@mnmal-ai/cortext 0.0.0 → 1.0.0-alpha.1

package/dist/kernel/cortext-namespace.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The namespace the kernel invariants are scoped to.
+ *
+ * Every CHECK constraint and partial index this plugin installs carries a
+ * `namespace = <literal>` predicate, so that a kernel-wide table
+ * (`rows`) can hold rows for unrelated namespaces without inheriting
+ * cortext's controlled vocabularies. That literal has to live in exactly one
+ * place, because getting it wrong fails SILENTLY: a constraint scoped to a
+ * namespace with no rows is not an error, it is a constraint that passes
+ * trivially, and an index whose predicate no query can satisfy is not an
+ * error either — it is a heap scan.
+ *
+ * Tests that seed rows under the namespace the migrations name cannot catch a
+ * mismatch with the one production uses, so this constant is the one copy.
+ *
+ * THE CONFIGURABILITY GAP, and what is actually done about it.
+ *
+ * The coordinator's namespaces are operator-configurable, while
+ * KernelMigrationContext exposes only `sql` and `metric` — a migration
+ * cannot read config. So these constants track the DEFAULTS, and a deployment
+ * that renames a namespace would get no kernel invariants at all.
+ *
+ * Parameterising the literals does not fix that. Migrations are recorded once
+ * by `id` in migrations and `apply` runs only when the id is absent, so
+ * a later rename can never retroactively re-scope objects already created. It
+ * would produce correct FRESH installs and silently-wrong RENAMED ones, which
+ * is worse than today because it reads as solved.
+ *
+ * The fix is reconciliation against the configured namespace. `onKernelReady`
+ * carries a `sql` handle and plugin-attributed coordinator namespaces, so it
+ * is possible, but it is opt-in (`./repair.ts`): a store that ran unscoped may
+ * hold rows violating the vocabulary, so `ADD CONSTRAINT` can fail on exactly
+ * the databases a repair exists for.
+ *
+ * So what ships is REPORTING, not reconciliation, in two places that answer
+ * different questions: the kernel's `./invariant-audit.ts` reads the catalog
+ * at boot (objects absent, misscoped, or NOT VALID), and the coordinator's
+ * `onStart` compares the CONFIGURED namespaces against these constants. See
+ * `packages/cortext/src/kernel-invariants.ts`.
+ *
+ * It warns rather than REFUSES. Per-cohort context stores are a designed
+ * capability that `bootstrap-config.test.ts` exercises with `codex`, so the
+ * override keeps working; only the silence goes.
+ */
+export declare const CORTEXT_NAMESPACE = "cortext";
+/**
+ * The namespace the architecture-findings surface registers under, and which
+ * migration 0002 scopes its body normalization to.
+ *
+ * Separate from CORTEXT_NAMESPACE because the two have separate operator
+ * knobs and diverging lifecycle policies (compaction, retention, audit) — but
+ * subject to exactly the same gap, which is why it is stated here rather than
+ * left as a bare literal inside 0002.
+ */
+export declare const ARCHITECTURE_NAMESPACE = "architecture";
+/**
+ * The `name` the cortext COORDINATOR plugin registers itself under.
+ *
+ * Lives here, beside the namespace literals, because it is load-bearing for
+ * exactly the same reason they are. The kernel resolves
+ * which namespace to target by filtering
+ * `KernelLifecycleContext.coordinatorNamespacesByPlugin` on
+ * `plugin === CORTEXT_COORDINATOR_NAME` — so if the coordinator is ever
+ * renamed and this literal is not, the filter matches nothing and the audit
+ * reports "cortext declares no namespace" on a perfectly healthy deployment.
+ *
+ * A predicate that silently matches nothing is not an error, and a confidently wrong answer is
+ * worse here than no answer, because "coordinator absent" reads as a real
+ * finding rather than as a broken check.
+ *
+ * `kernel-namespace-parity.test.ts` asserts the coordinator's actual
+ * `plugin.name` equals this. Do not inline the string on either side.
+ */
+export declare const CORTEXT_COORDINATOR_NAME = "cortext";
+/**
+ * Body keys cortext's namespaces mirror into `rows` columns, so the
+ * cold-start and status filters hit an index. `0001_baseline` creates them.
+ */
+export declare const CORTEXT_PROMOTED_COLUMNS: {
+    readonly archived: {
+        readonly column: 'archived';
+        readonly kind: 'boolean';
+    };
+    readonly project: {
+        readonly column: 'project';
+        readonly kind: 'text';
+    };
+    readonly status: {
+        readonly column: 'status';
+        readonly kind: 'text';
+    };
+    readonly priority: {
+        readonly column: 'priority';
+        readonly kind: 'text';
+    };
+};

