@mnmal-ai/cortext 1.0.0-alpha.10 → 1.0.0-alpha.12

package/dist/bootstrap.js

@@ -1,5 +1,5 @@
-import { E as isMonotonicAuth, t as createCortextPlugin, w as DEFAULT_AUTH } from "./src-DAeiNhDw.js";
-import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE } from "./plugin-CujP_pvT.js";
+import { D as isMonotonicAuth, T as DEFAULT_AUTH, t as createCortextPlugin } from "./src-4GYqbw6S.js";
+import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE } from "./plugin-BtBVkZpZ.js";
 import "./kernel.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";

package/dist/index.d.ts

@@ -26,7 +26,7 @@ import type { CortextPluginConfig } from './config.js';
 export { buildAuthPolicies, DEFAULT_AUTH, isMonotonicAuth } from './auth-policy.js';
 export { type CompactResult, registerCompactRoute, runCompact } from './compact.js';
 export type { CortextAuthConfig, CortextAuthMode, CortextPluginConfig } from './config.js';
-export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, buildArchitectureNamespace, buildClaudeNamespace, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES } from './namespace.js';
+export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, buildArchitectureNamespace, buildClaudeNamespace, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TASK_STATUS_VOCAB, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES } from './namespace.js';
 export { registerOnboardRoute } from './onboard.js';
 export { buildReleaseSurface, bumpClass, classifySurfaceChange, classSatisfies, type ReleaseClass, type ReleaseSurface, type SurfaceChange, type SurfaceField } from './release-surface.js';
 export { type ClosedTodoText, inferTodoResolution, type TodoResolution } from './todo-resolution.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-import { C as runCompact, E as isMonotonicAuth, S as registerCompactRoute, T as buildAuthPolicies, _ as TODO_RESOLUTION_ALIASES, a as classSatisfies, b as buildArchitectureNamespace, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_STATUS_ALIASES, w as DEFAULT_AUTH, x as buildClaudeNamespace, y as TODO_STATUS_IMPLIES } from "./src-DAeiNhDw.js";
-import { _ as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-CujP_pvT.js";
+import { C as registerCompactRoute, D as isMonotonicAuth, E as buildAuthPolicies, S as buildClaudeNamespace, T as DEFAULT_AUTH, _ as TASK_STATUS_VOCAB, a as classSatisfies, b as TODO_STATUS_IMPLIES, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_RESOLUTION_ALIASES, w as runCompact, x as buildArchitectureNamespace, y as TODO_STATUS_ALIASES } from "./src-4GYqbw6S.js";
+import { _ as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-BtBVkZpZ.js";
 import "./kernel.js";
 
-export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, DEFAULT_AUTH, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES, buildArchitectureNamespace, buildAuthPolicies, buildClaudeNamespace, buildReleaseSurface, bumpClass, classSatisfies, classifySurfaceChange, createCortextPlugin, inferTodoResolution, isMonotonicAuth, registerCompactRoute, registerOnboardRoute, runCompact };
+export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, DEFAULT_AUTH, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TASK_STATUS_VOCAB, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES, buildArchitectureNamespace, buildAuthPolicies, buildClaudeNamespace, buildReleaseSurface, bumpClass, classSatisfies, classifySurfaceChange, createCortextPlugin, inferTodoResolution, isMonotonicAuth, registerCompactRoute, registerOnboardRoute, runCompact };

package/dist/kernel/layout.d.ts

@@ -1,16 +1,22 @@
 /**
- * Which storage layout `rows` has: one shared table (`legacy`) or a table
- * partitioned by namespace and type (`partitioned`).
+ * How the store keeps rows: one shared `rows` table (`legacy`), `rows`
+ * partitioned by namespace and type (`partitioned`), or one table per type
+ * listed in `substrate_type_tables` (`tables`, the only layout substrate
+ * 1.0.0-alpha.12 and later boots).
  *
- * On a partitioned `rows`, Postgres refuses a UNIQUE index that lacks the
- * partition keys, and clones every parent-level index and CHECK onto every
- * other plugin's partitions. So cortext's raw DDL runs on `legacy` only; on
- * `partitioned` the engine builds cortext's declared and `indexed: true`
- * indexes per partition.
+ * cortext's raw DDL targets `rows` on `legacy` only. On `partitioned`,
+ * Postgres refuses a UNIQUE index that lacks the partition keys and clones
+ * every parent-level index and CHECK onto other plugins' partitions; on
+ * `tables` there is no `rows` at all. On both, the engine builds cortext's
+ * declared indexes, `indexed: true` fields and enum CHECKs per type.
  */
-export type StoreLayout = 'legacy' | 'partitioned';
+export type StoreLayout = 'legacy' | 'partitioned' | 'tables';
+/** Whether `layout` has a shared `rows` table for cortext's raw DDL to target. */
+export declare const hasRowsTable: (layout: unknown) => boolean;
 /**
  * The layout as the catalog reports it. Migrations read `ctx.layout` instead;
  * this is for boot-time code, whose lifecycle context does not carry it.
+ * A schema with neither table reads as `legacy`, whose audit then reports
+ * every object missing.
  */
 export declare function storeLayout(sql: unknown): Promise<StoreLayout>;

