@mnemom/mnemom 0.17.34-next.1 → 0.17.34-next.2

package/dist/vendor/shared/durable-contract/schema.js

@@ -0,0 +1,441 @@
+// GENERATED from shared/durable-contract/src/schema.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The M1 database catalogue S1 freezes for A1 and for the C17 catalog oracle (C17-R23..R27;
+ * BACKBONE A1; design §3.3). A1 implements exactly this; a needed difference is an S1 amendment.
+ *
+ * Column decisions beyond design §3.3 (whose lists end in "…"):
+ *  - agent_sessions.cwd: the registered worktree root (the idle builder source reads it);
+ *  - agent_sessions.spawn_id / hello_at: the current epoch's registered spawn and its accepted
+ *    hello (heartbeat revival and durable_seat_exit test them in one row read);
+ *  - durable_lease_keys.agent_id / org_id: attribution at the source (C14-R14);
+ *  - agent_executors.label: the machine label `show` and `session_homed_elsewhere` print;
+ *  - agent_session_events.principal_ref (C10-R0 (d)) and durable_event_kinds.writer (C10-R0 (e));
+ *  - durable_approvals.subject / requested_by: the owner_mutation subject kind and requester.
+ *
+ * Doors amendment columns (rulings 34.03, 34.06, 34.10), each appended to its table:
+ *  - agent_sessions.wait_ref (JSONB, NULL unless wait_reason is a PARKED_ONLY_WAIT_REASONS value);
+ *  - agent_executors.scope (TEXT NOT NULL DEFAULT 'user', EXECUTOR_SCOPES);
+ *  - durable_org_policy.dispatch_agent_id (nullable FK agents, same org).
+ *
+ * Amendment 54 (signed off by Wassim 2026-10-29; ruling B5a as amended, 1a + 2a), appended to its table:
+ *  - agent_sessions.new_session (BOOLEAN NOT NULL DEFAULT false): true only on a row that
+ *    create-and-lock inserted (`--new` under durable=always on a durable-only agent, one
+ *    transaction with the lock); a plain lock never sets it. The executor learns it only from the
+ *    claim success answer (`new_session: true`, while no seat hello was ever accepted for the
+ *    session); EXEC_SESSIONS_RESPONSE item keys are unchanged.
+ */
+import { canonicalJson, sha256Hex, UUID_RE } from "./canonical.js";
+import { CANONICAL_CELL_IDS } from "./cell-id.js";
+import { LEASE_SECONDS_DEFAULT, RESUME_RESET_SECONDS_DEFAULT } from "./constants.js";
+import { PARKED_ONLY_WAIT_REASONS } from "./states.js";
+export const M1_TABLES = [
+    "agent_sessions",
+    "durable_lease_keys",
+    "agent_session_charters",
+    "agent_session_events",
+    "durable_event_kinds",
+    "agent_session_chains",
+    "agent_executors",
+    "agent_durable_profiles",
+    "durable_cell_state",
+    "durable_org_policy",
+    "durable_user_policy",
+    "durable_approvals",
+    "durable_approval_attestations",
+];
+export const M1_COLUMNS = {
+    agent_sessions: [
+        "id",
+        "agent_id",
+        "org_id",
+        "conversation_id",
+        "aip_session_id",
+        "name",
+        "created_by",
+        "durable_mode",
+        "state",
+        "state_reason",
+        "wait_reason",
+        "resume_failures",
+        "running_since",
+        "home_cell",
+        "home_executor_id",
+        "profile_id",
+        "profile_version",
+        "charter_hash",
+        "cwd",
+        "lease_executor_id",
+        "attach_until",
+        "lease_epoch",
+        "lease_nonce",
+        "lease_expires_at",
+        "spawn_id",
+        "hello_at",
+        "outage_mode",
+        "outage_bound_s",
+        "outage_set_by",
+        "cc_session_id",
+        "guard_state",
+        "hmac_salt",
+        "journal_tip_hash",
+        "journal_tip_seq",
+        "expires_at",
+        "created_at",
+        "updated_at",
+        "wait_ref",
+        "new_session",
+    ],
+    durable_lease_keys: [
