@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/lib/subscription-login.js

@@ -16,7 +16,7 @@
  *
  * Pure apart from the injected deps, so every arm is unit-tested.
  */
-import { stripOwnerCredentialEnv } from "./agent.js";
+import { applyGatewayHintHeaders, stripOwnerCredentialEnv } from "./agent.js";
 export const AGENT_AUTHS = ["api-key", "subscription"];
 /**
  * The retired `console` value (it read the key Claude Code's Anthropic Console /login
@@ -132,6 +132,32 @@ export function subscriptionShape(shape, shapeExplicit, rcAllowed, say) {
     say("mnemom agent: subscription login runs terminal-only for now — launching in this terminal.");
     return "terminal";
 }
+/**
+ * The coding agent's env for either auth arm: what `mnemom agent` launches claude with, and what a
+ * durable seat launches its claude with (host/seat-launch.ts, dogfood B6). With an Anthropic key:
+ * Claude Code logged in via claude.ai (OAuth) PREEMPTS ANTHROPIC_API_KEY, so it is force-unset;
+ * the real key rides in ANTHROPIC_CUSTOM_HEADERS (`headers`) and ANTHROPIC_AUTH_TOKEN is a fixed
+ * non-secret placeholder. Without one (a subscription launch) NO auth token is set: Claude Code
+ * then sends its own claude.ai login. Either way the owner's own Mnemom credential env is
+ * stripped (MNE-8245), as is MNEMOM_AGENT_ANTHROPIC_KEY (the key reaches the child only in the
+ * headers: C14, B6), and Claude Code's gateway hint headers are on (a value the owner set wins):
+ * the seat proxy chains each turn by x-claude-code-prompt-id, and without it a seat's first typed
+ * turn chained to the launch prompt (dogfood B8). Set here so the two callers cannot drift apart.
+ */
+export function launchChildEnv(base, door, headers, anthropicKey) {
+    if (!anthropicKey)
+        return applyGatewayHintHeaders(subscriptionChildEnv(base, door, headers));
+    const env = { ...base };
+    delete env.ANTHROPIC_API_KEY;
+    delete env.MNEMOM_AGENT_ANTHROPIC_KEY;
+    env.ANTHROPIC_BASE_URL = door;
+    env.ANTHROPIC_AUTH_TOKEN = GATEWAY_AUTH_PLACEHOLDER;
+    env.ANTHROPIC_CUSTOM_HEADERS = headers;
+    stripOwnerCredentialEnv(env);
+    return applyGatewayHintHeaders(env);
+}
+/** The fixed, non-secret ANTHROPIC_AUTH_TOKEN of an api-key launch (the key rides in a header). */
+export const GATEWAY_AUTH_PLACEHOLDER = "mnemom-gateway";
 /**
  * The child env for a subscription launch: the gateway door, the Mnemom headers, and
  * NOTHING that would make Claude Code send a key instead of its claude.ai login.
@@ -139,6 +165,7 @@ export function subscriptionShape(shape, shapeExplicit, rcAllowed, say) {
 export function subscriptionChildEnv(base, door, headers) {
     const env = { ...base };
     delete env.ANTHROPIC_API_KEY;
+    delete env.MNEMOM_AGENT_ANTHROPIC_KEY;
     delete env.ANTHROPIC_AUTH_TOKEN;
     // The key already rides in the headers; the child process has no other use for it.
     // MNE-8245 defense-in-depth: also strips MNEMOM_API_KEY/MNEMOM_TOKEN, in case the

package/dist/vendor/durable-contract/index.js

@@ -193,7 +193,10 @@ var SUSPENDED_REASONS = [
   "card_drift",
   "attestation_failed",
   "owner_departed",
-  "respawn_failed"
+  "respawn_failed",
+  /** ruling 34.22: a question wait's, or any non-budget approval wait's, approval expired or was denied; the owner resumes by hand. Budget waits keep budget_reached. */
+  "approval_expired",
+  "approval_denied"
 ];
 var PAUSED_REASONS = ["owner", "agent_contained", "breakglass"];
 var FAILED_REASONS = ["transcript_lost"];
@@ -224,7 +227,10 @@ var M1_WRITTEN_SUSPENDED_REASONS = [
   "identity_mismatch",
   "attestation_failed",
   "respawn_failed",
-  "grant_expired"
+  "grant_expired",
+  /** ruling 34.22: written by the approval-wait expiry/denial path. */
+  "approval_expired",
+  "approval_denied"
 ];
 var WAIT_REASONS = [
   "approval",
@@ -902,6 +908,9 @@ var DURABLE_CODES = {
     surfaces: ["api"],
     fields: ["reason", "state_reason", "check", "state", "wait_reason"]
   },
+  // The per-org claim rate limit (ruling 34.24): nothing written, no key minted. retry_after_s is
+  // the number of seconds to wait (claimRateLimitedDetailsOk).