package/dist/kernel/migrations/0001_baseline.d.ts

@@ -3,6 +3,10 @@
  * body (see `CORTEXT_PROMOTED_COLUMNS`), their indexes, and the invariants
  * on cortext's own types.
  *
+ * Only a store with a shared `rows` table gets any of it; on per-type tables
+ * the engine builds the columns, indexes and enum CHECKs from cortext's
+ * namespace definition, so both `apply` and `rollback` return first.
+ *
  * The kernel runner does not wrap `apply` in a transaction, so each statement
  * commits on its own and a run that dies part-way re-applies cleanly: every
  * statement is idempotent.

package/dist/kernel/migrations/0002_drop_engine_owned_indexes.d.ts

@@ -3,7 +3,8 @@
  * the engine serves the same reads: the derived recipient index for the
  * inbox, and the `indexed: true` indexes on project and status.
  *
- * A partitioned `rows` never had them. Idempotent, like 0001: the runner does
+ * A partitioned `rows` never had them, and a per-type tables store has no
+ * `rows` at all. Idempotent, like 0001: the runner does
  * not wrap `apply` in a transaction.
  */
 import type { KernelMigration } from '@mnmal-ai/substrate/sdk';

package/dist/kernel/substrate-contract.d.ts

@@ -16,4 +16,4 @@
  * by reflex: widen it only after reading what the new major changed.
  * `substrate-contract-parity.test.ts` holds the manifest to this literal.
  */
-export declare const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.10 <2.0.0";
+export declare const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.12 <2.0.0";

package/dist/kernel-bootstrap.js

@@ -1,4 +1,4 @@
-import { t as createCortextKernelPlugin } from "./plugin-CujP_pvT.js";
+import { t as createCortextKernelPlugin } from "./plugin-BtBVkZpZ.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";
 

package/dist/kernel.js

@@ -1,3 +1,3 @@
-import { A as CORTEXT_NAMESPACE, C as auditObjects, D as scopedNamespace, E as resolveCortextNamespaces, O as ARCHITECTURE_NAMESPACE, S as auditNamespaceCoverage, T as reportInvariantAudit, _ as AGENT_MESSAGE_STATUS_VOCAB, a as repairInvariants, b as TODO_RESOLUTION_VOCAB, c as ENGINE_OWNED_INDEXES, d as VOCAB_CONSTRAINTS, f as countDuplicateHostInstallKeys, g as rescopeVocabConstraint, h as rescopeKidUniqueIndex, i as repairIfRequested, k as CORTEXT_COORDINATOR_NAME, l as cortextDropEngineOwnedIndexesMigration, m as rescopeHostInstallKeyIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as countDuplicateKids, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as cortextBaselineMigration, v as TODO_LIFECYCLE_VOCAB, w as findingMessage, x as INVARIANT_OBJECTS, y as TODO_PRIORITY_VOCAB } from "./plugin-CujP_pvT.js";
+import { A as CORTEXT_NAMESPACE, C as auditObjects, D as scopedNamespace, E as resolveCortextNamespaces, O as ARCHITECTURE_NAMESPACE, S as auditNamespaceCoverage, T as reportInvariantAudit, _ as AGENT_MESSAGE_STATUS_VOCAB, a as repairInvariants, b as TODO_RESOLUTION_VOCAB, c as ENGINE_OWNED_INDEXES, d as VOCAB_CONSTRAINTS, f as countDuplicateHostInstallKeys, g as rescopeVocabConstraint, h as rescopeKidUniqueIndex, i as repairIfRequested, k as CORTEXT_COORDINATOR_NAME, l as cortextDropEngineOwnedIndexesMigration, m as rescopeHostInstallKeyIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as countDuplicateKids, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as cortextBaselineMigration, v as TODO_LIFECYCLE_VOCAB, w as findingMessage, x as INVARIANT_OBJECTS, y as TODO_PRIORITY_VOCAB } from "./plugin-BtBVkZpZ.js";
 
 export { AGENT_MESSAGE_STATUS_VOCAB, ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE, ENGINE_OWNED_INDEXES, INVARIANT_OBJECTS, REPAIR_ENV_VAR, SUBSTRATE_CONTRACT_RANGE, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB, VOCAB_CONSTRAINTS, auditNamespaceCoverage, auditObjects, cortextBaselineMigration, cortextDropEngineOwnedIndexesMigration, countDuplicateHostInstallKeys, countDuplicateKids, createCortextKernelPlugin, findingMessage, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested, reportInvariantAudit, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeVocabConstraint, resolveCortextNamespaces, scopedNamespace };

