@mnmal-ai/cortext 0.0.0 → 1.0.0-alpha.0

package/dist/src-BKaGTnRw.js

@@ -0,0 +1,1931 @@
+import { A as CORTEXT_PROMOTED_COLUMNS, D as ARCHITECTURE_NAMESPACE, O as CORTEXT_COORDINATOR_NAME, _ as TODO_LIFECYCLE_VOCAB, g as AGENT_MESSAGE_STATUS_VOCAB, k as CORTEXT_NAMESPACE, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_PRIORITY_VOCAB, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
+import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, applyUpdatePatch, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
+
+//#region src/auth-policy.ts
+/**
+* The default: anonymous read/create/update under
+* attribute mode, identity-gated hard-deletes. Archive stays the open soft path.
+*/
+const DEFAULT_AUTH = Object.freeze({
+	reads: "open",
+	writes: "open",
+	deletes: "identity"
+});
+const rank = (mode) => mode === "identity" ? 1 : 0;
+/** Strictness must be non-decreasing along reads → writes → deletes. */
+function isMonotonicAuth(auth) {
+	return rank(auth.reads) <= rank(auth.writes) && rank(auth.writes) <= rank(auth.deletes);
+}
+/**
+* Map a posture to the plugin-level policy list. Combinator order matters:
+* `or()` returns the LAST deny verbatim, so the deny arm's actionable reason
+* surfaces on denial instead of requireIdentity's terse default.
+*
+* Monotonicity makes the mapping a ladder — the strictest gated surface
+* determines the single composed policy:
+*   reads gated   → everything requires identity
+*   writes gated  → create/update/delete require identity, reads stay open
+*   deletes gated → only the destructive verbs require identity
+*   fully open    → no policy contributed at all
+*/
+function buildAuthPolicies(auth) {
+	if (!isMonotonicAuth(auth)) throw new Error(`cortext: auth posture must be monotonic (reads ≤ writes ≤ deletes in strictness); got reads=${auth.reads}, writes=${auth.writes}, deletes=${auth.deletes}`);
+	if (auth.reads === "identity") return [or(requireIdentity(), denyAll("cortext: all access requires an authenticated identity (auth.reads=identity)"))];
+	if (auth.writes === "identity") return [or(requireIdentity(), denyVerbs([
+		"create",
+		"update",
+		"delete"
+	], "cortext: writes require an authenticated identity (auth.writes=identity; reads stay open)"))];
+	if (auth.deletes === "identity") return [or(requireIdentity(), denyVerbs(["delete"], "cortext: deletes require an authenticated identity (auth.deletes=identity)"))];
+	return [];
+}
+
+//#endregion
+//#region src/compact.ts
+/**
+* Acked agent mail older than this is archived by the compact sweep (fan-out
+* writes one row per recipient, and without a policy the
+* acked majority accumulates in the mailbox scan forever). 30 days keeps a
+* generous correspondence-history window; `acked` means the recipient
+* explicitly actioned it, and `archived` only drops it from inbox-shaped
+* queries — the row remains queryable.
+*/
+const MAIL_ARCHIVE_AFTER_MS = 2592e6;
+/** The ids a Decision's `supersedes` names, whichever shape it was stored in. */
+function supersededIds(d) {
+	const v = d.supersedes;
+	if (typeof v === "string" && v !== "") return [v];
+	if (Array.isArray(v)) return v.filter((x) => typeof x === "string" && x !== "");
+	return [];
+}
+async function mutateBatch(engine, ns, mutationName, paramsList, fields) {
+	if (paramsList.length === 0) return;
+	const key = formatQualifiedKey(ns, mutationName);
+	const selected = selectAll(fields);
+	const failed = (await engine.mutate({
+		frame: { [key]: paramsList.map((params) => ({
+			params,
+			fields: selected
+		})) },
+		ctx: {
+			...makeCtx(ns, "mutate"),
+			identity: {
+				kind: "system",
+				id: "cortext:compact",
+				grants: { [ns]: [
+					"read",
+					"mutate",
+					"admin"
+				] }
+			}
+		}
+	})).errors?.[0];
+	if (failed !== void 0) throw new Error(`cortext compact: batched ${mutationName} failed: ${failed.message}`);
+}
+/**
+* Hard ceiling on per-call compaction reads. Without this, queryAll
+* pulls every SessionLog + Decision row into Node.js memory regardless of
+* corpus size — fine at 100s of rows, an OOM risk at 10k+ once
+* multi-project use accumulates. 10k is well above any realistic active
+* corpus and still bounds memory at single-MB. Beyond it, compaction
+* processes the most-recent 10k window per call; subsequent invocations
+* pick up the rest. Project-scoped compaction (passing a `where: { project }`
+* filter) is the proper long-term fix.
+*/
+const MAX_COMPACT_SCAN = 1e4;
+async function runCompact(engine, ns, retention, dryRun, opts = {}) {
+	const sessions = await queryAll(engine, ns, "SessionLog", {
+		where: { archived: { eq: false } },
+		limit: MAX_COMPACT_SCAN,
+		orderBy: [{ createdAt: "desc" }, { id: "desc" }]
+	}, ["id", "project"]);
+	const keptPerProject = /* @__PURE__ */ new Map();
+	const retained = [];
+	const toArchive = [];
+	for (const session of sessions) {
+		const group = session.project ?? "";
+		const kept = keptPerProject.get(group) ?? 0;
+		if (kept < retention) {
+			keptPerProject.set(group, kept + 1);
+			retained.push(session);
+		} else toArchive.push(session);
+	}
+	const archivedSessionIds = new Set(toArchive.map((s) => s.id));
+	const decisions = await queryAll(engine, ns, "Decision", {
+		where: { archived: { eq: false } },
+		limit: MAX_COMPACT_SCAN
+	}, [
+		"id",
+		"sessionId",
+		"supersedes"
+	]);
+	const superseded = new Set(decisions.flatMap(supersededIds));
+	const decisionsToArchive = decisions.filter((d) => d.sessionId != null && archivedSessionIds.has(d.sessionId) || superseded.has(d.id));
+	if (!dryRun) {
+		await mutateBatch(engine, ns, "updateDecision", decisionsToArchive.map((d) => ({
+			id: d.id,
+			archived: true
+		})), ["id"]);
+		await mutateBatch(engine, ns, "updateSessionLog", toArchive.map((s) => ({
+			id: s.id,
+			archived: true
+		})), ["id"]);
+	}
+	const mailCutoff = new Date(Date.now() - (opts.mailMaxAgeMs ?? MAIL_ARCHIVE_AFTER_MS));
+	const ackedMail = await queryAll(engine, ns, "AgentMessage", {
+		where: {
+			status: { eq: "acked" },
+			archived: { eq: false },
+			updatedAt: { lt: mailCutoff.toISOString() }
+		},
+		limit: MAX_COMPACT_SCAN
+	}, ["id"]);
+	if (!dryRun) await mutateBatch(engine, ns, "updateAgentMessage", ackedMail.map((m) => ({
+		id: m.id,
+		archived: true
+	})), ["id"]);
+	return {
+		dryRun,
+		sessionsArchived: toArchive.length,
+		decisionsArchived: decisionsToArchive.length,
+		sessionsRetained: retained.length,
+		messagesArchived: ackedMail.length
+	};
+}
+function parseBody(req) {
+	const raw = req.body;
+	if (raw === null || raw.length === 0) return { dryRun: false };
+	const text = raw.toString("utf8");
+	if (text.trim().length === 0) return { dryRun: false };
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (err) {
+		return { error: err instanceof Error ? err.message : "invalid JSON" };
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { dryRun: false };
+	return { dryRun: parsed.dryRun === true };
+}
+function registerCompactRoute(router, ctx, retention, namespace, auth = DEFAULT_AUTH) {
+	router.post("/compact", async (req) => {
+		if (auth.writes === "identity") {
+			const caps = grantedIn(grantOf(req.identity ?? null), namespace);
+			if (!caps.includes("admin") && !caps.includes("*")) return jsonResponse(403, {
+				code: "operator_only",
+				message: `POST /compact archives across every project and needs an operator (admin in '${namespace}')`
+			});
+		}
+		const parsed = parseBody(req);
+		if ("error" in parsed) return jsonResponse(400, {
+			code: "bad_request",
+			message: parsed.error
+		});
+		const result = await runCompact(ctx.engine, namespace, retention, parsed.dryRun);
+		return jsonResponse(200, result);
+	});
+}
+
+//#endregion
+//#region src/kernel-invariants.ts
+/**
+* Boot-time reporting for the namespaces the kernel cannot follow.
+*
+* The cortext kernel plugin scopes every CHECK constraint and partial index
+* with a `namespace = <literal>` predicate, baked in at authoring time because
+* a migration cannot read config (`KernelMigrationContext` is `{ sql, metric }`).
+* So a deployment that renames a namespace gets NO invariants, silently: a
+* constraint scoped to a namespace with no rows passes trivially, and an index
+* whose predicate no query can satisfy is just a heap scan.
+*
+* This warns rather than refuses. Per-cohort context stores are a designed
+* capability (`bootstrap-config.test.ts` names `codex` as an override target),
+* so the knob keeps working and the consequence is stated at boot.
+*
+* The kernel's own `invariant-audit.ts` reads the catalog too, but answers a
+* different question. HERE (coordinator): "the namespace I am CONFIGURED for
+* is not the one the kernel scopes to"; only the coordinator knows
+* `cfg.namespace`. THERE (kernel): "my scope literal is declared by no
+* coordinator", plus objects dropped, left NOT VALID, or re-scoped.
+*
+* Neither re-scopes automatically; that is the opt-in `./repair.ts`, because a
+* store that ran unscoped may hold rows violating the vocabulary, so
+* `ADD CONSTRAINT` can fail on exactly the databases a repair exists for.
+* Parameterising the literals alone would not help either: migrations are
+* recorded once by `id`, so a later rename never re-scopes existing objects.
+*/
+/**
+* Which configured namespaces the kernel does not cover. Empty is the
+* healthy case.
+*
+* Pure and separately exported so the condition can be tested directly rather
+* than through a lifecycle harness — the reporting below is a thin shell over
+* it.
