@ngockhoale/ukit 3.3.3 → 3.4.1

package/template_project/.claude/ukit/runtime/observability-emit.mjs

@@ -0,0 +1,1102 @@
+#!/usr/bin/env node
+/**
+ * observability-emit.mjs (TASK-003, SPEC §5 FR-003, §6, §14) — the installed
+ * live session-boot emit surface. Parity-locked mirror of
+ * src/core/observability/emit/sessionBoot.js: installed runtime code cannot
+ * import package source, so this file replicates the same pipeline —
+ * envelope fill → validate → sanitize → sampling decider → bounded append —
+ * against the same semantic contract (SCHEMA_VERSION 1 envelope, registry
+ * names/privacy floors, allowlist/deny-list, redaction rules). Keep this
+ * file byte-equivalent in behavior to the twin;
+ * tests/consistency/sessionBootEmitParity.test.js asserts identical
+ * persisted shape.
+ *
+ *   emitSessionBoot({ projectRoot, engine, sessionId, config?, deps? })
+ *   emitOutcomeObserved({ projectRoot, record, config?, deps? })
+ *   resolveEmitStage(config) → 'off' | 'shadow' | 'canary' | 'default'
+ *   loadEmitConfig(projectRoot) → merged emit config (never throws)
+ *   runHook(ctx) — in-proc chain step: SessionStart → emitSessionBoot
+ *
+ * A hook child lives for milliseconds — startLifecycle's interval timers
+ * cannot survive it, so the emit is a bounded one-shot write per event
+ * (SPEC §14). Fire-and-forget, bounded (< SESSION_BOOT_EMIT_DEADLINE_MS),
+ * never throws, never delays the session.
+ *
+ * Segment layout parity with segments/retention.js: appends land in
+ * active.jsonl (O_APPEND, O_NOFOLLOW) with _state.json bookkeeping. The
+ * mirror does not seal/rotate segments itself — an active file that would
+ * exceed maxSegmentBytes yields a typed 'segment_full' drop rather than
+ * an unsafe half-rotation; total-segment growth past maxTotalBytes flips
+ * the _state.json disabled flag (the recorder's retention owns eviction).
+ */
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { scanText } from './sensitive-value-scanner.mjs';
+
+// --- frozen schema contract (mirror of schema/constants.js + registry) ---
+
+const SCHEMA_VERSION = 1;
+const RECORD_TYPES = new Set(['fact', 'derived', 'evaluation', 'decision']);
+const PRIVACY_CLASSES = Object.freeze(['public', 'internal', 'sensitive', 'private']);
+const IMPORTANCE_LEVELS = Object.freeze(['low', 'normal', 'high', 'critical']);
+const RESOURCE_SOURCES = new Set(['PROVIDER', 'LOCAL_TOKENIZER', 'ESTIMATED', 'UNKNOWN']);
+const CONFIDENCE_TYPES = Object.freeze([
+  'HEURISTIC',
+  'STATISTICAL',
+  'EVALUATOR',
+  'CALIBRATED_MODEL',
+  'MODEL_SELF_REPORT',
+]);
+
+const ENVELOPE_FIELDS = new Set([
+  'record_type',
+  'semantic_name',
+  'schema_version',
+  'record_id',
+  'trace_id',
+  'span_id',
+  'parent_span_id',
+  'execution_id',
+  'session_id',
+  'project_ref',
+  'boot_id',
+  'writer_id',
+  'sequence',
+  'wall_time_utc',
+  'monotonic_ns',
+  'importance',
+  'privacy_class',
+  'origin',
+  'payload',
+  'agent_id',
+  'project_instance_id',
+  'sampling',
+]);
+const KNOWN_ENVELOPE_FIELDS = new Set([...ENVELOPE_FIELDS, 'redaction_version']);
+const REQUIRED_ENVELOPE_FIELDS = [
+  'record_type',
+  'semantic_name',
+  'schema_version',
+  'record_id',
+  'boot_id',
+  'writer_id',
+  'sequence',
+  'wall_time_utc',
+  'importance',
+  'privacy_class',
+  'payload',
+];
+const OPTIONAL_ID_FIELDS = [
+  'trace_id',
+  'span_id',
+  'parent_span_id',
+  'execution_id',
+  'session_id',
+  'project_ref',
+  'agent_id',
+];
+const REASON_CODE_FIELDS = ['error_code', 'reason_code', 'wait_code'];
+const MAX_ID_FIELD_CHARS = 128;
+const ISO_8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+
+// Registry privacy floors (name → privacy_class) — the validator's semantic
+// vocabulary and the sanitizer's floor stamp both read this.