+  durable_claim_rate_limited: { status: 429, surfaces: ["api"], fields: ["retry_after_s"] },
   // ---- api journal (C10-R0 (i), (j), (k)) ----
   /** Lost CAS race on (session_id, seq). */
   durable_append_conflict: { status: 409, surfaces: ["api"], fields: ["tip_seq"] },
@@ -995,7 +1004,8 @@ var CLAIM_OUTCOMES = [
   "needs_key",
   "lost_race",
   "ineligible",
-  "unavailable"
+  "unavailable",
+  "rate_limited"
 ];
 var CLAIM_OUTCOME_STATUS = {
   acquired: 200,
@@ -1004,7 +1014,8 @@ var CLAIM_OUTCOME_STATUS = {
   needs_key: 409,
   lost_race: 409,
   ineligible: 403,
-  unavailable: 503
+  unavailable: 503,
+  rate_limited: 429
 };
 var CLAIM_LOST_RACE_REASONS = ["stale_tokens", "lease_live", "org_lease_cap"];
 var CLAIM_INELIGIBLE_REASONS = [
@@ -1069,6 +1080,14 @@ function claimLostRaceDetailsOk(details) {
   if (details.reason !== "org_lease_cap") return !("live" in details) && !("cap" in details);
   return Number.isInteger(details.live) && details.live >= 0 && Number.isInteger(details.cap) && details.cap >= 1;
 }
+function claimRateLimitedDetailsOk(details) {
+  if (Object.keys(details).some(
+    (k) => !["fix", ...DURABLE_CODES.durable_claim_rate_limited.fields].includes(k)
+  ))
+    return false;
+  const t = details.retry_after_s;
+  return typeof t === "number" && Number.isFinite(t) && t >= 0;
+}
 function claimIneligibleDetailsOk(details) {
   if (Object.keys(details).some(
     (k) => !["fix", ...DURABLE_CODES.durable_claim_ineligible.fields].includes(k)
@@ -1603,6 +1622,17 @@ var FIX_LINES = {
   ),
   respawn_failed: e("command", "`mnemom agent resume <name>`"),
   attestation_failed: e("command", "`mnemom agent resume <name>`"),
+  /** suspended(approval_expired|approval_denied) (ruling 34.22): the wait was left; the owner resumes by hand. */
+  approval_expired: e(
+    "command",
+    "`mnemom agent resume <name>`",
+    "the approval expired and this session needs you to resume it: "
+  ),
+  approval_denied: e(
+    "command",
+    "`mnemom agent resume <name>`",
+    "the approval was denied and this session needs you to resume it: "
+  ),
   attestation_cwd_missing: e(
     "command",
     "`cd <toplevel> && mnemom agent <name> --new`",
@@ -1693,6 +1723,13 @@ var FIX_LINES = {
     "command",
     "`mnemom agent <name> --agent <another-agent>`, or <precondition>"
   ),
+  // The api's create refusal while another session is locked on the agent (dogfood walk5): the
+  // reader finishes or reuses the holder, or starts <name> on another agent. <holder> is the
+  // locked session's name; `<another-agent>` stays literal (ruling 21).