package/dist/namespace.d.ts

@@ -141,9 +141,10 @@ export { AGENT_MESSAGE_STATUS_VOCAB } from './kernel/index.js';
 export declare const HOST_INSTALL_FRAGMENT_STATES: readonly ['current', 'stale', 'missing', 'undigested', 'uncomparable', 'source', 'absent'];
 /** HostInstall's per-check verdicts: the worst finding each check produced. */
 export declare const HOST_INSTALL_CHECK_STATES: readonly ['ok', 'warn', 'unknown'];
+export declare const TASK_STATUS_VOCAB: readonly ['active', 'paused', 'done'];
 export declare function buildClaudeNamespace(ns: string): NamespaceDefinition;
 /** The canonical ordered list of type names registered by this namespace. */
-export declare const CLAUDE_TYPE_NAMES: readonly ['SessionLog', 'Decision', 'Todo', 'AgentRule', 'CouncilSession', 'CouncilAdvisor', 'Memory', 'AnchorIntent', 'Concept', 'ConceptLink', 'Skill', 'AgentIdentity', 'AgentMessage', 'HostInstall'];
+export declare const CLAUDE_TYPE_NAMES: readonly ['SessionLog', 'Decision', 'Todo', 'AgentRule', 'CouncilSession', 'CouncilAdvisor', 'Memory', 'AnchorIntent', 'Concept', 'ConceptLink', 'Skill', 'AgentIdentity', 'AgentMessage', 'HostInstall', 'Task', 'ExecutionCheckpoint'];
 /**
  * Architecture namespace — Claude-lineage code-review findings. Kept separate
  * from the claude context namespace so lifecycle (compaction, retention,

package/dist/participants.d.ts

@@ -11,7 +11,15 @@
  * An operator is an identity granted `admin` (or `*`) in this namespace.
  */
 import type { NamespaceInstallContext, RegistryEntryResolver, RequestContext } from '@mnmal-ai/substrate/sdk';
-/** Whether the caller holds `admin` (or `*`) in the namespace it is calling. */
+/**
+ * Whether `identity` is an operator: it holds `admin` (or `*`) in `namespace`,
+ * or the deployment admin capability (`SUBSTRATE_ADMIN_CAPABILITY`, default
+ * `admin`) in `_system`, as substrate's own admin gate reads it.
+ */
+export declare function isOperatorIdentity(identity: RequestContext['identity'], namespace: string, env?: {
+    SUBSTRATE_ADMIN_CAPABILITY?: string;
+}): boolean;
+/** Whether the caller is an operator in the namespace it is calling. */
 export declare function isOperator(ctx: RequestContext): boolean;
 /**
  * AgentMessage update/delete: the sender, the recipient, or an operator.

package/dist/{plugin-CujP_pvT.js → plugin-BtBVkZpZ.js}

@@ -98,15 +98,22 @@ const CORTEXT_PROMOTED_COLUMNS = {
 
 //#endregion
 //#region src/kernel/layout.ts
+/** Whether `layout` has a shared `rows` table for cortext's raw DDL to target. */
+const hasRowsTable = (layout) => layout === "legacy" || layout === "partitioned";
 /**
 * The layout as the catalog reports it. Migrations read `ctx.layout` instead;
 * this is for boot-time code, whose lifecycle context does not carry it.
+* A schema with neither table reads as `legacy`, whose audit then reports
+* every object missing.
 */
 async function storeLayout(sql) {
 	const [row] = await sql`
-    SELECT c.relkind AS kind FROM pg_class c WHERE c.oid = to_regclass('rows')
+    SELECT (SELECT c.relkind FROM pg_class c WHERE c.oid = to_regclass('rows')) AS kind,
+           to_regclass('substrate_type_tables') IS NOT NULL AS tables
   `;
-	return row?.kind === "p" ? "partitioned" : "legacy";
+	if (row?.kind === "p") return "partitioned";
+	if (row?.kind == null && row?.tables === true) return "tables";
+	return "legacy";
 }
 