+*/
+function uncoveredNamespaces(cfg) {
+	return [{
+		field: "namespace",
+		configured: cfg.namespace,
+		scopedTo: CORTEXT_NAMESPACE
+	}, {
+		field: "architectureNamespace",
+		configured: cfg.architectureNamespace,
+		scopedTo: ARCHITECTURE_NAMESPACE
+	}].filter((c) => c.configured !== c.scopedTo);
+}
+/** The operator-facing sentence for one uncovered namespace. */
+function uncoveredNamespaceMessage({ field, configured, scopedTo }) {
+	return `[cortext] ${field} is '${configured}', but the cortext kernel scopes its constraints and indexes to '${scopedTo}'. Every kernel invariant for '${configured}' is therefore INACTIVE — Todo/AgentMessage vocabularies are unenforced, the mailbox inbox index covers no rows, and AgentIdentity.kid uniqueness is NOT held. Writes succeed and queries answer, so nothing else will report this. Use '${scopedTo}', or accept the loss deliberately.`;
+}
+/**
+* Emit the warnings at plugin start. Returns what it reported, so a caller (or
+* a test) can assert on it without capturing the console.
+*
+* Both sinks on purpose: `metric` is the
+* structured channel an operator can alert on, and the console line is what
+* actually appears in the server journal next to substrate's own loader
+* warnings, where someone will see it.
+*/
+function reportUncoveredNamespaces(cfg, metric, warn = console.warn) {
+	const uncovered = uncoveredNamespaces(cfg);
+	for (const entry of uncovered) {
+		metric("cortext.kernel_invariants_inactive", { ...entry });
+		warn(uncoveredNamespaceMessage(entry));
+	}
+	return uncovered;
+}
+
+//#endregion
+//#region src/participants.ts
+/** Whether the caller holds `admin` (or `*`) in the namespace it is calling. */
+function isOperator(ctx) {
+	const caps = grantedIn(grantOf(ctx.identity), ctx.namespace);
+	return caps.includes("admin") || caps.includes("*");
+}
+function rowId(args) {
+	const raw = args.params?.id;
+	return typeof raw === "string" || typeof raw === "number" ? raw : void 0;
+}
+function callerKid(ctx) {
+	const id = ctx.identity?.id;
+	return typeof id === "string" && id !== "" ? id : null;
+}
+/**
+* AgentMessage update/delete: the sender, the recipient, or an operator.
+* The sender is the key that signed the send (`_metadata.createdBy`); the
+* recipient is the kid on the addressed directory row. Archiving someone
+* else's mail hides it from their inbox, and deleting it destroys it, so
+* neither is a bystander's call.
+*/
+function messageParticipantsOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const message = await resolveEntityRow(ds, "AgentMessage", id);
+		if (message === null) return inner(ctx, args);
+		const caller = callerKid(ctx);
+		const sender = message._metadata?.createdBy?.id;
+		let recipient = null;
+		if (typeof message.recipient === "string" && message.recipient !== "") {
+			const { rows } = await ds.read("AgentIdentity", { id: message.recipient });
+			recipient = rows[0]?.kid ?? null;
+		}
+		if (caller !== null && (caller === sender || caller === recipient)) return inner(ctx, args);
+		throw new ResolverFrameError("not_participant", `${name}: only this message's sender ('${String(sender ?? "unknown")}') or recipient ('${String(recipient ?? "unknown")}'), or an operator, may change or delete it`, { id: message.id });
+	};
+}
+/**
+* AgentIdentity update: the identity itself (the caller's kid is the row's
+* kid) or an operator. `kid` is the row's identity, so changing it is an
+* operator act even on your own row: otherwise a row could be renamed onto a
+* kid whose mail it would then receive.
+*/
+function identitySelfOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const row = await resolveEntityRow(ds, "AgentIdentity", id);
+		if (row === null) return inner(ctx, args);
+		const params = args.params ?? {};
+		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
+		if (callerKid(ctx) === row.kid) return inner(ctx, args);
+		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
+	};
+}
+/** AgentIdentity delete: operators only. Mail hangs off these rows. */
+function operatorOnly(name, inner) {
+	return async (ctx, args) => {
+		if (isOperator(ctx)) return inner(ctx, args);
+		throw new ResolverFrameError("operator_only", `${name}: only an operator may delete an identity row; retire it with active: false instead`, {});
+	};
+}
+
+//#endregion
+//#region src/mailbox.ts
+const TYPE = "AgentMessage";
+const DIRECTORY_TYPE = "AgentIdentity";
+/**
+* Fields whose writes are reserved to the transition mutations. Checked by
+* `mailboxWriteGuard` against update params; there is no create verb to deny
+* wholesale — the mutation is not registered.
+*/
+const TRANSITION_FIELDS = [
+	"status",
+	"ackedBy",
+	"ackedAt"
+];
+/**
+* Fields written once, by sendAgentMessage, and never edited. `instance`
+* is the sender's own account of which writer it was; letting a later update
+* change it would make it say whatever the last editor wanted.
+*/
+const SEND_ONLY_FIELDS = ["instance"];
+/**
+* The only fields updateAgentMessage may write. Everything else a
+* message carries is fixed at send; a denylist would let any agent rewrite
+* `recipient` to its own identity row and then ack, or edit `body` after delivery.
+* `id` addresses the row; `_`-prefixed keys are request controls, not fields.
+*/
+const UPDATABLE_FIELDS = /* @__PURE__ */ new Set([
+	"id",
+	"archived",
+	"tags"
+]);
+/**
+* sendAgentMessage's introspection/registration param schema. `to`
+* wire-accepts a single kid string, a list of kids, or '*' (broadcast to
+* every active identity except the sender); declared as list-of-string for
+* introspection, the resolver normalises at runtime.
+*/
+const SEND_PARAMS = {
+	to: field.list(field.string()),
+	subject: field.string(),
+	body: field.string({ indexed: false }),
+	inReplyTo: field.string({ nullable: true }),
+	tags: field.list(field.string(), { nullable: true }),
+	instance: field.string({ nullable: true })
+};
+/**
+* Runtime allowlist derived from the declared params — one
+* authoritative declaration, so the schema can never advertise a param the
+* resolver rejects (or vice versa).
+*/
+const SEND_PARAM_NAMES = new Set(Object.keys(SEND_PARAMS));
+/**
+* Upper bound on a directory read. The cohort is ~10 identities; 1000 exists
+* so a `'*'` fan-out can never be silently truncated by a kernel default
+* limit, not because that scale is anticipated.
+*/
+const DIRECTORY_READ_LIMIT = 1e3;
+/**
+* Policy over AgentMessage's hand-registered surface — `installMailboxMutations`
+* composes it with the plugin policy, the way defineNamespace composes type
+* policies for autoCRUD types. Retires the direct write paths:
+*   - create → always denied. The verb is not registered (autoCrud:false), so
+*     this branch only fires if something re-registers it; the schema never
+*     advertises it.
+*   - update → only archived and tags may change; a transition field
+*     or anything fixed at send is denied, each with its own reason.
+*/
+const mailboxWriteGuard = (ctx, args) => {
+	const ns = ctx.namespace;
+	if (ctx.verb === "create") return {
+		allow: false,
+		reason: `${ns}/AgentMessage: direct createAgentMessage is retired — use ${ns}/sendAgentMessage (kid-addressed; to: '<kid>' | ['<kid>', …] | '*')`
+	};
+	if (ctx.verb === "update") {
+		const params = args.params ?? {};
+		for (const fieldName of TRANSITION_FIELDS) if (fieldName in params) return {
+			allow: false,
+			reason: `${ns}/AgentMessage: '${fieldName}' transitions only via ${ns}/markAgentMessageRead / ${ns}/ackAgentMessage (recipient-only)`
+		};
+		for (const fieldName of SEND_ONLY_FIELDS) if (fieldName in params) return {
+			allow: false,
+			reason: `${ns}/AgentMessage: '${fieldName}' is set once by ${ns}/sendAgentMessage and cannot be edited`
+		};
+		for (const fieldName of Object.keys(params)) {
+			if (UPDATABLE_FIELDS.has(fieldName) || fieldName.startsWith("_")) continue;
+			return {
+				allow: false,
+				reason: `${ns}/AgentMessage: '${fieldName}' is fixed at send; updateAgentMessage may change only archived and tags. Reply with ${ns}/sendAgentMessage instead.`
+			};
+		}
+	}
+	return { allow: true };
+};
+/**
+* Resolve the `to` param into directory rows, validate-first so a bad address
+* rejects before any row is written:
+*   - wildcard (`['*']` canonical; bare `'*'` accepted as sugar) → every
+*     active identity except the sender; empty → no_recipients. Mixing the
+*     wildcard with explicit kids is ambiguous → wildcard_mixed.
+*   - kid / kid[] → deduped; unknown kid → unknown_recipient; inactive →
+*     inactive_recipient.
+*/
+/**
+* Whether `to:'*'` should fan a copy out to this identity.
+*
+* ABSENT AND NULL BOTH MEAN ELIGIBLE, and that is the whole reason this is a
+* predicate rather than a `where` clause. `broadcastEligible` is declared
+* `default: true`, but a default is applied on WRITE — every AgentIdentity row
+* created before the field existed carries no such key and reads back as
+* `null`.
+*
+* So `where: { broadcastEligible: { eq: true } }` would match NONE of them
+* (and `eq: null` matches nothing either, under SQL three-valued logic),
+* turning every broadcast into `no_recipients`. Opting OUT has to be an
+* explicit `false`.
+*
+* Exported because it cannot be exercised through `createAgentIdentity`: that
+* path applies the declared default, so a row written through the schema always
+* carries the key. The pre-field shape is only reachable directly, which is
+* what `mailbox-broadcast-eligibility.test.ts` does.
