@mnmal-ai/cortext 1.0.0-alpha.8 → 1.0.0-alpha.9

package/dist/bootstrap.js

@@ -1,5 +1,5 @@
-import { E as isMonotonicAuth, t as createCortextPlugin, w as DEFAULT_AUTH } from "./src-BKaGTnRw.js";
-import { D as ARCHITECTURE_NAMESPACE, k as CORTEXT_NAMESPACE } from "./plugin-27UpMnoE.js";
+import { E as isMonotonicAuth, t as createCortextPlugin, w as DEFAULT_AUTH } from "./src-DyQq4vqr.js";
+import { D as ARCHITECTURE_NAMESPACE, k as CORTEXT_NAMESPACE } from "./plugin-oVE0E3so.js";
 import "./kernel.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { C as runCompact, E as isMonotonicAuth, S as registerCompactRoute, T as buildAuthPolicies, _ as TODO_RESOLUTION_ALIASES, a as classSatisfies, b as buildArchitectureNamespace, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_STATUS_ALIASES, w as DEFAULT_AUTH, x as buildClaudeNamespace, y as TODO_STATUS_IMPLIES } from "./src-BKaGTnRw.js";
-import { g as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-27UpMnoE.js";
+import { C as runCompact, E as isMonotonicAuth, S as registerCompactRoute, T as buildAuthPolicies, _ as TODO_RESOLUTION_ALIASES, a as classSatisfies, b as buildArchitectureNamespace, c as AGENT_RULE_CATEGORY_VOCAB, d as ARCHITECTURE_TYPE_NAMES, f as CLAUDE_TYPE_NAMES, g as HOST_INSTALL_FRAGMENT_STATES, h as HOST_INSTALL_CHECK_STATES, i as bumpClass, l as AGENT_RULE_SEVERITY_ALIASES, m as DECISION_STATUS_VOCAB, n as inferTodoResolution, o as classifySurfaceChange, p as DECISION_STATUS_ALIASES, r as buildReleaseSurface, s as registerOnboardRoute, t as createCortextPlugin, u as AGENT_RULE_SEVERITY_VOCAB, v as TODO_STATUS_ALIASES, w as DEFAULT_AUTH, x as buildClaudeNamespace, y as TODO_STATUS_IMPLIES } from "./src-DyQq4vqr.js";
+import { g as AGENT_MESSAGE_STATUS_VOCAB } from "./plugin-oVE0E3so.js";
 import "./kernel.js";
 
 export { AGENT_MESSAGE_STATUS_VOCAB, AGENT_RULE_CATEGORY_VOCAB, AGENT_RULE_SEVERITY_ALIASES, AGENT_RULE_SEVERITY_VOCAB, ARCHITECTURE_TYPE_NAMES, CLAUDE_TYPE_NAMES, DECISION_STATUS_ALIASES, DECISION_STATUS_VOCAB, DEFAULT_AUTH, HOST_INSTALL_CHECK_STATES, HOST_INSTALL_FRAGMENT_STATES, TODO_RESOLUTION_ALIASES, TODO_STATUS_ALIASES, TODO_STATUS_IMPLIES, buildArchitectureNamespace, buildAuthPolicies, buildClaudeNamespace, buildReleaseSurface, bumpClass, classSatisfies, classifySurfaceChange, createCortextPlugin, inferTodoResolution, isMonotonicAuth, registerCompactRoute, registerOnboardRoute, runCompact };

package/dist/kernel/invariant-audit.d.ts

@@ -89,6 +89,7 @@ export type Finding =
     readonly kind: 'object_misscoped';
     readonly object: InvariantObject;
     readonly scopedTo: string | null;
+    readonly expected: string;
 }
 /** Present and correctly scoped, but NOT VALID — new writes only. */
  | {
@@ -148,7 +149,7 @@ export declare function scopedNamespace(definition: string): string | null;
  * gains a filter, an early return or a per-object skip, the completion metric
  * reports what was actually inspected instead of a promise.
  */
-export declare function auditObjects(sql: unknown): Promise<{
+export declare function auditObjects(sql: unknown, target?: string): Promise<{
     findings: Finding[];
     checked: number;
 }>;