 //#endregion
@@ -360,11 +367,11 @@ function findingMessage(finding) {
 * structured channel this belongs in.
 */
 async function reportInvariantAudit(ctx, warn = console.warn) {
-	let findings = [...auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin)];
-	const target = ctx.coordinatorNamespaces.includes("cortext") ? CORTEXT_NAMESPACE : resolveCortextNamespaces(ctx.coordinatorNamespacesByPlugin)?.[0] ?? "cortext";
 	const catalogRead = ctx.sql !== null && ctx.sql !== void 0;
-	let objectsChecked = 0;
 	const layout = catalogRead ? await storeLayout(ctx.sql).catch(() => "legacy") : null;
+	let findings = layout !== null && layout !== "legacy" ? [] : auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin);
+	const target = ctx.coordinatorNamespaces.includes("cortext") ? CORTEXT_NAMESPACE : resolveCortextNamespaces(ctx.coordinatorNamespacesByPlugin)?.[0] ?? "cortext";
+	let objectsChecked = 0;
 	if (catalogRead && layout === "legacy") try {
 		const result = await auditObjects(ctx.sql, target);
 		if (target !== "cortext" && result.findings.length === 0) findings = findings.filter((f) => f.kind !== "namespace_drifted");
@@ -602,7 +609,7 @@ const cortextBaselineMigration = {
 	id: "0001_baseline",
 	apply: async (ctx) => {
 		const { sql, metric } = ctx;
-		if (sql === null) return;
+		if (sql === null || !hasRowsTable(ctx.layout)) return;
 		const s = sql;
 		await s.unsafe(`
       ALTER TABLE rows
@@ -620,8 +627,8 @@ const cortextBaselineMigration = {
 		await rescopeKidUniqueIndex(s, CORTEXT_NAMESPACE);
 		await rescopeHostInstallKeyIndex(s, CORTEXT_NAMESPACE);
 	},
-	rollback: async ({ sql }) => {
-		if (sql === null) return;
+	rollback: async ({ sql, layout }) => {
+		if (sql === null || !hasRowsTable(layout)) return;
 		const s = sql;
 		for (const { constraint } of VOCAB_CONSTRAINTS) await s.unsafe(`ALTER TABLE rows DROP CONSTRAINT IF EXISTS ${constraint}`);
 		await s.unsafe("DROP INDEX IF EXISTS rows_agent_identity_kid_unique, rows_host_install_key_unique");
@@ -641,7 +648,7 @@ const ENGINE_OWNED_INDEXES = [
 const cortextDropEngineOwnedIndexesMigration = {
 	id: "0002_drop_engine_owned_indexes",
 	apply: async ({ sql, layout }) => {
-		if (sql === null || layout === "partitioned") return;
+		if (sql === null || layout !== "legacy") return;
 		await sql.unsafe(`DROP INDEX IF EXISTS ${ENGINE_OWNED_INDEXES.join(", ")}`);
 	},
 	rollback: async () => {}
@@ -740,9 +747,10 @@ async function repairIfRequested(ctx, warn = console.warn) {
 		ctx.metric("cortext_kernel.repair_declined", { reason: "target_unknown" });
 		return null;
 	}
-	if (await storeLayout(ctx.sql).catch(() => "legacy") === "partitioned") {
-		warn(`[cortext-kernel] ${REPAIR_ENV_VAR} is set, but rows is partitioned: the engine owns cortext's indexes there and there are no parent-level objects to repair. Nothing to do.`);
-		ctx.metric("cortext_kernel.repair_declined", { reason: "partitioned" });
+	const layout = await storeLayout(ctx.sql).catch(() => "legacy");
+	if (layout !== "legacy") {
+		warn(`[cortext-kernel] ${REPAIR_ENV_VAR} is set, but the store layout is ${layout}: the engine owns cortext's indexes and CHECKs there, and there are no objects on rows to repair. Nothing to do.`);
+		ctx.metric("cortext_kernel.repair_declined", { reason: layout });
 		return null;
 	}
 	warn(`[cortext-kernel] ${REPAIR_ENV_VAR} is set — re-scoping kernel invariants to '${ctx.namespace}'. This takes ACCESS EXCLUSIVE on rows and briefly blocks writes.` + (ctx.namespace === "cortext" ? " Target matches the built-in scope literal, so this is a no-op rebuild." : ""));
@@ -789,7 +797,7 @@ async function repairIfRequested(ctx, warn = console.warn) {
 * by reflex: widen it only after reading what the new major changed.
 * `substrate-contract-parity.test.ts` holds the manifest to this literal.
 */
-const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.10 <2.0.0";
+const SUBSTRATE_CONTRACT_RANGE = ">=1.0.0-alpha.12 <2.0.0";
 
 //#endregion
 //#region src/kernel/plugin.ts

package/dist/{src-DAeiNhDw.js → src-4GYqbw6S.js}

@@ -1,5 +1,5 @@
-import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE, _ as AGENT_MESSAGE_STATUS_VOCAB, b as TODO_RESOLUTION_VOCAB, j as CORTEXT_PROMOTED_COLUMNS, k as CORTEXT_COORDINATOR_NAME, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_LIFECYCLE_VOCAB, y as TODO_PRIORITY_VOCAB } from "./plugin-CujP_pvT.js";
-import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
+import { A as CORTEXT_NAMESPACE, O as ARCHITECTURE_NAMESPACE, _ as AGENT_MESSAGE_STATUS_VOCAB, b as TODO_RESOLUTION_VOCAB, j as CORTEXT_PROMOTED_COLUMNS, k as CORTEXT_COORDINATOR_NAME, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_LIFECYCLE_VOCAB, y as TODO_PRIORITY_VOCAB } from "./plugin-BtBVkZpZ.js";
+import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, SYSTEM_NAMESPACE, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
 