+*/
+function isBroadcastEligible(row) {
+	return row.broadcastEligible !== false;
+}
+async function resolveRecipients(ds, to, senderId, ns) {
+	const list = Array.isArray(to) ? to : [to];
+	if (list.includes("*")) {
+		if (list.length > 1) throw new ResolverFrameError("wildcard_mixed", "sendAgentMessage: the '*' wildcard cannot be combined with explicit kids — it already reaches every active identity", { field: "to" });
+		const { rows } = await ds.read(DIRECTORY_TYPE, {
+			where: { active: { eq: true } },
+			limit: DIRECTORY_READ_LIMIT
+		});
+		const others = rows.filter((r) => r.kid !== senderId);
+		const eligible = others.filter(isBroadcastEligible);
+		if (eligible.length === 0) throw new ResolverFrameError("no_recipients", others.length === 0 ? "sendAgentMessage: to:'*' found no active cortext/AgentIdentity besides the sender" : `sendAgentMessage: to:'*' found ${others.length} active cortext/AgentIdentity besides the sender, but all of them have broadcastEligible: false`, {
+			sender: senderId,
+			active: others.length
+		});
+		return eligible;
+	}
+	if (list.length === 0 || !list.every((k) => typeof k === "string" && k.length > 0)) throw new ResolverFrameError("missing_required_field", "sendAgentMessage: params.to must be a kid, a non-empty list of kids, or ['*']", { field: "to" });
+	const kids = [...new Set(list)];
+	const { rows } = await ds.read(DIRECTORY_TYPE, {
+		where: { kid: { in: kids } },
+		limit: DIRECTORY_READ_LIMIT
+	});
+	const byKid = /* @__PURE__ */ new Map();
+	for (const r of rows) {
+		const kid = String(r.kid);
+		if (byKid.has(kid)) throw new ResolverFrameError("ambiguous_recipient", `sendAgentMessage: kid '${kid}' matches more than one ${ns}/AgentIdentity row — directory uniqueness is violated; resolve the duplicate before sending`, { kid });
+		byKid.set(kid, r);
+	}
+	return kids.map((kid) => {
+		const row = byKid.get(kid);
+		if (row === void 0) throw new ResolverFrameError("unknown_recipient", `sendAgentMessage: no ${ns}/AgentIdentity row with kid '${kid}'`, { kid });
+		if (row.active !== true) throw new ResolverFrameError("inactive_recipient", `sendAgentMessage: identity '${kid}' is inactive — messages to retired identities are refused`, { kid });
+		return row;
+	});
+}
+function sendResolver(installCtx, createMessage) {
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		for (const key of Object.keys(params)) if (!SEND_PARAM_NAMES.has(key)) throw new ResolverFrameError("unknown_field", `sendAgentMessage: unknown param '${key}'. Allowed: ${[...SEND_PARAM_NAMES].sort().join(", ")}.`, { field: key });
+		const ds = args.dataset ?? installCtx.dataset;
+		const actor = resolveIdentity(ctx);
+		const recipients = await resolveRecipients(ds, params.to, actor.id, ctx.namespace);
+		return Promise.all(recipients.map((recipient) => {
+			const rowParams = {
+				recipient: recipient.id,
+				subject: params.subject,
+				body: params.body
+			};
+			if (params.inReplyTo !== void 0) rowParams.inReplyTo = params.inReplyTo;
+			if (params.tags !== void 0) rowParams.tags = params.tags;
+			if (params.instance !== void 0) rowParams.instance = params.instance;
+			return createMessage(ctx, {
+				...args,
+				params: rowParams
+			});
+		}));
+	};
+}
+/**
+* One entry per transition: the Record forces exhaustiveness —
+* adding a TransitionTarget without a spec is a compile error rather than a
+* silent no-op.
+*/
+const TRANSITIONS = {
+	read: {
+		mutationName: "markAgentMessageRead",
+		isNoOp: (status) => status !== "unread",
+		stamp: () => ({})
+	},
+	acked: {
+		mutationName: "ackAgentMessage",
+		isNoOp: (status) => status === "acked",
+		stamp: (actor, at) => ({
+			ackedBy: actor.id,
+			ackedAt: at
+		})
+	}
+};
+function transitionResolver(installCtx, target) {
+	const { mutationName: name, isNoOp, stamp } = TRANSITIONS[target];
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		for (const key of Object.keys(params)) if (key !== "id") throw new ResolverFrameError("unknown_param", `${name}: unknown param '${key}'. Allowed: id.`, { field: key });
+		const ds = args.dataset ?? installCtx.dataset;
+		const raw = params.id;
+		const id = typeof raw === "string" || typeof raw === "number" ? raw : void 0;
+		if (id === void 0) throw new ResolverFrameError("missing_id", `${name}: params.id is required`, { field: "id" });
+		const message = await resolveEntityRow(ds, TYPE, id);
+		if (message === null) return null;
+		const recipientId = message.recipient;
+		if (typeof recipientId !== "string" || recipientId.length === 0) throw new ResolverFrameError("no_recipient", `${name}: message has no resolvable recipient (broadcast-era or orphaned row) — transitions are recipient-only`, { id: message.id });
+		const { rows: identityRows } = await ds.read(DIRECTORY_TYPE, { id: recipientId });
+		const identityRow = identityRows[0];
+		if (identityRow === void 0) throw new ResolverFrameError("no_recipient", `${name}: the recipient identity row no longer exists`, { id: message.id });
+		const actor = resolveIdentity(ctx);
+		if (actor.id !== identityRow.kid) throw new ResolverFrameError("not_recipient", `${name}: only the recipient ('${String(identityRow.kid)}') may transition this message`, { recipient: identityRow.kid });
+		if (isNoOp(message.status)) return message;
+		const at = ctx.now.toISOString();
+		return applyUpdatePatch(ds, TYPE, message.id, {
+			status: target,
+			...stamp(actor, at)
+		}, ctx, args.onWrite);
+	};
+}
+/**
+* Register AgentMessage's whole surface. The type declares `autoCrud: false`,
+* so defineNamespace installed nothing for it and this function owns the lot:
+* the type entry, get/update/delete — same resolvers and same params/returns
+* installAutoCrud would have emitted — plus the custom family (sendAgentMessage,
+* markAgentMessageRead, ackAgentMessage). What is deliberately absent is
+* `createAgentMessage`: an advertised mutation the route only denies teaches
+* callers to build a shape that cannot work, and the refusal reads like a
+* grant problem. Field defs arrive pre-augmentation; the reserved engine
+* fields are added here, the way defineNamespace adds them for autoCRUD types.
+*/
+function installMailboxMutations(ctx, messageFields) {
+	const fields = {
+		...messageFields,
+		...RESERVED_AUTOCRUD_FIELDS
+	};
+	const writePolicy = ctx.pluginPolicy === void 0 ? mailboxWriteGuard : and(ctx.pluginPolicy, mailboxWriteGuard);
+	ctx.registry.register(TYPE, {
+		resolver: listResolver(TYPE, ctx.dataset, { fields }),
+		kind: "type",
+		policy: writePolicy,
+		fields
+	});
+	ctx.registry.register(`get${TYPE}`, {
+		resolver: getResolver(TYPE, ctx.dataset),
+		kind: "mutation",
+		verb: "get",
+		params: { id: field.string() },
+		returns: field.struct(fields, { nullable: true }),
+		policy: writePolicy,
+		fields
+	});
+	ctx.registry.register(`update${TYPE}`, {
+		resolver: messageParticipantsOnly(ctx, `update${TYPE}`, updateResolver(TYPE, ctx.dataset, ctx.edges, { fields })),
+		kind: "mutation",
+		verb: "update",
+		params: {
+			id: field.string(),
+			...fields
+		},
+		returns: field.struct(fields, { nullable: true }),
+		policy: writePolicy,
+		fields
+	});
+	ctx.registry.register(`delete${TYPE}`, {
+		resolver: messageParticipantsOnly(ctx, `delete${TYPE}`, deleteResolver(TYPE, ctx.dataset, ctx.edges)),
+		kind: "mutation",
+		verb: "delete",
+		params: { id: field.string() },
+		returns: field.struct({
+			id: field.string(),
+			deleted: field.boolean()
+		}),
+		policy: writePolicy
+	});
+	const createMessage = createResolverWithEdges(TYPE, ctx.dataset, ctx.edges, { fields });
+	const requireSender = or(requireIdentity(), denyAll("sendAgentMessage requires an authenticated identity — the sender is the signed principal (spec §3)"));
+	const sendPolicy = ctx.pluginPolicy !== void 0 ? and(ctx.pluginPolicy, requireSender) : requireSender;
+	const transitionPolicy = ctx.pluginPolicy;
+	const messageStruct = field.struct(fields);
+	ctx.registry.register("sendAgentMessage", {
+		resolver: sendResolver(ctx, createMessage),
+		kind: "mutation",
+		verb: "create",
+		params: SEND_PARAMS,
+		returns: field.list(messageStruct),
+		policy: sendPolicy,
+		fields
+	});
+	for (const [target, spec] of Object.entries(TRANSITIONS)) ctx.registry.register(spec.mutationName, {
+		resolver: transitionResolver(ctx, target),
+		kind: "mutation",
+		verb: "update",
+		params: { id: field.string() },
+		returns: field.struct(fields, { nullable: true }),
+		...transitionPolicy !== void 0 ? { policy: transitionPolicy } : {},
+		fields
+	});
+}
+
+//#endregion
+//#region src/nl-rulings.ts
+/**
+* How people talk about cortext, for substrate's NL parser and judge. Curated
+* operator rulings, kept here so the eval and production read one copy, owned
+* by the namespace. Declared via `defineNamespace` annotations; substrate's NL
+* layer validates them and the runtime can override per key.
+*/
+const CORTEXT_NL_RULINGS = {
+	unscopedTypes: [
+		"AgentIdentity",
+		"AgentMessage",
+		"Skill"
+	],
+	liveStatus: { Todo: "open" },
+	timeField: { SessionLog: "startedAt" },
+	typeAliases: {
+		inbox: "AgentMessage",
+		mail: "AgentMessage",
+		agents: "AgentIdentity",
+		agent: "AgentIdentity",
+		session: "SessionLog",
+		sessions: "SessionLog",
+		anchor: "AnchorIntent",
+		rule: "AgentRule",
+		rules: "AgentRule",
+		task: "Todo",
+		tasks: "Todo",
+		decide: "Decision",
+		decided: "Decision"
+	},
+	fieldAliases: {
+		repo: "project",
+		repository: "project"
+	},
+	valueAliases: {
+		"in force": [{
+			type: "Decision",
+			field: "status",
+			eq: "active"
+		}],
+		"signal-gated": [{
+			type: "Todo",
+			field: "title",
+			startsWith: "[SG]"
+		}],
+		ship: [{
+			type: "Todo",
+			field: "resolution",
+			eq: "completed"
+		}],
+		shipped: [{
+			type: "Todo",
+			field: "resolution",
+			eq: "completed"
+		}],
+		drop: [{
+			type: "Todo",
+			field: "resolution",
+			in: ["wont_do", "obsolete"]
+		}],
+		dropped: [{
+			type: "Todo",
+			field: "resolution",
+			in: ["wont_do", "obsolete"]
+		}]
+	},
+	typeNotes: {
+		SessionLog: "a record of one working session: what was done, when, on which branch",
+		Decision: "a choice that was made, with its rationale",
+		Todo: "a tracked piece of work",
+		Memory: "a durable fact an agent recorded to remember",
+		AgentMessage: "mail between agents; the sender is createdById",
+		AgentIdentity: "a registered agent: kid (name@host), display name, project",
+		Concept: "an operational concept, with a kind",
+		AgentRule: "a standing rule agents follow"
+	}
+};
+
+//#endregion
+//#region src/namespace.ts
+/**
+* Decision lifecycle states this vocabulary DOCUMENTS. ADVISORY, not enforced,
+* like `AgentRule.category`. This is a list, not a census: nothing reconciles
+* it against the store, so it never claims what is "in use".