package/dist/kernel-bootstrap.js

@@ -1,4 +1,4 @@
-import { t as createCortextKernelPlugin } from "./plugin-27UpMnoE.js";
+import { t as createCortextKernelPlugin } from "./plugin-oVE0E3so.js";
 import { defineBootstrap } from "@mnmal-ai/substrate/sdk";
 import { z } from "zod";
 

package/dist/kernel.js

@@ -1,3 +1,3 @@
-import { C as findingMessage, D as ARCHITECTURE_NAMESPACE, E as scopedNamespace, O as CORTEXT_COORDINATOR_NAME, S as auditObjects, T as resolveCortextNamespaces, _ as TODO_LIFECYCLE_VOCAB, a as repairInvariants, b as INVARIANT_OBJECTS, c as cortextBaselineMigration, d as countDuplicateKids, f as rescopeHostInstallKeyIndex, g as AGENT_MESSAGE_STATUS_VOCAB, h as rescopeVocabConstraint, i as repairIfRequested, k as CORTEXT_NAMESPACE, l as VOCAB_CONSTRAINTS, m as rescopeRecipientIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as rescopeKidUniqueIndex, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as countDuplicateHostInstallKeys, v as TODO_PRIORITY_VOCAB, w as reportInvariantAudit, x as auditNamespaceCoverage, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
+import { C as findingMessage, D as ARCHITECTURE_NAMESPACE, E as scopedNamespace, O as CORTEXT_COORDINATOR_NAME, S as auditObjects, T as resolveCortextNamespaces, _ as TODO_LIFECYCLE_VOCAB, a as repairInvariants, b as INVARIANT_OBJECTS, c as cortextBaselineMigration, d as countDuplicateKids, f as rescopeHostInstallKeyIndex, g as AGENT_MESSAGE_STATUS_VOCAB, h as rescopeVocabConstraint, i as repairIfRequested, k as CORTEXT_NAMESPACE, l as VOCAB_CONSTRAINTS, m as rescopeRecipientIndex, n as SUBSTRATE_CONTRACT_RANGE, o as repairOutcomeMessage, p as rescopeKidUniqueIndex, r as REPAIR_ENV_VAR, s as repairRequested, t as createCortextKernelPlugin, u as countDuplicateHostInstallKeys, v as TODO_PRIORITY_VOCAB, w as reportInvariantAudit, x as auditNamespaceCoverage, y as TODO_RESOLUTION_VOCAB } from "./plugin-oVE0E3so.js";
 
 export { AGENT_MESSAGE_STATUS_VOCAB, ARCHITECTURE_NAMESPACE, CORTEXT_COORDINATOR_NAME, CORTEXT_NAMESPACE, INVARIANT_OBJECTS, REPAIR_ENV_VAR, SUBSTRATE_CONTRACT_RANGE, TODO_LIFECYCLE_VOCAB, TODO_PRIORITY_VOCAB, TODO_RESOLUTION_VOCAB, VOCAB_CONSTRAINTS, auditNamespaceCoverage, auditObjects, cortextBaselineMigration, countDuplicateHostInstallKeys, countDuplicateKids, createCortextKernelPlugin, findingMessage, repairIfRequested, repairInvariants, repairOutcomeMessage, repairRequested, reportInvariantAudit, rescopeHostInstallKeyIndex, rescopeKidUniqueIndex, rescopeRecipientIndex, rescopeVocabConstraint, resolveCortextNamespaces, scopedNamespace };

package/dist/participants.d.ts

@@ -21,12 +21,26 @@ export declare function isOperator(ctx: RequestContext): boolean;
  * neither is a bystander's call.
  */
 export declare function messageParticipantsOnly(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
+/**
+ * AgentIdentity create: a non-operator may not file a row whose `host` is a
+ * machine other than the one its kid names. The fleet audit trusts `host`
+ * (and `roaming` on that host) when it decides who may write a host's
+ * HostInstall rows.
+ */
+export declare function identityCreateGuard(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
 /**
  * AgentIdentity update: the identity itself (the caller's kid is the row's
  * kid) or an operator. `kid` is the row's identity, so changing it is an
  * operator act even on your own row: otherwise a row could be renamed onto a
- * kid whose mail it would then receive.
+ * kid whose mail it would then receive. `host` must stay the kid's machine,
+ * and reactivating a retired row is an operator act.
  */
 export declare function identitySelfOnly(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver): RegistryEntryResolver;
+/**
+ * Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+ * Todo carries none. A resolution with a live resulting status is refused,
+ * and moving a Todo back to a live status clears the one it had.
+ */
+export declare function todoResolutionGuard(installCtx: NamespaceInstallContext, name: string, inner: RegistryEntryResolver, statusAliases: Readonly<Record<string, string>>): RegistryEntryResolver;
 /** AgentIdentity delete: operators only. Mail hangs off these rows. */
 export declare function operatorOnly(name: string, inner: RegistryEntryResolver): RegistryEntryResolver;