+  durable_only_held: e(
+    "command",
+    "<holder> is locked on this agent: finish it with `mnemom agent done <holder>`, carry on in it with `mnemom agent <holder>`, or start <name> on another agent with `mnemom agent <name> --agent <another-agent>`"
+  ),
   // ---- owner verbs (owner-verb table step 3; final F04, F06) ----
   not_owner_admin: e(
     "command",
@@ -1793,6 +1830,9 @@ function renderDurableOnlyWith(clauses, launcherKey, params) {
   });
   return launcherKey === "always" ? base : base + DURABLE_ONLY_CONFIG_CLAUSE;
 }
+function renderDurableOnlyHeld(params) {
+  return substitute(FIX_LINES.durable_only_held.body, { name: params.name, holder: params.holder });
+}
 var STOPPED_EFFECTIVE_STATES = ["paused", "suspended", "suspended_grant_expired"];
 var STOPPED_FIX_NULL_REASON = "null";
 var STOPPED_FIX_ANY_REASON = "*";
@@ -1813,7 +1853,9 @@ var STOPPED_FIX = Object.freeze({
     card_drift: "stopped_no_m1_remedy",
     attestation_failed: "attestation_failed",
     owner_departed: "stopped_no_m1_remedy",
-    respawn_failed: "respawn_failed"
+    respawn_failed: "respawn_failed",
+    approval_expired: "approval_expired",
+    approval_denied: "approval_denied"
   }),
   suspended_grant_expired: Object.freeze({ [STOPPED_FIX_ANY_REASON]: "grant_expired" })
 });
@@ -2202,7 +2244,8 @@ var DURABLE_EVENT_KINDS = [
   "tip.signed",
   "session.ready",
   "session.waiting",
-  "session.wait_cleared"
+  "session.wait_cleared",
+  "executor.turn_continued"
 ];
 function isDurableEventKind(v) {
   return typeof v === "string" && DURABLE_EVENT_KINDS.includes(v);
@@ -2210,7 +2253,8 @@ function isDurableEventKind(v) {
 var AMENDMENT_EVENT_GROUPS = Object.freeze({
   "session.ready": "lifecycle",
   "session.waiting": "lifecycle",
-  "session.wait_cleared": "lifecycle"
+  "session.wait_cleared": "lifecycle",
+  "executor.turn_continued": "lease"
 });
 function eventGroupOf(kind) {
   if (Object.prototype.hasOwnProperty.call(AMENDMENT_EVENT_GROUPS, kind))
@@ -2221,7 +2265,8 @@ function eventGroupOf(kind) {
 var EVENT_WRITERS = ["executor", "gateway", "api"];
 var EXECUTOR_WRITABLE_KINDS = [
   "executor.spawned",
-  "session.waiting"
+  "session.waiting",
+  "executor.turn_continued"
 ];
 var GATEWAY_WRITABLE_KINDS = [
   "lease.zombie_call",
@@ -2329,7 +2374,14 @@ var KIND_REFS = {
   "session.unpaused": obj(
     {
       from_state: ENUM(["paused", "suspended"]),
-      from_reason: ENUM(["owner", "agent_contained", "respawn_failed", "attestation_failed"])
+      from_reason: ENUM([
+        "owner",
+        "agent_contained",
+        "respawn_failed",
+        "attestation_failed",
+        "approval_expired",
+        "approval_denied"
+      ])
     },
     ["from_state", "from_reason"],
     [
@@ -2341,7 +2393,14 @@ var KIND_REFS = {
       {
         field: "from_state",
         equals: "suspended",
-        enums: { from_reason: ["respawn_failed", "attestation_failed"] }
+        enums: {
+          from_reason: [
+            "respawn_failed",
+            "attestation_failed",
+            "approval_expired",
+            "approval_denied"
+          ]
+        }
       }
     ]
   ),
@@ -2432,7 +2491,10 @@ var KIND_REFS = {
       { field: "wait_reason", equals: "budget", require: ["approval_id"], forbid: ["head_sha"] }
     ]
   ),
-  "session.wait_cleared": obj({ wait_reason: ENUM(PARKED_ONLY_WAIT_REASONS) })
+  "session.wait_cleared": obj({ wait_reason: ENUM(PARKED_ONLY_WAIT_REASONS) }),