+        "key_hash",
+        "session_id",
+        "agent_id",
+        "org_id",
+        "epoch",
+        "revoked_at",
+        "last_used_at",
+        "created_at",
+    ],
+    agent_session_charters: [
+        "session_id",
+        "version",
+        "hash",
+        "prev_hash",
+        "charter",
+        "contract_ciphertext",
+        "wrapped_data_key",
+        "cipher_key_ref",
+        "contract_purge_after",
+        "signature",
+        "created_at",
+    ],
+    agent_session_events: [
+        "session_id",
+        "seq",
+        "ts",
+        "kind",
+        "principal_uid",
+        "principal_ref",
+        "epoch",
+        "idempotency_key",
+        "detail",
+        "detail_sha256",
+        "refs",
+        "refs_sha256",
+        "prev_hash",
+        "hash",
+    ],
+    durable_event_kinds: ["kind", "grp", "writer", "refs_schema", "added_at"],
+    agent_session_chains: ["session_id", "chain_id", "posture", "decided_at"],
+    agent_executors: [
+        "id",
+        "org_id",
+        "owner_user_id",
+        "kind",
+        "key_id",
+        "label",
+        "runtime",
+        "contract_version",
+        "grant_expires_at",
+        "age_recipient",
+        "heartbeat_data",
+        "revoked_at",
+        "breakglass_at",
+        "last_seen_at",
+        "risk_line_version",
+        "created_at",
+        "scope",
+    ],
+    agent_durable_profiles: [
+        "id",
+        "org_id",
+        "owner_user_id",
+        "name",
+        "version",
+        "hash",
+        "body",
+        "created_at",
+    ],
+    durable_cell_state: [
+        "cell_id",
+        "cell_generation",
+        "unattended_enabled",
+        "lease_seconds",
+        "resume_reset_seconds",
+    ],
+    durable_org_policy: [
+        "org_id",
+        "host_unattended",
+        "outage_bound_max_s",
+        "limits",
+        "executor_kinds",
+        "updated_by",
+        "updated_at",
+        "dispatch_agent_id",
+    ],
+    durable_user_policy: ["org_id", "user_id", "host_unattended_off"],
+    durable_approvals: [
+        "id",
+        "org_id",
+        "session_id",
+        "kind",
+        "subject",
+        "subject_hash",
+        "subject_ciphertext",
+        "question_ciphertext",
+        "cipher_key_ref",
+        "redaction_version",
+        "gateway_witness",
+        "requested_by",
+        "state",
+        "consumed_at",
+        "expires_at",
+        "created_at",
+    ],
+    durable_approval_attestations: [
+        "approval_id",
+        "principal_uid",
+        "decision",
+        "via",
+        "assurance",
+        "external_actor",
+        "trust_root_id",
+        "notary_jws",
+        "created_at",
+    ],
+};
+/** Columns no anon/authenticated column-level grant may reach (C17-R27, C17-M44). */
+export const CIPHERTEXT_COLUMNS = [
+    ["agent_session_charters", "contract_ciphertext"],
+    ["agent_session_charters", "wrapped_data_key"],
+];
+/** Columns that must NOT exist (dropped seams, cut items). */
+export const FORBIDDEN_COLUMNS = [["durable_cell_state", "test_barriers_enabled"]];
+const TERMINAL_ARRAY = "ARRAY['completed'::text, 'failed'::text, 'killed'::text, 'expired'::text]";
+/** Every unique index an M1 ON CONFLICT relies on (C17-R24). */
+export const M1_ARBITERS = [
+    {
+        name: "agent_sessions_live_name_key",
+        table: "agent_sessions",
+        columns: ["org_id", "created_by", "name"],
+        nullsNotDistinct: true,
+        where: `(state <> ALL (${TERMINAL_ARRAY}))`,
+    },
+    {
+        name: "agent_sessions_agent_conversation_key",
+        table: "agent_sessions",
+        columns: ["agent_id", "conversation_id"],