+const SEMANTIC_PRIVACY = Object.freeze({
+  'execution.started': 'internal',
+  'execution.completed': 'internal',
+  'execution.failed': 'internal',
+  'execution.blocked': 'internal',
+  'tool.started': 'sensitive',
+  'tool.completed': 'sensitive',
+  'tool.failed': 'sensitive',
+  'model.started': 'internal',
+  'model.completed': 'internal',
+  'model.failed': 'internal',
+  'cache.hit': 'internal',
+  'cache.miss': 'internal',
+  'verification.completed': 'internal',
+  'context.item.injected': 'internal',
+  'decision.made': 'internal',
+  'telemetry.dropped': 'internal',
+  'telemetry.recovered': 'internal',
+  'telemetry.redacted': 'internal',
+  'memory.write': 'internal',
+  'memory.retrieved': 'internal',
+  'retrieval.query': 'internal',
+  'outcome.observed': 'internal',
+  'anomaly.detected': 'internal',
+  'telemetry.crashed': 'internal',
+  'subagent.usage': 'internal',
+});
+const SEMANTIC_NAMES = new Set(Object.keys(SEMANTIC_PRIVACY));
+
+const REASON_CODES = new Set([
+  'TOOL_TIMEOUT', 'AUTH_FAILED', 'RATE_LIMITED', 'MODEL_ERROR', 'NETWORK_ERROR',
+  'QUEUE_OVERFLOW', 'SAMPLED_OUT', 'HOST_BLIND', 'FLUSH_FAILED', 'DISK_FULL',
+  'PERMISSION_DENIED', 'SCHEMA_MISMATCH', 'CHECKSUM_MISMATCH', 'PARTIAL_TAIL',
+  'ROTATED', 'REDACTED_FIELD', 'USER_CANCELLED', 'GATE_BLOCKED',
+  'WAITING_ON_TOOL', 'WAITING_ON_MODEL', 'WAITING_ON_USER', 'CONFIG_INVALID',
+]);
+
+const RESOURCE_SEMANTICS = new Set(['model.completed', 'model.failed']);
+
+// --- frozen privacy contract (mirror of privacy/allowlist.js) ------------
+
+const REDACTION_VERSION = 'df-redact-6';
+const ALLOWED_FIELDS = ENVELOPE_FIELDS;
+const DENIED_PAYLOAD_FIELDS = new Set([
+  'error_detail', 'feedback', 'comment', 'note_text', 'prompt', 'prompt_text',
+  'system_prompt', 'messages', 'command', 'cmd', 'argv', 'stdin', 'stdout',
+  'stderr', 'output', 'raw_output', 'body', 'request_body', 'response_body',
+  'content', 'text', 'diff', 'patch', 'snippet', 'env', 'dotenv', 'secret',
+  'token', 'api_key', 'apikey', 'password', 'passwd', 'credential',
+  'credentials', 'auth', 'authorization', 'cookie', 'cookies', 'session_token',
+  'private_key', 'email', 'username', 'hostname', 'host', 'ip', 'ip_address',
+  'url', 'uri', 'path', 'file_path', 'filepath', 'abs_path', 'cwd', 'home',
+  'home_dir', 'stack', 'stack_trace', 'traceback',
+]);
+const MAX_RECORD_BYTES = 64 * 1024;
+const MAX_STRING_CHARS = 8 * 1024;
+const MAX_OBJECT_KEYS = 64;
+const MAX_ARRAY_ITEMS = 128;
+const MAX_DEPTH = 8;
+
+// --- redaction (mirror of privacy/redaction.js) ----------------------------
+
+const REDACTION_RULES = [
+  { tag: 'secret', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
+  { tag: 'secret', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
+  { tag: 'secret', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
+  { tag: 'secret', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  { tag: 'secret', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+  { tag: 'secret', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
+  { tag: 'secret', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+  { tag: 'secret', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
+  { tag: 'secret', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
+  { tag: 'secret', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  { tag: 'secret', re: /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi },
+  { tag: 'secret', re: /\bssh-(?:rsa|ed25519|dss)\s+[A-Za-z0-9+/=]{20,}/g },
+  { tag: 'secret', re: /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@[^\s]+/gi },
+  { tag: 'secret', re: /\b(?:SECRET|TOKEN|PASSWORD|PASSWD|API[_-]?KEY|PRIVATE[_-]?KEY|CREDENTIALS?)[A-Z0-9_-]*\s*=\s*[^\s"']+/gi },
+  { tag: 'path', re: /\/(?:[\w.@+-]+)(?:\/[\w.@+-]+)+/g },
+  { tag: 'path', re: /\b[A-Za-z]:\\(?:[^\s"']+\\)*[^\s"']*/g },
+  { tag: 'pii', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
+];
+const FORBIDDEN_CHARS_RE =
+  /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F\u00AD\u2028-\u202E\u2066-\u2069\u200B-\u200D\u2060\uFEFF\uFFF0-\uFFFF]/g;
+
+function hasLineBreak(value) {
+  return value.includes('\n') || value.includes('\r');
+}
+
+function redactString(value, { scanner, maxChars }) {
+  let out = value;
+  if (hasLineBreak(out)) return '[REDACTED:multiline]';
+  for (const { tag, re } of REDACTION_RULES) {
+    re.lastIndex = 0;
+    out = out.replace(re, `[REDACTED:${tag}]`);
+  }
+  FORBIDDEN_CHARS_RE.lastIndex = 0;
+  out = out.replace(FORBIDDEN_CHARS_RE, '');
+  if (typeof scanner === 'function') {
+    let hit = false;
+    try {
+      const res = scanner(out);
+      hit = Boolean(res && res.hasSecret);
+    } catch {
+      hit = true;
+    }
+    if (hit) return '[REDACTED:secret]';
+  }
+  if (out.length > maxChars) {
+    const marker = '…[TRUNCATED]';
+    out = `${out.slice(0, Math.max(0, maxChars - marker.length))}${marker}`;
+  }
+  return out;
+}
+
+// --- sanitize (mirror of privacy/sanitizeObserved.js) ----------------------
+
+function sanitizeKey(key, ctx) {
+  if (typeof key !== 'string' || key.length === 0 || key.length > 128) return null;
+  const cleaned = redactString(key, { scanner: ctx.scanner, maxChars: 128 });
+  if (cleaned !== key) return null;
+  return key;
+}
+
+function sanitizeValue(value, ctx, depth) {
+  if (value === null) return null;
+  const t = typeof value;
+  if (t === 'boolean') return value;
+  if (t === 'number') return Number.isFinite(value) ? value : null;
+  if (t === 'string') {
+    return redactString(value, { scanner: ctx.scanner, maxChars: MAX_STRING_CHARS });
+  }
+  if (depth >= MAX_DEPTH) return undefined;
+  if (Array.isArray(value)) {
+    const out = [];
+    for (const item of value.slice(0, MAX_ARRAY_ITEMS)) {
+      const v = sanitizeValue(item, ctx, depth + 1);
+      out.push(v === undefined ? null : v);
+    }
+    return out;
+  }
+  if (isPlainObject(value)) {
+    const out = {};
+    let kept = 0;
+    for (const [k, v] of Object.entries(value)) {
+      if (kept >= MAX_OBJECT_KEYS) break;