+*
+* A free string is the honest encoding of a taxonomy nobody designed. An enum
+* freezes it, and agents then either invent undeclared synonyms or pick the
+* nearest legal word. `open` names a decision recorded before it was made.
+*
+* Nothing branches on `status` today (cold-start projects and renders it), but
+* that is not the argument: `status` is a conventionally mechanical name, so a
+* future consumer is likely to branch on it.
+*
+* THE DIRECTION MATTERS. Widening cannot invalidate stored data; it only
+* surprises readers. Narrowing STRANDS rows — readable, not round-trippable,
+* and selectively so, since a partial update avoiding the field still succeeds
+* while a read-modify-write client gets `invalid_enum_value` on a row it never
+* touched. So re-adding `field.enum` here later is not a symmetric undo. Do
+* not do it.
+*
+* Add to this list when a genuinely NEW state earns its place; it feeds the
+* onboarding contract, so what is here is what an agent is taught. `accepted`
+* is deliberately an alias of `active` rather than a state of its own.
+*/
+const DECISION_STATUS_VOCAB = [
+	"open",
+	"active",
+	"superseded",
+	"deferred"
+];
+/**
+* Synonyms the server normalises on every write and filter. `field.vocab` with
+* `strict: false` is NOT the enum warned against above: unknown values are
+* still admitted, so nothing narrows and nothing strands. It only maps the
+* words agents reach for onto the state they mean. `proposed` is a decision
+* recorded before it was made, which is what `open` documents.
+*/
+const DECISION_STATUS_ALIASES = {
+	accepted: "active",
+	adopted: "active",
+	decided: "active",
+	proposed: "open"
+};
+/**
+* Words agents reach for when a Todo stops, mapped onto lifecycle + outcome.
+* Each closing word sets `status: closed` AND the resolution it
+* means, so `status: done` still works and now records WHY. A caller that
+* also sends a contradicting `resolution` is refused (`conflicting_implication`).
+*/
+const TODO_STATUS_ALIASES = {
+	done: "closed",
+	finished: "closed",
+	completed: "closed",
+	shipped: "closed",
+	cancelled: "closed",
+	dropped: "closed",
+	superseded: "closed",
+	not_started: "open"
+};
+const TODO_STATUS_IMPLIES = {
+	done: { resolution: "completed" },
+	finished: { resolution: "completed" },
+	completed: { resolution: "completed" },
+	shipped: { resolution: "completed" },
+	cancelled: { resolution: "wont_do" },
+	dropped: { resolution: "wont_do" },
+	superseded: { resolution: "superseded" }
+};
+const TODO_RESOLUTION_ALIASES = {
+	done: "completed",
+	shipped: "completed",
+	wontfix: "wont_do",
+	declined: "wont_do",
+	dup: "duplicate",
+	moot: "obsolete"
+};
+/**
+* AgentRule severity — CLOSED, unlike `category`. Cold-start branches on it:
+* `must` rules render in the binding brief. `high` and `medium` are aliases
+* rather than stranded values.
+*/
+const AGENT_RULE_SEVERITY_VOCAB = ["must", "should"];
+const AGENT_RULE_SEVERITY_ALIASES = {
+	high: "must",
+	medium: "should"
+};
+/**
+* AgentRule categories. ADVISORY, not enforced.
+*
+* An enum here arrives narrower than the data and freezes the taxonomy. The
+* damage is not a write rejection anyone notices but SILENT SUBSTITUTION:
+* agents pick the nearest legal word and move on, and the taxonomy flattens
+* toward whatever is allowed. Nothing consumes `category` mechanically —
+* cold-start projects it and renders it, never groups or filters on it — and
+* `ArchitectureConcern.category` in this same file is a free string too.
+* Widening an enum would only move the wall to the next category.
+*
+* Add to this list when a genuinely new category earns its place; it feeds the
+* onboarding contract so agents see the real taxonomy. Do NOT re-add
+* `field.enum` over it.
+*/
+const AGENT_RULE_CATEGORY_VOCAB = [
+	"git",
+	"testing",
+	"style",
+	"process",
+	"tooling",
+	"communication",
+	"investigation",
+	"migration-patterns",
+	"permissions",
+	"scope-discipline",
+	"side-findings",
+	"verification"
+];
+/**
+* HostInstall.fragmentState: the cold-start fragment drift check's own verdict,
+* plus `source` for the repo that ships the fragment.
+*/
+const HOST_INSTALL_FRAGMENT_STATES = [
+	"current",
+	"stale",
+	"missing",
+	"undigested",
+	"uncomparable",
+	"source",
+	"absent"
+];
+/** HostInstall's per-check verdicts: the worst finding each check produced. */
+const HOST_INSTALL_CHECK_STATES = [
+	"ok",
+	"warn",
+	"unknown"
+];
+const CONCEPT_NAME_TTL_MS = 6e4;
+/** Long-form length past which `embed.source` appends the long form to the synopsis. */
+const LONGFORM_EMBED_CHARS = 1200;
+function buildClaudeNamespace(ns) {
+	/**
+	* Concept names are near-static (concepts evolve rarely) but `Decision.embed.source`
+	* reads one on every Decision write — the most common write in this namespace —
+	* purely to inline a string into the embedding text. Cache the
+	* (conceptId → name) lookup with a short TTL: collapses repeated reads on the
+	* write path; a renamed Concept re-embeds on the next Decision write past the TTL.
+	*
+	* The cache lives in this closure — not at module level — so each namespace
+	* instance owns its cache lifecycle and `createCortextPlugin` stays the pure
+	* factory index.ts claims: no state shared across engines or
+	* surviving engine teardown in multi-engine processes.
+	*/
+	const conceptNameCache = /* @__PURE__ */ new Map();
+	async function resolveConceptName(ctx, conceptId) {
+		const now = Date.now();
+		const hit = conceptNameCache.get(conceptId);
+		if (hit !== void 0 && hit.expiresAt > now) return hit.name;
+		for (const [key, entry] of conceptNameCache) if (entry.expiresAt <= now) conceptNameCache.delete(key);
+		const concept = await ctx.read(ns, "Concept", { id: conceptId });
+		const name = concept !== null && typeof concept.name === "string" ? concept.name : null;
+		conceptNameCache.set(conceptId, {
+			name,
+			expiresAt: now + CONCEPT_NAME_TTL_MS
+		});
+		return name;
+	}
+	/**
+	* Embedding text for a synopsis-bearing row: the synopsis, followed by
+	* `long` once `long` passes `LONGFORM_EMBED_CHARS`; `long` alone when there
+	* is no synopsis. A long row's synopsis is a handle, not a summary (median
+	* 10% of the long form), so embedding it alone leaves the body unreachable
+	* by dense recall.
+	*/
+	function embedText(synopsis, long) {
+		const syn = typeof synopsis === "string" ? synopsis : "";
+		if (syn === "") return long;
+		return long.length > LONGFORM_EMBED_CHARS ? `${syn}\n\n${long}` : syn;
+	}
+	/**
+	* Join the parts of a `lexical.source` into one indexable string.
+	*
+	* Empty parts are dropped rather than left as blank paragraphs, and an
+	* all-empty result becomes `null` — the same un-indexable sentinel
+	* `embed.source` uses, so a row with no long-form text is left out of the
+	* index rather than entered at the empty string.
+	*/
+	function lexicalText(...parts) {
+		const kept = parts.filter((p) => typeof p === "string" && p.length > 0);
+		return kept.length === 0 ? null : kept.join("\n\n");
+	}
+	const types = {
+		SessionLog: {
+			fields: {
+				branch: field.string(),
+				startedAt: field.date(),
+				summary: field.string({ indexed: false }),
+				synopsis: field.string({ nullable: true }),
+				decisionsCount: field.number(),
+				packages: field.string(),
+				body: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				tags: field.list(field.string(), { nullable: true }),
+				archived: field.boolean({ default: false }),
+				project: field.string({ nullable: true })
+			},
+			embed: { source: (r) => embedText(r.synopsis, typeof r.summary === "string" ? r.summary : "") },
+			/**
+			* The LEXICAL index takes the long form, where `embed` above takes the
+			* handle. That asymmetry is the whole point of the arm: `embed.source`
+			* is conventionally `synopsis || <long form>`, and a dense vector cannot
+			* recover the proper nouns the synopsis drops — most synopses drop a
+			* capitalised token that IS present in the long form.
+			*
+			* The synopsis is included ALONGSIDE the long form rather than replaced by
+			* it. A rare token in a synopsis is worth finding too, and unlike vector
+			* concatenation this is not dilution: a lexical index has no centroid to
+			* pull off-target, so more text only adds reachable tokens and costs index
+			* size.
+			*
+			* Note `lexical.source` takes `(row)` only — there is no `ctx`, so unlike
+			* `embed.source` it cannot follow a crossRef to inline related text.
+			*/
+			lexical: { source: (r) => lexicalText(r.synopsis, r.summary, r.body) }
+		},
+		Decision: {
+			fields: {
+				topic: field.string(),
+				choice: field.string(),
+				rationale: field.string({ indexed: false }),
+				sessionId: field.crossRef(ns, "SessionLog", {
+					nullable: true,
+					onDelete: "set_null"
+				}),
+				supersedes: field.crossRef(ns, "Decision", {
+					nullable: true,
+					onDelete: "set_null",
+					spread: true
+				}),
+				status: field.vocab(DECISION_STATUS_VOCAB, {
+					aliases: DECISION_STATUS_ALIASES,
+					strict: false,
+					default: "active"
+				}),
+				tags: field.list(field.string(), { nullable: true }),
+				revisitWhen: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				establishesConcept: field.crossRef(ns, "Concept", {
+					nullable: true,
+					onDelete: "set_null",
+					spread: true,
+					expandCrossType: true
+				}),
+				archived: field.boolean({ default: false }),
+				project: field.string({ nullable: true })
+			},
+			embed: { source: async (r, ctx) => {
+				const base = `${typeof r.topic === "string" ? r.topic : ""}\n\n${typeof r.choice === "string" ? r.choice : ""}\n\n${typeof r.rationale === "string" ? r.rationale : ""}`;
+				if (ctx === void 0 || typeof r.establishesConcept !== "string") return base;
+				const conceptName = await resolveConceptName(ctx, r.establishesConcept);
+				return conceptName !== null ? `${base}\n\n[concept] ${conceptName}` : base;
+			} },
+			/**
+			* Decision is the one type whose `embed.source` is ALREADY the long form,
+			* so it gains least here — declared anyway, deliberately, so that "which
+			* types are lexically indexed" has no per-type exception to remember.