package/dist/kernel/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * cortext's kernel plugin public surface.
+ *
+ * Exported for direct embedding (the perf harness, test harnesses).
+ * Production deployments go through the manifest loader →
+ * `./bootstrap` entry.
+ */
+export { ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE } from './cortext-namespace.js';
+export { auditNamespaceCoverage, auditObjects, type Finding, findingMessage, INVARIANT_OBJECTS, type InvariantObject, type PluginNamespace, reportInvariantAudit, resolveCortextNamespaces, scopedNamespace, type UntargetableReason } from './invariant-audit.js';
+export { cortextBaselineMigration } from './migrations/0001_baseline.js';
+export { createCortextKernelPlugin } from './plugin.js';
+export { REPAIR_ENV_VAR, type RepairOutcome, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested } from './repair.js';
+export { countDuplicateHostInstallKeys, countDuplicateKids, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeRecipientIndex, rescopeVocabConstraint, VOCAB_CONSTRAINTS, type VocabConstraint } from './rescope.js';
+export { SUBSTRATE_CONTRACT_RANGE } from './substrate-contract.js';
+export { AGENT_MESSAGE_STATUS_VOCAB, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB } from './todo-vocab.js';

package/dist/kernel/invariant-audit.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Boot-time audit of the kernel invariants this plugin installs.
+ *
+ * ## What this is, and what it deliberately is not
+ *
+ * It VERIFIES. It does not repair. Every migration here installs a CHECK
+ * constraint or a partial index carrying a `namespace = <literal>` predicate,
+ * and a migration is recorded once by `id` — `apply` runs only when that id is
+ * absent — so nothing re-examines those objects after the first boot that
+ * created them. Between then and now they can be dropped by hand, left NOT
+ * VALID by a failed validation, or point at a namespace no coordinator uses.
+ * All three fail the same way: writes succeed, queries answer, and the
+ * guarantee is simply gone.
+ *
+ * AgentIdentity.kid uniqueness is what the mailbox's recipient-only trust
+ * model rests on. A constraint scoped to a namespace with no rows is not an
+ * error; it passes trivially.
+ *
+ * ## Why this reports rather than repairs
+ *
+ * Not because repair is impossible — `./repair.ts` does it, using the `sql`
+ * handle and the plugin-attributed namespaces, the latter being what makes a
+ * rename TARGETABLE rather than merely detectable.
+ *
+ * The split is deliberate and permanent. Auditing is a read, so it runs on
+ * every boot. Repairing is DDL taking ACCESS EXCLUSIVE on `rows`, so it
+ * runs only when an operator asks via `SYNOPTIC_CORTEXT_REPAIR`. Keeping them
+ * apart means the reporting path can never surprise anyone, and the repair path
+ * has exactly one trigger to reason about.
+ *
+ * The flat `coordinatorNamespaces` this function reads answers "is our literal
+ * declared?" but never "what replaced it". `resolveCortextNamespaces` reads the
+ * attributed list — and keeps `undefined` from collapsing into `[]`, which would
+ * make "too old to answer" read as "answered: none".
+ */
+import { ARCHITECTURE_NAMESPACE, CORTEXT_NAMESPACE } from './cortext-namespace.js';
+/** A catalog object one of the migrations installs, and what rests on it. */
+export interface InvariantObject {
+    readonly name: string;
+    readonly kind: 'constraint' | 'index';
+    /** The migration that installs it, for the operator chasing this down. */
+    readonly migration: string;
+    /** Stated as the loss, not the mechanism — see `findingMessage`. */
+    readonly guarantee: string;
+}
+/**
+ * The five objects. Enumerated by hand rather than derived from the migration
+ * array, deliberately: a migration's `apply` is opaque SQL text, so anything
+ * "derived" would be a regex over it that agrees with reality only by luck.
+ * `invariant-audit.test.ts` greps the migration sources for the DDL and fails
+ * if this list and the migrations disagree — which is the check that actually
+ * holds them together.
+ *
+ * Note there is no `architecture/*` entry, and that is correct: migration 0002
+ * is a one-time body normalisation, not a standing invariant. A drifted
+ * architecture namespace means that normalisation never ran for those rows —
+ * real, but a different and lesser thing than "kid uniqueness is not held".
+ */
+export declare const INVARIANT_OBJECTS: readonly InvariantObject[];
+/**
+ * Why the audit could not say which namespace replaced ours.
+ *
+ * `host_does_not_attribute` is NOT the same as `coordinator_absent`, and
+ * collapsing them is the whole reason this type exists — see
+ * `resolveCortextNamespaces`.
+ */
+export type UntargetableReason = 'host_does_not_attribute' | 'coordinator_absent';
+export type Finding = 
+/** Our literal is undeclared, and we cannot say what replaced it. */
+{
+    readonly kind: 'namespace_uncovered';
+    readonly scopedTo: string;
+    readonly declared: readonly string[];
+    readonly reason: UntargetableReason;
+}
