@nifrajs/coding-agent 3.2.0

package/dist/orchestration/host.js

@@ -0,0 +1,334 @@
+/**
+ * The OrchestrationHost: the lifecycle owner for a compiled {@link RunPlan}. It does not schedule
+ * work itself - each top-level DAG layer is handed to a kernel {@link WorkflowRunner}, exactly as
+ * {@link compileRunPlan} would fold them into one `sequence`. Driving layer by layer gives a safe
+ * pause boundary (in-flight nodes finish; no new layer starts) and a cancellation seam (the layer's
+ * runner and any bounded subagent share the run's abort signal) without a second engine.
+ *
+ * Every transition is guarded by an explicit state machine: an illegal transition returns a stable
+ * code and mutates nothing. A terminal run is frozen - a late completion from an aborted layer
+ * cannot change its status, counters, or digest. Terminal results expose status, completed node ids,
+ * an order-independent evidence digest, artifact refs, counters, and a failure code only: never a
+ * step output, prompt, or payload.
+ */
+import { parseRunPlan, RUN_PLAN_VERSION } from "@nifrajs/agent-protocol";
+import { WorkflowRunner } from "../workflows.js";
+import { noopArtifactPort } from "./artifact-port.js";
+import { compileRunPlanLayers, digestRunPlan } from "./compile.js";
+import { MemoryEvidenceStore } from "./evidence-store.js";
+import { admitCapability, ChildVectorTracker } from "./policy.js";
+const TERMINAL = new Set(["succeeded", "failed", "cancelled"]);
+function isTerminal(state) {
+    return TERMINAL.has(state);
+}
+/** Thrown on an illegal lifecycle transition or an unknown run. `code` is stable. */
+export class OrchestrationStateError extends Error {
+    code;
+    constructor(reason, code) {
+        super(`orchestration host: ${reason}`);
+        this.code = code;
+        this.name = "OrchestrationStateError";
+    }
+}
+const DEFAULT_MAX_STEPS = 100_000;
+const DEFAULT_MAX_DEPTH = 64;
+/** Owns run lifecycle and evidence projection over the kernel WorkflowRunner. */
+export class OrchestrationHost {
+    catalog;
+    limits;
+    maxSteps;
+    maxDepth;
+    policy;
+    vectors = new ChildVectorTracker();
+    runs = new Map();
+    counter = 0;
+    constructor(options) {
+        this.catalog = options.catalog;
+        this.limits = options.limits;
+        this.maxSteps = options.maxSteps ?? DEFAULT_MAX_STEPS;
+        this.maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+        this.policy = options.policy;
+    }
+    /**
+     * Admit a capability descriptor against the host policy before it can be invoked. Throws
+     * {@link OrchestrationStateError} (`E_POLICY_REJECTED`) carrying the admission reason when refused.
+     * With no policy configured this is a passthrough - the host admits nothing it is not told to gate.
+     */
+    admit(descriptor) {
+        if (this.policy === undefined)
+            return;
+        const admission = admitCapability(this.policy, descriptor);
+        if (!admission.ok)
+            throw new OrchestrationStateError(`capability refused by host policy (${admission.code})`, "E_POLICY_REJECTED");
+    }
+    /**
+     * Allocate the next monotonic child vector for a live run, addressing a decision boundary the run
+     * pauses on. Strictly increasing per run, so a decision carrying any other vector is provably stale.
+     */
+    openBoundaryVector(runId) {
+        const run = this.require(runId);
+        if (isTerminal(run.state))
+            throw new OrchestrationStateError(`run '${runId}' is terminal; no boundary opens`, "E_NOT_TERMINAL");
+        return this.vectors.open(runId);
+    }
+    /**
+     * Parse, compile, and register a run in `submitted`. All structural ceilings and capability
+     * authority are enforced here (a `CompileError` with a stable code), so an over-limit or
+     * unauthorized plan never reaches `running`.