package/dist/{plugin-27UpMnoE.js → plugin-oVE0E3so.js}

@@ -280,7 +280,7 @@ async function readCatalog(sql) {
 * gains a filter, an early return or a per-object skip, the completion metric
 * reports what was actually inspected instead of a promise.
 */
-async function auditObjects(sql) {
+async function auditObjects(sql, target = CORTEXT_NAMESPACE) {
 	const catalog = await readCatalog(sql);
 	const findings = [];
 	let checked = 0;
@@ -295,11 +295,12 @@ async function auditObjects(sql) {
 			continue;
 		}
 		const scope = scopedNamespace(row.definition);
-		if (scope !== "cortext") {
+		if (scope !== target) {
 			findings.push({
 				kind: "object_misscoped",
 				object,
-				scopedTo: scope
+				scopedTo: scope,
+				expected: target
 			});
 			continue;
 		}
@@ -320,7 +321,7 @@ function findingMessage(finding) {
 		case "namespace_drifted": return `${head} the cortext coordinator is configured for namespace '${finding.configured}', but every kernel constraint and index is scoped to '${finding.scopedTo}'. So all of them are INACTIVE for '${finding.configured}': Todo/AgentMessage vocabularies unenforced, the mailbox inbox index covering no rows, and AgentIdentity.kid uniqueness NOT held. Writes succeed and queries answer, so nothing else will report this. Use '${finding.scopedTo}', or accept the loss deliberately.`;
 		case "namespace_uncovered": return `${head} invariants are scoped to namespace '${finding.scopedTo}', which no loaded coordinator declares (declared: ${finding.declared.join(", ") || "none"}). Every kernel guarantee below is therefore INACTIVE, and nothing else will report it — a constraint scoped to a namespace with no rows passes trivially. ` + (finding.reason === "host_does_not_attribute" ? "This substrate does not attribute namespaces to their plugin (added in 5.1.0), so which namespace REPLACED it cannot be determined — upgrade the binary to get a named target rather than this list." : "This substrate does attribute, and the cortext coordinator declared no namespace at all — it is not loaded. The objects are orphaned rather than misscoped.") + " Set SYNOPTIC_CORTEXT_REPAIR=1 for one restart to re-scope.";
 		case "object_missing": return `${head} ${finding.object.kind} '${finding.object.name}' (${finding.object.migration}) is ABSENT. Lost guarantee: ${finding.object.guarantee}. Migrations are recorded once by id, so this will NOT be reinstalled by a restart.`;
-		case "object_misscoped": return `${head} ${finding.object.kind} '${finding.object.name}' is scoped to ${finding.scopedTo === null ? "no namespace" : `'${finding.scopedTo}'`}, not '${CORTEXT_NAMESPACE}'. Lost guarantee: ${finding.object.guarantee}. It exists, so nothing errors; it simply matches no rows.`;
+		case "object_misscoped": return `${head} ${finding.object.kind} '${finding.object.name}' is scoped to ${finding.scopedTo === null ? "no namespace" : `'${finding.scopedTo}'`}, not '${finding.expected}'. Lost guarantee: ${finding.object.guarantee}. It exists, so nothing errors; it simply matches no rows.`;
 		case "object_not_validated": return `${head} ${finding.object.kind} '${finding.object.name}' exists but is NOT VALID — enforced for new writes only, and existing rows were never checked against it. Guarantee held only going forward: ${finding.object.guarantee}.`;
 	}
 }
@@ -352,11 +353,13 @@ function findingMessage(finding) {
 * structured channel this belongs in.
 */
 async function reportInvariantAudit(ctx, warn = console.warn) {
-	const findings = [...auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin)];
+	let findings = [...auditNamespaceCoverage(ctx.coordinatorNamespaces, ctx.coordinatorNamespacesByPlugin)];
+	const target = ctx.coordinatorNamespaces.includes("cortext") ? CORTEXT_NAMESPACE : resolveCortextNamespaces(ctx.coordinatorNamespacesByPlugin)?.[0] ?? "cortext";
 	const catalogRead = ctx.sql !== null && ctx.sql !== void 0;
 	let objectsChecked = 0;
 	if (catalogRead) try {
-		const result = await auditObjects(ctx.sql);
+		const result = await auditObjects(ctx.sql, target);
+		if (target !== "cortext" && result.findings.length === 0) findings = findings.filter((f) => f.kind !== "namespace_drifted");
 		findings.push(...result.findings);
 		objectsChecked = result.checked;
 	} catch (error) {