+			*
+			* It is not a no-op: `embed.source` inlines the linked Concept's NAME via
+			* `ctx.read`, and `lexical.source` gets no `ctx`, so the two texts differ
+			* on any Decision carrying `establishesConcept`.
+			*/
+			lexical: { source: (r) => lexicalText(r.topic, r.choice, r.rationale) }
+		},
+		Todo: { fields: {
+			title: field.string(),
+			area: field.string(),
+			status: field.vocab(TODO_LIFECYCLE_VOCAB, {
+				aliases: TODO_STATUS_ALIASES,
+				implies: TODO_STATUS_IMPLIES
+			}),
+			resolution: field.vocab(TODO_RESOLUTION_VOCAB, {
+				aliases: TODO_RESOLUTION_ALIASES,
+				nullable: true
+			}),
+			priority: field.enum(TODO_PRIORITY_VOCAB),
+			notes: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			blockedBy: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			revisitWhen: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			body: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			tags: field.list(field.string(), {
+				nullable: true,
+				indexed: true
+			}),
+			archived: field.boolean({ default: false }),
+			targetDate: field.date({ nullable: true }),
+			implementsDecision: field.crossRef(ns, "Decision", {
+				nullable: true,
+				onDelete: "set_null"
+			}),
+			owner: field.crossRef(ns, "AgentIdentity", {
+				nullable: true,
+				onDelete: "set_null"
+			}),
+			project: field.string({ nullable: true })
+		} },
+		AgentRule: {
+			fields: {
+				rule: field.string({ indexed: false }),
+				category: field.vocab(AGENT_RULE_CATEGORY_VOCAB, { strict: false }),
+				severity: field.vocab(AGENT_RULE_SEVERITY_VOCAB, {
+					aliases: AGENT_RULE_SEVERITY_ALIASES,
+					nullable: true
+				}),
+				active: field.boolean(),
+				pinned: field.boolean({ nullable: true }),
+				synopsis: field.string({ nullable: true }),
+				rationale: field.string({ indexed: false }),
+				expressesConcept: field.crossRef(ns, "Concept", {
+					nullable: true,
+					onDelete: "set_null"
+				}),
+				archived: field.boolean({ default: false }),
+				project: field.string({ nullable: true })
+			},
+			embed: { source: (r) => {
+				return `${embedText(r.synopsis, typeof r.rule === "string" ? r.rule : "")}${typeof r.category === "string" && r.category.length > 0 ? ` [${r.category}]` : ""}`;
+			} },
+			/**
+			* `rationale` is included beside `rule` on the same reasoning as
+			* SessionLog.body: it is long-form unindexed
+			* prose carrying proper nouns, and the no-dilution argument above means
+			* including it costs only index size.
+			*
+			* `category` is deliberately NOT folded in the way `embed.source` folds
+			* it. There it is a topical anchor that steers a vector; here it would
+			* just be a token repeated across every rule in the category, which is
+			* what a filter on the indexed `category` field already does better.
+			*/
+			lexical: { source: (r) => lexicalText(r.synopsis, r.rule, r.rationale) }
+		},
+		CouncilSession: { fields: {
+			question: field.string({ indexed: false }),
+			slug: field.string(),
+			context: field.string({ indexed: false }),
+			options: field.string({ indexed: false }),
+			agreement: field.string({ indexed: false }),
+			disagreement: field.string({ indexed: false }),
+			blindSpots: field.string({ indexed: false }),
+			verdict: field.string({ indexed: false }),
+			verdictAlignment: field.string(),
+			sessionLogId: field.crossRef(ns, "SessionLog", {
+				nullable: true,
+				onDelete: "set_null"
+			}),
+			date: field.date(),
+			project: field.string({ nullable: true })
+		} },
+		CouncilAdvisor: { fields: {
+			councilSessionId: field.crossRef(ns, "CouncilSession", {
+				nullable: true,
+				onDelete: "cascade"
+			}),
+			role: field.string(),
+			response: field.string({ indexed: false }),
+			recommendation: field.string({ indexed: false })
+		} },
+		Memory: {
+			fields: {
+				name: field.string(),
+				description: field.string(),
+				type: field.string(),
+				tags: field.list(field.string(), { nullable: true }),
+				body: field.string({ indexed: false }),
+				synopsis: field.string({ nullable: true }),
+				archived: field.boolean({ default: false }),
+				project: field.string({ nullable: true })
+			},
+			embed: { source: (r) => {
+				const desc = typeof r.description === "string" ? r.description : "";
+				const body = typeof r.body === "string" ? r.body : "";
+				return embedText(r.synopsis, `${desc}\n\n${body}`);
+			} },
+			lexical: { source: (r) => lexicalText(r.synopsis, r.description, r.body) }
+		},
+		AnchorIntent: {
+			fields: {
+				synopsis: field.string(),
+				body: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				authoredBy: field.struct({ kind: field.string() }),
+				project: field.string({ nullable: true }),
+				archived: field.boolean({ default: false })
+			},
+			embed: { source: (r) => embedText(r.synopsis, typeof r.body === "string" ? r.body : "") },
+			lexical: { source: (r) => lexicalText(r.synopsis, r.body) }
+		},
+		Concept: {
+			fields: {
+				name: field.string(),
+				description: field.string(),
+				kind: field.string(),
+				body: field.string({ indexed: false }),
+				tags: field.list(field.string(), { nullable: true }),
+				synopsis: field.string({ nullable: true }),
+				archived: field.boolean({ default: false }),
+				project: field.string({ nullable: true })
+			},
+			embed: { source: (r) => {
+				const desc = typeof r.description === "string" ? r.description : "";
+				const body = typeof r.body === "string" ? r.body : "";
+				return embedText(r.synopsis, `${desc}\n\n${body}`);
+			} },
+			lexical: { source: (r) => lexicalText(r.synopsis, r.description, r.body) }
+		},
+		ConceptLink: { fields: {
+			fromConcept: field.crossRef(ns, "Concept", { onDelete: "cascade" }),
+			toConcept: field.crossRef(ns, "Concept", { onDelete: "cascade" }),
+			kind: field.string(),
+			note: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			archived: field.boolean({ default: false }),
+			project: field.string({ nullable: true })
+		} },
+		Skill: { fields: {
+			name: field.string(),
+			description: field.string(),
+			body: field.string({ indexed: false }),
+			version: field.string(),
+			active: field.boolean()
+		} },
+		AgentIdentity: { fields: {
+			kid: field.string(),
+			project: field.string({ nullable: true }),
+			host: field.string(),
+			displayName: field.string({ nullable: true }),
+			description: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			active: field.boolean({ default: true }),
+			broadcastEligible: field.boolean({ default: true }),
+			roaming: field.boolean({ default: false })
+		} },
+		AgentMessage: {
+			autoCrud: false,
+			fields: {
+				shortId: field.number({
+					indexed: true,
+					readonly: true
+				}),
+				recipient: field.crossRef(ns, "AgentIdentity", {
+					nullable: true,
+					onDelete: "set_null"
+				}),
+				subject: field.string(),
+				body: field.string({ indexed: false }),
+				status: field.enum(AGENT_MESSAGE_STATUS_VOCAB, { default: "unread" }),
+				ackedBy: field.string({ nullable: true }),
+				ackedAt: field.date({
+					nullable: true,
+					serverSet: "both"
+				}),
+				inReplyTo: field.crossRef(ns, "AgentMessage", {
+					nullable: true,
+					onDelete: "set_null",
+					spread: true
+				}),
+				tags: field.list(field.string(), { nullable: true }),
+				instance: field.string({ nullable: true }),
+				archived: field.boolean({ default: false })
+			}
+		},
+		HostInstall: { fields: {
+			key: field.string(),
+			host: field.string(),
+			hostReported: field.string(),
+			project: field.string(),
+			kid: field.string({ nullable: true }),
+			harness: field.string(),
+			pluginVersion: field.string({ nullable: true }),
+			fragmentVersion: field.string({ nullable: true }),
+			fragmentDigest: field.string({ nullable: true }),
+			fragmentState: field.enum(HOST_INSTALL_FRAGMENT_STATES),
+			refreshedAt: field.date(),
+			pinState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+			pinNote: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			mcpJsonState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+			mcpJsonNote: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			authorityState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+			authorityNote: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			settingsState: field.enum(HOST_INSTALL_CHECK_STATES, { nullable: true }),
+			settingsNote: field.string({
+				nullable: true,
+				indexed: false
+			}),
+			settingsEnv: field.json({ nullable: true })
+		} }
+	};
+	const definition = defineNamespace(ns, types, {
+		annotations: { nl: CORTEXT_NL_RULINGS },
+		promotedColumns: CORTEXT_PROMOTED_COLUMNS
+	});
+	const baseInstall = definition.install.bind(definition);
+	return {
+		...definition,
+		install(ctx) {
+			baseInstall(ctx);
+			installMailboxMutations(ctx, definition.types.AgentMessage.fields);
+			for (const [name, wrap] of [["updateAgentIdentity", (r) => identitySelfOnly(ctx, "updateAgentIdentity", r)], ["deleteAgentIdentity", (r) => operatorOnly("deleteAgentIdentity", r)]]) {
+				const entry = ctx.registry.get(name);
+				if (entry === void 0) throw new Error(`cortext: autoCRUD did not register ${name}`);
+				ctx.registry.replace(name, {
+					...entry,
+					resolver: wrap(entry.resolver)
+				});
+			}
+		}
+	};
+}
+/** The canonical ordered list of type names registered by this namespace. */
+const CLAUDE_TYPE_NAMES = [
+	"SessionLog",
+	"Decision",
+	"Todo",
+	"AgentRule",
+	"CouncilSession",
+	"CouncilAdvisor",
+	"Memory",
+	"AnchorIntent",
+	"Concept",
+	"ConceptLink",
+	"Skill",
+	"AgentIdentity",
+	"AgentMessage",
+	"HostInstall"
+];
+/**
+* Architecture namespace — Claude-lineage code-review findings. Kept separate
+* from the claude context namespace so lifecycle (compaction, retention,
+* audit) differs: architectural findings outlive session-scoped rationale.