+        nullsNotDistinct: false,
+        where: null,
+    },
+    {
+        name: "agent_session_events_idempotency_key",
+        table: "agent_session_events",
+        columns: ["session_id", "idempotency_key"],
+        nullsNotDistinct: false,
+        where: null,
+    },
+    {
+        name: "agent_session_events_seq_key",
+        table: "agent_session_events",
+        columns: ["session_id", "seq"],
+        nullsNotDistinct: false,
+        where: null,
+    },
+    {
+        name: "agent_session_chains_chain_key",
+        table: "agent_session_chains",
+        columns: ["session_id", "chain_id"],
+        nullsNotDistinct: false,
+        where: null,
+    },
+    {
+        name: "agent_session_charters_version_key",
+        table: "agent_session_charters",
+        columns: ["session_id", "version"],
+        nullsNotDistinct: false,
+        where: null,
+    },
+    {
+        name: "durable_approvals_open_key",
+        table: "durable_approvals",
+        columns: ["org_id", "session_id", "kind", "subject_hash"],
+        nullsNotDistinct: true,
+        where: "(state = 'open'::text)",
+    },
+];
+/** The indexdef pg_get_indexdef prints for an arbiter (public schema, btree). */
+export function arbiterIndexDef(a) {
+    const nnd = a.nullsNotDistinct ? " NULLS NOT DISTINCT" : "";
+    const where = a.where === null ? "" : ` WHERE ${a.where}`;
+    return `CREATE UNIQUE INDEX ${a.name} ON public.${a.table} USING btree (${a.columns.join(", ")})${nnd}${where}`;
+}
+export const M1_FUNCTIONS = [
+    "resolve_durable_session_key",
+    "agent_durable_only",
+    "durable_schema_version",
+    "durable_attest_begin",
+    "durable_claim_lease",
+    "durable_heartbeat",
+    "durable_seat_hello",
+    "durable_seat_exit",
+    "durable_fail_session",
+    "durable_release_lease",
+    "durable_append_event",
+    "durable_fence_check",
+    "durable_guard_add",
+    "durable_revoke_executor",
+    "durable_sweep",
+    "durable_kill_agent_sessions",
+    "durable_agent_killed",
+];
+/** Functions keeping EXECUTE for PUBLIC/anon/authenticated: none in M1. */
+export const EXECUTE_EXCEPTIONS = [];
+export const M1_TRIGGERS = [
+    { name: "durable_agent_killed", table: "agents", fn: "durable_agent_killed" },
+];
+/** Not in M1: must be absent from the catalog. */
+export const ABSENT_FUNCTIONS_M1 = [
+    "durable_assert_attach",
+    "durable_set_org_policy",
+    "durable_test_barrier",
+];
+/** Down migrations refuse while any of these has rows. */
+export const LEDGER_TABLES = [
+    "agent_sessions",
+    "agent_session_events",
+    "agent_session_charters",
+    "durable_approvals",
+    "durable_approval_attestations",
+    "agent_executors",
+];
+export const MIGRATION_LOCK_TIMEOUT = "3s";
+/** The durable_cell_state seed: exactly one row per canonical cell id. */
+export function cellSeedRows() {
+    return CANONICAL_CELL_IDS.map((cell_id) => ({
+        cell_id,
+        cell_generation: 0,
+        unattended_enabled: false,
+        lease_seconds: LEASE_SECONDS_DEFAULT,
+        resume_reset_seconds: RESUME_RESET_SECONDS_DEFAULT,
+    }));
+}
+/**
+ * durable_approvals.subject (kind owner_mutation) and its target rule (ruling 32.12). An enrollment
+ * approval is a row with subject 'enrollment' and a NULL session_id, scoped by org_id and
+ * requested_by; a grant_renewal names its executor inside the subject. Every other subject names a
+ * session, question included (ruling 34.06.1.1: the question wait's approval, appended). A1
+ * mirrors both CHECKs. The journal's approval.requested refs enum does not gain
+ * 'enrollment' (events.ts): executor.enrolled is journaled into no session (C10-R0(f)).