+     */
+    async submit(source, options = {}) {
+        const plan = parseRunPlan(source);
+        const planDigest = await digestRunPlan(plan);
+        const runId = options.runId ?? `run-${++this.counter}`;
+        if (this.runs.has(runId))
+            throw new OrchestrationStateError(`run '${runId}' already exists`, "E_DUPLICATE_RUN");
+        const artifactPort = options.artifactPort ?? noopArtifactPort();
+        const effectKeys = new Map();
+        const artifacts = new Map();
+        const layers = compileRunPlanLayers(plan, {
+            catalog: this.catalog,
+            planDigest,
+            artifactPort,
+            ...(this.limits !== undefined ? { limits: this.limits } : {}),
+            onNodeEffect: (nodeId, key) => effectKeys.set(nodeId, key),
+            collectArtifact: (nodeId, ref) => {
+                const list = artifacts.get(nodeId);
+                if (list === undefined)
+                    artifacts.set(nodeId, [ref]);
+                else
+                    list.push(ref);
+            },
+        });
+        const { kindById, idempotentById, nodeIds } = this.indexPlan(plan);
+        let finish;
+        const done = new Promise((resolve) => {
+            finish = resolve;
+        });
+        this.runs.set(runId, {
+            runId,
+            planDigest,
+            layers,
+            store: options.store ?? new MemoryEvidenceStore(),
+            controller: new AbortController(),
+            kindById,
+            idempotentById,
+            nodeIds,
+            effectKeys,
+            artifacts,
+            state: "submitted",
+            layerIndex: 0,
+            seq: 0,
+            cancelRequested: false,
+            failureCode: undefined,
+            gate: undefined,
+            done,
+            finish,
+        });
+        return runId;
+    }
+    /** Content-free progress view. Throws `E_NOT_FOUND` for an unknown run. */
+    inspect(runId) {
+        const run = this.require(runId);
+        return {
+            runId,
+            state: run.state,
+            planDigest: run.planDigest,
+            layerIndex: run.layerIndex,
+            layerCount: run.layers.length,
+            counters: run.store.counters(),
+        };
+    }
+    /** `submitted` -> `running`. Begins the driver. */
+    start(runId) {
+        const run = this.require(runId);
+        this.transition(run, "start", ["submitted"], "running");
+        void this.drive(run);
+    }
+    /** `running` -> `paused`. Takes effect at the next layer boundary; in-flight nodes finish. */
+    pause(runId) {
+        const run = this.require(runId);
+        this.transition(run, "pause", ["running"], "paused");
+        let resolve;
+        const promise = new Promise((r) => {
+            resolve = r;
+        });
+        run.gate = { promise, resolve };
+    }
+    /** `paused` -> `running`. Releases the layer boundary. */
+    resume(runId) {
+        const run = this.require(runId);
+        this.transition(run, "resume", ["paused"], "running");
+        run.gate?.resolve();
+        run.gate = undefined;
+    }
+    /**
+     * Cancel from any non-terminal state. Aborts the in-flight layer and any bounded subagent, frees a
+     * paused gate, and freezes the run in `cancelled`. A late completion cannot revive it.
+     */
+    cancel(runId) {
+        const run = this.require(runId);
+        if (isTerminal(run.state))
+            throw new OrchestrationStateError(`run '${runId}' cannot cancel from terminal '${run.state}'`, "E_ILLEGAL_TRANSITION");
+        run.cancelRequested = true;
+        run.state = "cancelled";
+        run.failureCode = "E_CANCELLED";
+        run.controller.abort();
+        run.gate?.resolve();
+        run.gate = undefined;
+        this.vectors.release(run.runId);
+        run.finish();
+    }
+    /** Terminal result. Throws `E_NOT_TERMINAL` while the run is still live. */
+    async result(runId) {
+        const run = this.require(runId);
+        if (!isTerminal(run.state))
+            throw new OrchestrationStateError(`run '${runId}' is '${run.state}', not terminal`, "E_NOT_TERMINAL");
+        return this.buildResult(run);
+    }
+    /** Await the run reaching a terminal state, then return its result. */
+    async settled(runId) {
+        const run = this.require(runId);
+        await run.done;
+        return this.buildResult(run);
+    }
+    require(runId) {
+        const run = this.runs.get(runId);
+        if (run === undefined)
+            throw new OrchestrationStateError(`unknown run '${runId}'`, "E_NOT_FOUND");
+        return run;
+    }
+    transition(run, op, from, to) {
+        if (!from.includes(run.state))
+            throw new OrchestrationStateError(`cannot ${op} run '${run.runId}' from '${run.state}'`, "E_ILLEGAL_TRANSITION");
+        run.state = to;
+    }
+    async buildResult(run) {
+        const status = run.state;
+        return {
+            runId: run.runId,
+            status,
+            planDigest: run.planDigest,
+            completedNodeIds: run.store.completedNodeIds(),
+            evidenceDigest: await run.store.digest(),
+            artifacts: run.store.artifacts(),
+            counters: run.store.counters(),
+            ...(run.failureCode !== undefined ? { failureCode: run.failureCode } : {}),
+        };
+    }
+    async drive(run) {
+        try {
+            for (; run.layerIndex < run.layers.length; run.layerIndex++) {
+                while (run.state === "paused")
+                    await run.gate?.promise;
+                if (isTerminal(run.state))
+                    return; // cancelled while paused
+                const layer = run.layers[run.layerIndex];
+                const result = await new WorkflowRunner({
+                    signal: run.controller.signal,
+                    maxSteps: this.maxSteps,
+                    maxDepth: this.maxDepth,
+                    onEvent: (event) => this.project(run, event),