 //#region src/auth-policy.ts
 /**
@@ -40,6 +40,154 @@ function buildAuthPolicies(auth) {
 	return [];
 }
 
+//#endregion
+//#region src/participants.ts
+/**
+* Whether `identity` is an operator: it holds `admin` (or `*`) in `namespace`,
+* or the deployment admin capability (`SUBSTRATE_ADMIN_CAPABILITY`, default
+* `admin`) in `_system`, as substrate's own admin gate reads it.
+*/
+function isOperatorIdentity(identity, namespace, env = process.env) {
+	const grant = grantOf(identity);
+	const caps = grantedIn(grant, namespace);
+	if (caps.includes("admin") || caps.includes("*")) return true;
+	const adminCap = env.SUBSTRATE_ADMIN_CAPABILITY || "admin";
+	const system = grantedIn(grant, SYSTEM_NAMESPACE);
+	return system.includes(adminCap) || system.includes("*");
+}
+/** Whether the caller is an operator in the namespace it is calling. */
+function isOperator(ctx) {
+	return isOperatorIdentity(ctx.identity, ctx.namespace);
+}
+function rowId(args) {
+	const raw = args.params?.id;
+	return typeof raw === "string" || typeof raw === "number" ? raw : void 0;
+}
+function callerKid(ctx) {
+	const id = ctx.identity?.id;
+	return typeof id === "string" && id !== "" ? id : null;
+}
+/**
+* AgentMessage update/delete: the sender, the recipient, or an operator.
+* The sender is the key that signed the send (`_metadata.createdBy`); the
+* recipient is the kid on the addressed directory row. Archiving someone
+* else's mail hides it from their inbox, and deleting it destroys it, so
+* neither is a bystander's call.
+*/
+function messageParticipantsOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const message = await resolveEntityRow(ds, "AgentMessage", id);
+		if (message === null) return inner(ctx, args);
+		const caller = callerKid(ctx);
+		const sender = message._metadata?.createdBy?.id;
+		let recipient = null;
+		if (typeof message.recipient === "string" && message.recipient !== "") {
+			const { rows } = await ds.read("AgentIdentity", { id: message.recipient });
+			recipient = rows[0]?.kid ?? null;
+		}
+		if (caller !== null && (caller === sender || caller === recipient)) return inner(ctx, args);
+		throw new ResolverFrameError("not_participant", `${name}: only this message's sender ('${String(sender ?? "unknown")}') or recipient ('${String(recipient ?? "unknown")}'), or an operator, may change or delete it`, { id: message.id });
+	};
+}
+/**
+* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
+* A kid with no `@` names no machine, so it may carry no host.
+*/
+function hostMatchesKid(host, kid) {
+	if (host === void 0 || host === null) return true;
+	if (typeof kid !== "string" || !kid.includes("@")) return false;
+	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
+}
+function refuseForeignHost(name, host, kid) {
+	if (hostMatchesKid(host, kid)) return;
+	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
+}
+/**
+* AgentIdentity create: a non-operator may not file a row whose `host` is a
+* machine other than the one its kid names. The fleet audit trusts `host`
+* (and `roaming` on that host) when it decides who may write a host's
+* HostInstall rows.
+*/
+function identityCreateGuard(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
+		if (typeof params.kid === "string") {
+			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
+				where: { kid: { eq: params.kid } },
+				limit: 1
+			});
+			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
+		}
+		return inner(ctx, args);
+	};
+}
+/**
+* AgentIdentity update: the identity itself (the caller's kid is the row's
+* kid) or an operator. `kid` is the row's identity, so changing it is an
+* operator act even on your own row: otherwise a row could be renamed onto a
+* kid whose mail it would then receive. `host` must stay the kid's machine,
+* and reactivating a retired row is an operator act.
+*/
+function identitySelfOnly(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const id = rowId(args);
+		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
+		const ds = args.dataset ?? installCtx.dataset;
+		const row = await resolveEntityRow(ds, "AgentIdentity", id);
+		if (row === null) return inner(ctx, args);
+		const params = args.params ?? {};
+		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
+		if (callerKid(ctx) === row.kid) {
+			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
+			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
+			return inner(ctx, args);
+		}
+		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
+	};
+}
+/**
+* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+* Todo carries none. A resolution with a live resulting status is refused,
+* and moving a Todo back to a live status clears the one it had.
+*/
+function todoResolutionGuard(installCtx, name, inner, statusAliases) {
+	const canon = (v) => {
+		const s = String(v).trim().toLowerCase();
+		return statusAliases[s] ?? s;
+	};
+	return async (ctx, args) => {
+		const params = { ...args.params ?? {} };
+		const statusGiven = params.status !== void 0 && params.status !== null;
+		let resulting = statusGiven ? canon(params.status) : null;
+		let current = null;
+		const id = rowId(args);
+		if (id !== void 0) {
+			const ds = args.dataset ?? installCtx.dataset;
+			current = await resolveEntityRow(ds, "Todo", id);
+			if (resulting === null && current !== null) resulting = canon(current.status);
+		}
+		if (resulting === null) resulting = "open";
+		if (resulting === "closed") return inner(ctx, args);
+		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
+		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
+		return inner(ctx, {
+			...args,
+			params
+		});
+	};
+}
+/** AgentIdentity delete: operators only. Mail hangs off these rows. */
+function operatorOnly(name, inner) {
+	return async (ctx, args) => {
+		if (isOperator(ctx)) return inner(ctx, args);
+		throw new ResolverFrameError("operator_only", `${name}: only an operator may delete an identity row; retire it with active: false instead`, {});
+	};
+}
+
 //#endregion
 //#region src/compact.ts
 /**
@@ -173,10 +321,9 @@ function parseBody(req) {
 function registerCompactRoute(router, ctx, retention, namespace, auth = DEFAULT_AUTH) {
 	router.post("/compact", async (req) => {
 		if (auth.writes === "identity") {
-			const caps = grantedIn(grantOf(req.identity ?? null), namespace);
-			if (!caps.includes("admin") && !caps.includes("*")) return jsonResponse(403, {
+			if (!isOperatorIdentity(req.identity ?? null, namespace)) return jsonResponse(403, {
 				code: "operator_only",
-				message: `POST /compact archives across every project and needs an operator (admin in '${namespace}')`
+				message: `POST /compact archives across every project and needs an operator (admin in '${namespace}', or the deployment admin)`
 			});
 		}
 		const parsed = parseBody(req);
@@ -258,142 +405,6 @@ function reportUncoveredNamespaces(cfg, metric, warn = console.warn) {
 	return uncovered;
 }
 