+      if (DENIED_PAYLOAD_FIELDS.has(k)) continue;
+      const key = sanitizeKey(k, ctx);
+      if (key === null) continue;
+      const sv = sanitizeValue(v, ctx, depth + 1);
+      if (sv === undefined) continue;
+      out[key] = sv;
+      kept += 1;
+    }
+    return out;
+  }
+  return undefined;
+}
+
+function sanitizeObserved(record, options = {}) {
+  try {
+    if (!isPlainObject(record)) return { ok: false, reason: 'record_not_object' };
+    const ctx = {
+      scanner: typeof options.scanner === 'function' ? options.scanner : scanText,
+    };
+    const out = {};
+    for (const [key, value] of Object.entries(record)) {
+      if (!ALLOWED_FIELDS.has(key)) continue;
+      if (key === 'payload') continue;
+      const sv = sanitizeValue(value, ctx, 0);
+      if (sv !== undefined) out[key] = sv;
+    }
+    if (!isPlainObject(record.payload)) return { ok: false, reason: 'payload_not_object' };
+    out.payload = sanitizeValue(record.payload, ctx, 0);
+    if (!PRIVACY_CLASSES.includes(out.privacy_class)) {
+      const floor = SEMANTIC_PRIVACY[out.semantic_name];
+      out.privacy_class = floor || 'internal';
+    }
+    out.redaction_version = REDACTION_VERSION;
+    let serialized;
+    try {
+      serialized = JSON.stringify(out);
+    } catch {
+      return { ok: false, reason: 'serialization_failed' };
+    }
+    if (serialized.length > MAX_RECORD_BYTES) return { ok: false, reason: 'record_too_large' };
+    return { ok: true, record: out };
+  } catch {
+    return { ok: false, reason: 'sanitizer_error' };
+  }
+}
+
+// --- validate (mirror of schema/validate.js, sans cross-record context) ----
+
+function validateSemanticRecord(record) {
+  const errors = [];
+  if (!isPlainObject(record)) return { ok: false, errors: ['record must be a plain object'] };
+
+  for (const key of Object.keys(record)) {
+    if (!KNOWN_ENVELOPE_FIELDS.has(key)) errors.push(`unknown envelope field: ${key}`);
+  }
+  for (const field of REQUIRED_ENVELOPE_FIELDS) {
+    if (record[field] === undefined || record[field] === null) {
+      errors.push(`missing required field: ${field}`);
+    }
+  }
+  if (errors.length > 0) return { ok: false, errors };
+
+  if (!Number.isInteger(record.schema_version)) {
+    errors.push('schema_version must be an integer');
+  } else if (record.schema_version !== SCHEMA_VERSION) {
+    errors.push(`unsupported schema version: ${record.schema_version} (supported: ${SCHEMA_VERSION})`);
+  }
+  if (!RECORD_TYPES.has(record.record_type)) {
+    errors.push(`record_type must be one of ${[...RECORD_TYPES].join('|')}`);
+  }
+  if (!isNonEmptyString(record.semantic_name)) {
+    errors.push('semantic_name must be a non-empty string');
+  } else if (!SEMANTIC_NAMES.has(record.semantic_name)) {
+    errors.push(`unknown semantic name: ${record.semantic_name}`);
+  }
+  if (!isNonEmptyString(record.record_id)) errors.push('record_id must be a non-empty string');
+  if (!isNonEmptyString(record.boot_id)) errors.push('boot_id must be a non-empty string');
+  if (!isNonEmptyString(record.writer_id)) errors.push('writer_id must be a non-empty string');
+  if (!Number.isInteger(record.sequence) || record.sequence < 0) {
+    errors.push('sequence must be a non-negative integer');
+  }
+  if (typeof record.wall_time_utc !== 'string'
+    || !ISO_8601_RE.test(record.wall_time_utc)
+    || Number.isNaN(Date.parse(record.wall_time_utc))) {
+    errors.push('wall_time_utc must be an ISO-8601 timestamp string');
+  }
+  if (record.monotonic_ns !== undefined && record.monotonic_ns !== null) {
+    if (typeof record.monotonic_ns !== 'number' || !Number.isFinite(record.monotonic_ns) || record.monotonic_ns < 0) {
+      errors.push('monotonic_ns must be a non-negative number when present');
+    }
+  }
+  if (!IMPORTANCE_LEVELS.includes(record.importance)) {
+    errors.push('importance must be a valid importance level');
+  }
+  if (!PRIVACY_CLASSES.includes(record.privacy_class)) {
+    errors.push('privacy_class must be a valid privacy class');
+  } else {
+    const floor = SEMANTIC_PRIVACY[record.semantic_name];
+    if (floor && PRIVACY_CLASSES.indexOf(record.privacy_class) < PRIVACY_CLASSES.indexOf(floor)) {
+      errors.push(`privacy_class below registry floor ${floor} for ${record.semantic_name}`);
+    }
+  }
+  for (const field of OPTIONAL_ID_FIELDS) {
+    const value = record[field];
+    if (value !== undefined && value !== null && typeof value !== 'string') {
+      errors.push(`${field} must be a string or null`);
+    }
+  }
+  for (const field of ['agent_id', 'project_instance_id']) {
+    const value = record[field];
+    if (value !== undefined && value !== null) {
+      if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ID_FIELD_CHARS) {
+        errors.push(`${field} must be a non-empty string of at most ${MAX_ID_FIELD_CHARS} characters`);
+      }
+    }
+  }
+  if (record.sampling !== undefined && record.sampling !== null) {
+    const sampling = record.sampling;
+    if (!isPlainObject(sampling)) {
+      errors.push('sampling must be an object {policy_version, rate}');
+    } else {
+      if (!isNonEmptyString(sampling.policy_version) || sampling.policy_version.length > MAX_ID_FIELD_CHARS) {
+        errors.push('sampling.policy_version invalid');
+      }
+      if (typeof sampling.rate !== 'number' || !Number.isFinite(sampling.rate) || sampling.rate < 0 || sampling.rate > 1) {
+        errors.push('sampling.rate must be a number in [0, 1]');
+      }
+    }
+  }
+
+  if (!isPlainObject(record.payload)) {
+    errors.push('payload must be an object');
+  } else {
+    const payload = record.payload;
+    if (payload.resource !== undefined && payload.resource !== null) {
+      const resource = payload.resource;
+      if (!isPlainObject(resource)) {
+        errors.push('payload.resource must be an object {value, source}');
+      } else {
+        if (!RESOURCE_SOURCES.includes(resource.source)) {
+          errors.push('payload.resource.source invalid');