+                }).run(layer);
+                if (isTerminal(run.state))
+                    return; // cancelled mid-layer: ignore the late result
+                if (!result.ok) {
+                    run.state = "failed";
+                    run.failureCode = run.failureCode ?? "E_STEP_FAILED";
+                    return;
+                }
+            }
+            if (!isTerminal(run.state))
+                run.state = "succeeded";
+        }
+        finally {
+            if (!isTerminal(run.state))
+                run.state = "failed";
+            this.vectors.release(run.runId);
+            run.finish();
+        }
+    }
+    /** Project one kernel event into a content-free evidence record. Frozen once the run is terminal. */
+    async project(run, event) {
+        if (isTerminal(run.state))
+            return; // a late completion cannot mutate a terminal run
+        if (!("id" in event) || !run.nodeIds.has(event.id))
+            return;
+        const base = {
+            version: RUN_PLAN_VERSION,
+            runId: run.runId,
+            planDigest: run.planDigest,
+            nodeId: event.id,
+            seq: run.seq++,
+            idempotent: run.idempotentById.get(event.id) ?? false,
+        };
+        const key = run.effectKeys.get(event.id);
+        const effect = key !== undefined ? { effectKey: key.digest } : {};
+        if (event.type === "step.started") {
+            await run.store.append({ ...base, status: "started" });
+            return;
+        }
+        if (event.type === "step.completed") {
+            if (isGateRejection(run.kindById.get(event.id), event.output)) {
+                run.failureCode = "E_GATE_REJECTED";
+                await run.store.append({ ...base, status: "failed", errorCode: "GATE_REJECTED", ...effect });
+                return;
+            }
+            const refs = run.artifacts.get(event.id);
+            await run.store.append({
+                ...base,
+                status: "completed",
+                ...effect,
+                ...(refs !== undefined && refs.length > 0 ? { artifacts: refs } : {}),
+            });
+            return;
+        }
+        if (event.type === "step.failed") {
+            run.failureCode = "E_STEP_FAILED";
+            await run.store.append({ ...base, status: "failed", errorCode: "STEP_FAILED", ...effect });
+        }
+    }
+    /** Walk the plan tree once: node kinds, idempotency flags, and the full id set. */
+    indexPlan(plan) {
+        const kindById = new Map();
+        const idempotentById = new Map();
+        const nodeIds = new Set();
+        const walk = (node) => {
+            nodeIds.add(node.id);
+            kindById.set(node.id, node.kind);
+            const step = "step" in node ? this.catalog.get(node.step) : undefined;
+            idempotentById.set(node.id, step?.selectEffect !== undefined);
+            switch (node.kind) {
+                case "sequence":
+                case "parallel":
+                    for (const child of node.children)
+                        walk(child);
+                    break;
+                case "retry":
+                    walk(node.child);
+                    break;
+                case "branch":
+                    walk(node.then);
+                    if (node.otherwise !== undefined)
+                        walk(node.otherwise);
+                    break;
+            }
+        };
+        for (const node of plan.nodes)
+            walk(node);
+        return { kindById, idempotentById, nodeIds };
+    }
+}
+/** A verify/approve node whose output is not a pass. Other kinds never gate. */
+function isGateRejection(kind, output) {
+    if (kind === "verify") {
+        if (output === true)
+            return false;
+        return !(typeof output === "object" &&
+            output !== null &&
+            output.ok === true);
+    }
+    if (kind === "approve")
+        return output !== true;
+    return false;
+}
+//# sourceMappingURL=host.js.map

package/dist/orchestration/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/orchestration/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EAAsB,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAA;AAC5F,OAAO,EAA6C,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAmB,MAAM,aAAa,CAAA;AAIlF,MAAM,QAAQ,GAA0B,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;AAErF,SAAS,UAAU,CAAC,KAAe;IACjC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAGrC;IAFX,YACE,MAAc,EACL,IAAY;QAErB,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAA;QAF7B,SAAI,GAAJ,IAAI,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AA+CD,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAuB5B,iFAAiF;AACjF,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAa;IACpB,MAAM,CAAiC;IACvC,QAAQ,CAAQ;IAChB,QAAQ,CAAQ;IAChB,MAAM,CAAwB;IAC9B,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAClC,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC5C,OAAO,GAAG,CAAC,CAAA;IAEnB,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;QACrD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC9B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAgC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAM;QACrC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC,SAAS,CAAC,EAAE;YACf,MAAM,IAAI,uBAAuB,CAC/B,sCAAsC,SAAS,CAAC,IAAI,GAAG,EACvD,mBAAmB,CACpB,CAAA;IACL,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,KAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,kCAAkC,EAC/C,gBAAgB,CACjB,CAAA;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAyB,EAAE,UAAyB,EAAE;QACjE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,KAAK,kBAAkB,EAAE,iBAAiB,CAAC,CAAA;QAEvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAA;QAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;QACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAA;QAClD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU;YACV,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