-//#endregion
-//#region src/participants.ts
-/** Whether the caller holds `admin` (or `*`) in the namespace it is calling. */
-function isOperator(ctx) {
-	const caps = grantedIn(grantOf(ctx.identity), ctx.namespace);
-	return caps.includes("admin") || caps.includes("*");
-}
-function rowId(args) {
-	const raw = args.params?.id;
-	return typeof raw === "string" || typeof raw === "number" ? raw : void 0;
-}
-function callerKid(ctx) {
-	const id = ctx.identity?.id;
-	return typeof id === "string" && id !== "" ? id : null;
-}
-/**
-* AgentMessage update/delete: the sender, the recipient, or an operator.
-* The sender is the key that signed the send (`_metadata.createdBy`); the
-* recipient is the kid on the addressed directory row. Archiving someone
-* else's mail hides it from their inbox, and deleting it destroys it, so
-* neither is a bystander's call.
-*/
-function messageParticipantsOnly(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const id = rowId(args);
-		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
-		const ds = args.dataset ?? installCtx.dataset;
-		const message = await resolveEntityRow(ds, "AgentMessage", id);
-		if (message === null) return inner(ctx, args);
-		const caller = callerKid(ctx);
-		const sender = message._metadata?.createdBy?.id;
-		let recipient = null;
-		if (typeof message.recipient === "string" && message.recipient !== "") {
-			const { rows } = await ds.read("AgentIdentity", { id: message.recipient });
-			recipient = rows[0]?.kid ?? null;
-		}
-		if (caller !== null && (caller === sender || caller === recipient)) return inner(ctx, args);
-		throw new ResolverFrameError("not_participant", `${name}: only this message's sender ('${String(sender ?? "unknown")}') or recipient ('${String(recipient ?? "unknown")}'), or an operator, may change or delete it`, { id: message.id });
-	};
-}
-/**
-* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
-* A kid with no `@` names no machine, so it may carry no host.
-*/
-function hostMatchesKid(host, kid) {
-	if (host === void 0 || host === null) return true;
-	if (typeof kid !== "string" || !kid.includes("@")) return false;
-	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
-}
-function refuseForeignHost(name, host, kid) {
-	if (hostMatchesKid(host, kid)) return;
-	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
-}
-/**
-* AgentIdentity create: a non-operator may not file a row whose `host` is a
-* machine other than the one its kid names. The fleet audit trusts `host`
-* (and `roaming` on that host) when it decides who may write a host's
-* HostInstall rows.
-*/
-function identityCreateGuard(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const params = args.params ?? {};
-		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
-		if (typeof params.kid === "string") {
-			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
-				where: { kid: { eq: params.kid } },
-				limit: 1
-			});
-			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
-		}
-		return inner(ctx, args);
-	};
-}
-/**
-* AgentIdentity update: the identity itself (the caller's kid is the row's
-* kid) or an operator. `kid` is the row's identity, so changing it is an
-* operator act even on your own row: otherwise a row could be renamed onto a
-* kid whose mail it would then receive. `host` must stay the kid's machine,
-* and reactivating a retired row is an operator act.
-*/
-function identitySelfOnly(installCtx, name, inner) {
-	return async (ctx, args) => {
-		const id = rowId(args);
-		if (id === void 0 || isOperator(ctx)) return inner(ctx, args);
-		const ds = args.dataset ?? installCtx.dataset;
-		const row = await resolveEntityRow(ds, "AgentIdentity", id);
-		if (row === null) return inner(ctx, args);
-		const params = args.params ?? {};
-		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
-		if (callerKid(ctx) === row.kid) {
-			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
-			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
-			return inner(ctx, args);
-		}
-		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
-	};
-}
-/**
-* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
-* Todo carries none. A resolution with a live resulting status is refused,
-* and moving a Todo back to a live status clears the one it had.
-*/
-function todoResolutionGuard(installCtx, name, inner, statusAliases) {
-	const canon = (v) => {
-		const s = String(v).trim().toLowerCase();
-		return statusAliases[s] ?? s;
-	};
-	return async (ctx, args) => {
-		const params = { ...args.params ?? {} };
-		const statusGiven = params.status !== void 0 && params.status !== null;
-		let resulting = statusGiven ? canon(params.status) : null;
-		let current = null;
