAFFERENCE P5, conformance S9).
+ *
+ * An arbiter that throws or rejects has always failed CLOSED — the effect is
+ * withheld — but it used to withhold *silently*, queueing no refusal. The held
+ * intent then expired at the executor's AWAIT_TIMEOUT and reconciled as a plain
+ * failure, landing on COMPETENCE: a PDP outage taught the mind it was unskilled
+ * at something it is perfectly capable of. So a fault now yields a real verdict:
+ *
+ *   • 'deny'    — still fail-closed, unchanged. The effect never reaches the world.
+ *   • 'context' — but it teaches NOTHING. The arbiter being unreachable is not a
+ *                 fact about the ability, so nothing about the ability may move.
+ *
+ * It goes through `_recordAndApply` rather than straight to the refusal queue so
+ * the fault lands on the VERDICT TAPE too. That closes a replay hole: an
+ * unrecorded fault left the source with nothing to re-feed, and a source miss
+ * reproduces a buffered ALLOW — so a live run that withheld the effect would
+ * have replayed as one that dispatched it.
+ */
+const ARBITER_FAULT_VERDICT: Readonly<Verdict> = Object.freeze({
+  decision:   'deny' as const,
+  reasonCode: 'ARBITER_UNAVAILABLE',
+  finality:   'context' as const,
+})
+
 /** How long an escalated intent is held awaiting a resolution before it degrades
  *  to a refusal — 2× the host-ack timeout, so a human has real time to answer. */
 const ESCALATION_TTL_TICKS = 30
@@ -136,6 +166,7 @@ export class effectorController {
     try { verdict = this._arbiter.evaluate( invocation ) }
     catch( err ){
       logger.error(`[policy] arbiter "${this._arbiter.name}" threw for "${invocation.schema}" — failing closed:`, err )
+      this._recordAndApply( instance, payload, invocation, ARBITER_FAULT_VERDICT )
       return
     }
 
@@ -145,7 +176,10 @@ export class effectorController {
       // queue drains each tick, so a verdict landing a few ticks late still lands.
       void verdict.then(
         v => this._recordAndApply( instance, payload, invocation, v ),
-        err => logger.error(`[policy] arbiter "${this._arbiter.name}" rejected for "${invocation.schema}" — failing closed:`, err ),
+        err => {
+          logger.error(`[policy] arbiter "${this._arbiter.name}" rejected for "${invocation.schema}" — failing closed:`, err )
+          this._recordAndApply( instance, payload, invocation, ARBITER_FAULT_VERDICT )
+        },
       )
       return
     }
@@ -218,7 +252,8 @@ export class effectorController {
         intentId:   invocation.intentId,
         schema:     invocation.schema,
         reasonCode: verdict.reasonCode ?? 'POLICY_DENIED',
-        finality:   verdict.finality ?? 'instance',
+        finality:   finalityOf( verdict ),
+        ...( verdict.counterfactual ? { counterfactual: verdict.counterfactual } : {} ),
       })
       this._pendingRefusals.set( instance.config.id, queue )
       return
@@ -272,7 +307,8 @@ export class effectorController {
       this.confirmExecution( instance, refusal.intentId, {
         success:     false,
         refused:     true,
-        finality:    refusal.finality === 'class' ? 'class' : 'instance',
+        finality:    refusal.finality,
+        ...( refusal.counterfactual ? { counterfactual: refusal.counterfactual } : {} ),
         description: `refused by policy: ${refusal.reasonCode} (${refusal.finality})`,
       } )
   }
@@ -317,7 +353,16 @@ export class effectorController {
     }
   }
 
-  /** Degrade escalations no one answered in time into instance-refusals (P4). */
+  /**
+   * Degrade escalations no one answered in time into light refusals (P4).
+   *
+   * Finality 'parameter' is chosen for its BEHAVIOUR, not its name: silence is
+   * not literally an argument problem, but the light-dent-with-recovery it
+   * produces is exactly right — a Will whose asks go unanswered should ask
+   * progressively less, and should resume asking if someone starts answering.
+   * 'class' would be a lie (nobody said never) and 'context' would teach
+   * nothing, leaving the mind to escalate forever into an empty room.
+   */
   private _expireEscalations( instance: WillInstance, tick: number ): void {
     const active = this._activeEscalations.get( instance.config.id )
     if( !active || active.size === 0 ) return
@@ -325,14 +370,14 @@ export class effectorController {
       if( tick < esc.expiresAt ) continue
       active.delete( intentId )
       this._clearEscalated( instance, intentId )
-      this._queueRefusal( instance, esc.intentId, esc.schema, 'ESCALATION_EXPIRED', 'instance')
+      this._queueRefusal( instance, esc.intentId, esc.schema, 'ESCALATION_EXPIRED', 'parameter')
       logger.info(`[policy] escalation EXPIRED → refusing "${esc.schema}" intent "${intentId}"`)
     }
   }
 