package/dist/{src-BKaGTnRw.js → src-DyQq4vqr.js}

@@ -1,5 +1,5 @@
-import { A as CORTEXT_PROMOTED_COLUMNS, D as ARCHITECTURE_NAMESPACE, O as CORTEXT_COORDINATOR_NAME, _ as TODO_LIFECYCLE_VOCAB, g as AGENT_MESSAGE_STATUS_VOCAB, k as CORTEXT_NAMESPACE, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_PRIORITY_VOCAB, y as TODO_RESOLUTION_VOCAB } from "./plugin-27UpMnoE.js";
-import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, applyUpdatePatch, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
+import { A as CORTEXT_PROMOTED_COLUMNS, D as ARCHITECTURE_NAMESPACE, O as CORTEXT_COORDINATOR_NAME, _ as TODO_LIFECYCLE_VOCAB, g as AGENT_MESSAGE_STATUS_VOCAB, k as CORTEXT_NAMESPACE, n as SUBSTRATE_CONTRACT_RANGE, v as TODO_PRIORITY_VOCAB, y as TODO_RESOLUTION_VOCAB } from "./plugin-oVE0E3so.js";
+import { JSON_HEADERS, RESERVED_AUTOCRUD_FIELDS, ResolverFrameError, and, createResolverWithEdges, defineNamespace, deleteResolver, denyAll, denyVerbs, field, formatQualifiedKey, getResolver, grantOf, grantedIn, jsonResponse, listResolver, makeCtx, or, queryAll, requireIdentity, resolveEntityRow, resolveIdentity, selectAll, updateResolver } from "@mnmal-ai/substrate/sdk";
 