+/** Our literal is undeclared, and the cortext coordinator names its replacement. */
+ | {
+    readonly kind: 'namespace_drifted';
+    readonly scopedTo: string;
+    readonly configured: string;
+}
+/** The object is not in the catalog at all. */
+ | {
+    readonly kind: 'object_missing';
+    readonly object: InvariantObject;
+}
+/** Present, but its predicate names a different namespace. */
+ | {
+    readonly kind: 'object_misscoped';
+    readonly object: InvariantObject;
+    readonly scopedTo: string | null;
+}
+/** Present and correctly scoped, but NOT VALID — new writes only. */
+ | {
+    readonly kind: 'object_not_validated';
+    readonly object: InvariantObject;
+};
+/** One entry of the host's plugin-attributed namespace list. */
+export interface PluginNamespace {
+    readonly plugin: string;
+    readonly namespace: string;
+}
+/**
+ * The namespaces the cortext COORDINATOR declared, or `null` when the host
+ * cannot say.
+ *
+ * The three states are genuinely distinct and the middle one is easy to lose:
+ *
+ *   - `undefined` in  -> `null` out. The host predates
+ *     `coordinatorNamespacesByPlugin`. It is not telling us
+ *     "none"; it is not telling us anything.
+ *   - `[]` in, or no rows for our plugin -> `[]` out. The host DID attribute,
+ *     and cortext contributed nothing — it is not loaded.
+ *   - rows for our plugin -> those namespaces, in declaration order.
+ *
+ * The host deliberately does not default `undefined` to `[]`, which would make
+ * "too old to answer" read identically to "answered: none". Returning `null`
+ * rather than an empty array preserves that distinction.
+ */
+export declare function resolveCortextNamespaces(byPlugin: readonly PluginNamespace[] | undefined): readonly string[] | null;
+/**
+ * Whether a coordinator declared the namespace our objects are scoped to, and
+ * — when the host attributes — which namespace replaced it.
+ *
+ * Pure, and the only half that works without a `sql` handle, so it is what runs
+ * against the in-memory dataset.
+ *
+ * Only the context-store literal is checked. `ARCHITECTURE_NAMESPACE` is
+ * exported for callers that want it but is not audited here, for the reason in
+ * `INVARIANT_OBJECTS`: no catalog object is scoped to it.
+ */
+export declare function auditNamespaceCoverage(coordinatorNamespaces: readonly string[], byPlugin?: readonly PluginNamespace[]): Finding[];
+/** The namespace a predicate is scoped to, or null if it names none. */
+export declare function scopedNamespace(definition: string): string | null;
+/**
+ * Audit every object's presence, scope and validity.
+ *
+ * `sql` is typed `unknown` on the lifecycle context (substrate keeps the driver out
+ * of its type surface), so the cast happens here, once, exactly as the
+ * migrations do it.
+ */
+/**
+ * Audit the invariant objects.
+ *
+ * Returns the INSPECTED COUNT alongside the findings.
+ *
+ * A tally rather than `INVARIANT_OBJECTS.length`, so that if this loop ever
+ * gains a filter, an early return or a per-object skip, the completion metric
+ * reports what was actually inspected instead of a promise.
+ */
+export declare function auditObjects(sql: unknown): Promise<{
+    findings: Finding[];
+    checked: number;
+}>;
+/** The operator-facing sentence for one finding. */
+export declare function findingMessage(finding: Finding): string;
+/**
+ * Run the audit and report. Returns the findings so a caller — or a test — can
+ * assert on them without capturing the console.
+ *
+ * Both sinks: `metric` is the structured
+ * channel an operator alerts on, and the console line is what actually appears
+ * in the server journal beside substrate's own loader warnings, which is
+ * where someone will see it.
+ *
+ * Never throws. A kernel plugin that aborts the boot over an OBSERVATION
+ * would take the service down for a condition the service has been running
+ * with, possibly for weeks — the whole point is that these failures are silent
+ * and survivable. A catalog read that itself fails is reported and swallowed.
+ *
+ * ## It always emits, including when it finds nothing
+ *
+ * Every OTHER metric here names a failure, so without a completion signal a
+ * clean audit and an audit that never ran would both be silence. A check whose
+ * PASS state is indistinguishable from its absence is not falsifiable.
+ *
+ * So `invariant_audit_complete` fires on every path that reaches the end,
+ * carrying `checked`. Silence now means the audit DID NOT RUN and is
+ * actionable, and a `checked` that drops from 5 to 4 is visible without
+ * anything having failed. Metric only, not a console line: a per-boot success
+ * message on every deployment is noise, and the metric sink is exactly the
+ * structured channel this belongs in.
+ */
+export declare function reportInvariantAudit(ctx: {
+    readonly sql: unknown;
+    readonly coordinatorNamespaces: readonly string[];
+    readonly coordinatorNamespacesByPlugin?: readonly PluginNamespace[];
+    metric(name: string, payload?: unknown): void;
+}, warn?: (message: string) => void): Promise<Finding[]>;
+export { ARCHITECTURE_NAMESPACE, CORTEXT_NAMESPACE };