;YAC1D,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;;oBAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,MAAmB,CAAA;QACvB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,MAAM,GAAG,OAAO,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;YACnB,KAAK;YACL,UAAU;YACV,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE;YACjD,UAAU,EAAE,IAAI,eAAe,EAAE;YACjC,QAAQ;YACR,cAAc;YACd,OAAO;YACP,UAAU;YACV,SAAS;YACT,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,CAAC;YACb,GAAG,EAAE,CAAC;YACN,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,SAAS;YACtB,IAAI,EAAE,SAAS;YACf,IAAI;YACJ,MAAM;SACP,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,KAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,OAAO;YACL,KAAK;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;YAC7B,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC/B,CAAA;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,KAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAA;QACvD,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,KAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAA;QACpD,IAAI,OAAoB,CAAA;QACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;YACtC,OAAO,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,KAAa;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAA;QACrD,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;QACnB,GAAG,CAAC,IAAI,GAAG,SAAS,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,kCAAkC,GAAG,CAAC,KAAK,GAAG,EAC3D,sBAAsB,CACvB,CAAA;QACH,GAAG,CAAC,eAAe,GAAG,IAAI,CAAA;QAC1B,GAAG,CAAC,KAAK,GAAG,WAAW,CAAA;QACvB,GAAG,CAAC,WAAW,GAAG,aAAa,CAAA;QAC/B,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACtB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;QACnB,GAAG,CAAC,IAAI,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,GAAG,CAAC,MAAM,EAAE,CAAA;IACd,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,SAAS,GAAG,CAAC,KAAK,iBAAiB,EAChD,gBAAgB,CACjB,CAAA;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,GAAG,CAAC,IAAI,CAAA;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,KAAK,GAAG,EAAE,aAAa,CAAC,CAAA;QAC5E,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,UAAU,CAAC,GAAc,EAAE,EAAU,EAAE,IAAyB,EAAE,EAAY;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EAAE,SAAS,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,KAAK,GAAG,EACrD,sBAAsB,CACvB,CAAA;QACH,GAAG,CAAC,KAAK,GAAG,EAAE,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAc;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAA6C,CAAA;QAChE,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM;YACN,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC9C,cAAc,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;YACxC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE;YAChC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC9B,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAc;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,CAAA;gBACtD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAM,CAAC,yBAAyB;gBAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAiB,CAAA;gBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC;oBACtC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;iBAC7C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACb,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAM,CAAC,8CAA8C;gBAChF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACpB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,eAAe,CAAA;oBACpD,OAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAA;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAA;YAChD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC/B,GAAG,CAAC,MAAM,EAAE,CAAA;QACd,CAAC;IACH,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,OAAO,CAAC,GAAc,EAAE,KAAoB;QACxD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAM,CAAC,iDAAiD;QACnF,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,OAAM;QAC1D,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK;SAC7C,CAAA;QACV,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAEjE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,WAAW,GAAG,iBAAiB,CAAA;gBACnC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;gBAC5F,OAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrB,GAAG,IAAI;gBACP,MAAM,EAAE,WAAW;gBACnB,GAAG,MAAM;gBACT,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,GAAG,CAAC,WAAW,GAAG,eAAe,CAAA;YACjC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,SAAS,CAAC,IAAa;QAK7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC/C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmB,CAAA;QACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAQ,EAAE;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACrE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,KAAK,SAAS,CAAC,CAAA;YAC7D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,UAAU,CAAC;gBAChB,KAAK,UAAU;oBACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;wBAAE,IAAI,CAAC,KAAK,CAAC,CAAA;oBAC9C,MAAK;gBACP,KAAK,OAAO;oBACV,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBAChB,MAAK;gBACP,KAAK,QAAQ;oBACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACf,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;wBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACtD,MAAK;YACT,CAAC;QACH,CAAC,CAAA;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;IAC9C,CAAC;CACF;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,IAA6B,EAAE,MAAe;IACrE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QACjC,OAAO,CAAC,CACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAA2B,CAAC,EAAE,KAAK,IAAI,CACzC,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,IAAI,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/orchestration/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@nifrajs/coding-agent/orchestration` - declarative RunPlans compiled onto the existing
+ * WorkflowRunner, with content-free evidence, a caller-owned artifact seam, and content-free
+ * idempotency keys. No second engine; no payload sink. See the P0 addendum for the design lock.