+        }
+        if (resource.value !== null && resource.value !== undefined && typeof resource.value !== 'number') {
+          errors.push('payload.resource.value must be a number or null');
+        }
+        if (typeof resource.value === 'number' && resource.source === 'UNKNOWN') {
+          errors.push('payload.resource.value must be null when source is UNKNOWN');
+        }
+      }
+    }
+    for (const field of REASON_CODE_FIELDS) {
+      const code = payload[field];
+      if (code !== undefined && code !== null && !REASON_CODES.has(code)) {
+        errors.push(`payload.${field} is not in the reason-code registry`);
+      }
+    }
+    if (payload.confidence !== undefined && payload.confidence !== null) {
+      if (isPlainObject(payload.confidence)) {
+        if (!CONFIDENCE_TYPES.includes(payload.confidence.type)) {
+          errors.push('payload.confidence.type invalid');
+        }
+        if (typeof payload.confidence.value !== 'number' || !Number.isFinite(payload.confidence.value)) {
+          errors.push('payload.confidence.value must be a finite number');
+        }
+      } else if (!CONFIDENCE_TYPES.includes(payload.confidence)) {
+        errors.push('payload.confidence invalid');
+      }
+    }
+    if (payload.telemetry_complete !== undefined && typeof payload.telemetry_complete !== 'boolean') {
+      errors.push('payload.telemetry_complete must be a boolean');
+    }
+    if (payload.duration_ms !== undefined && payload.duration_ms !== null) {
+      if (typeof payload.duration_ms !== 'number' || !Number.isFinite(payload.duration_ms) || payload.duration_ms < 0) {
+        errors.push('payload.duration_ms must be a non-negative finite number');
+      }
+    }
+  }
+
+  const origin = record.origin;
+  switch (record.record_type) {
+    case 'fact':
+      if (origin !== undefined && origin !== null && !isPlainObject(origin)) {
+        errors.push('origin must be an object when present');
+      }
+      break;
+    case 'derived':
+      if (!isPlainObject(origin)) errors.push('record_type "derived" requires origin with derived_from');
+      else if (!Array.isArray(origin.derived_from) || origin.derived_from.length === 0) {
+        errors.push('origin.derived_from must be a non-empty array of source record refs');
+      }
+      break;
+    case 'evaluation':
+      if (!isPlainObject(origin)) errors.push('record_type "evaluation" requires origin with evaluator and confidence');
+      else {
+        if (!isNonEmptyString(origin.evaluator)) errors.push('origin.evaluator must name the evaluator');
+        if (!CONFIDENCE_TYPES.includes(origin.confidence)) errors.push('origin.confidence invalid');
+      }
+      break;
+    case 'decision':
+      if (!isPlainObject(origin)) errors.push('record_type "decision" requires origin with experiment provenance');
+      else if (!isNonEmptyString(origin.experiment)) errors.push('origin.experiment invalid');
+      break;
+    default:
+      break;
+  }
+
+  return { ok: errors.length === 0, errors };
+}
+
+// --- emit config + sampling (mirror of emit/config.js + recorder decider) --
+
+const VALID_STAGES = new Set(['off', 'shadow', 'canary', 'default']);
+
+function resolveStage(config = null) {
+  const node = isPlainObject(config) ? config.observability : undefined;
+  const stage = isPlainObject(node) ? node.stage : undefined;
+  return VALID_STAGES.has(stage) ? stage : 'off';
+}
+
+const SAMPLING_RATE_KEYS = new Set(['low', 'normal', 'high', 'critical']);
+const MAX_POLICY_VERSION_CHARS = 128;
+const SAMPLING_BUCKETS = 10000;
+const SAMPLING_SEED = 0;
+let samplingConfigInvalidSeen = false;
+
+function resolveSampling(config = null) {
+  const node = isPlainObject(config) ? config.observability : undefined;
+  if (!isPlainObject(node)) return null;
+  const sampling = node.sampling;
+  if (sampling === undefined || sampling === null) return null;
+  const invalid = () => {
+    samplingConfigInvalidSeen = true;
+    return null;
+  };
+  if (!isPlainObject(sampling)) return invalid();
+  const { policy_version, rates } = sampling;
+  if (
+    typeof policy_version !== 'string'
+    || policy_version.length === 0
+    || policy_version.length > MAX_POLICY_VERSION_CHARS
+  ) {
+    return invalid();
+  }
+  if (!isPlainObject(rates)) return invalid();
+  const out = {};
+  for (const [key, value] of Object.entries(rates)) {
+    if (!SAMPLING_RATE_KEYS.has(key)) return invalid();
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1) {
+      return invalid();
+    }
+    out[key] = value;
+  }
+  for (const level of SAMPLING_RATE_KEYS) {
+    if (out[level] === undefined) out[level] = 1;
+  }
+  return { policy_version, rates: out };
+}
+
+function samplingBucket(recordId, seed) {
+  let h = (seed >>> 0) ^ 0x9747b28c;
+  for (let i = 0; i < recordId.length; i += 1) {
+    h = Math.imul(h ^ recordId.charCodeAt(i), 0x5bd1e995);
+    h = (h << 15) | (h >>> 17);
+  }
+  h ^= h >>> 15;
+  h = Math.imul(h, 0x85ebca6b);
+  h ^= h >>> 13;
+  return (h >>> 0) % SAMPLING_BUCKETS;
+}
+
+function effectiveSamplingRate(policy, importance) {
+  if (importance === 'critical') return 1;
+  const rate = policy.rates[importance];
+  return typeof rate === 'number' ? rate : 1;
+}
+
+function keptBySampling(recordId, rate, seed) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  if (typeof recordId !== 'string' || recordId.length === 0) return true;
+  return samplingBucket(recordId, seed) < Math.round(rate * SAMPLING_BUCKETS);
+}
+
+function stampSampling(candidate, policy) {
+  if (policy !== null && isPlainObject(candidate)) {
+    candidate.sampling = {
+      policy_version: policy.policy_version,
+      rate: effectiveSamplingRate(policy, candidate.importance),
+    };
+  }
+}
+
+// --- emit module -----------------------------------------------------------
+
+/** Hard upper bound for the whole one-shot emit (ms). */
+export const SESSION_BOOT_EMIT_DEADLINE_MS = 250;
+
+const ACTIVE_FILE = 'active.jsonl';
+const STATE_FILE = '_state.json';