+*
+* Single type today (ArchitectureConcern). Notes:
+*   - `archived` is `field.boolean()` to match every other type that carries
+*     archived state.
+*   - `supersedes` is a self-ref `field.crossRef` edge with `set_null` —
+*     a concern survives the one it superseded going away.
+*/
+function buildArchitectureNamespace(ns) {
+	return defineNamespace(ns, { ArchitectureConcern: { fields: {
+		title: field.string(),
+		status: field.string(),
+		archived: field.boolean({ default: false }),
+		category: field.string(),
+		evidence: field.string({ indexed: false }),
+		proposal: field.string({ indexed: false }),
+		severity: field.string(),
+		supersedes: field.crossRef(ns, "ArchitectureConcern", {
+			nullable: true,
+			onDelete: "set_null"
+		}),
+		revisitWhen: field.string({
+			nullable: true,
+			indexed: false
+		}),
+		affectsTypes: field.string(),
+		discoveredIn: field.string(),
+		affectsPackages: field.string(),
+		project: field.string({ nullable: true })
+	} } }, { promotedColumns: CORTEXT_PROMOTED_COLUMNS });
+}
+const ARCHITECTURE_TYPE_NAMES = ["ArchitectureConcern"];
+
+//#endregion
+//#region src/onboard.ts
+/**
+* Render a controlled vocabulary as the agent-facing union string the onboard
+* surface uses (e.g. `'open' | 'done'`). Sourced from the kernel's exported
+* vocab constants so this description can't drift from the `field.enum` + pg
+* CHECK that actually enforce it.
+*/
+function vocabUnion(values) {
+	return values.map((v) => `'${v}'`).join(" | ");
+}
+/** Render an alias table as `'a' → 'b', …` for the onboarding contract. */
+function aliasList(aliases) {
+	return Object.entries(aliases).map(([alias, canonical]) => `'${alias}' → '${canonical}'`).join(", ");
+}
+/**
+* The AgentMessage write surface is its custom mutation family, NOT autoCRUD:
+* the type declares `autoCrud: false`, so `createAgentMessage` is never
+* registered and the schema never advertises it (sendAgentMessage is the only
+* send path, with kid addressing + '*' fan-out), and status transitions go
+* through markAgentMessageRead / ackAgentMessage exclusively. updateAgentMessage survives for
+* non-transition fields (tags, archived); deleteAgentMessage is standard.
+*/
+const AGENT_MESSAGE_MUTATIONS = [
+	"sendAgentMessage",
+	"markAgentMessageRead",
+	"ackAgentMessage",
+	"updateAgentMessage",
+	"deleteAgentMessage"
+];
+/**
+* Derived from CLAUDE_TYPE_NAMES so a newly registered type cannot be
+* silently missing from the advertised mutation surface — the same
+* drift-proofing move vocabUnion makes for vocabularies.
+*/
+function buildMutations() {
+	const mutations = {};
+	for (const typeName of CLAUDE_TYPE_NAMES) mutations[typeName] = typeName === "AgentMessage" ? AGENT_MESSAGE_MUTATIONS : [
+		`create${typeName}`,
+		`update${typeName}`,
+		`delete${typeName}`
+	];
+	return mutations;
+}
+function buildBody(namespace, retention) {
+	return {
+		plugin: "cortext",
+		namespace,
+		description: "Persistent context store for Claude Code sessions",
+		retention,
+		types: {
+			SessionLog: {
+				purpose: "One entry per development session or stable milestone",
+				fields: {
+					id: "auto-generated",
+					branch: "git branch name",
+					startedAt: "ISO 8601 UTC datetime",
+					summary: "one-paragraph session summary (not indexed)",
+					decisionsCount: "count of decisions made this session",
+					packages: "comma-separated list of packages touched",
+					archived: "true if compacted"
+				},
+				writeWhen: ["At each stable milestone (PR merged, feature complete, significant fix)", "Not just at session end — a dropped session should lose at most one milestone"]
+			},
+			Decision: {
+				purpose: "Architectural and design choices worth preserving across sessions",
+				fields: {
+					id: "auto-generated",
+					topic: "short topic label",
+					choice: "what was decided",
+					rationale: "why (not indexed)",
+					sessionId: "UUID crossRef to SessionLog, set_null on delete (nullable)",
+					createdAt: "ISO 8601 UTC datetime",
+					supersedes: "UUID crossRef to the Decision this replaces, set_null on delete (nullable)",
+					status: `open vocabulary, not enforced; states this vocabulary documents (not a reading of what is stored): ${DECISION_STATUS_VOCAB.join(", ")}; synonyms normalised by the server: ${aliasList(DECISION_STATUS_ALIASES)}`,
+					revisitWhen: "trigger condition for revisiting a deferred decision (not indexed)",
+					archived: "true if compacted"
+				},
+				writeWhen: ["Immediately when a decision is made — do not defer to session end"]
+			},
+			Todo: {
+				purpose: "Tracked work items and deferred tasks",
+				fields: {
+					id: "auto-generated",
+					title: "short description",
+					area: "free-text area/component label (e.g. 'substrate-core', 'infrastructure'); not schema-enforced",
+					status: `${vocabUnion(TODO_LIFECYCLE_VOCAB)} (lifecycle only); closing words set the resolution too: ${aliasList(TODO_STATUS_ALIASES)}`,
+					resolution: `${vocabUnion(TODO_RESOLUTION_VOCAB)} (nullable): why a closed Todo stopped`,
+					priority: vocabUnion(TODO_PRIORITY_VOCAB),
+					notes: "additional detail (not indexed)",
+					blockedBy: "free-text description of the blocker (not indexed)",
+					implementsDecision: "UUID crossRef to Decision, set_null on delete (nullable)",
+					createdAt: "ISO 8601 UTC datetime",
+					archived: "true if compacted"
+				},
+				writeWhen: ["On creation — do not batch to session end", "Freely without asking — when a gap, improvement, or deferred item is identified"]
+			},
+			AgentRule: {
+				purpose: "Operational rule for agent behaviour, loaded into context at session start",
+				fields: {
+					id: "auto-generated",
+					rule: "full rule body (not indexed)",
+					category: `open vocabulary; categories in use: ${AGENT_RULE_CATEGORY_VOCAB.join(", ")}`,
+					severity: `${vocabUnion(AGENT_RULE_SEVERITY_VOCAB)} (nullable); synonyms normalised by the server: ${aliasList(AGENT_RULE_SEVERITY_ALIASES)}`,
+					active: "only active rules load at cold-start",
+					pinned: "always-on rules exempt from salience ranking; absent = unpinned (nullable)",
+					synopsis: "short retrieval-optimized summary; primary embedding source (nullable)",
+					rationale: "why the rule exists (not indexed)",
+					expressesConcept: "UUID crossRef to Concept, set_null on delete (nullable)",
+					archived: "true if retired"
+				},
+				writeWhen: ["When the user gives durable operational guidance — corrections and confirmed approaches alike"]
+			},
+			CouncilSession: {
+				purpose: "One pressure-test deliberation: question, advisor synthesis, verdict",
+				fields: {
+					id: "auto-generated",
+					question: "the decision under pressure-test (not indexed)",
+					slug: "short kebab-case handle",
+					context: "framing given to the advisors (not indexed)",
+					options: "candidate options considered (not indexed)",
+					agreement: "where the advisors agreed (not indexed)",
+					disagreement: "where the advisors split (not indexed)",
+					blindSpots: "risks no option addresses (not indexed)",
+					verdict: "final synthesis (not indexed)",
+					verdictAlignment: "how aligned the verdict is with advisor consensus",
+					sessionLogId: "UUID crossRef to SessionLog, set_null on delete (nullable)",
+					date: "ISO 8601 date of the deliberation"
+				},
+				writeWhen: ["At the end of a council/pressure-test run, with one CouncilAdvisor row per advisor"]
+			},
+			CouncilAdvisor: {
+				purpose: "One advisor's response within a CouncilSession",
+				fields: {
+					id: "auto-generated",
+					councilSessionId: "UUID crossRef to CouncilSession, cascade on delete (nullable)",
+					role: "advisor persona / thinking style",
+					response: "full advisor response (not indexed)",
+					recommendation: "the advisor's bottom-line recommendation (not indexed)"
+				},
+				writeWhen: ["Alongside its parent CouncilSession — an advisor row is meaningless without one"]
+			},
+			Memory: {
+				purpose: "Persistent agent note that survives across conversations",
+				fields: {
+					id: "auto-generated",
+					name: "canonical human label; deduped by convention, not schema",
+					description: "one-line hook shown in the session-start index",
+					type: "category: 'user' | 'feedback' | 'project' | 'reference' (convention, not schema-enforced)",
+					body: "full memory body (not indexed)",
+					synopsis: "short retrieval-optimized compression; preferred embedding source (nullable)",
+					archived: "true if retired"
+				},
+				writeWhen: ["When a durable fact, preference, or lesson surfaces that the repo itself does not record"]
+			},
+			AnchorIntent: {
+				purpose: "Topical anchor for hybrid recall — \"what I am focused on right now\"",
+				fields: {
+					id: "auto-generated",
+					synopsis: "short intent summary (1-3 sentences); primary embedding source",
+					body: "optional long-form continuation (not indexed, nullable)",
+					authoredBy: "provenance struct, starts with kind: 'user' | 'agent'",
+					project: "project scope; null = cross-project",
+					archived: "true if retired"
+				},
+				writeWhen: ["At session boot if the newest anchor is stale, and at any material focus shift", "The newest non-archived row in scope IS the current anchor — there is no active flag"]
+			},
+			Concept: {
+				purpose: "Operational semantics of a domain entity — the conceptual layer above types",
+				fields: {
+					id: "auto-generated",
+					name: "canonical human label; deduped by write-path convention",
+					description: "one-line hook for the cold-start frame",
+					kind: "domain classifier (e.g. 'type', 'protocol', 'pattern', 'role', 'convention'); free text",
+					body: "full operational semantics (not indexed)",
+					synopsis: "short embedding-side compression (nullable)",
+					archived: "true if retired"
+				},
+				writeWhen: ["When operational semantics stabilise around an entity worth teaching future sessions"]
+			},
+			ConceptLink: {
+				purpose: "Typed edge between two Concepts",
+				fields: {