+ */
+export const DURABLE_APPROVAL_SUBJECTS = [
+    "unlock",
+    "unpause_contained",
+    "grant_renewal",
+    "budget_raise",
+    "enrollment",
+    "question",
+];
+/** Subjects whose row may carry a NULL session_id. */
+export const DURABLE_APPROVAL_SESSIONLESS_SUBJECTS = [
+    "grant_renewal",
+    "enrollment",
+];
+const sqlList = (xs) => xs.map((x) => `'${x}'`).join(",");
+export const DURABLE_APPROVALS_SUBJECT_CHECK = `subject IN (${sqlList(DURABLE_APPROVAL_SUBJECTS)})`;
+export const DURABLE_APPROVALS_TARGET_CHECK = `subject IN (${sqlList(DURABLE_APPROVAL_SESSIONLESS_SUBJECTS)}) OR session_id IS NOT NULL`;
+/** The target CHECK as a predicate. */
+export function approvalTargetOk(subject, sessionId) {
+    return (DURABLE_APPROVAL_SESSIONLESS_SUBJECTS.includes(subject) ||
+        sessionId !== null);
+}
+/** The enrollment subject's risk_line_version: decimal text, never a number (ruling 32.30). */
+export const RISK_LINE_VERSION_TEXT_RE = /^[1-9][0-9]{0,31}$/;
+const nonEmpty = (v) => typeof v === "string" && v.length > 0;
+const uuid = (v) => typeof v === "string" && UUID_RE.test(v);
+const riskLineVersion = (v) => typeof v === "string" && RISK_LINE_VERSION_TEXT_RE.test(v);
+const SESSION_SUBJECT = { session_id: uuid };
+/** The closed subject shapes (besides `subject` itself), one per subject (ruling 32.12). */
+const SUBJECT_SHAPES = {
+    enrollment: {
+        org_id: nonEmpty,
+        owner_user_id: nonEmpty,
+        runtime: nonEmpty,
+        risk_line_version: riskLineVersion,
+    },
+    grant_renewal: { executor_id: uuid },
+    unlock: SESSION_SUBJECT,
+    unpause_contained: SESSION_SUBJECT,
+    budget_raise: SESSION_SUBJECT,
+    // ruling 34.06.1.1: a question wait parks on an open owner_mutation approval of the
+    // parking session, so its subject names that session like the other session subjects.
+    question: SESSION_SUBJECT,
+};
+/** Keys a subject may carry besides its shape, each present only with the one value it allows. */
+const OPTIONAL_SUBJECT_KEYS = {
+    enrollment: { scope: (v) => v === "org" },
+};
+/**
+ * durable_approvals.subject_hash: lowercase hex sha256 of canonicalJson(subject) (rulings 32.12,
+ * 32.30). Subjects: {subject: 'enrollment', org_id, owner_user_id, runtime, risk_line_version},
+ * {subject: 'grant_renewal', executor_id}, {subject, session_id} for the session subjects. Rejects
+ * with RangeError on an unknown subject, an extra or missing key, or a value of the wrong form.
+ * An enrollment subject may also carry scope: 'org' and nothing else (ruling 34.03.1), so an org
+ * enrollment commits the approver to a runner that can claim any pool session in the org; without
+ * it the subject, and its hash, are M1's byte for byte.
+ */
+export async function approvalSubjectHash(subject) {
+    if (subject === null || typeof subject !== "object" || Array.isArray(subject))
+        throw new RangeError("approval subject must be an object");
+    const kind = subject.subject;
+    if (typeof kind !== "string" || !Object.prototype.hasOwnProperty.call(SUBJECT_SHAPES, kind))
+        throw new RangeError(`unknown approval subject: ${String(kind)}`);
+    const shape = SUBJECT_SHAPES[kind];
+    const optional = Object.keys(OPTIONAL_SUBJECT_KEYS[kind] ?? {});
+    const keys = Object.keys(subject).filter((k) => k !== "subject" && !optional.includes(k));
+    const want = Object.keys(shape);
+    if (keys.length !== want.length || !want.every((k) => keys.includes(k)))
+        throw new RangeError(`approval subject ${kind}: keys must be exactly subject, ${want.join(", ")}`);
+    for (const k of want)
+        if (!shape[k](subject[k]))
+            throw new RangeError(`approval subject ${kind}: bad ${k}`);
+    for (const k of optional)
+        if (k in subject &&
+            !OPTIONAL_SUBJECT_KEYS[kind][k](subject[k]))
+            throw new RangeError(`approval subject ${kind}: bad ${k}`);
+    return sha256Hex(canonicalJson(subject));
+}
+// ---- Doors amendment CHECKs (rulings 34.02, 34.03, 34.06) ---------------------------------------
+/**
+ * agent_sessions_ready_ck (ruling 34.02 (1), (2)): a ready row is locked, has no reason, no home and
+ * no holder. agent_sessions_state_reason_ck gains the arm `WHEN 'ready' THEN state_reason IS NULL`
+ * (STATE_REASONS.ready), and the state CHECK lists SESSION_STATES.