+const MAX_SEGMENT_BYTES = 8 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+const IO_TIMEOUT_MS = 5000;
+
+const STATE_DEFAULTS = Object.freeze({
+  next_segment_seq: 1,
+  expired_segments: 0,
+  quarantined_segments: 0,
+  disabled: false,
+  active_since_ms: null,
+});
+
+const SEMANTIC_EXECUTION_STARTED = 'execution.started';
+const SEMANTIC_OUTCOME_OBSERVED = 'outcome.observed';
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function hasTraversal(rawPath) {
+  return String(rawPath).split(/[\\/]+/).includes('..');
+}
+
+function observabilityRoot(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'observability');
+}
+
+function segmentsRoot(projectRoot) {
+  return path.join(observabilityRoot(projectRoot), 'segments');
+}
+
+/** Deterministic session-boot join key — same as the canonical twin. */
+export function sessionBootRequestKey({ projectRoot, sessionId } = {}) {
+  const digest = crypto
+    .createHash('sha256')
+    .update(`${String(projectRoot ?? '')}\n${String(sessionId ?? '')}`)
+    .digest('hex')
+    .slice(0, 24);
+  return `session-boot-${digest}`;
+}
+
+function buildSessionBootRecord({
+  projectRoot,
+  engine,
+  sessionId,
+  nowMs = Date.now(),
+} = {}) {
+  if (!isNonEmptyString(projectRoot)) return null;
+  const trace_id = `trace-${crypto.randomUUID()}`;
+  return {
+    semantic_name: SEMANTIC_EXECUTION_STARTED,
+    trace_id,
+    span_id: `span-${crypto.randomUUID()}`,
+    parent_span_id: null,
+    execution_id: `exec-${crypto.randomUUID()}`,
+    session_id: isNonEmptyString(sessionId) ? sessionId : undefined,
+    project_ref: `proj-${crypto
+      .createHash('sha256')
+      .update(String(path.resolve(projectRoot)))
+      .digest('hex')
+      .slice(0, 12)}`,
+    payload: {
+      operation: 'session-boot',
+      duration_ms: null,
+      engine: isNonEmptyString(engine) ? engine : 'unknown',
+      sessionId: isNonEmptyString(sessionId) ? sessionId : 'unknown',
+      ts: new Date(nowMs).toISOString(),
+      request_key: sessionBootRequestKey({ projectRoot, sessionId }),
+    },
+  };
+}
+
+export function resolveEmitStage(config = null) {
+  const node = isPlainObject(config) ? config.observability : undefined;
+  if (isPlainObject(node) && node.stage === 'off') return 'off';
+  const stage = resolveStage(config);
+  return stage === 'off' ? 'default' : stage;
+}
+
+export async function loadEmitConfig(projectRoot) {
+  if (!isNonEmptyString(projectRoot)) return null;
+  try {
+    const raw = await fs.promises.readFile(
+      path.join(projectRoot, '.ukit', 'storage', 'config.json'),
+      'utf8',
+    );
+    const parsed = JSON.parse(raw);
+    return isPlainObject(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+async function withTimeout(promise, ms) {
+  if (ms <= 0) {
+    return Promise.reject(Object.assign(new Error('io timeout'), { code: 'IO_TIMEOUT' }));
+  }
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(Object.assign(new Error('io timeout'), { code: 'IO_TIMEOUT' }));
+    }, ms);
+    if (timer.unref) timer.unref();
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+async function readState(root, timeoutMs) {
+  try {
+    const raw = await withTimeout(fs.promises.readFile(path.join(root, STATE_FILE), 'utf8'), timeoutMs);
+    const parsed = JSON.parse(raw);
+    return { ...STATE_DEFAULTS, ...(parsed && typeof parsed === 'object' ? parsed : {}) };
+  } catch {
+    return { ...STATE_DEFAULTS };
+  }
+}
+
+async function writeState(root, state, timeoutMs) {
+  try {
+    await withTimeout(
+      fs.promises.writeFile(path.join(root, STATE_FILE), JSON.stringify(state, null, 2)),
+      timeoutMs,
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Bounded append: replicate appendRecord's durable invariants (mkdir, state
+// gate, symlink rejection, O_APPEND, active_since stamp) without the seal
+// lane — an oversized active file drops typed, the total cap flips disabled.
+async function appendBounded(root, record, { nowMs } = {}) {
+  const timeoutMs = IO_TIMEOUT_MS;
+  if (typeof root !== 'string' || root.length === 0 || hasTraversal(root)) {
+    return { ok: false, reason: 'unsafe_root' };
+  }
+  const line = JSON.stringify(record) + '\n';
+  const lineBytes = Buffer.byteLength(line, 'utf8');
+  try {
+    const st = await withTimeout(fs.promises.lstat(root), timeoutMs);
+    if (!st.isDirectory()) return { ok: false, reason: 'root_not_directory' };
+  } catch (err) {
+    if (!err || err.code !== 'ENOENT') return { ok: false, reason: `io_${err?.code || 'error'}` };
+  }
+  try {
+    await withTimeout(fs.promises.mkdir(root, { recursive: true }), timeoutMs);
+  } catch (err) {
+    return { ok: false, reason: `io_${err?.code || 'error'}` };
+  }
+
+  const state = await readState(root, timeoutMs);
+  if (state.disabled) return { ok: false, reason: 'disabled' };
+
+  const activePath = path.join(root, ACTIVE_FILE);
+  try {
+    const st = await withTimeout(fs.promises.lstat(activePath), timeoutMs);
+    if (st.isSymbolicLink()) return { ok: false, reason: 'unsafe_path' };
+    if (st.isFile() && st.size > 0 && st.size + lineBytes > MAX_SEGMENT_BYTES) {
+      return { ok: false, reason: 'segment_full' };
+    }
+  } catch (err) {
+    if (!err || err.code !== 'ENOENT') return { ok: false, reason: `io_${err?.code || 'error'}` };
+  }
+
+  const appendFlags =
+    fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND |
+    (fs.constants.O_NOFOLLOW || 0);
+  try {
+    await withTimeout(fs.promises.appendFile(activePath, line, { flag: appendFlags }), timeoutMs);
+  } catch (err) {
+    return { ok: false, reason: `io_${err?.code || 'error'}` };
+  }
+
+  if (state.active_since_ms === null || state.active_since_ms === undefined) {
+    state.active_since_ms = Number.isFinite(nowMs) ? nowMs : Date.now();
+    await writeState(root, state, timeoutMs);
+  }
+
+  // Total-size bound (retention-lite): past the hard cap the store marks
+  // itself disabled — future emits drop typed rather than grow unbounded.