+ */
+export type { ArtifactContext, ArtifactPort, ArtifactRef, NodeEffectKey, RunBranchNode, RunEvidence, RunEvidenceStatus, RunLeafKind, RunLeafNode, RunNode, RunNodeKind, RunParallelNode, RunPlan, RunRetryNode, RunRetryPolicy, RunSequenceNode, RunStructuralKind, } from "@nifrajs/agent-protocol";
+export { assertEvidenceSize, EVIDENCE_MAX_BYTES, FORBIDDEN_CONTENT_KEYS, parseArtifactRef, parseRunEvidence, parseRunPlan, RUN_PLAN_VERSION, RunContractError, } from "@nifrajs/agent-protocol";
+export { type MemoryArtifactPort, memoryArtifactPort, noopArtifactPort, } from "./artifact-port.js";
+export { CatalogError, type CatalogStep, createStepCatalog, mergeStepCatalogs, type StepCatalog, type StepEffectContext, type StepRunContext, stepVersion, } from "./catalog.js";
+export { CompileError, type CompileOptions, compileRunPlan, compileRunPlanLayers, digestRunPlan, type OrchestrationLimits, } from "./compile.js";
+export { createRunDispatch, DISPATCH_JOB_NAME, type DispatchBoundary, type DispatchInspection, type DispatchResultCode, type DispatchState, type DispatchWriteResult, type DurableDispatchAdapter, deriveRunIdempotencyKey, type InjectedClock, MAX_DISPATCH_ATTEMPTS, MAX_DISPATCH_STRING, parseRunCheckpoint, parseRunDispatch, parseRunDispatchEvidence, parseRunLease, RUN_DISPATCH_VERSION, type RunCheckpoint, type RunDispatch, type RunDispatchEvidence, type RunDispatchStore, type RunLease, systemClock, } from "./dispatch.js";
+export { createDurableJobsStore, createMemoryRunDispatchStore, type DurableJobsStoreOptions, } from "./durable-jobs.js";
+export { deriveNodeEffectKey, type EffectKeyMaterial } from "./effect-key.js";
+export { type EvidenceCounters, type EvidenceStore, FileEvidenceStore, type FileEvidenceStoreOptions, MemoryEvidenceStore, type MemoryEvidenceStoreOptions, } from "./evidence-store.js";
+export { canonicalJson, sha256Hex, sha256HexOf } from "./hash.js";
+export { OrchestrationHost, type OrchestrationHostOptions, OrchestrationStateError, type RunResult, type RunState, type RunStatus, type SubmitOptions, } from "./host.js";
+export { type Admission, type AdmissionRejection, admitCapability, assertAdmitted, ChildVectorTracker, type HostPolicy, PolicyError, } from "./policy.js";
+export { type CommittedEffect, EffectRejectedError, type IdempotencyProofStore, MemoryIdempotencyProofStore, RecoveryCrashError, type RecoveryMachineOptions, type RecoveryProcessResult, type RunEffect, type RunEffectContext, RunRecoveryMachine, TestClock, } from "./recovery.js";
+export { type RunTraceOptions, type RunTraceResult, runTrace } from "./tracer.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/orchestration/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/orchestration/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,eAAe,EACf,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,OAAO,EACP,WAAW,EACX,eAAe,EACf,OAAO,EACP,YAAY,EACZ,cAAc,EACd,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,WAAW,GACZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,KAAK,aAAa,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,KAAK,UAAU,EACf,WAAW,GACZ,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,eAAe,EACpB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,SAAS,GACV,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA"}

package/dist/orchestration/index.js

@@ -0,0 +1,19 @@
+/**
+ * `@nifrajs/coding-agent/orchestration` - declarative RunPlans compiled onto the existing
+ * WorkflowRunner, with content-free evidence, a caller-owned artifact seam, and content-free
+ * idempotency keys. No second engine; no payload sink. See the P0 addendum for the design lock.