-		const id = rowId(args);
-		if (id !== void 0) {
-			const ds = args.dataset ?? installCtx.dataset;
-			current = await resolveEntityRow(ds, "Todo", id);
-			if (resulting === null && current !== null) resulting = canon(current.status);
-		}
-		if (resulting === null) resulting = "open";
-		if (resulting === "closed") return inner(ctx, args);
-		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
-		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
-		return inner(ctx, {
-			...args,
-			params
-		});
-	};
-}
-/** AgentIdentity delete: operators only. Mail hangs off these rows. */
-function operatorOnly(name, inner) {
-	return async (ctx, args) => {
-		if (isOperator(ctx)) return inner(ctx, args);
-		throw new ResolverFrameError("operator_only", `${name}: only an operator may delete an identity row; retire it with active: false instead`, {});
-	};
-}
-
 //#endregion
 //#region src/mailbox.ts
 const TYPE = "AgentMessage";
@@ -932,6 +943,11 @@ const HOST_INSTALL_CHECK_STATES = [
 	"warn",
 	"unknown"
 ];
+const TASK_STATUS_VOCAB = [
+	"active",
+	"paused",
+	"done"
+];
 const CONCEPT_NAME_TTL_MS = 6e4;
 /** Long-form length past which `embed.source` appends the long form to the synopsis. */
 const LONGFORM_EMBED_CHARS = 1200;
@@ -1349,6 +1365,45 @@ function buildClaudeNamespace(ns) {
 				where: "live",
 				name: "rows_host_install_key_unique"
 			}]
+		},
+		Task: { fields: {
+			title: field.string(),
+			status: field.enum(TASK_STATUS_VOCAB, { default: "active" }),
+			todo: field.crossRef(ns, "Todo", {
+				nullable: true,
+				onDelete: "set_null"
+			}),
+			archived: field.boolean({ default: false }),
+			project: field.string({
+				nullable: true,
+				indexed: true
+			})
+		} },
+		ExecutionCheckpoint: {
+			fields: {
+				task: field.crossRef(ns, "Task", { onDelete: "cascade" }),
+				revision: field.number(),
+				completed: field.string({ indexed: false }),
+				nextAction: field.string({ indexed: false }),
+				blockers: field.string({
+					nullable: true,
+					indexed: false
+				}),
+				refs: field.list(field.string(), { nullable: true }),
+				project: field.string({
+					nullable: true,
+					indexed: true
+				})
+			},
+			indexes: [{
+				fields: ["task", {
+					field: "revision",
+					dir: "desc"
+				}],
+				unique: true,
+				where: "live",
+				name: "rows_execution_checkpoint_task_revision_unique"
+			}]
 		}
 	};
 	const definition = defineNamespace(ns, types, {
@@ -1393,7 +1448,9 @@ const CLAUDE_TYPE_NAMES = [
 	"Skill",
 	"AgentIdentity",
 	"AgentMessage",
-	"HostInstall"
+	"HostInstall",
+	"Task",
+	"ExecutionCheckpoint"
 ];
 /**
 * Architecture namespace — Claude-lineage code-review findings. Kept separate
@@ -1690,6 +1747,32 @@ function buildBody(namespace, retention) {
 					settingsEnv: "json — allowlisted non-secret switch values, plus whether the identity keys are set (nullable)"
 				},
 				writeWhen: ["Written by the cold-start of every session with an agent identity; agents read it, they do not write it"]
+			},
+			Task: {
+				purpose: "A unit of work in flight: the stable identity a fresh session resumes by after a reset, independent of session id. Not a backlog ticket; link one via `todo`",
+				fields: {
+					id: "auto-generated",
+					title: "what the work is",
+					status: `${vocabUnion(TASK_STATUS_VOCAB)} (default active)`,
+					todo: "UUID crossRef to the Todo this work implements, set_null on delete (nullable)",
+					archived: "true if retired",
+					project: "repo basename; null = cross-cutting"
+				},
+				writeWhen: ["When starting work that may outlive the context window", "Flip status to done when the work is finished, paused when set aside"]
+			},
+			ExecutionCheckpoint: {
+				purpose: "One acknowledged step of a Task: what was completed and the next action. The latest is the Task's highest revision",
+				fields: {
+					id: "auto-generated",
+					task: "UUID crossRef to the Task, cascade on delete",
+					revision: "one higher than the Task's latest; unique per Task, so a second write at the same revision is refused",
+					completed: "what this step finished (not indexed)",
+					nextAction: "the exact next operation (not indexed)",
+					blockers: "what stands in the way (not indexed, nullable)",
+					refs: "file paths, #shortIds, PR or commit references (nullable)",
+					project: "repo basename; null = cross-cutting"
+				},
+				writeWhen: ["After a completed subtask, a blocker, or before a reset; point at files and rows, never retell them", "Treat the step as done only once the write is acknowledged; on a refused revision, re-read the latest and retry"]
 			}
 		},
 		mutations: buildMutations(),
@@ -2069,4 +2152,4 @@ function createCortextPlugin(cfg) {
 }
 