+  try {
+    let total = 0;
+    for (const name of await withTimeout(fs.promises.readdir(root), timeoutMs)) {
+      if (name === ACTIVE_FILE || name.endsWith('.jsonl') || name.endsWith('.jsonl.zst')) {
+        try {
+          total += (await withTimeout(fs.promises.stat(path.join(root, name)), timeoutMs)).size;
+        } catch { /* stat race — skip */ }
+      }
+    }
+    if (total > MAX_TOTAL_BYTES) {
+      await writeState(root, { ...state, disabled: true }, timeoutMs);
+    }
+  } catch { /* accounting failure never fails the write */ }
+
+  return { ok: true, written: true };
+}
+
+async function bounded(promise, deadlineMs) {
+  if (!Number.isFinite(deadlineMs) || deadlineMs <= 0) {
+    return { timedOut: true };
+  }
+  let timer;
+  try {
+    const result = await Promise.race([
+      Promise.resolve(promise).then((value) => ({ value })),
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ timedOut: true }), deadlineMs);
+        if (timer.unref) timer.unref();
+      }),
+    ]);
+    return result;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function makeClock(deps) {
+  return {
+    nowMs:
+      typeof deps.nowMs === 'function'
+        ? deps.nowMs
+        : () => (Number.isFinite(deps.nowMs) ? deps.nowMs : Date.now()),
+    nowNs:
+      typeof deps.nowNs === 'function'
+        ? deps.nowNs
+        : () => (Number.isFinite(deps.nowNs) ? deps.nowNs : Number(process.hrtime.bigint())),
+    iso:
+      typeof deps.iso === 'function'
+        ? deps.iso
+        : () => (typeof deps.iso === 'string' ? deps.iso : new Date().toISOString()),
+  };
+}
+
+// Envelope fill — the recorder's fillEnvelope verbatim: caller ids win,
+// missing fields are stamped by this boot.
+function fillEnvelope(record, state, time) {
+  const out = { ...record };
+  if (out.record_type === undefined || out.record_type === null) out.record_type = 'fact';
+  if (out.schema_version === undefined || out.schema_version === null) {
+    out.schema_version = SCHEMA_VERSION;
+  }
+  if (typeof out.record_id !== 'string' || out.record_id.length === 0) {
+    out.record_id = `rec-${crypto.randomUUID()}`;
+  }
+  if (typeof out.boot_id !== 'string' || out.boot_id.length === 0) out.boot_id = state.boot_id;
+  if (typeof out.writer_id !== 'string' || out.writer_id.length === 0) {
+    out.writer_id = state.writer_id;
+  }
+  if (!Number.isInteger(out.sequence)) out.sequence = ++state.sequence;
+  if (typeof out.wall_time_utc !== 'string') out.wall_time_utc = time.iso();
+  if (out.monotonic_ns === undefined || out.monotonic_ns === null) {
+    out.monotonic_ns = Number(time.nowNs());
+  }
+  if (typeof out.importance !== 'string') out.importance = 'normal';
+  if (typeof out.privacy_class !== 'string') {
+    out.privacy_class = SEMANTIC_PRIVACY[out.semantic_name] || 'internal';
+  }
+  if (isPlainObject(out.payload)) {
+    out.payload = { ...out.payload };
+    if (RESOURCE_SEMANTICS.has(out.semantic_name) && out.payload.resource === undefined) {
+      out.payload.resource = { value: null, source: 'UNKNOWN' };
+    }
+  }
+  return out;
+}
+
+async function emitOne({ projectRoot, config, record, deps, deadlineMs }) {
+  const started = Date.now();
+  const fail = (reason) => ({
+    status: 'dropped',
+    reason,
+    elapsed_ms: Math.max(0, Date.now() - started),
+  });
+
+  if (!isNonEmptyString(projectRoot)) return fail('missing-project-root');
+  if (!isPlainObject(record)) return fail('invalid-record');
+  if (resolveEmitStage(config) === 'off') return fail('stage-off');
+
+  const injected = isPlainObject(deps) ? deps : {};
+  const time = makeClock(injected);
+  const seed = Number.isFinite(injected.samplingSeed) ? injected.samplingSeed >>> 0 : SAMPLING_SEED;
+
+  const effectiveConfig = isPlainObject(config)
+    ? {
+        ...config,
+        observability: {
+          ...(isPlainObject(config.observability) ? config.observability : {}),
+          stage: resolveEmitStage(config),
+        },
+      }
+    : { observability: { stage: 'default' } };
+
+  const budget = Number.isFinite(deadlineMs) && deadlineMs > 0
+    ? Math.min(deadlineMs, SESSION_BOOT_EMIT_DEADLINE_MS)
+    : SESSION_BOOT_EMIT_DEADLINE_MS;
+
+  try {
+    const policy = resolveSampling(effectiveConfig);
+    const state = {
+      boot_id: `boot-${crypto.randomUUID()}`,
+      writer_id: `recorder-${crypto.randomUUID()}`,
+      sequence: 0,
+    };
+    const candidate = fillEnvelope(record, state, time);
+    stampSampling(candidate, policy);
+    const validation = validateSemanticRecord(candidate);
+    if (!validation.ok) return fail('invalid');
+    const clean = sanitizeObserved(candidate);
+    if (!clean.ok) return fail('sanitize-rejected');
+    if (policy !== null && !keptBySampling(candidate.record_id, candidate.sampling.rate, seed)) {
+      // Recorder parity: a sampled drop emits one aggregate self-record —
+      // the one-shot seam writes it directly (no queue) when it lands.