 //#region src/auth-policy.ts
 /**
@@ -163,8 +163,12 @@ function parseBody(req) {
 	} catch (err) {
 		return { error: err instanceof Error ? err.message : "invalid JSON" };
 	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { dryRun: false };
-	return { dryRun: parsed.dryRun === true };
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { error: "body must be a JSON object, e.g. {\"dryRun\": true}" };
+	const unknown = Object.keys(parsed).filter((k) => k !== "dryRun");
+	if (unknown.length > 0) return { error: `unknown field(s): ${unknown.join(", ")}` };
+	const dryRun = parsed.dryRun;
+	if (dryRun !== void 0 && typeof dryRun !== "boolean") return { error: "\"dryRun\" must be true or false" };
+	return { dryRun: dryRun === true };
 }
 function registerCompactRoute(router, ctx, retention, namespace, auth = DEFAULT_AUTH) {
 	router.post("/compact", async (req) => {
@@ -295,10 +299,44 @@ function messageParticipantsOnly(installCtx, name, inner) {
 	};
 }
 /**
+* Whether `host` names the machine in `kid`'s `@host` part, ignoring case.
+* A kid with no `@` names no machine, so it may carry no host.
+*/
+function hostMatchesKid(host, kid) {
+	if (host === void 0 || host === null) return true;
+	if (typeof kid !== "string" || !kid.includes("@")) return false;
+	return String(host).toLowerCase() === kid.slice(kid.lastIndexOf("@") + 1).toLowerCase();
+}
+function refuseForeignHost(name, host, kid) {
+	if (hostMatchesKid(host, kid)) return;
+	throw new ResolverFrameError("operator_only", `${name}: 'host' must be the machine in the kid ('${String(kid)}'); only an operator may set another`, { field: "host" });
+}
+/**
+* AgentIdentity create: a non-operator may not file a row whose `host` is a
+* machine other than the one its kid names. The fleet audit trusts `host`
+* (and `roaming` on that host) when it decides who may write a host's
+* HostInstall rows.
+*/
+function identityCreateGuard(installCtx, name, inner) {
+	return async (ctx, args) => {
+		const params = args.params ?? {};
+		if (!isOperator(ctx)) refuseForeignHost(name, params.host, params.kid);
+		if (typeof params.kid === "string") {
+			const { rows } = await (args.dataset ?? installCtx.dataset).read("AgentIdentity", {
+				where: { kid: { eq: params.kid } },
+				limit: 1
+			});
+			if (rows.length > 0) throw new ResolverFrameError("duplicate_kid", `${name}: an AgentIdentity row for '${params.kid}' already exists; update it instead`, { field: "kid" });
+		}
+		return inner(ctx, args);
+	};
+}
+/**
 * AgentIdentity update: the identity itself (the caller's kid is the row's
 * kid) or an operator. `kid` is the row's identity, so changing it is an
 * operator act even on your own row: otherwise a row could be renamed onto a
-* kid whose mail it would then receive.
+* kid whose mail it would then receive. `host` must stay the kid's machine,
+* and reactivating a retired row is an operator act.
 */
 function identitySelfOnly(installCtx, name, inner) {
 	return async (ctx, args) => {
@@ -309,10 +347,45 @@ function identitySelfOnly(installCtx, name, inner) {
 		if (row === null) return inner(ctx, args);
 		const params = args.params ?? {};
 		if ("kid" in params && params.kid !== row.kid) throw new ResolverFrameError("operator_only", `${name}: 'kid' is the row's identity and only an operator may change it`, { field: "kid" });
-		if (callerKid(ctx) === row.kid) return inner(ctx, args);
+		if (callerKid(ctx) === row.kid) {
+			if ("host" in params || "roaming" in params || "project" in params) refuseForeignHost(name, "host" in params ? params.host : row.host, row.kid);
+			if (params.active === true && row.active === false) throw new ResolverFrameError("operator_only", `${name}: a retired identity may only be reactivated by an operator`, { field: "active" });
+			return inner(ctx, args);
+		}
 		throw new ResolverFrameError("not_self", `${name}: only '${String(row.kid)}' itself, or an operator, may edit this identity row`, { id: row.id });
 	};
 }
+/**
+* Todo create/update: `resolution` says why a CLOSED Todo stopped, so a live
+* Todo carries none. A resolution with a live resulting status is refused,
+* and moving a Todo back to a live status clears the one it had.
+*/
+function todoResolutionGuard(installCtx, name, inner, statusAliases) {
+	const canon = (v) => {
+		const s = String(v).trim().toLowerCase();
+		return statusAliases[s] ?? s;
+	};
+	return async (ctx, args) => {
+		const params = { ...args.params ?? {} };
+		const statusGiven = params.status !== void 0 && params.status !== null;
+		let resulting = statusGiven ? canon(params.status) : null;
+		let current = null;
+		const id = rowId(args);
+		if (id !== void 0) {
+			const ds = args.dataset ?? installCtx.dataset;
+			current = await resolveEntityRow(ds, "Todo", id);
+			if (resulting === null && current !== null) resulting = canon(current.status);
+		}
+		if (resulting === null) resulting = "open";
+		if (resulting === "closed") return inner(ctx, args);