+					id: "auto-generated",
+					fromConcept: "UUID crossRef to the source Concept, cascade on delete",
+					toConcept: "UUID crossRef to the target Concept, cascade on delete",
+					kind: "edge kind: 'depends_on' | 'specializes' | 'see_also' | 'extends' (convention, not schema-enforced)",
+					note: "optional free-text annotation (not indexed, nullable)"
+				},
+				writeWhen: ["When a relationship between concepts carries operational meaning"]
+			},
+			Skill: {
+				purpose: "Reusable agent-behaviour definition (cross-project)",
+				fields: {
+					id: "auto-generated",
+					name: "skill name referenced by disk-side pointer stubs",
+					description: "when to invoke",
+					body: "full skill body (not indexed)",
+					version: "skill version string",
+					active: "inactive skills are retired"
+				},
+				writeWhen: ["When authoring or revising a reusable agent behaviour"]
+			},
+			AgentIdentity: {
+				purpose: "Directory of registered agent identities — the social/discovery layer over _system/Key auth",
+				fields: {
+					id: "auto-generated",
+					kid: "wire identity (e.g. 'peer-claude@host-a'); matches a registered _system/Key kid by convention",
+					project: "repo basename; null = cross-cutting/fleet identity",
+					host: "machine hostname",
+					displayName: "optional human-friendly name (nullable)",
+					description: "optional blurb (not indexed, nullable)",
+					active: "retired/revoked identities flip false",
+					broadcastEligible: "false = a to:'*' broadcast skips this identity",
+					roaming: "true = works whichever repo it is sent into on its own host (no project); the fleet audit accepts it as any repo's HostInstall writer there"
+				},
+				writeWhen: ["On identity registration (normally via /substrate-setup or substrate-admin register)"]
+			},
+			AgentMessage: {
+				purpose: "Durable agent-to-agent mail (1:1 + cohort fan-out)",
+				fields: {
+					id: "auto-generated",
+					recipient: "UUID crossRef to AgentIdentity, set_null on delete (nullable). Address by kid via sendAgentMessage; the sender is NOT a field — it is _metadata.createdBy, server-stamped from the signed principal",
+					subject: "message subject",
+					body: "message body (not indexed)",
+					status: `${vocabUnion(AGENT_MESSAGE_STATUS_VOCAB)} — recipient-only lifecycle, transitioned via markAgentMessageRead / ackAgentMessage exclusively`,
+					ackedBy: "ack attribution kid, server-stamped by ackAgentMessage (nullable)",
+					ackedAt: "ack timestamp, server-stamped by ackAgentMessage (nullable)",
+					inReplyTo: "UUID crossRef to the AgentMessage this replies to, set_null on delete (nullable)",
+					archived: "true once compacted (acked mail past the retention window) or manually archived"
+				},
+				writeWhen: ["Send via sendAgentMessage with `to` as a kid list ('*' fans out to all active identities except the sender)", "Recipients mark lifecycle with markAgentMessageRead / ackAgentMessage"]
+			},
+			HostInstall: {
+				purpose: "What one host has installed for one repo under one harness, upserted by the cold-start each session; check refreshedAt before trusting it (fresh < 24h, quiet < 7d, stale beyond)",
+				fields: {
+					id: "auto-generated",
+					key: "`<host>/<project>/<harness>`, unique; the upsert key",
+					host: "normalised hostname (lowercase, domain dropped)",
+					hostReported: "raw hostname as the host reported it",
+					project: "repo basename",
+					kid: "the identity the repo signs as (nullable)",
+					harness: "claude-code | opencode | hook",
+					pluginVersion: "plugin version that served the session (nullable)",
+					fragmentVersion: "installed conventions fragment version (nullable)",
+					fragmentDigest: "installed conventions fragment digest (nullable)",
+					fragmentState: `${vocabUnion(HOST_INSTALL_FRAGMENT_STATES)} — the cold-start's fragment drift verdict`,
+					refreshedAt: "last cold-start report, written only by the cold-start; the liveness signal",
+					pinState: `${vocabUnion(HOST_INSTALL_CHECK_STATES)} — marketplace pin vs the served plugin (nullable; claude-code only)`,
+					pinNote: "the pin check's worst finding (nullable)",
+					mcpJsonState: `${vocabUnion(HOST_INSTALL_CHECK_STATES)} — the repo's .mcp.json (nullable)`,
+					mcpJsonNote: "the .mcp.json check's worst finding (nullable)",
+					authorityState: `${vocabUnion(HOST_INSTALL_CHECK_STATES)} — whether the key works and its grant covers cortext (nullable)`,
+					authorityNote: "the authority check's worst finding (nullable)",
+					settingsState: `${vocabUnion(HOST_INSTALL_CHECK_STATES)} — settings.local.json parses and enables the MCP server (nullable)`,
+					settingsNote: "the settings check's worst finding (nullable)",
+					settingsEnv: "json — allowlisted non-secret switch values, plus whether the identity keys are set (nullable)"
+				},
+				writeWhen: ["Written by the cold-start of every session with an agent identity; agents read it, they do not write it"]
+			}
+		},
+		mutations: buildMutations(),
+		endpoints: {
+			query: {
+				method: "POST",
+				path: "/substrate/v1/query"
+			},
+			mutate: {
+				method: "POST",
+				path: "/substrate/v1/mutate"
+			},
+			compact: {
+				method: "POST",
+				path: "/substrate/v1/plugins/cortext/compact"
+			},
+			ws: {
+				path: "/substrate/v1/ws",
+				namespace
+			}
+		},
+		contextLoading: { onSessionStart: {
+			description: "Load recent context at the start of each session",
+			query: {
+				SessionLog: {
+					params: { limit: 3 },
+					fields: {
+						id: true,
+						branch: true,
+						startedAt: true,
+						summary: true,
+						archived: true
+					}
+				},
+				Decision: {
+					params: { limit: 80 },
+					fields: {
+						id: true,
+						topic: true,
+						choice: true,
+						rationale: true,
+						sessionId: true,
+						status: true,
+						revisitWhen: true,
+						archived: true
+					}
+				},
+				Todo: {
+					params: { limit: 50 },
+					fields: {
+						id: true,
+						title: true,
+						area: true,
+						status: true,
+						priority: true,
+						notes: true,
+						blockedBy: true,
+						archived: true
+					}
+				}
+			},
+			surfaceToUser: [
+				"The 3 most recent non-archived SessionLog entries",
+				"Non-archived Decisions",
+				"Todos with status 'open' or 'blocked'",
+				"Skip archived records silently"
+			]
+		} },
+		compaction: {
+			description: "Archives old sessions and their decisions, keeping the most recent N live",
+			default: {
+				retention,
+				route: "POST /substrate/v1/plugins/cortext/compact"
+			},
+			dryRun: {
+				body: { dryRun: true },
+				description: "Preview without committing"
+			}
+		}
+	};
+}
+function registerOnboardRoute(router, _ctx, retention, namespace) {
+	const body = buildBody(namespace, retention);
+	const serialised = Buffer.from(JSON.stringify(body), "utf8");
+	router.get("/onboard", () => {
+		return {
+			status: 200,
+			headers: JSON_HEADERS,
+			body: serialised
+		};
+	});
+}
+
+//#endregion
+//#region src/release-surface.ts
+/**
+* The plugin-facing surface, snapshotted so a release can be SIZED rather than
+* judged.
+*
+* ## Why this exists
+*
+* A release-class guard that defines the surface as a list of paths passes a
+* major as a patch with a green check the moment a type moves out of those
+* paths: `git diff` on the stale path is empty, so it approves.
+*
+* cortext's propagation is heavy — a
+* `packages/cortext/src` change reaches consumers as an npm tarball loaded by
+* the substrate runtime from `SUBSTRATE_PLUGIN_DIR`, needing a publish **and** a
+* runtime deploy. npm publishes are immutable, so a mis-sized release cannot be
+* withdrawn, only superseded.
+*
+* ## Why it resolves through the code, not through paths
+*
+* A path list rots silently. This calls
+* `buildClaudeNamespace()` and walks what it returns, so the surface is
+* DERIVED from the thing it describes. A type or field cannot move out from
+* under it, because there is no "under it" — moving a declaration between files
+* changes nothing here, and that is the point.
+*
+* The committed `release-surface.json` is kept honest by
+* `test/release-surface.test.ts`, exactly as `config.schema.json` is kept
+* honest by `schema-parity.test.ts`. So the release script never has to execute
+* TypeScript or parse a declaration: it diffs two committed JSON snapshots.
+*
+* ## What counts as breaking, and why `indexed` is in here
+*
+* Removing a type or field, making an optional field REQUIRED, narrowing an
+* enum, or moving the substrate contract range are all breaks for someone holding
+* data or code against this schema.
+*
+* `indexed` is included and it is not cosmetic: un-indexing a field turns a
+* working `where` filter into an `unindexed_field` rejection. That is a
+* runtime break for a caller who changed nothing, and it would otherwise be
+* invisible to a version-bump decision.
+*/
+function reduceField(raw) {
+	const nullable = raw.nullable === true;
+	const hasDefault = Object.hasOwn(raw, "default");
+	const readonly = raw.readonly === true;
+	const serverSet = raw.serverSet !== void 0 && raw.serverSet !== false;
+	const out = {
+		kind: typeof raw.kind === "string" ? raw.kind : "unknown",
+		nullable,
+		hasDefault,
+		readonly,
+		serverSet,
+		indexed: raw.indexed === true,
+		required: !(nullable || hasDefault || readonly || serverSet)
+	};
+	if (typeof raw.type === "string") {
+		if (out.kind === "crossRef") out.target = raw.type;
+		else out.type = raw.type;
+	}
+	if (Array.isArray(raw.enum)) out.enum = [...raw.enum].sort();
+	if (out.kind === "list" && raw.of !== null && typeof raw.of === "object") {
+		const inner = raw.of;
+		if (typeof inner.type === "string") out.type = `list<${inner.type}>`;
+	}
+	return out;
+}
+/**
+* Build the canonical surface.
+*
+* Keys are sorted so the committed JSON is stable — an unstable snapshot would
+* produce diff noise on every regeneration and train its reader to skim, which
+* is the failure this whole file is guarding against one level down.