   /** Push a refusal onto the queue drained by _applyRefusals this same tick. */
   private _queueRefusal(
-    instance: WillInstance, intentId: string, schema: string, reasonCode: string, finality: 'class' | 'instance',
+    instance: WillInstance, intentId: string, schema: string, reasonCode: string, finality: DenialFinality,
   ): void {
     const queue = this._pendingRefusals.get( instance.config.id ) ?? []
     queue.push({ intentId, schema, reasonCode, finality })
@@ -419,7 +464,9 @@ export class effectorController {
       /** POLICY_REAFFERENCE P2 — set when the ack is a policy refusal, so the
        *  ReafferenceEngine routes it to availability rather than competence. */
       refused?:    boolean
-      finality?:   'class' | 'instance'
+      finality?:   DenialFinality
+      /** ENVELOPE_NARROWING P0 — the bound that was exceeded, if the arbiter said. */
+      counterfactual?: PolicyCounterfactual
     },
   ): void {
     const tick = instance.tickCount

package/src/stem/tracts/outbox.writer.ts

@@ -21,6 +21,19 @@ import { logger } from '#core/logger'
 import type { OutboxMessage } from '#types'
 import type { SessionLogger } from './session.logger'
 
+/**
+ * Referent → a deliverable address, and the room to use when none was chosen.
+ *
+ * Returns null when the referent is already an address (nothing to translate) or
+ * when the mind holds no route at all — in which case the row goes out as-is and
+ * the bridge's own roster fallback still applies, so a message is never silently
+ * dropped for want of a handle.
+ */
+export type OutboxRouting = (
+  targetEntityId: string,
+  chosenThread:   string | undefined,
+) => { targetEntityId: string; threadId?: string } | null
+
 /** The caller-supplied fields of an outbox row; the writer stamps id + defaults. */
 export interface OutboxRow {
   targetEntityId:    string
@@ -43,6 +56,7 @@ export class OutboxWriter {
    * which made the embedded ids in `conversation.sent` diverge every run).
    */
   private _seq = 0
+  private _routing: OutboxRouting | null = null
 
   constructor( opts: { outbox?: OutboxMessage[]; willId?: string } = {} ){
     this._outbox = opts.outbox ?? []
@@ -53,6 +67,21 @@ export class OutboxWriter {
     this._sessionLogger = logger
   }
 
+  /**
+   * Turn a referent into somewhere the world can actually be spoken to.
+   *
+   * Injected rather than read here, because this writer is deliberately dumb —
+   * it holds no state and must stay replay-safe. Assembly closes over the state
+   * manager (the same shape as `attachMemorySink`).
+   *
+   * This is the ONE seam both send paths cross: ProactiveCommunicator's
+   * `enqueue()` and AuditionEngine's `enqueueReply()`. Translating anywhere else
+   * would mean doing it twice and getting it wrong once.
+   */
+  attachRouting( resolve: OutboxRouting | null ): void {
+    this._routing = resolve
+  }
+
   private _genId( suffix = ''): string {
     return `outbox-${ this._willId }-${ ++this._seq }${ suffix }`
   }
@@ -63,15 +92,24 @@ export class OutboxWriter {
    */
   enqueue( row: OutboxRow, idSuffix = ''): string {
     const id = this._genId( idSuffix )
+    // A `ke:` anchor is who, never where. Resolve it to an address the bridge can
+    // deliver to and a room to say it in — and where a room was already chosen
+    // (a reply answers into the thread it was asked in), that choice WINS. The
+    // mind picking a room is a decision; this is only the fallback for when it
+    // made none, and the alternative to the fallback is dropping the message.
+    const routed = this._routing?.( row.targetEntityId, row.threadId ) ?? null
+    const target = routed?.targetEntityId ?? row.targetEntityId
+    const thread = row.threadId ?? routed?.threadId
+
     this._outbox.push({
       id,
-      targetEntityId:   row.targetEntityId,
+      targetEntityId:   target,
       ...( row.targetEntityName !== undefined ? { targetEntityName: row.targetEntityName } : {} ),
       content:          row.content,
       effectorName:      row.effectorName,
       ...( row.gestureType      ? { gestureType:      row.gestureType }      : {} ),
       ...( row.replyToMessageId ? { replyToMessageId: row.replyToMessageId } : {} ),
-      ...( row.threadId         ? { threadId:         row.threadId }         : {} ),
+      ...( thread               ? { threadId:         thread }               : {} ),
       deliveryStatus:   'pending',
       createdAtTick:    0,
       createdAt:        Date.now(),