+      const aggregate = fillEnvelope({
+        semantic_name: 'telemetry.dropped',
+        payload: { reason_code: 'SAMPLED_OUT', dropped_count: 1 },
+      }, state, time);
+      stampSampling(aggregate, policy);
+      const aggregateClean = sanitizeObserved(aggregate);
+      if (aggregateClean.ok) {
+        await bounded(appendBounded(segmentsRoot(path.resolve(projectRoot)), aggregateClean.record, { nowMs: time.nowMs() }), budget);
+      }
+      return fail('sampled-out');
+    }
+    if (samplingConfigInvalidSeen && !state.configInvalidReported) {
+      state.configInvalidReported = true;
+      const aggregate = fillEnvelope({
+        semantic_name: 'telemetry.dropped',
+        payload: { reason_code: 'CONFIG_INVALID', dropped_count: 1 },
+      }, state, time);
+      const aggregateClean = sanitizeObserved(aggregate);
+      if (aggregateClean.ok) {
+        await bounded(appendBounded(segmentsRoot(path.resolve(projectRoot)), aggregateClean.record, { nowMs: time.nowMs() }), budget);
+      }
+    }
+    const writer =
+      typeof injected.writer === 'function'
+        ? (rec) => injected.writer(rec)
+        : (rec) => appendBounded(segmentsRoot(path.resolve(projectRoot)), rec, { nowMs: time.nowMs() });
+    const written = await bounded(Promise.resolve().then(() => writer(clean.record)), budget);
+    if (written.timedOut) {
+      return { status: 'partial', reason: 'deadline', elapsed_ms: Math.max(0, Date.now() - started) };
+    }
+    const result = written.value;
+    if (result && result.ok) {
+      return { status: 'written', written: 1, elapsed_ms: Math.max(0, Date.now() - started) };
+    }
+    return {
+      status: 'dropped',
+      reason: (result && result.reason) || 'write-failed',
+      elapsed_ms: Math.max(0, Date.now() - started),
+    };
+  } catch {
+    return fail('emit-error');
+  }
+}
+
+export async function emitSessionBoot({
+  projectRoot,
+  engine,
+  sessionId,
+  config,
+  deps,
+  deadlineMs,
+} = {}) {
+  const injected = isPlainObject(deps) ? deps : {};
+  const nowMs = typeof injected.nowMs === 'function' ? injected.nowMs() : injected.nowMs;
+  const record = buildSessionBootRecord({
+    projectRoot,
+    engine: isNonEmptyString(engine) ? engine : 'unknown',
+    sessionId,
+    nowMs: Number.isFinite(nowMs) ? nowMs : Date.now(),
+  });
+  return emitOne({ projectRoot, config, record, deps: injected, deadlineMs });
+}
+
+export async function emitOutcomeObserved({
+  projectRoot,
+  record,
+  config,
+  deps,
+  deadlineMs,
+} = {}) {
+  const candidate = isPlainObject(record) ? { ...record } : record;
+  if (isPlainObject(candidate) && candidate.semantic_name === undefined) {
+    candidate.semantic_name = SEMANTIC_OUTCOME_OBSERVED;
+  }
+  return emitOne({
+    projectRoot,
+    config,
+    record: candidate,
+    deps: isPlainObject(deps) ? deps : {},
+    deadlineMs,
+  });
+}
+
+
+// --- TASK-005 (FR-005, BL-007): terminal OutcomeRecord construction ---------
+// The three terminal emitters (record-execution.mjs receipts,
+// stop-coordinator.mjs verdicts, execution-ledger.mjs finalizers) share ONE
+// record builder so every `outcome.observed` record carries the ARCH
+// §Data Contracts OutcomeRecord fields plus the TASK-003 session-boot
+// `request_key` join id — the missing 1-of-3934 emitter surface (TM §2).
+
+export const OUTCOME_VERDICTS = Object.freeze([
+  'VERIFIED', 'FAILED', 'BLOCKED', 'INCONCLUSIVE', 'INTERRUPTED',
+]);
+
+const OUTCOME_ENFORCEMENTS = new Set(['enforced', 'advisory']);
+
+// FR-005/FR-006: `advisory` is the Codex marker — the engine stamp may arrive
+// as an explicit `engine` argument or as `env.UKIT_HARNESS` (the stamp the
+// .sh wrappers and the omp bridge export). Anything else is `enforced`.
+export function deriveEnforcement({ engine = null, env = null } = {}) {
+  const fromArg = isNonEmptyString(engine) ? engine : null;
+  const fromEnv = isPlainObject(env) && isNonEmptyString(env.UKIT_HARNESS) ? env.UKIT_HARNESS : null;
+  return (fromArg === 'codex' || fromEnv === 'codex') ? 'advisory' : 'enforced';
+}
+
+// The run id is the ledger's session identity: `run-<safe session id>` when a
+// session is known, `run-transcript-<sha256[:12]>` for transcript-only
+// payloads (never the raw path — it would be path-redacted anyway), else null.
