@ornexus/neocortex 4.60.41 → 4.60.43

package/packages/shared/dist/invocation/executable-policy-recovery.js

@@ -0,0 +1,272 @@
+/** P220.21 immutable policy, invocation, compatibility, recovery and budget closure. */
+import { createHash } from 'node:crypto';
+import { canonicalizeCommandRegistryJcs, commandRegistryChecksum, normalizeCommandRegistryDocument, } from '../command-registry-contract.js';
+import { CATALOG_OPERATIONAL_BASELINE_V1, } from '../executable-graph-catalog/contracts.js';
+import { YOLOOP_FAILURE_CATEGORIES } from '../yoloop/recovery-types.js';
+export const EXECUTABLE_POLICY_RECOVERY_SCHEMA = 'ExecutablePolicyRecoveryProjection/1.0';
+export const EXECUTABLE_POLICY_RECOVERY_EVIDENCE_ID = 'P220-EV-POLICY-CLOSURE';
+export const EXECUTABLE_POLICY_RECOVERY_REASON_CODES = Object.freeze([
+    'POLICY_PROJECTION_INPUT_INVALID',
+    'POLICY_REGISTRY_MISMATCH',
+    'POLICY_INVOCATION_MISMATCH',
+    'POLICY_ROUTE_MISMATCH',
+    'POLICY_READ_ONLY_INVARIANT',
+    'POLICY_COMPATIBILITY_MISMATCH',
+    'POLICY_RECOVERY_INVALID',
+    'POLICY_OPERATIONAL_BUDGET_MISMATCH',
+]);
+export class ExecutablePolicyRecoveryError extends Error {
+    reasonCode;
+    constructor(reasonCode) {
+        super(reasonCode);
+        this.reasonCode = reasonCode;
+        this.name = 'ExecutablePolicyRecoveryError';
+    }
+}
+const fail = (reasonCode) => {
+    throw new ExecutablePolicyRecoveryError(reasonCode);
+};
+const compareBytes = (left, right) => Buffer.from(left).compare(Buffer.from(right));
+function deepFreeze(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function canonicalHash(domain, value) {
+    return createHash('sha256')
+        .update(`${domain}\0${canonicalizeCommandRegistryJcs(value)}`)
+        .digest('hex');
+}
+function canonicalSha256(value) {
+    return createHash('sha256')
+        .update(canonicalizeCommandRegistryJcs(value))
+        .digest('hex');
+}
+function copyValue(value) {
+    return JSON.parse(canonicalizeCommandRegistryJcs(value));
+}
+function exactKeys(value, keys) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort(compareBytes).join('\0')
+            === [...keys].sort(compareBytes).join('\0'));
+}
+function normalizedRegistry(input) {
+    try {
+        return normalizeCommandRegistryDocument(input);
+    }
+    catch {
+        return fail('POLICY_REGISTRY_MISMATCH');
+    }
+}
+function expectedInvocationCommands(commands) {
+    return commands
+        .filter(({ visibility }) => visibility === 'public')
+        .map((command) => ({
+        commandId: command.id,
+        inputShape: command.inputShape,
+        operation: {
+            required: command.invocation.operation.required,
+            unknownAsPositional: command.invocation.operation.unknownAsPositional,
+            operations: command.subcommands.map(({ id, aliases }) => ({ id, aliases: [...aliases] })),
+        },
+        options: command.invocation.options,
+        positionals: command.invocation.positionals,
+        terminator: true,
+    }))
+        .sort((left, right) => compareBytes(left.commandId, right.commandId));
+}
+function validateInvocationSchema(manifest, registry, commands, registryChecksum) {
+    const keys = [
+        'commandCount', 'commands', 'operationCount', 'optionCount', 'positionalCount',
+        'projectionSha256', 'registryChecksum', 'registryVersion', 'schemaChecksum', 'schemaVersion',
+    ];
+    if (!exactKeys(manifest, keys)
+        || manifest.schemaVersion !== 'p205-invocation-schema-v1'
+        || manifest.registryVersion !== registry.registryVersion
+        || manifest.registryChecksum !== registryChecksum
+        || !Array.isArray(manifest.commands)) {
+        return fail('POLICY_INVOCATION_MISMATCH');
+    }
+    const expected = expectedInvocationCommands(commands);
+    const schemaProjection = {
+        schemaVersion: manifest.schemaVersion,
+        registryVersion: manifest.registryVersion,
+        registryChecksum: manifest.registryChecksum,
+        commands: manifest.commands,
+    };
+    const optionCount = manifest.commands.reduce((sum, command) => sum + (command.options?.length ?? 0), 0);
+    const positionalCount = manifest.commands.reduce((sum, command) => sum + (command.positionals?.length ?? 0), 0);
+    const operationCount = manifest.commands.reduce((sum, command) => sum + (command.operation?.operations?.length ?? 0), 0);
+    if (manifest.schemaChecksum !== canonicalSha256(schemaProjection)