+*/
+function buildReleaseSurface(namespace = "cortext") {
+	const ns = buildClaudeNamespace(namespace);
+	const types = {};
+	for (const typeName of Object.keys(ns.types).sort()) {
+		const declared = ns.types[typeName]?.fields ?? {};
+		const fields = {};
+		for (const fieldName of Object.keys(declared).sort()) {
+			const raw = declared[fieldName];
+			if (raw === void 0) continue;
+			fields[fieldName] = reduceField(raw);
+		}
+		types[typeName] = fields;
+	}
+	return {
+		contractVersion: SUBSTRATE_CONTRACT_RANGE,
+		types
+	};
+}
+const CLASS_RANK = {
+	patch: 0,
+	minor: 1,
+	major: 2
+};
+/**
+* Classify the difference between two surfaces.
+*
+* Reports EVERY reason rather than the first, because a release usually carries
+* several and a guard that stops at one teaches its reader to fix-and-rerun
+* instead of reading.
+*/
+function classifySurfaceChange(before, after) {
+	const breaking = [];
+	const additive = [];
+	const review = [];
+	if (before.contractVersion !== after.contractVersion) breaking.push(`substrate contract range moved ${before.contractVersion} -> ${after.contractVersion}`);
+	for (const typeName of Object.keys(before.types)) {
+		if (!Object.hasOwn(after.types, typeName)) {
+			breaking.push(`type removed: ${typeName}`);
+			continue;
+		}
+		const b = before.types[typeName] ?? {};
+		const a = after.types[typeName] ?? {};
+		for (const fieldName of Object.keys(b)) {
+			const bf = b[fieldName];
+			const af = a[fieldName];
+			const at = `${typeName}.${fieldName}`;
+			if (bf === void 0) continue;
+			if (af === void 0) {
+				breaking.push(`field removed: ${at}`);
+				continue;
+			}
+			if (bf.kind !== af.kind) breaking.push(`field kind changed: ${at} ${bf.kind} -> ${af.kind}`);
+			if (bf.type !== af.type && (bf.type ?? af.type) !== void 0) breaking.push(`field type changed: ${at} ${bf.type ?? "?"} -> ${af.type ?? "?"}`);
+			if (bf.target !== af.target && (bf.target ?? af.target) !== void 0) breaking.push(`crossRef target changed: ${at} ${bf.target ?? "?"} -> ${af.target ?? "?"}`);
+			if (!bf.required && af.required) breaking.push(`field became REQUIRED: ${at}`);
+			if (bf.required && !af.required) additive.push(`field relaxed to optional: ${at}`);
+			if (bf.nullable && !af.nullable) breaking.push(`field no longer nullable: ${at}`);
+			if (bf.indexed && !af.indexed) breaking.push(`field no longer indexed: ${at}`);
+			if (!bf.indexed && af.indexed) additive.push(`field now indexed: ${at}`);
+			const bEnum = bf.enum ?? null;
+			const aEnum = af.enum ?? null;
+			if (bEnum !== null && aEnum === null) additive.push(`enum constraint dropped: ${at}`);
+			if (bEnum === null && aEnum !== null) breaking.push(`enum constraint added: ${at}`);
+			if (bEnum !== null && aEnum !== null) {
+				const removed = bEnum.filter((v) => !aEnum.includes(v));
+				const added = aEnum.filter((v) => !bEnum.includes(v));
+				if (removed.length > 0) breaking.push(`enum narrowed: ${at} lost ${removed.join(", ")}`);
+				if (added.length > 0) additive.push(`enum widened: ${at} gained ${added.join(", ")}`);
+			}
+		}
+		for (const fieldName of Object.keys(a)) {
+			if (Object.hasOwn(b, fieldName)) continue;
+			const af = a[fieldName];
+			if (af === void 0) continue;
+			const at = `${typeName}.${fieldName}`;
+			if (af.required) breaking.push(`field added as REQUIRED: ${at}`);
+			else additive.push(`field added: ${at}`);
+		}
+	}
+	for (const typeName of Object.keys(after.types)) if (!Object.hasOwn(before.types, typeName)) additive.push(`type added: ${typeName}`);
+	const bApi = before.api ?? null;
+	const aApi = after.api ?? null;
+	const bFormat = before.surfaceFormat ?? 1;
+	const aFormat = after.surfaceFormat ?? 1;
+	if (bApi !== null && aApi !== null && bFormat !== aFormat) review.push(`published-API comparison SKIPPED: surface format ${bFormat} -> ${aFormat}. The export naming scheme changed, so a diff would be noise rather than signal. Size this release from the type section above and from reading the .d.ts diff by hand.`);
+	else if (bApi !== null && aApi !== null) {
+		for (const pkg of Object.keys(bApi)) {
+			const b = bApi[pkg];
+			const a = aApi[pkg];
+			if (b === void 0) continue;
+			if (a === void 0) {
+				breaking.push(`package no longer published: ${pkg}`);
+				continue;
+			}
+			for (const name of b.exports) if (!a.exports.includes(name)) breaking.push(`export removed: ${pkg}#${name}`);
+			for (const name of a.exports) if (!b.exports.includes(name)) additive.push(`export added: ${pkg}#${name}`);
+			if (b.dtsDigest !== a.dtsDigest) review.push(`${pkg}: emitted declarations changed (${b.dtsDigest} -> ${a.dtsDigest}). A signature moved somewhere in this package. Read the .d.ts diff and decide whether it breaks a caller — this cannot tell a widened return type from a narrowed one.`);
+		}
+		for (const pkg of Object.keys(aApi)) if (!Object.hasOwn(bApi, pkg)) additive.push(`package now published: ${pkg}`);
+	}
+	return {
+		class: breaking.length > 0 ? "major" : additive.length > 0 || review.length > 0 ? "minor" : "patch",
+		breaking,
+		additive,
+		review
+	};
+}
+/** Is `proposed` at least as large as `required`? */
+function classSatisfies(proposed, required) {
+	return CLASS_RANK[proposed] >= CLASS_RANK[required];
+}
+/** The class implied by a version bump. Returns null when it is not a bump. */
+function bumpClass(from, to) {
+	const p = (v) => {
+		const [a = NaN, b = NaN, c = NaN] = v.trim().replace(/^v/, "").split(".").map(Number);
+		return [
+			a,
+			b,
+			c
+		];
+	};
+	const [fa, fb, fc] = p(from);
+	const [ta, tb, tc] = p(to);
+	if ([
+		fa,
+		fb,
+		fc,
+		ta,
+		tb,
+		tc
+	].some((n) => !Number.isFinite(n))) return null;
+	if (ta > fa) return "major";
+	if (ta === fa && tb > fb) return "minor";
+	if (ta === fa && tb === fb && tc > fc) return "patch";
+	return null;
+}
+
+//#endregion
+//#region src/todo-resolution.ts
+/** How much of the notes / body opening is read for a closure cue. */
+const OPENING = 240;
+const CUES = [
+	["duplicate", /\b(duplicate of|dup(?:e)? of|duplicates #|same (?:defect|bug|issue) as #)/i],
+	["superseded", /\b(superseded|folded into|replaced by|subsumed (?:by|into)|rolled into|merged into #)/i],
+	["obsolete", /\b(obsolete|moot|no longer (?:relevant|needed|applies|an issue)|overtaken by events|as stale\b|already fixed)/i],
+	["wont_do", /\b(won'?t[ -](?:do|fix)|wontfix|not (?:needed|worth (?:it|doing))|declined|cancell?ed|abandoned|not doing|invalid|not[ -]a[ -]bug)\b/i],
+	["completed", /\b(done|merged|shipped|landed|released|fixed|implemented|deployed|resolved|verified live|complete|completed|delivered|(?:by|via|in) PR #?\d+)\b/i]
+];
+function inferTodoResolution(todo) {
+	const opening = (t) => typeof t === "string" ? t.slice(0, OPENING) : "";
+	const text = [
+		/^\s*\[([^\]]*)\]/.exec(todo.title ?? "")?.[1] ?? "",
+		opening(todo.notes),
+		opening(todo.body)
+	].join("\n");
+	let best = null;
+	for (const [resolution, cue] of CUES) {
+		const m = cue.exec(text);
+		if (m !== null && (best === null || m.index < best.at)) best = {
+			at: m.index,
+			resolution
+		};
+	}
+	return best?.resolution ?? "unspecified";
+}
+
+//#endregion
+//#region src/index.ts
+function createCortextPlugin(cfg) {
+	return {
+		name: CORTEXT_COORDINATOR_NAME,
+		contractVersion: SUBSTRATE_CONTRACT_RANGE,
+		onStart: (ctx) => {
+			reportUncoveredNamespaces(cfg, ctx.metric);
+		},
+		namespaces: [buildClaudeNamespace(cfg.namespace), buildArchitectureNamespace(cfg.architectureNamespace)],
+		policies: buildAuthPolicies(cfg.auth ?? DEFAULT_AUTH),
+		schedule: cfg.autoCompactIntervalMs !== void 0 ? [{
+			name: `${cfg.namespace}-auto-compact`,
+			intervalMs: cfg.autoCompactIntervalMs,
+			runOnStart: false,
+			handler: async (taskCtx) => {
+				await runCompact(taskCtx.engine, cfg.namespace, cfg.compactRetention, false);
+				taskCtx.metric("compact_applied", { namespace: cfg.namespace });
+			}
+		}] : [],
+		routes: (router, routeCtx) => {
+			registerOnboardRoute(router, routeCtx, cfg.compactRetention, cfg.namespace);
+			registerCompactRoute(router, routeCtx, cfg.compactRetention, cfg.namespace, cfg.auth ?? DEFAULT_AUTH);
+		}
+	};
+}
+
+//#endregion
+export { runCompact as C, isMonotonicAuth as E, registerCompactRoute as S, buildAuthPolicies as T, TODO_RESOLUTION_ALIASES as _, classSatisfies as a, buildArchitectureNamespace as b, AGENT_RULE_CATEGORY_VOCAB as c, ARCHITECTURE_TYPE_NAMES as d, CLAUDE_TYPE_NAMES as f, HOST_INSTALL_FRAGMENT_STATES as g, HOST_INSTALL_CHECK_STATES as h, bumpClass as i, AGENT_RULE_SEVERITY_ALIASES as l, DECISION_STATUS_VOCAB as m, inferTodoResolution as n, classifySurfaceChange as o, DECISION_STATUS_ALIASES as p, buildReleaseSurface as r, registerOnboardRoute as s, createCortextPlugin as t, AGENT_RULE_SEVERITY_VOCAB as u, TODO_STATUS_ALIASES as v, DEFAULT_AUTH as w, buildClaudeNamespace as x, TODO_STATUS_IMPLIES as y };