package/dist/kernel/migrations/0001_baseline.d.ts

@@ -0,0 +1,11 @@
+/**
+ * cortext-kernel's schema on `rows`: the columns cortext promotes out of the
+ * body (see `CORTEXT_PROMOTED_COLUMNS`), their indexes, and the invariants
+ * on cortext's own types.
+ *
+ * The kernel runner does not wrap `apply` in a transaction, so each statement
+ * commits on its own and a run that dies part-way re-applies cleanly: every
+ * statement is idempotent.
+ */
+import type { KernelMigration } from '@mnmal-ai/substrate/sdk';
+export declare const cortextBaselineMigration: KernelMigration;

package/dist/kernel/plugin.d.ts

@@ -0,0 +1,29 @@
+/**
+ * cortext's kernel plugin — kernel-tier sibling of the
+ * `@mnmal-ai/cortext` coordinator.
+ *
+ * Owns the kernel-level schema/body invariants for the cortext
+ * coordination namespaces (`cortext/*` + `architecture/*`: vocabulary CHECK
+ * constraints, one-time body normalisations) so the generic
+ * pg dataset in substrate stays plugin-agnostic.
+ *
+ * Migration order is the array order below. See `./cortext-namespace.ts` for
+ * why the namespace literal has exactly one home.
+ *
+ * The plugin contributes `migrations` and one `onKernelReady` handler. No
+ * filter operators, no kernel routes, no MCP tools — if a future schema-level
+ * need arises (e.g. column promotion for a new controlled vocabulary), it
+ * lands as another `KernelMigration` in the `migrations` array.
+ *
+ * `onKernelReady` AUDITS on every boot and REPAIRS only when asked.
+ * Migrations run once and are recorded by id, so nothing re-examines
+ * what they installed; the handler reads the catalog and reports objects that
+ * are absent, scoped to a namespace no coordinator declares, or left NOT VALID.
+ *
+ * The `sql` handle makes the audit possible, and plugin-attributed namespaces
+ * make repair targetable. Repair is gated on `SYNOPTIC_CORTEXT_REPAIR` rather than
+ * automatic — see `./repair.ts` for why, and for why it declines rather than
+ * guessing when the target namespace is unknown.
+ */
+import type { KernelPlugin } from '@mnmal-ai/substrate/sdk';
+export declare function createCortextKernelPlugin(): KernelPlugin;