+export function outcomeRunId(payload = {}) {
+  const sessionId = isNonEmptyString(payload.session_id)
+    ? payload.session_id
+    : (isNonEmptyString(payload.sessionId) ? payload.sessionId : null);
+  if (sessionId) {
+    const safe = sessionId.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96);
+    return `run-${safe}`;
+  }
+  const transcript = isNonEmptyString(payload.transcript_path)
+    ? payload.transcript_path
+    : (isNonEmptyString(payload.transcriptPath) ? payload.transcriptPath : null);
+  if (transcript) {
+    const digest = crypto.createHash('sha256').update(String(transcript)).digest('hex').slice(0, 12);
+    return `run-transcript-${digest}`;
+  }
+  return null;
+}
+
+function outcomeStringList(value, cap) {
+  if (!Array.isArray(value)) return [];
+  return value
+    .filter((item) => typeof item === 'string' && item.length > 0)
+    .map((item) => item.slice(0, 160))
+    .slice(0, cap);
+}
+
+function outcomeCost(value) {
+  if (!isPlainObject(value)) return { latencyMs: null, rounds: null };
+  const cost = value;
+  return {
+    latencyMs: Number.isFinite(cost.latencyMs) && cost.latencyMs >= 0 ? cost.latencyMs : null,
+    rounds: Number.isFinite(cost.rounds) && cost.rounds >= 0 ? cost.rounds : null,
+  };
+}
+
+/**
+ * buildOutcomeObservedRecord({ outcome, projectRoot, payload, sessionId,
+ * engine, env }) → semantic-record candidate for `outcome.observed`.
+ *
+ * `outcome` is the ARCH §Data Contracts OutcomeRecord subset the emitter knows:
+ *   { outcomeId?, runId?, routeId?, routeFingerprint?, ledgerKey?, verdict,
+ *     evidenceIds?, cost?, reviewActions?, enforcement?, engine?, source?, ts? }
+ * Every field defaults sanely — a terminal event without runId/route data
+ * still emits with nulls (task case 4) and never blocks the caller's path.
+ * `payload` is the hook payload: it supplies session identity for runId
+ * derivation, the session-boot request_key join, and the envelope session_id.
+ * `enforcement` derives per FR-006 unless the emitter overrode it.
+ */
+export function buildOutcomeObservedRecord({
+  outcome = null,
+  projectRoot = null,
+  payload = {},
+  sessionId = null,
+  engine = null,
+  env = null,
+} = {}) {
+  const safe = isPlainObject(outcome) ? outcome : {};
+  const resolvedSessionId = isNonEmptyString(sessionId)
+    ? sessionId
+    : (isNonEmptyString(payload?.session_id)
+      ? payload.session_id
+      : (isNonEmptyString(payload?.sessionId) ? payload.sessionId : null));
+  const engineName = isNonEmptyString(engine)
+    ? engine
+    : (isNonEmptyString(safe.engine) ? safe.engine : null);
+  const verdict = OUTCOME_VERDICTS.includes(safe.verdict) ? safe.verdict : 'INCONCLUSIVE';
+  const recordPayload = {
+    outcomeId: isNonEmptyString(safe.outcomeId) ? safe.outcomeId : `oc-${crypto.randomUUID()}`,
+    runId: safe.runId !== undefined ? safe.runId : outcomeRunId(payload),
+    routeId: safe.routeId !== undefined ? safe.routeId : null,
+    routeFingerprint: safe.routeFingerprint !== undefined ? safe.routeFingerprint : null,
+    ledgerKey: safe.ledgerKey !== undefined ? safe.ledgerKey : null,
+    verdict,
+    evidenceIds: outcomeStringList(safe.evidenceIds, 32),
+    cost: outcomeCost(safe.cost),
+    reviewActions: outcomeStringList(safe.reviewActions, 32),
+    // TASK-C85-016 (BL-016): per-pair tracking — nullable, additive. The
+    // join key for implementer↔reviewer outcome-rate measurement
+    // (ARCH §Adaptive Cross-Check calibration).
+    implementer: isNonEmptyString(safe.implementer) ? safe.implementer.slice(0, 96) : null,
+    reviewer: isNonEmptyString(safe.reviewer) ? safe.reviewer.slice(0, 96) : null,
+    reviewVerdict: isNonEmptyString(safe.reviewVerdict) ? safe.reviewVerdict.slice(0, 96) : null,
+    enforcement: OUTCOME_ENFORCEMENTS.has(safe.enforcement)
+      ? safe.enforcement
+      : deriveEnforcement({ engine: engineName, env }),
+    engine: engineName,
+    source: isNonEmptyString(safe.source) ? safe.source.slice(0, 96) : null,
+    request_key: sessionBootRequestKey({ projectRoot, sessionId: resolvedSessionId }),
+    ts: isNonEmptyString(safe.ts) ? safe.ts : new Date().toISOString(),
+  };
+  return {
+    semantic_name: SEMANTIC_OUTCOME_OBSERVED,
+    session_id: resolvedSessionId ?? undefined,
+    payload: recordPayload,
+  };
+}
+
+// --- SPEC §8 chain-step entry ------------------------------------------------
+// runHook(ctx) — in-proc SessionStart chain step. Advisory: always exit 0;
+// a telemetry fault can never block session start. The record is written
+// BEFORE slow .sh chain members can exhaust the chain budget, which is why
+// this step sits first in the SessionStart list.
+export async function runHook(ctx = {}) {
+  try {
+    const payload = isPlainObject(ctx.payload) ? ctx.payload : {};
+    if (payload.hook_event_name !== 'SessionStart') {
+      return { code: 0, stdout: '', stderr: '' };
+    }
+    const projectRoot = isNonEmptyString(ctx.projectRoot)
+      ? ctx.projectRoot
+      : (isNonEmptyString(payload.cwd) ? payload.cwd : null);
+    if (!projectRoot) return { code: 0, stdout: '', stderr: '' };
+    const env = isPlainObject(ctx.env) ? ctx.env : process.env;
+    const config = await loadEmitConfig(projectRoot);
+    await emitSessionBoot({
+      projectRoot,
+      engine: isNonEmptyString(env.UKIT_HARNESS) ? env.UKIT_HARNESS : 'claude-code',
+      sessionId: payload.session_id,
+      config,
+      deadlineMs: Number.isFinite(ctx.deadlineMs) ? ctx.deadlineMs : undefined,
+    });
+    return { code: 0, stdout: '', stderr: '' };
+  } catch {
+    return { code: 0, stdout: '', stderr: '' };
+  }
+}