+		if (params.resolution !== void 0 && params.resolution !== null) throw new ResolverFrameError("resolution_on_live_todo", `${name}: 'resolution' is for closed Todos; this one would be '${resulting}'`, { field: "resolution" });
+		if (statusGiven && current !== null && current.resolution != null && !("resolution" in params)) params.resolution = null;
+		return inner(ctx, {
+			...args,
+			params
+		});
+	};
+}
 /** AgentIdentity delete: operators only. Mail hangs off these rows. */
 function operatorOnly(name, inner) {
 	return async (ctx, args) => {
@@ -541,12 +614,27 @@ function transitionResolver(installCtx, target) {
 		if (identityRow === void 0) throw new ResolverFrameError("no_recipient", `${name}: the recipient identity row no longer exists`, { id: message.id });
 		const actor = resolveIdentity(ctx);
 		if (actor.id !== identityRow.kid) throw new ResolverFrameError("not_recipient", `${name}: only the recipient ('${String(identityRow.kid)}') may transition this message`, { recipient: identityRow.kid });
-		if (isNoOp(message.status)) return message;
-		const at = ctx.now.toISOString();
-		return applyUpdatePatch(ds, TYPE, message.id, {
-			status: target,
-			...stamp(actor, at)
-		}, ctx, args.onWrite);
+		let current = message;
+		for (let attempt = 0; attempt < 3 && current !== null; attempt++) {
+			if (isNoOp(current.status)) return current;
+			const { matched, row } = await ds.conditionalUpdate(TYPE, current.id, { status: current.status }, {
+				status: target,
+				...stamp(actor, ctx.now.toISOString())
+			}, actor, ctx.now);
+			if (matched && row !== null) {
+				args.onWrite?.({
+					ns: ds.namespace,
+					type: TYPE,
+					id: row.id,
+					operation: "update",
+					row
+				});
+				return row;
+			}
+			current = await resolveEntityRow(ds, TYPE, message.id);
+		}
+		if (current === null) return null;
+		throw new ResolverFrameError("conflict", `${name}: the message kept changing while it was being transitioned; retry`, { id: message.id });
 	};
 }
 /**
@@ -1244,7 +1332,13 @@ function buildClaudeNamespace(ns) {
 		install(ctx) {
 			baseInstall(ctx);
 			installMailboxMutations(ctx, definition.types.AgentMessage.fields);
-			for (const [name, wrap] of [["updateAgentIdentity", (r) => identitySelfOnly(ctx, "updateAgentIdentity", r)], ["deleteAgentIdentity", (r) => operatorOnly("deleteAgentIdentity", r)]]) {
+			for (const [name, wrap] of [
+				["createAgentIdentity", (r) => identityCreateGuard(ctx, "createAgentIdentity", r)],
+				["updateAgentIdentity", (r) => identitySelfOnly(ctx, "updateAgentIdentity", r)],
+				["deleteAgentIdentity", (r) => operatorOnly("deleteAgentIdentity", r)],
+				["createTodo", (r) => todoResolutionGuard(ctx, "createTodo", r, TODO_STATUS_ALIASES)],
+				["updateTodo", (r) => todoResolutionGuard(ctx, "updateTodo", r, TODO_STATUS_ALIASES)]
+			]) {
 				const entry = ctx.registry.get(name);
 				if (entry === void 0) throw new Error(`cortext: autoCRUD did not register ${name}`);
 				ctx.registry.replace(name, {
@@ -1592,7 +1686,11 @@ function buildBody(namespace, retention) {
 			description: "Load recent context at the start of each session",
 			query: {
 				SessionLog: {
-					params: { limit: 3 },
+					params: {
+						where: { archived: { eq: false } },
+						orderBy: [{ createdAt: "desc" }],
+						limit: 3
+					},
 					fields: {
 						id: true,
 						branch: true,
@@ -1602,7 +1700,11 @@ function buildBody(namespace, retention) {
 					}
 				},
 				Decision: {
-					params: { limit: 80 },
+					params: {
+						where: { archived: { eq: false } },
+						orderBy: [{ createdAt: "desc" }],
+						limit: 80
+					},
 					fields: {
 						id: true,
 						topic: true,
@@ -1615,7 +1717,18 @@ function buildBody(namespace, retention) {
 					}
 				},
 				Todo: {
-					params: { limit: 50 },
+					params: {
+						where: {
+							archived: { eq: false },
+							status: { in: [
+								"open",
+								"in_progress",
+								"blocked"
+							] }
+						},
+						orderBy: [{ createdAt: "desc" }],
+						limit: 50
+					},
 					fields: {
 						id: true,
 						title: true,
@@ -1631,7 +1744,7 @@ function buildBody(namespace, retention) {
 			surfaceToUser: [
 				"The 3 most recent non-archived SessionLog entries",
 				"Non-archived Decisions",
-				"Todos with status 'open' or 'blocked'",
+				"Todos with status 'open', 'in_progress' or 'blocked'",
 				"Skip archived records silently"
 			]
 		} },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnmal-ai/cortext",
-  "version": "1.0.0-alpha.8",
+  "version": "1.0.0-alpha.9",
   "description": "Cortext: the agent-neutral coordination context store for Substrate (Todos, Decisions, SessionLogs, AgentRules, Memory, Concepts, Councils, …) plus architecture findings. One package carrying two plugins: the coordinator that registers the namespaces, and the kernel plugin that owns their Postgres invariants.",
   "license": "Apache-2.0",
   "repository": {