package/dist/kernel/repair.d.ts

@@ -0,0 +1,94 @@
+/**
+ * OPT-IN repair for drifted kernel invariants.
+ *
+ * ## Opt-in, and why it is not automatic
+ *
+ * Repair is DDL — `DROP CONSTRAINT` / `ADD CONSTRAINT`, `DROP INDEX` /
+ * `CREATE INDEX` — taking ACCESS EXCLUSIVE on `rows` and briefly blocking
+ * writes. Doing that unbidden on every boot, for a condition the deployment has
+ * been tolerating for weeks, is disproportionate to the problem: the invariants
+ * being inactive is bad, but it is not an outage, and a self-healing pass that
+ * surprises an operator mid-incident is.
+ *
+ * The same reasoning keeps a renamed namespace bootable: per-cohort context
+ * stores are a designed capability, so the kernel reports and never refuses.
+ *
+ * So the audit reports on every boot and this runs only when asked:
+ *
+ *     SYNOPTIC_CORTEXT_REPAIR=1
+ *
+ * An ENV VAR rather than a config field, deliberately. A config field persists,
+ * which makes repair run on every boot forever — that is "automatic" wearing an
+ * opt-in label. An env var is set for one maintenance restart and then removed,
+ * which is what opt-in actually means. It also keeps `config.schema.json`
+ * unchanged, and that file is compared byte-for-byte by `schema-parity.test.ts`.
+ *
+ * ## What it will not do
+ *
+ * Repair needs a TARGET namespace, and it will only use one the host told it:
+ * `coordinatorNamespacesByPlugin`, filtered to the cortext
+ * coordinator. Against an older host that field is `undefined` and the answer
+ * is "cannot target" — so repair declines rather than guessing. Guessing which
+ * of `codex, perf, review` replaced our literal is the failure mode this whole
+ * lineage exists to remove, and it would be re-scoping a production schema on
+ * the strength of it.
+ *
+ * It also never aborts the boot. A duplicate kid makes the unique index
+ * unbuildable; that is reported and skipped, not thrown. An operator who set an
+ * env var for one restart should not be able to brick the service with it.
+ */
+type Metric = (name: string, payload?: unknown) => void;
+/** The env var that opts a deployment in, for one restart. */
+export declare const REPAIR_ENV_VAR = "SYNOPTIC_CORTEXT_REPAIR";
+/**
+ * Whether repair was asked for.
+ *
+ * Accepts only the affirmative spellings an operator would plausibly type, and
+ * treats everything else — including `0` and `false` — as off. Deliberately not
+ * a truthiness check on the raw string: `SYNOPTIC_CORTEXT_REPAIR=false` is
+ * unambiguously a request NOT to repair, and a bare presence check would read
+ * it as a yes and re-scope a production schema.
+ */
+export declare function repairRequested(env: Record<string, string | undefined>): boolean;
+export type RepairOutcome = 
+/** Every object now scoped to the target and fully validated. */
+{
+    readonly kind: 'repaired';
+    readonly object: string;
+}
+/** Re-scoped, but existing rows violate it — enforced for new writes only. */
+ | {
+    readonly kind: 'repaired_not_validated';
+    readonly object: string;
+    readonly violations: number;
+}
+/** Could not be rebuilt; the old object is left in place untouched. */
+ | {
+    readonly kind: 'skipped';
+    readonly object: string;
+    readonly reason: string;
+};
+/**
+ * Re-scope every invariant object to `namespace`.
+ *
+ * Constraints first, then indexes — the constraints are
+ * the correctness-bearing half and should land even if an index cannot.
+ */
+export declare function repairInvariants(sql: unknown, metric: Metric, namespace: string): Promise<RepairOutcome[]>;
+/** The operator-facing sentence for one outcome. */
+export declare function repairOutcomeMessage(outcome: RepairOutcome, namespace: string): string;
+/**
+ * Run repair if asked, and report. Returns null when it did not run, so a
+ * caller can tell "declined" from "ran and found nothing to do".
+ *
+ * Never throws, for the same reason the audit does not: this is invoked during
+ * boot, and a failure here must degrade to a report rather than take down a
+ * service that was running fine — badly, but fine — a moment earlier.
+ */
+export declare function repairIfRequested(ctx: {
+    readonly sql: unknown;
+    readonly namespace: string | null;
+    readonly env: Record<string, string | undefined>;
+    metric(name: string, payload?: unknown): void;
+}, warn?: (message: string) => void): Promise<RepairOutcome[] | null>;
+export {};