+  // ---- lead ruling 2026-10-28: the spawn that sent the continue; a separate fact, so
+  // executor.spawned's refs stay exactly {spawn_id} ----
+  "executor.turn_continued": obj({ spawn_id: UUID })
 };
 function refsSchemaOf(kind) {
   return KIND_REFS[kind] ?? EMPTY;
@@ -2652,7 +2714,7 @@ function ownerVerbDecision(i) {
     case "resume":
       if (!locked) return row8();
       if (contained) return deviceStepOr(i, "unpause_contained");
-      if (i.state === "paused" && i.state_reason === "owner" || i.state === "suspended" && (i.state_reason === "respawn_failed" || i.state_reason === "attestation_failed")) {
+      if (i.state === "paused" && i.state_reason === "owner" || i.state === "suspended" && (i.state_reason === "respawn_failed" || i.state_reason === "attestation_failed" || i.state_reason === "approval_expired" || i.state_reason === "approval_denied")) {
         return {
           kind: "apply",
           status: 200,
@@ -3048,11 +3110,16 @@ var CHAIN_KEY = "chain";
 var INBOX_KEY = "inbox";
 var TURN_HASH_RE = /^[0-9a-f]{64}$/;
 var ATTENDED_SOURCES = [void 0, "typed", "queued"];
+var TURN_PRODUCER_RE = /^[a-z][a-z0-9-]{0,31}$/;
+var ATTENDED_TASK_PRODUCER = "session-task";
+var attendedHuman = (e2) => e2.origin === "human" && ATTENDED_SOURCES.includes(e2.source) && !e2.inbox;
 function candidatePosture(entries, schemaKnown = true) {
   if (!schemaKnown) return "unattended";
   const newest = entries[entries.length - 1];
   if (newest === void 0) return "unattended";
-  return newest.origin === "human" && ATTENDED_SOURCES.includes(newest.source) && !newest.inbox ? "attended" : "unattended";
+  if (attendedHuman(newest)) return "attended";
+  const continuation = newest.origin === "task" && newest.source === "system" && newest.producer === ATTENDED_TASK_PRODUCER && !newest.inbox && entries.slice(0, -1).some(attendedHuman);
+  return continuation ? "attended" : "unattended";
 }
 async function chainIdOf(rootPromptId) {
   if (typeof rootPromptId !== "string" || rootPromptId.length === 0)
@@ -3389,7 +3456,8 @@ var M1_COLUMNS = {
     "expires_at",
     "created_at",
     "updated_at",
-    "wait_ref"
+    "wait_ref",
+    "new_session"
   ],
   durable_lease_keys: [
     "key_hash",
@@ -3891,6 +3959,7 @@ var CIPHER_KEY_REFS = ["mnemom"];
 var DEK_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
+var CONTRACT_OPTIONAL_KEYS = ["goal_id", "work_card", "shape"];
 function contractAad(sessionId, charterVersion) {
   return `durable-contract:v1:${sessionId}:${charterVersion}`;
 }
@@ -3898,26 +3967,39 @@ function parseContract(raw) {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
   const r = raw;
   const keys = ["statement", "requirements", "allowed_paths", "forbidden_paths"];
-  if (Object.keys(r).some((k) => !keys.includes(k))) return null;
+  const known = [...keys, ...CONTRACT_OPTIONAL_KEYS];
+  if (Object.keys(r).some((k) => !known.includes(k))) return null;
   if (typeof r.statement !== "string" || r.statement.length === 0 || r.statement.length > CONTRACT_STATEMENT_MAX_CHARS)
     return null;
   for (const k of keys.slice(1)) {
     const v = r[k] ?? [];
     if (!Array.isArray(v) || v.some((s) => typeof s !== "string")) return null;
   }
-  return {
+  if ("goal_id" in r && (typeof r.goal_id !== "string" || r.goal_id.length === 0)) return null;
+  if ("work_card" in r && r.work_card !== true) return null;
+  if ("shape" in r && r.shape !== "duty") return null;