+ */
+export const AGENT_SESSIONS_READY_CHECK = "state <> 'ready' OR (durable_mode = 'locked' AND state_reason IS NULL AND home_executor_id IS NULL" +
+    " AND lease_executor_id IS NULL AND lease_expires_at IS NULL AND spawn_id IS NULL AND hello_at IS NULL)";
+/**
+ * agent_sessions_wait_parked_ck (ruling 34.06 (1), (2)): ci, question and budget are valid only with
+ * state 'parked', and wait_ref is set exactly when wait_reason is one of them. The wait_reason
+ * CHECK lists WAIT_REASONS.
+ */
+export const AGENT_SESSIONS_WAIT_PARKED_CHECK = "CASE WHEN wait_reason IN ('ci','question','budget') THEN state = 'parked' AND wait_ref IS NOT NULL" +
+    " ELSE wait_ref IS NULL END";
+/** agent_executors.scope CHECK (ruling 34.03 (1)). */
+export const AGENT_EXECUTORS_SCOPE_CHECK = "scope IN ('user','org')";
+/** The ready-row CHECK as a predicate over the columns it reads. */
+export function readyRowOk(row) {
+    return (row.state !== "ready" ||
+        (row.durable_mode === "locked" &&
+            row.state_reason === null &&
+            row.home_executor_id === null &&
+            row.lease_executor_id === null &&
+            row.lease_expires_at === null &&
+            row.spawn_id === null &&
+            row.hello_at === null));
+}
+/** The wait-parked CHECK as a predicate. */
+export function waitParkedRowOk(row) {
+    return row.wait_reason !== null &&
+        PARKED_ONLY_WAIT_REASONS.includes(row.wait_reason)
+        ? row.state === "parked" && row.wait_ref !== null
+        : row.wait_ref === null;
+}

package/dist/vendor/shared/durable-contract/seal.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The durable seal round trip (S1 amendment 55, signed off by Wassim 2026-10-29; C07-R02, R13, R14).
+ * A reloaded durable seal keeps exactly what the owner sealed.
+ *
+ * The gateway seals a goal contract (its `SealedContract`, every field below). At lock the API
+ * splits it with splitSealedContract: the text goes into the encrypted Contract (envelope.ts) and
+ * everything else into the charter commitments, including `contract_hash`, the full sha256 of the
+ * sealed contract (the gateway's 16-hex x-mnemom-contract-hash is its first 16 characters). A
+ * rehydrate rebuilds the seal with sealedContractFromCharter, which returns null unless the rebuilt
+ * contract hashes to the committed contract_hash, so a reload can never serve a different contract.
+ *
+ *   Contract (ciphertext)   statement, requirements, allowed_paths, forbidden_paths, goal_id,
+ *                           work_card, shape
+ *   commitments             statement_hash, requirements_hash, contract_hash, mode, budget_usd,
+ *                           max_turns, stall_turns, active_time_limit_s (the seal's time_limit_s)
+ *
+ * The seal's sealed_at is charter v1's created_at (charterV1CreatedAt), not a commitment.
+ */
+import { type CONTRACT_MODE_VALUES, type Contract } from "./envelope.js";
+export type ContractMode = (typeof CONTRACT_MODE_VALUES)[number];
+/** The gateway's sealed goal contract, field for field (gateway/src/goal-contract.ts SealedContract). */
+export interface SealedGoalContract extends Contract {
+    max_turns?: number;
+    budget_usd?: number;
+    stall_turns?: number;
+    time_limit_s?: number;
+    mode?: ContractMode;
+}
+/** Every field the gateway hashes into a sealed contract. */
+export declare const SEALED_CONTRACT_FIELDS: readonly ["goal_id", "statement", "requirements", "allowed_paths", "forbidden_paths", "max_turns", "budget_usd", "stall_turns", "time_limit_s", "mode", "work_card", "shape"];
+/**
+ * The full sha256 the gateway's canonicalHash truncates: canonicalJson of the contract with `mode`
+ * omitted when it is "nudge" or absent (MNE-8199: the default never moves a legacy hash).