package/dist/kernel/rescope.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The re-scoping primitives, parameterised by target namespace.
+ *
+ * The baseline migration calls these with `CORTEXT_NAMESPACE`; the opt-in
+ * repair path (`./repair.ts`) calls them with the namespace the coordinator is
+ * actually configured for.
+ *
+ * One copy is the point. A repair path that re-declared
+ * this DDL would be a SECOND source of truth for what these objects are, and
+ * the two would drift the moment a vocabulary changed — reinstalling the exact
+ * class of bug that the repair exists to fix, one layer up. The
+ * vocabularies themselves come from the kernel vocab constants rather than
+ * being restated here, for the same reason.
+ *
+ * Everything here is idempotent DROP-then-CREATE. None of it decides POLICY:
+ * whether a duplicate kid should abort the migration or be skipped
+ * and reported (repair's) is the caller's call, which is why the duplicate
+ * count is exposed separately rather than being handled in here.
+ */
+import type postgres from 'postgres';
+type Sql = ReturnType<typeof postgres>;
+type Metric = (name: string, payload?: unknown) => void;
+export interface VocabConstraint {
+    readonly constraint: string;
+    readonly type: string;
+    readonly column: 'status' | 'priority';
+    readonly vocab: readonly string[];
+}
+export declare const VOCAB_CONSTRAINTS: readonly VocabConstraint[];
+/**
+ * Re-scope one vocabulary CHECK to `namespace`.
+ *
+ * Returns the number of existing rows that violate it — 0 means VALIDATE
+ * succeeded and the constraint is fully enforced; >0 means it was left NOT
+ * VALID (enforcing new writes only) and an operator has rows to reconcile.
+ *
+ * The NOT VALID -> validate-inside-a-handler shape is what makes this safe to
+ * run against a store that has been writing UNCONSTRAINED. A plain
+ * `ADD CONSTRAINT ... CHECK` validates immediately and therefore fails on
+ * exactly the databases a repair exists for — the ones that drifted long
+ * enough to accumulate bad rows.
+ */
+export declare function rescopeVocabConstraint(s: Sql, metric: Metric, { constraint, type, column, vocab }: VocabConstraint, namespace: string): Promise<number>;
+/**
+ * Re-scope the mailbox inbox index (0003) to `namespace`.
+ *
+ * Dropped and rebuilt rather than left alongside a correctly-scoped sibling:
+ * two partial indexes over the same expression is one the planner can never
+ * use, plus write amplification on every AgentMessage insert.
+ */
+export declare function rescopeRecipientIndex(s: Sql, namespace: string): Promise<void>;
+/**
+ * How many kids would collide if the unique index were scoped to `namespace`.
+ *
+ * Exposed separately because a UNIQUE index has no `NOT VALID` equivalent —
+ * there is no "enforce for new writes only" state for an index. `CREATE UNIQUE
+ * INDEX` either succeeds over the whole predicate or fails outright, so the
+ * only way to avoid failing is to ask first. That asymmetry with the CHECK
+ * constraints is why repair treats the two differently.
+ *
+ * The predicate matches `rescopeKidUniqueIndex`'s exactly, including the
+ * tombstone exemption — an archived duplicate is still a conflict, and hard-
+ * deleting a retired identity frees its kid.
+ */
+export declare function countDuplicateKids(s: Sql, namespace: string): Promise<number>;
+/**
+ * Re-scope the AgentIdentity.kid unique index (0004) to `namespace`.
+ *
+ * THROWS on duplicate kids, and that is deliberate — it preserves 0004's
+ * fail-loud stance, because recipient resolution and the mailbox's
+ * recipient-only enforcement are both ambiguous until an operator decides
+ * which row owns the identity. Callers that must not abort should call
+ * `countDuplicateKids` first; the repair path does.
+ */
+export declare function rescopeKidUniqueIndex(s: Sql, namespace: string): Promise<void>;
+/**
+ * How many HostInstall keys would collide if the unique index were scoped to
+ * `namespace`. Asked first for the same reason as `countDuplicateKids`.
+ */
+export declare function countDuplicateHostInstallKeys(s: Sql, namespace: string): Promise<number>;
+/**
+ * Re-scope the HostInstall.key unique index (0008) to `namespace`. Throws on
+ * duplicate keys; callers that must not abort call
+ * `countDuplicateHostInstallKeys` first.
+ */
+export declare function rescopeHostInstallKeyIndex(s: Sql, namespace: string): Promise<void>;
+export {};