 //#endregion
-export { runCompact as C, isMonotonicAuth as E, registerCompactRoute as S, buildAuthPolicies as T, TODO_RESOLUTION_ALIASES as _, classSatisfies as a, buildArchitectureNamespace as b, AGENT_RULE_CATEGORY_VOCAB as c, ARCHITECTURE_TYPE_NAMES as d, CLAUDE_TYPE_NAMES as f, HOST_INSTALL_FRAGMENT_STATES as g, HOST_INSTALL_CHECK_STATES as h, bumpClass as i, AGENT_RULE_SEVERITY_ALIASES as l, DECISION_STATUS_VOCAB as m, inferTodoResolution as n, classifySurfaceChange as o, DECISION_STATUS_ALIASES as p, buildReleaseSurface as r, registerOnboardRoute as s, createCortextPlugin as t, AGENT_RULE_SEVERITY_VOCAB as u, TODO_STATUS_ALIASES as v, DEFAULT_AUTH as w, buildClaudeNamespace as x, TODO_STATUS_IMPLIES as y };
+export { registerCompactRoute as C, isMonotonicAuth as D, buildAuthPolicies as E, buildClaudeNamespace as S, DEFAULT_AUTH as T, TASK_STATUS_VOCAB as _, classSatisfies as a, TODO_STATUS_IMPLIES as b, AGENT_RULE_CATEGORY_VOCAB as c, ARCHITECTURE_TYPE_NAMES as d, CLAUDE_TYPE_NAMES as f, HOST_INSTALL_FRAGMENT_STATES as g, HOST_INSTALL_CHECK_STATES as h, bumpClass as i, AGENT_RULE_SEVERITY_ALIASES as l, DECISION_STATUS_VOCAB as m, inferTodoResolution as n, classifySurfaceChange as o, DECISION_STATUS_ALIASES as p, buildReleaseSurface as r, registerOnboardRoute as s, createCortextPlugin as t, AGENT_RULE_SEVERITY_VOCAB as u, TODO_RESOLUTION_ALIASES as v, runCompact as w, buildArchitectureNamespace as x, TODO_STATUS_ALIASES as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnmal-ai/cortext",
-  "version": "1.0.0-alpha.10",
+  "version": "1.0.0-alpha.12",
   "description": "Cortext: the agent-neutral coordination context store for Substrate (Todos, Decisions, SessionLogs, AgentRules, Memory, Concepts, Councils, …) plus architecture findings. One package carrying two plugins: the coordinator that registers the namespaces, and the kernel plugin that owns their Postgres invariants.",
   "license": "Apache-2.0",
   "repository": {
@@ -62,10 +62,10 @@
     "zod": "^4.6.5"
   },
   "peerDependencies": {
-    "@mnmal-ai/substrate": ">=1.0.0-alpha.10 <2.0.0"
+    "@mnmal-ai/substrate": ">=1.0.0-alpha.12 <2.0.0"
   },
   "devDependencies": {
-    "@mnmal-ai/substrate": "1.0.0-alpha.10",
+    "@mnmal-ai/substrate": "1.0.0-alpha.12",
     "@types/node": "^26.6.4",
     "tsdown": "^0.23.0",
     "typescript": "^7.0.2",