+ */
+export { assertEvidenceSize, EVIDENCE_MAX_BYTES, FORBIDDEN_CONTENT_KEYS, parseArtifactRef, parseRunEvidence, parseRunPlan, RUN_PLAN_VERSION, RunContractError, } from "@nifrajs/agent-protocol";
+export { memoryArtifactPort, noopArtifactPort, } from "./artifact-port.js";
+export { CatalogError, createStepCatalog, mergeStepCatalogs, stepVersion, } from "./catalog.js";
+export { CompileError, compileRunPlan, compileRunPlanLayers, digestRunPlan, } from "./compile.js";
+export { createRunDispatch, DISPATCH_JOB_NAME, deriveRunIdempotencyKey, MAX_DISPATCH_ATTEMPTS, MAX_DISPATCH_STRING, parseRunCheckpoint, parseRunDispatch, parseRunDispatchEvidence, parseRunLease, RUN_DISPATCH_VERSION, systemClock, } from "./dispatch.js";
+export { createDurableJobsStore, createMemoryRunDispatchStore, } from "./durable-jobs.js";
+export { deriveNodeEffectKey } from "./effect-key.js";
+export { FileEvidenceStore, MemoryEvidenceStore, } from "./evidence-store.js";
+export { canonicalJson, sha256Hex, sha256HexOf } from "./hash.js";
+export { OrchestrationHost, OrchestrationStateError, } from "./host.js";
+export { admitCapability, assertAdmitted, ChildVectorTracker, PolicyError, } from "./policy.js";
+export { EffectRejectedError, MemoryIdempotencyProofStore, RecoveryCrashError, RunRecoveryMachine, TestClock, } from "./recovery.js";
+export { runTrace } from "./tracer.js";
+//# sourceMappingURL=index.js.map

package/dist/orchestration/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/orchestration/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,YAAY,EAEZ,iBAAiB,EACjB,iBAAiB,EAIjB,WAAW,GACZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,YAAY,EAEZ,cAAc,EACd,oBAAoB,EACpB,aAAa,GAEd,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EAOjB,uBAAuB,EAEvB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EAMpB,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAE7B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,mBAAmB,EAA0B,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAGL,iBAAiB,EAEjB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EACL,iBAAiB,EAEjB,uBAAuB,GAKxB,MAAM,WAAW,CAAA;AAClB,OAAO,EAGL,eAAe,EACf,cAAc,EACd,kBAAkB,EAElB,WAAW,GACZ,MAAM,aAAa,CAAA;AACpB,OAAO,EAEL,mBAAmB,EAEnB,2BAA2B,EAC3B,kBAAkB,EAKlB,kBAAkB,EAClB,SAAS,GACV,MAAM,eAAe,CAAA;AACtB,OAAO,EAA6C,QAAQ,EAAE,MAAM,aAAa,CAAA"}

package/dist/orchestration/policy.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Host policy admission for the orchestration host (REG-06) and the monotonic child-vector allocator
+ * (REG-07).
+ *
+ * A {@link HostPolicy} is the authority: it declares which capability kinds may run, an allowlist of
+ * required capabilities, an isolation floor, and whether every capability must be approved. A
+ * {@link CapabilityDescriptor} is only a request - {@link admitCapability} lets the descriptor tighten
+ * nothing it did not already promise and, crucially, cannot loosen the policy. A descriptor asking for
+ * weaker isolation than the floor, declaring a capability outside the allowlist, or offering `none`
+ * approval where the host requires approval is refused with a stable code. Descriptors, plans, models,
+ * extensions, and clients therefore cannot override host policy.
+ *
+ * The {@link ChildVectorTracker} hands each newly opened decision boundary a strictly increasing
+ * per-run vector. A decision must later carry the exact vector its boundary opened with, so a replayed
+ * or superseded decision cannot resume work. The tracker never allocates a non-advancing vector.
+ */
+import type { CapabilityDescriptor, CapabilityKind, IsolationClass } from "@nifrajs/agent/registry";
+/** The authoritative admission policy. Empty allowlists deny everything of that kind. */
+export interface HostPolicy {
+    /** Capability kinds the host will admit. A descriptor of any other kind is refused. */
+    readonly allowedKinds: readonly CapabilityKind[];
+    /** Required-capability allowlist. Every `requiredCapabilities` entry must be present. */
+    readonly allowedCapabilities: readonly string[];
+    /** Isolation floor. A descriptor offering weaker isolation than this is refused. */
+    readonly minIsolation: IsolationClass;
+    /** When true, a descriptor whose approval class is `none` is refused as a downgrade. */
+    readonly requireApproval: boolean;
+}
+/** Stable, content-free reasons the host refuses to admit a capability. */
+export type AdmissionRejection = "kind_not_allowed" | "capability_not_allowed" | "isolation_too_weak" | "approval_downgrade";
+export type Admission = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: AdmissionRejection;
+};
+/** Thrown when the host refuses admission and the caller wants an exception rather than a result. */
+export declare class PolicyError extends Error {
+    readonly code: AdmissionRejection;
+    constructor(code: AdmissionRejection);
+}
+/**
+ * Admit a capability descriptor against the host policy. The policy is the floor; the descriptor can
+ * only meet or exceed it. Returns the first failing reason, or `{ ok: true }` when every gate passes.
+ */
+export declare function admitCapability(policy: HostPolicy, descriptor: CapabilityDescriptor): Admission;
+/** Admit or throw {@link PolicyError}. Use at the host boundary where a refusal must stop the run. */
+export declare function assertAdmitted(policy: HostPolicy, descriptor: CapabilityDescriptor): void;
+/**
+ * Per-run monotonic child-vector allocator. `open` returns the next strictly increasing vector for a
+ * run; `last` reports the high-water mark (`-1` before the first boundary). A vector is never reused,
+ * so a decision carrying anything other than its boundary's opened vector is provably stale.