+  const out = {
     statement: r.statement,
     requirements: r.requirements ?? [],
     allowed_paths: r.allowed_paths ?? [],
     forbidden_paths: r.forbidden_paths ?? []
   };
+  return { ...out, ...optionalContractFields(r) };
+}
+function optionalContractFields(c) {
+  const out = {};
+  if (c.goal_id !== void 0) out.goal_id = c.goal_id;
+  if (c.work_card !== void 0) out.work_card = c.work_card;
+  if (c.shape !== void 0) out.shape = c.shape;
+  return out;
 }
 function contractPlaintext(c) {
   return canonicalJson({
     statement: c.statement,
     requirements: c.requirements,
     allowed_paths: c.allowed_paths,
-    forbidden_paths: c.forbidden_paths
+    forbidden_paths: c.forbidden_paths,
+    ...optionalContractFields(c)
   });
 }
 async function statementHash(statement) {
@@ -3997,8 +4079,13 @@ var COMMITMENT_KEYS = [
   "active_time_limit_s",
   "pins",
   "tool_classes",
-  "launch_spec"
+  "launch_spec",
+  // amendment 55 (C07-R02): what the gateway sealed beyond the ceilings, so a reload keeps it
+  "mode",
+  "stall_turns",
+  "contract_hash"
 ];
+var CONTRACT_MODE_VALUES = ["nudge", "enforce"];
 var TOOL_CLASS_VALUES = ["input_dependent", "safe", "idempotent"];
 var PIN_KEYS = ["card_content_hash", "policy_engine_major"];
 function isValidCommitment(raw) {
@@ -4008,6 +4095,7 @@ function isValidCommitment(raw) {
     switch (k) {
       case "statement_hash":
       case "requirements_hash":
+      case "contract_hash":
         if (typeof v !== "string" || !HEX64_RE.test(v)) return false;
         break;
       case "budget_usd":
@@ -4017,6 +4105,7 @@ function isValidCommitment(raw) {
       case "max_wakes_per_day":
       case "max_turns":
       case "active_time_limit_s":
+      case "stall_turns":
         if (!Number.isSafeInteger(v) || v < 0) return false;
         break;
       case "pins": {
@@ -4036,6 +4125,9 @@ function isValidCommitment(raw) {
         }
         break;
       }
+      case "mode":
+        if (!CONTRACT_MODE_VALUES.includes(v)) return false;
+        break;
       case "launch_spec":
         if (typeof v !== "object" || v === null || Array.isArray(v)) return false;
         break;
@@ -4081,10 +4173,74 @@ function charterPreimage(row) {
     created_at: canonicalEventTs(row.created_at)
   };
 }
+function charterV1CreatedAt(sealedAt) {
+  try {
+    return canonicalEventTs(sealedAt);
+  } catch {
+  }
+  const ms = Date.parse(sealedAt);
+  if (!Number.isFinite(ms)) throw new RangeError(`not a seal instant: ${sealedAt}`);
+  return canonicalEventTs(new Date(ms).toISOString());
+}
 async function charterHash(row) {
   return sha256Hex(canonicalJson(charterPreimage(row)));
 }
 
+// ../shared/durable-contract/src/seal.ts
+var SEALED_CONTRACT_FIELDS = [
+  "goal_id",
+  "statement",
+  "requirements",
+  "allowed_paths",
+  "forbidden_paths",
+  "max_turns",
+  "budget_usd",
+  "stall_turns",
+  "time_limit_s",
+  "mode",
+  "work_card",
+  "shape"
+];
+async function sealedContractHash(c) {
+  const normalised = { ...c };
+  if ((c.mode ?? "nudge") === "nudge") delete normalised.mode;
+  return sha256Hex(canonicalJson(normalised));
+}
+var CEILINGS = [
+  ["budget_usd", "budget_usd"],
+  ["max_turns", "max_turns"],
+  ["stall_turns", "stall_turns"],
+  ["time_limit_s", "active_time_limit_s"]
+];
+async function splitSealedContract(seal) {
+  const known = SEALED_CONTRACT_FIELDS;
+  if (Object.keys(seal).some((k) => !known.includes(k))) return null;