package/dist/kernel/substrate-contract.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The range of substrate versions both cortext plugins are built against.
+ *
+ * ONE literal, used in two places that must never disagree:
+ *
+ *   1. `contractVersion` on both plugin objects, checked by the substrate
+ *      loader at boot, which refuses a plugin outside it.
+ *   2. The `@mnmal-ai/substrate` peer range in the manifest, checked by the
+ *      package manager at install.
+ *
+ * Both exist because they guard different paths: `SUBSTRATE_PLUGIN_DIR` scans
+ * a directory, so a plugin dropped in by hand never meets a package manager,
+ * and the loader check is all that is left.
+ *
+ * The ceiling tracks actual plugin-facing compatibility, not the next major
+ * by reflex: widen it only after reading what the new major changed.
+ * `substrate-contract-parity.test.ts` holds the manifest to this literal.
+ */
+export declare const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.0 <2.0.0";

package/dist/kernel/todo-vocab.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Todo lifecycle and outcome, split. A single `status` doing both jobs makes
+ * `done` vs `closed` a grey distinction nobody can apply consistently.
+ *
+ * LIFECYCLE (`status`): is it live? OUTCOME (`resolution`): why did it stop?
+ * The same split GitHub (state + state_reason) and Jira (status + resolution)
+ * make.
+ *
+ * The pg CHECK admits exactly the lifecycle set; `done` / `not_started` are
+ * aliases the schema canonicalises on write.
+ */
+export declare const TODO_LIFECYCLE_VOCAB: readonly ['open', 'in_progress', 'blocked', 'deferred', 'closed'];
+/** Why a closed Todo stopped. `unspecified` is for migrated rows with no clear cue. */
+export declare const TODO_RESOLUTION_VOCAB: readonly ['completed', 'wont_do', 'superseded', 'duplicate', 'obsolete', 'unspecified'];
+export declare const TODO_PRIORITY_VOCAB: readonly ['low', 'medium', 'high'];
+/** AgentMessage delivery state; the pg CHECK and the field enum share it. */
+export declare const AGENT_MESSAGE_STATUS_VOCAB: readonly ['unread', 'read', 'acked'];

package/dist/kernel-bootstrap.js

@@ -0,0 +1,21 @@
+import { t as createCortextKernelPlugin } from "./plugin-27UpMnoE.js";
+import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
+import { z } from "zod";
+
+//#region src/kernel/bootstrap.ts
+/**
+* Structured-config bootstrap for cortext's kernel plugin
+* (mirrors the recall + plane bootstrap pattern).
+*
+* No operator-overridable surface today — the plugin contributes a
+* static migration list and nothing else. Reserved for future schema-
+* level controls if any emerge.
+*/
+const CortextKernelConfigSchema = z.object({}).strict();
+const bootstrap = defineBootstrap.kernel({
+	schema: CortextKernelConfigSchema,
+	build: () => createCortextKernelPlugin()
+});
+
+//#endregion
+export { bootstrap, bootstrap as default };