+ */
+export declare class ChildVectorTracker {
+    private readonly highWater;
+    /** Allocate the next vector for a run. Strictly greater than every previously allocated vector. */
+    open(runId: string): number;
+    /** The last allocated vector for a run, or `-1` when none has opened. */
+    last(runId: string): number;
+    /** Forget a run's vectors once it is terminal. Idempotent. */
+    release(runId: string): void;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/orchestration/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/orchestration/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAEV,oBAAoB,EACpB,cAAc,EACd,cAAc,EACf,MAAM,yBAAyB,CAAA;AAEhC,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;IAChD,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/C,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAA;IACrC,wFAAwF;IACxF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAClC;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,CAAA;AAExB,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,CAAA;AAE7D,qGAAqG;AACrG,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;gBAErB,IAAI,EAAE,kBAAkB;CAKrC;AAaD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,GAAG,SAAS,CAU/F;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAGzF;AAED;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IAEtD,mGAAmG;IACnG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAM3B,yEAAyE;IACzE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI3B,8DAA8D;IAC9D,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG7B"}

package/dist/orchestration/policy.js

@@ -0,0 +1,80 @@
+/**
+ * Host policy admission for the orchestration host (REG-06) and the monotonic child-vector allocator
+ * (REG-07).
+ *
+ * A {@link HostPolicy} is the authority: it declares which capability kinds may run, an allowlist of
+ * required capabilities, an isolation floor, and whether every capability must be approved. A
+ * {@link CapabilityDescriptor} is only a request - {@link admitCapability} lets the descriptor tighten
+ * nothing it did not already promise and, crucially, cannot loosen the policy. A descriptor asking for
+ * weaker isolation than the floor, declaring a capability outside the allowlist, or offering `none`
+ * approval where the host requires approval is refused with a stable code. Descriptors, plans, models,
+ * extensions, and clients therefore cannot override host policy.
+ *
+ * The {@link ChildVectorTracker} hands each newly opened decision boundary a strictly increasing
+ * per-run vector. A decision must later carry the exact vector its boundary opened with, so a replayed
+ * or superseded decision cannot resume work. The tracker never allocates a non-advancing vector.
+ */
+/** Thrown when the host refuses admission and the caller wants an exception rather than a result. */
+export class PolicyError extends Error {
+    code;
+    constructor(code) {
+        super(`host policy: ${code}`);
+        this.code = code;
+        this.name = "PolicyError";
+    }
+}
+// Isolation is a total order: a higher rank is stronger and satisfies any lower floor.
+const ISOLATION_RANK = {
+    inherit: 0,
+    process: 1,
+    sandbox: 2,
+};
+function approvalIsNone(approval) {
+    return approval.kind === "none";
+}
+/**
+ * Admit a capability descriptor against the host policy. The policy is the floor; the descriptor can
+ * only meet or exceed it. Returns the first failing reason, or `{ ok: true }` when every gate passes.
+ */
+export function admitCapability(policy, descriptor) {
+    if (!policy.allowedKinds.includes(descriptor.kind))
+        return { ok: false, code: "kind_not_allowed" };
+    const allowed = new Set(policy.allowedCapabilities);
+    for (const capability of descriptor.requiredCapabilities)
+        if (!allowed.has(capability))
+            return { ok: false, code: "capability_not_allowed" };
+    if (ISOLATION_RANK[descriptor.isolation] < ISOLATION_RANK[policy.minIsolation])
+        return { ok: false, code: "isolation_too_weak" };
+    if (policy.requireApproval && approvalIsNone(descriptor.approval))
+        return { ok: false, code: "approval_downgrade" };
+    return { ok: true };
+}
+/** Admit or throw {@link PolicyError}. Use at the host boundary where a refusal must stop the run. */
+export function assertAdmitted(policy, descriptor) {
+    const admission = admitCapability(policy, descriptor);
+    if (!admission.ok)
+        throw new PolicyError(admission.code);
+}
+/**
+ * Per-run monotonic child-vector allocator. `open` returns the next strictly increasing vector for a
+ * run; `last` reports the high-water mark (`-1` before the first boundary). A vector is never reused,
+ * so a decision carrying anything other than its boundary's opened vector is provably stale.