+  const text = {};
+  for (const k of ["statement", "requirements", "allowed_paths", "forbidden_paths", "goal_id", "work_card", "shape"])
+    if (seal[k] !== void 0) text[k] = seal[k];
+  const contract = parseContract(text);
+  if (contract === null) return null;
+  const commitments = {
+    statement_hash: await statementHash(contract.statement),
+    requirements_hash: await requirementsHash(contract.requirements),
+    contract_hash: await sealedContractHash(seal)
+  };
+  if (seal.mode !== void 0) commitments.mode = seal.mode;
+  for (const [from, to] of CEILINGS) if (seal[from] !== void 0) commitments[to] = seal[from];
+  return isValidCommitment(commitments) ? { contract, commitments } : null;
+}
+async function sealedContractFromCharter(contract, charter) {
+  if (typeof charter.contract_hash !== "string") return null;
+  const seal = { ...contract };
+  if (typeof charter.mode === "string") seal.mode = charter.mode;
+  for (const [to, from] of CEILINGS) {
+    const v = charter[from];
+    if (typeof v === "number") seal[to] = v;
+  }
+  const hash = await sealedContractHash(seal);
+  return hash === charter.contract_hash ? { contract: seal, contract_hash: hash } : null;
+}
+
 // ../shared/durable-contract/src/executor-state.ts
 var EXECUTOR_STATE_VERSION = 1;
 var EXECUTOR_STATE_SCHEMA = Object.freeze({
@@ -4203,6 +4359,12 @@ function execSessionsResponseOk(v) {
     return keysExactly(v, Object.keys(EXEC_SESSIONS_RESPONSE.grant_expired)) && v.grant_expired === true && v.sessions.length === 0 && fieldOk({ type: "timestamp", nullable: false }, v.grant_expires_at);
   return keysExactly(v, ["sessions"]) && v.sessions.every(execSessionsItemOk);
 }
+var OWNER_SESSION_VIEW_FIELDS = Object.freeze({
+  cc_session_id: "string|null"
+});
+function ownerSessionViewOk(v) {
+  return isObj(v) && "cc_session_id" in v && fieldOk({ type: "string", nullable: true }, v.cc_session_id);
+}
 var EXECUTOR_KEY_HEADER = "X-Mnemom-Api-Key";
 var HEARTBEAT_REQUEST_KEYS = ["nonce", "entries"];
 function heartbeatRequestOk(v) {
@@ -4880,6 +5042,8 @@ var FREEZE_STRUCTURED = Object.freeze({
   HEARTBEAT_RESULT_FIELDS,
   /** GET exec_sessions body: only sessions[] and each item's uuid id are frozen (24.16). */
   EXEC_SESSIONS_RESPONSE,
+  /** Owner session view: cc_session_id present, string or null; the view is otherwise open (#1085). */
+  OWNER_SESSION_VIEW_FIELDS,
   /** Claim refusal details (24.22.1): lost_race reasons, ineligible reasons and their presence rules. */
   CLAIM_LOST_RACE_REASONS,
   CLAIM_INELIGIBLE_REASONS,
@@ -5122,6 +5286,50 @@ var CHARTER_HASH_VECTORS = {
     }
   ]
 };
+var SEAL_VECTORS = {
+  "seal": {
+    "statement": "Ship the release. canary zq-k1-102d461d964a345ca757",
+    "requirements": [
+      "Tests stay green. canary zq-k2-54e87989d0dd1c2f7a00"
+    ],
+    "budget_usd": 5,
+    "max_turns": 40,
+    "time_limit_s": 3600,
+    "mode": "enforce",
+    "allowed_paths": [
+      "src/**"
+    ],
+    "forbidden_paths": [
+      "secrets/**"
+    ]
+  },
+  "enforce_hash": "85fc982c26cf4a28ac1e7e3ba0f746a83bd96bc3ce7a3ed84401f79aa684d13a",
+  "gateway_enforce_h16": "85fc982c26cf4a28",
+  "nudge_hash": "d0344555137faf1ce06f81bb905ec9dfb15dd385de57b6a959e381bf1f3fe654",
+  "gateway_nudge_h16": "d0344555137faf1c",
+  "sealed_at": "2026-10-29T12:45:33.355-07:00",
+  "charter_v1": {
+    "commitments": {
+      "statement_hash": "04ed1e6039e500e2a1d09fd4238a77863cdfc699e504cea01a4c63263ffdf538",