+ */
+export declare function sealedContractHash(c: SealedGoalContract): Promise<string>;
+export interface SplitSeal {
+    contract: Contract;
+    /** The seal's commitments; the lock adds pins, tool_classes, launch_spec and the wake caps. */
+    commitments: Record<string, unknown>;
+}
+/**
+ * Split a gateway seal into the encrypted Contract and its charter commitments. Null when the seal
+ * cannot be committed exactly: an unknown field, a text field the Contract refuses, or a value the
+ * commitment schema refuses (a fractional max_turns, say). Never drops a field.
+ */
+export declare function splitSealedContract(seal: SealedGoalContract): Promise<SplitSeal | null>;
+/**
+ * Rebuild the seal a charter describes from its decrypted Contract and its commitments. Null when
+ * the charter commits no contract_hash, or when the rebuilt contract does not hash to it.
+ */
+export declare function sealedContractFromCharter(contract: Contract, charter: Readonly<Record<string, unknown>>): Promise<{
+    contract: SealedGoalContract;
+    contract_hash: string;
+} | null>;

package/dist/vendor/shared/durable-contract/seal.js

@@ -0,0 +1,99 @@
+// GENERATED from shared/durable-contract/src/seal.ts by cli/scripts/sync-durable-contract.mjs; do not edit.
+/**
+ * The durable seal round trip (S1 amendment 55, signed off by Wassim 2026-10-29; C07-R02, R13, R14).
+ * A reloaded durable seal keeps exactly what the owner sealed.
+ *
+ * The gateway seals a goal contract (its `SealedContract`, every field below). At lock the API
+ * splits it with splitSealedContract: the text goes into the encrypted Contract (envelope.ts) and
+ * everything else into the charter commitments, including `contract_hash`, the full sha256 of the
+ * sealed contract (the gateway's 16-hex x-mnemom-contract-hash is its first 16 characters). A
+ * rehydrate rebuilds the seal with sealedContractFromCharter, which returns null unless the rebuilt
+ * contract hashes to the committed contract_hash, so a reload can never serve a different contract.
+ *
+ *   Contract (ciphertext)   statement, requirements, allowed_paths, forbidden_paths, goal_id,
+ *                           work_card, shape
+ *   commitments             statement_hash, requirements_hash, contract_hash, mode, budget_usd,
+ *                           max_turns, stall_turns, active_time_limit_s (the seal's time_limit_s)
+ *
+ * The seal's sealed_at is charter v1's created_at (charterV1CreatedAt), not a commitment.
+ */
+import { canonicalJson, sha256Hex } from "./canonical.js";
+import { isValidCommitment, parseContract, requirementsHash, statementHash, } from "./envelope.js";
+/** Every field the gateway hashes into a sealed contract. */
+export const SEALED_CONTRACT_FIELDS = [
+    "goal_id",
+    "statement",
+    "requirements",
+    "allowed_paths",
+    "forbidden_paths",
+    "max_turns",
+    "budget_usd",
+    "stall_turns",
+    "time_limit_s",
+    "mode",
+    "work_card",
+    "shape",
+];
+/**
+ * The full sha256 the gateway's canonicalHash truncates: canonicalJson of the contract with `mode`
+ * omitted when it is "nudge" or absent (MNE-8199: the default never moves a legacy hash).
+ */
+export async function sealedContractHash(c) {
+    const normalised = { ...c };
+    if ((c.mode ?? "nudge") === "nudge")
+        delete normalised.mode;
+    return sha256Hex(canonicalJson(normalised));
+}
+/** The commitment field each sealed ceiling is committed as. */
+const CEILINGS = [
+    ["budget_usd", "budget_usd"],
+    ["max_turns", "max_turns"],
+    ["stall_turns", "stall_turns"],
+    ["time_limit_s", "active_time_limit_s"],
+];
+/**
+ * Split a gateway seal into the encrypted Contract and its charter commitments. Null when the seal
+ * cannot be committed exactly: an unknown field, a text field the Contract refuses, or a value the
+ * commitment schema refuses (a fractional max_turns, say). Never drops a field.