package/dist/kernel-invariants.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Boot-time reporting for the namespaces the kernel cannot follow.
+ *
+ * The cortext kernel plugin scopes every CHECK constraint and partial index
+ * with a `namespace = <literal>` predicate, baked in at authoring time because
+ * a migration cannot read config (`KernelMigrationContext` is `{ sql, metric }`).
+ * So a deployment that renames a namespace gets NO invariants, silently: a
+ * constraint scoped to a namespace with no rows passes trivially, and an index
+ * whose predicate no query can satisfy is just a heap scan.
+ *
+ * This warns rather than refuses. Per-cohort context stores are a designed
+ * capability (`bootstrap-config.test.ts` names `codex` as an override target),
+ * so the knob keeps working and the consequence is stated at boot.
+ *
+ * The kernel's own `invariant-audit.ts` reads the catalog too, but answers a
+ * different question. HERE (coordinator): "the namespace I am CONFIGURED for
+ * is not the one the kernel scopes to"; only the coordinator knows
+ * `cfg.namespace`. THERE (kernel): "my scope literal is declared by no
+ * coordinator", plus objects dropped, left NOT VALID, or re-scoped.
+ *
+ * Neither re-scopes automatically; that is the opt-in `./repair.ts`, because a
+ * store that ran unscoped may hold rows violating the vocabulary, so
+ * `ADD CONSTRAINT` can fail on exactly the databases a repair exists for.
+ * Parameterising the literals alone would not help either: migrations are
+ * recorded once by `id`, so a later rename never re-scopes existing objects.
+ */
+/** One configured namespace the kernel's baked-in literals do not cover. */
+export interface UncoveredNamespace {
+    /** Config key the operator set. */
+    readonly field: 'namespace' | 'architectureNamespace';
+    /** What they set it to. */
+    readonly configured: string;
+    /** The literal the kernel actually scopes its invariants to. */
+    readonly scopedTo: string;
+}
+/**
+ * Which configured namespaces the kernel does not cover. Empty is the
+ * healthy case.
+ *
+ * Pure and separately exported so the condition can be tested directly rather
+ * than through a lifecycle harness — the reporting below is a thin shell over
+ * it.
+ */
+export declare function uncoveredNamespaces(cfg: {
+    namespace: string;
+    architectureNamespace: string;
+}): UncoveredNamespace[];
+/** The operator-facing sentence for one uncovered namespace. */
+export declare function uncoveredNamespaceMessage({ field, configured, scopedTo }: UncoveredNamespace): string;
+/**
+ * Emit the warnings at plugin start. Returns what it reported, so a caller (or
+ * a test) can assert on it without capturing the console.
+ *
+ * Both sinks on purpose: `metric` is the
+ * structured channel an operator can alert on, and the console line is what
+ * actually appears in the server journal next to substrate's own loader
+ * warnings, where someone will see it.
+ */
+export declare function reportUncoveredNamespaces(cfg: {
+    namespace: string;
+    architectureNamespace: string;
+}, metric: (name: string, payload?: unknown) => void, warn?: (message: string) => void): UncoveredNamespace[];

package/dist/kernel.js

@@ -0,0 +1,3 @@
+import { C as findingMessage, D as ARCHITECTURE_NAMESPACE, E as scopedNamespace, O as CORTEXT_COORDINATOR_NAME, S as auditObjects, T as resolveCortextNamespaces, _ as TODO_LIFECYCLE_VOCAB, a as repairInvariants, b as INVARIANT_OBJECTS, c as cortextBaselineMigration, d as countDuplicateKids, f as rescopeHostInstallKeyIndex, g as AGENT_MESSAGE_STATUS_VOCAB, h as rescopeVocabConstraint, i as repairIfRequested, k as CORTEXT_NAMESPACE, l as VOCAB_CONSTRAINTS, m as rescopeRecipientIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as rescopeKidUniqueIndex, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as countDuplicateHostInstallKeys, v as TODO_PRIORITY_VOCAB, w as reportInvariantAudit, x as auditNamespaceCoverage, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
+
+export { AGENT_MESSAGE_STATUS_VOCAB, ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE, INVARIANT_OBJECTS, REPAIR_ENV_VAR, SUBSTRATE_CONTRACT_RANGE, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB, VOCAB_CONSTRAINTS, auditNamespaceCoverage, auditObjects, cortextBaselineMigration, countDuplicateHostInstallKeys, countDuplicateKids, createCortextKernelPlugin, findingMessage, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested, reportInvariantAudit, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeRecipientIndex, rescopeVocabConstraint, resolveCortextNamespaces, scopedNamespace };