+      "requirements_hash": "d594733b87aa9594eb4d084a49e8450aa8ac9e32ffb9c985d7a2f24fa6513fcd",
+      "contract_hash": "85fc982c26cf4a28ac1e7e3ba0f746a83bd96bc3ce7a3ed84401f79aa684d13a",
+      "mode": "enforce",
+      "budget_usd": 5,
+      "max_turns": 40,
+      "active_time_limit_s": 3600,
+      "pins": {
+        "card_content_hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+        "policy_engine_major": 3
+      },
+      "tool_classes": {
+        "Bash": "input_dependent"
+      }
+    },
+    "created_at": "2026-10-29T19:45:33.355000Z",
+    "preimage": '{"charter":{"active_time_limit_s":3600,"budget_usd":5,"contract_hash":"85fc982c26cf4a28ac1e7e3ba0f746a83bd96bc3ce7a3ed84401f79aa684d13a","max_turns":40,"mode":"enforce","pins":{"card_content_hash":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","policy_engine_major":3},"requirements_hash":"d594733b87aa9594eb4d084a49e8450aa8ac9e32ffb9c985d7a2f24fa6513fcd","statement_hash":"04ed1e6039e500e2a1d09fd4238a77863cdfc699e504cea01a4c63263ffdf538","tool_classes":{"Bash":"input_dependent"}},"created_at":"2026-10-29T19:45:33.355000Z","prev_hash":"0000000000000000000000000000000000000000000000000000000000000000","session_id":"11111111-2222-4333-8444-555555555555","v":1,"version":1}',
+    "hash": "5a3bb041c155d67e50d18ee9afb0e6903f7a64988c881ab6373d3447fd5906f5"
+  }
+};
 export {
   ABSENT_FUNCTIONS_M1,
   ADMISSION_PRECEDENCE,
@@ -5152,6 +5360,7 @@ export {
   ARM_VERSION,
   ATTACH_WAIT_S,
   ATTENDED_SOURCES,
+  ATTENDED_TASK_PRODUCER,
   ATTESTATION_CHECKS_M1,
   ATTRIBUTE_VALUES,
   BUILDER_INPUT_TABLE,
@@ -5187,6 +5396,8 @@ export {
   CLI_USAGE_EXIT,
   COMMITMENT_KEYS,
   CONTRACT_JSON_MAX_BYTES,
+  CONTRACT_MODE_VALUES,
+  CONTRACT_OPTIONAL_KEYS,
   CONTRACT_PURGE_AFTER_S,
   CONTRACT_STATEMENT_MAX_CHARS,
   CONTRACT_VECTOR,
@@ -5356,6 +5567,7 @@ export {
   OUTAGE_TEXT_M1,
   OWNER_MUTATION_APPROVAL_TTL_S,
   OWNER_MUTATION_CLIENT_ID,
+  OWNER_SESSION_VIEW_FIELDS,
   OWNER_TABLE_VERBS,
   OWNER_VERBS,
   PARKED_ONLY_WAIT_REASONS,
@@ -5413,6 +5625,8 @@ export {
   RUNNER_OUTCOMES,
   RUNNER_OUTCOME_FIELDS,
   RUNNER_REFUSED_REASONS,
+  SEALED_CONTRACT_FIELDS,
+  SEAL_VECTORS,
   SEAT_DAEMON_FLAGS,
   SEAT_MAX_ATTEMPTS_NONRETRY,
   SEAT_TEXT_M1,
@@ -5476,6 +5690,7 @@ export {
   TURN_HASH_RE,
   TURN_HEADER_MAX_LEN,
   TURN_ORIGINS,
+  TURN_PRODUCER_RE,
   TURN_SOURCES,
   TURN_WAIT_MS,
   T_HELLO_S,
@@ -5519,12 +5734,14 @@ export {
   charterByHashResponseOk,
   charterHash,
   charterPreimage,
+  charterV1CreatedAt,
   checkDurableSpan,
   claimBackoffMs,
   claimBodyOk,
   claimIneligibleDetailsOk,
   claimLostRaceDetailsOk,
   claimNeedsKeyRetry,
+  claimRateLimitedDetailsOk,
   classifyKey,
   cliRefusalJson,
   contractAad,
@@ -5596,6 +5813,7 @@ export {
   normalizeCellId,
   normalizeSessionName,
   openContract,
+  ownerSessionViewOk,
   ownerVerbDecision,
   parseArm,
   parseContract,
@@ -5625,6 +5843,7 @@ export {
   refsSha256,
   renderAdoptNote,
   renderDurableOnly,
+  renderDurableOnlyHeld,
   renderFixLine,
   renderNonTtyLocked,
   renderStoppedReasonText,
@@ -5638,6 +5857,8 @@ export {
   s1Resolve,
   s1Value,
   sealContract,
+  sealedContractFromCharter,
+  sealedContractHash,
   seamsOf,
   secretEncodings,
   sessionNameRefusal,
@@ -5645,6 +5866,7 @@ export {
   shouldRetryHeader,
   spanStatusOf,
   specHash,
+  splitSealedContract,
   stampEventTs,
   stateRows,
   statementHash,