+ */
+export async function splitSealedContract(seal) {
+    const known = SEALED_CONTRACT_FIELDS;
+    if (Object.keys(seal).some((k) => !known.includes(k)))
+        return null;
+    const text = {};
+    for (const k of ["statement", "requirements", "allowed_paths", "forbidden_paths", "goal_id", "work_card", "shape"])
+        if (seal[k] !== undefined)
+            text[k] = seal[k];
+    const contract = parseContract(text);
+    if (contract === null)
+        return null;
+    const commitments = {
+        statement_hash: await statementHash(contract.statement),
+        requirements_hash: await requirementsHash(contract.requirements),
+        contract_hash: await sealedContractHash(seal),
+    };
+    if (seal.mode !== undefined)
+        commitments.mode = seal.mode;
+    for (const [from, to] of CEILINGS)
+        if (seal[from] !== undefined)
+            commitments[to] = seal[from];
+    return isValidCommitment(commitments) ? { contract, commitments } : null;
+}
+/**
+ * Rebuild the seal a charter describes from its decrypted Contract and its commitments. Null when
+ * the charter commits no contract_hash, or when the rebuilt contract does not hash to it.
+ */
+export async function sealedContractFromCharter(contract, charter) {
+    if (typeof charter.contract_hash !== "string")
+        return null;
+    const seal = { ...contract };
+    if (typeof charter.mode === "string")
+        seal.mode = charter.mode;
+    for (const [to, from] of CEILINGS) {
+        const v = charter[from];
+        if (typeof v === "number")
+            seal[to] = v;
+    }
+    const hash = await sealedContractHash(seal);
+    return hash === charter.contract_hash ? { contract: seal, contract_hash: hash } : null;
+}

package/dist/vendor/shared/durable-contract/secret-scope.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The secret scope (BACKBONE line 69; C04-P01; wave-0 fix ruling 2), frozen as data so every lane
+ * greps the same list: which secrets, in which encodings, may appear on which surfaces. None may
+ * appear on any surface, with one allowance: the executor key in EXECUTOR_STATE_FILE (mode 0600).
+ * The owner's own files in `excluded_paths` are outside the scan. Paths are HOME-relative.
+ */
+export declare const SECRET_KINDS: readonly ["owner_jwt", "owner_refresh_token", "owner_api_key", "lease_key", "executor_key", "enroll_poll_secret"];
+export type SecretKind = (typeof SECRET_KINDS)[number];
+export declare const SECRET_ENCODINGS: readonly ["raw", "base64", "base64url", "hex", "percent", "json_escaped"];
+export type SecretEncoding = (typeof SECRET_ENCODINGS)[number];
+/** Where no secret may appear. */
+export declare const SECRET_SURFACES: readonly ["host_files", "process_env", "process_argv", "tmux_global_env", "tmux_session_env", "tmux_scrollback", "tmpdir_files", "seat_transcripts", "durable_spans", "durable_logs"];
+export type SecretSurface = (typeof SECRET_SURFACES)[number];
+export declare const SECRET_SCOPE: Readonly<{
+    secrets: readonly ["owner_jwt", "owner_refresh_token", "owner_api_key", "lease_key", "executor_key", "enroll_poll_secret"];
+    encodings: readonly ["raw", "base64", "base64url", "hex", "percent", "json_escaped"];
+    surfaces: readonly ["host_files", "process_env", "process_argv", "tmux_global_env", "tmux_session_env", "tmux_scrollback", "tmpdir_files", "seat_transcripts", "durable_spans", "durable_logs"];
+    allow: readonly Readonly<{
+        secret: SecretKind;
+        path: ".mnemom/durable/executor-state.json";
+    }>[];
+    excluded_paths: readonly string[];
+}>;
+/**
+ * Every encoded form of one secret value the scan greps for, keyed by encoding (UTF-8 bytes;
+ * base64 and base64url without padding variants, so a padded copy still matches as a substring).
+ */
+export declare function secretEncodings(value: string): Readonly<Record<SecretEncoding, string>>;