+ */
+export class ChildVectorTracker {
+    highWater = new Map();
+    /** Allocate the next vector for a run. Strictly greater than every previously allocated vector. */
+    open(runId) {
+        const next = (this.highWater.get(runId) ?? -1) + 1;
+        this.highWater.set(runId, next);
+        return next;
+    }
+    /** The last allocated vector for a run, or `-1` when none has opened. */
+    last(runId) {
+        return this.highWater.get(runId) ?? -1;
+    }
+    /** Forget a run's vectors once it is terminal. Idempotent. */
+    release(runId) {
+        this.highWater.delete(runId);
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/orchestration/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/orchestration/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAgCH,qGAAqG;AACrG,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAoB;IAEjC,YAAY,IAAwB;QAClC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,cAAc,GAA6C;IAC/D,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;CACX,CAAA;AAED,SAAS,cAAc,CAAC,QAAuB;IAC7C,OAAO,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,UAAgC;IAClF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAClG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;IACnD,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,oBAAoB;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAA;IACpF,IAAI,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IAClD,IAAI,MAAM,CAAC,eAAe,IAAI,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,UAAgC;IACjF,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEtD,mGAAmG;IACnG,IAAI,CAAC,KAAa;QAChB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,KAAa;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,CAAC;IAED,8DAA8D;IAC9D,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;CACF"}

package/dist/orchestration/recovery.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Recovery state machine for at-least-once node dispatch.
+ *
+ * The machine treats every effect invocation as potentially side-effecting. A normal retry is
+ * allowed only for an explicit pre-effect rejection. Once an effect has been invoked, recovery
+ * requires a matching idempotency proof; without one it dead-letters the dispatch instead of
+ * guessing that a duplicate is safe. This is deliberately conservative and never claims exactly
+ * once delivery or hostile-code isolation.
+ */
+import { type DispatchResultCode, type InjectedClock, type RunDispatchStore, type RunLease } from "./dispatch.js";
+export interface IdempotencyProofStore {
+    has(key: string): boolean | Promise<boolean>;
+    record(key: string): void | Promise<void>;
+}
+/** Disposable proof reference for tests and one-process local runs. */
+export declare class MemoryIdempotencyProofStore implements IdempotencyProofStore {
+    private readonly keys;
+    has(key: string): boolean;
+    record(key: string): void;
+    keysSnapshot(): readonly string[];
+}
+/** A side effect must explicitly confirm that its idempotency proof was durably recorded. */
+export interface CommittedEffect {
+    readonly committed: true;
+}
+export interface RunEffectContext {
+    readonly lease: RunLease;
+    readonly signal: AbortSignal;
+    /** Persist a content-free safe boundary; a failed write prevents the next unsafe step. */
+    readonly checkpoint: (boundary: "before-effect" | "after-effect") => Promise<boolean>;
+}
+export type RunEffect = (context: RunEffectContext) => Promise<CommittedEffect> | CommittedEffect;
+/** Stable pre-effect failure; it may be retried with a new logical attempt. */
+export declare class EffectRejectedError extends Error {
+    readonly code: string;
+    constructor(code?: string);
+}
+/** Simulates worker loss at a named boundary; the lease is intentionally left unresolved. */
+export declare class RecoveryCrashError extends Error {
+    readonly boundary: "before-effect" | "after-effect" | "after-checkpoint";
+    constructor(boundary: "before-effect" | "after-effect" | "after-checkpoint");
+}
+export interface RecoveryMachineOptions {
+    readonly store: RunDispatchStore;
+    readonly clock?: InjectedClock;
+    readonly proofStore?: IdempotencyProofStore;
+    readonly leaseMs?: number;
+    readonly retryBackoff?: (attempt: number) => number;
+    readonly signal?: AbortSignal;
+}
+export interface RecoveryProcessResult {
+    readonly leased: number;
+    readonly completed: number;
+    readonly retried: number;
+    readonly deadLettered: number;
+    readonly cancelled: number;
+}
+/**
+ * Drives leases through safe checkpoints and terminal transitions. The caller owns the effect and
+ * any real idempotency ledger; this class stores only opaque proof keys in the reference adapter.
+ */
+export declare class RunRecoveryMachine {
+    private readonly store;
+    private readonly clock;
+    private readonly proofs;
+    private readonly leaseMs;
+    private readonly retryBackoff;
+    private readonly signal;
+    constructor(options: RecoveryMachineOptions);
+    /** Cancel all matching run dispatches; every late lease write then fails closed. */
+    cancel(runId: string): Promise<number>;
+    /** Process one bounded lease batch. No payload is read or emitted by this coordinator. */
+    process(effect: RunEffect, options?: {
+        readonly limit?: number;
+    }): Promise<RecoveryProcessResult>;
+    private processLease;
+    private storeCheckpoint;
+}
+/** A small deterministic clock useful for recovery schedules and tests. */
+export declare class TestClock implements InjectedClock {
+    private current;
+    constructor(start?: number);
+    now: () => number;
+    advance(milliseconds: number): void;
+}
+export type { DispatchResultCode };
+//# sourceMappingURL=recovery.d.ts.map