package/src/cognition/faculties/executive.engine/messages.ts

@@ -1,102 +0,0 @@
-// ─────────────────────────────────────────────────────────────
-// src/cognition/faculties/executive.engine/messages.ts
-// ─────────────────────────────────────────────────────────────
-
-import { logger } from '#core/logger'
-import type { Tick, ReadonlySimulationState } from '#core/types'
-import type { PendingMessage } from '#faculties/executive.engine/types'
-
-/**
- * Message queue state — tracks incoming communication entities,
- * pending messages during in-flight LLM calls, and reply deduplication.
- */
-export class MessageQueue {
-  /** Messages buffered while an LLM call is in-flight. */
-  pendingMessages: PendingMessage[] = []
-
-  /** Tick when the current (or most recent) LLM call started. */
-  pendingCallStartTick: number = -1
-
-  /** Entity IDs of communication entities that have been replied to this session. */
-  private _repliedEntityIds = new Set<string>()
-
-  /**
-   * Scan the simulation state for unprocessed communication entities
-   * and queue them into pendingMessages. Call every tick.
-   */
-  scanState( state: ReadonlySimulationState, tick: Tick ): void {
-    const seenIds = new Set( this.pendingMessages.map( m => m.id ) )
-
-    for( const [ id, entity ] of state.entities ){
-      if( entity.type !== 'communication') continue
-      if( entity.metadata?.processedByExecutive ) continue
-      if( seenIds.has( id ) ) continue
-
-      const msgTick = ( entity.metadata?.tick as number ) ?? 0
-      this.pendingMessages.push({
-        id,
-        content: (entity.metadata?.content as string) ?? '',
-        sender: (entity.metadata?.agentName as string) ?? 'unknown',
-        senderId: (entity.metadata?.keid as string) ?? 'unknown',
-        tick: msgTick
-      })
-
-      logger.info(`[executive] queued message from ${(entity.metadata?.agentName as string) ?? 'unknown'} (tick=${msgTick})`)
-    }
-  }
-
-  /**
-   * Clear messages that were included in the most recent LLM call.
-   * Any that arrived after the call started remain for the next cycle.
-   */
-  clearProcessedMessages(): void {
-    this.pendingMessages = this.pendingMessages.filter( m => m.tick > this.pendingCallStartTick )
-  }
-
-  /**
-   * Check if we've already replied to a specific communication entity this session.
-   */
-  hasRepliedTo( entityId: string ): boolean {
-    return this._repliedEntityIds.has( entityId )
-  }
-
-  /**
-   * Mark a communication entity as replied to.
-   */
-  markReplied( entityId: string ): void {
-    this._repliedEntityIds.add( entityId )
-  }
-
-  /**
-   * Build the set of communication entity IDs visible in state within the
-   * 30-tick window, plus any pending messages. Used to mark them as processed.
-   */
-  getVisibleMessageIds( state: ReadonlySimulationState, tick: Tick ): Set<string> {
-    const ids = new Set<string>( this.pendingMessages.map( m => m.id ) )
-    for( const [ id, entity ] of state.entities ){
-      if( entity.type !== 'communication') continue
-
-      const msgTick = (entity.metadata?.tick as number) ?? 0
-      if( tick - msgTick > 30 ) continue
-
-      ids.add( id )
-    }
-
-    return ids
-  }
-
-  /**
-   * Get stale communication entity IDs (>50 ticks old) for cleanup.
-   */
-  getStaleMessageIds( state: ReadonlySimulationState, tick: Tick ): string[] {
-    const stale: string[] = []
-    for( const [ id, entity ] of state.entities ){
-      if( entity.type !== 'communication') continue
-
-      const msgTick = (entity.metadata?.tick as number) ?? 0
-      tick - msgTick > 50 && stale.push( id )
-    }
-
-    return stale
-  }
-}