+        || manifest.projectionSha256 !== canonicalSha256(manifest.commands)
+        || manifest.commandCount !== manifest.commands.length
+        || manifest.optionCount !== optionCount
+        || manifest.positionalCount !== positionalCount
+        || manifest.operationCount !== operationCount
+        || canonicalizeCommandRegistryJcs(manifest.commands) !== canonicalizeCommandRegistryJcs(expected)) {
+        return fail('POLICY_INVOCATION_MISMATCH');
+    }
+    const byCommand = new Map(manifest.commands.map((command) => [command.commandId, command]));
+    if (byCommand.size !== manifest.commands.length)
+        fail('POLICY_INVOCATION_MISMATCH');
+    return byCommand;
+}
+function validateOperationalBaseline(value) {
+    if (canonicalizeCommandRegistryJcs(value)
+        !== canonicalizeCommandRegistryJcs(CATALOG_OPERATIONAL_BASELINE_V1)) {
+        return fail('POLICY_OPERATIONAL_BUDGET_MISMATCH');
+    }
+    return canonicalHash('p220-operational-baseline-v1', value);
+}
+function normalizedRecovery(recovery) {
+    if (!recovery.ok
+        || recovery.rules.length !== YOLOOP_FAILURE_CATEGORIES.length
+        || recovery.receipt.outcome !== 'accepted'
+        || recovery.receipt.evidenceId !== 'P220-EV-RECOVERY-CATALOG') {
+        return fail('POLICY_RECOVERY_INVALID');
+    }
+    const categorySet = new Set(recovery.rules.map(({ category }) => category));
+    if (categorySet.size !== YOLOOP_FAILURE_CATEGORIES.length
+        || YOLOOP_FAILURE_CATEGORIES.some((category) => !categorySet.has(category))) {
+        return fail('POLICY_RECOVERY_INVALID');
+    }
+    const canonicalRules = recovery.rules.map(({ commandId: _commandId, ...rule }) => rule);
+    const catalogHash = canonicalHash('p220-recovery-catalog-v1', {
+        schema_version: 1,
+        rules: canonicalRules,
+    });
+    const candidates = recovery.rules.filter(({ commandId }) => commandId !== null).length;
+    const sentinels = recovery.rules.length - candidates;
+    if (recovery.catalogHash !== catalogHash
+        || recovery.receipt.catalogDigestPrefix !== catalogHash.slice(0, 12)
+        || recovery.receipt.ruleCount !== recovery.rules.length
+        || recovery.receipt.candidateRuleCount !== candidates
+        || recovery.receipt.sentinelRuleCount !== sentinels) {
+        return fail('POLICY_RECOVERY_INVALID');
+    }
+    return { rules: recovery.rules, catalogHash, candidates, sentinels };
+}
+function exactPolicy(value, isStatus) {
+    const policy = copyValue(value);
+    if (!exactKeys(policy, [
+        'billingClass', 'idempotencyClass', 'minimumTier', 'mutationClass',
+        'privilege', 'quotaClass', 'replayClass', 'strictReadOnly',
+    ]))
+        return fail('POLICY_ROUTE_MISMATCH');
+    if (policy.strictReadOnly === 'allow'
+        && (policy.mutationClass !== 'read-only'
+            || policy.billingClass !== 'non-billable'
+            || policy.quotaClass !== 'none'
+            || policy.idempotencyClass !== 'none')) {
+        return fail('POLICY_READ_ONLY_INVARIANT');
+    }
+    if (isStatus && policy.strictReadOnly !== 'allow') {
+        return fail('POLICY_READ_ONLY_INVARIANT');
+    }
+    return policy;
+}
+function exactCompatibility(value) {
+    const compatibility = copyValue(value);
+    if (!exactKeys(compatibility, ['deprecatedIn', 'introducedIn', 'removedIn', 'replacement'])) {
+        return fail('POLICY_COMPATIBILITY_MISMATCH');
+    }
+    return compatibility;
+}
+function routeInvocation(command) {
+    return copyValue({
+        inputShape: command.inputShape,
+        operation: command.operation,
+        options: command.options,
+        positionals: command.positionals,
+        terminator: true,
+    });
+}
+export function compileExecutablePolicyRecoveryProjection(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return fail('POLICY_PROJECTION_INPUT_INVALID');
+    }
+    const registry = normalizedRegistry(input.registry);
+    const commands = registry.commands;
+    const registryChecksum = commandRegistryChecksum(registry);
+    const invocationByCommand = validateInvocationSchema(input.invocationSchema, registry, commands, registryChecksum);
+    const recovery = normalizedRecovery(input.recovery);
+    const operationalBudgetHash = validateOperationalBaseline(input.operationalBaseline);
+    const recoveryByRoute = new Map();
+    for (const rule of recovery.rules) {
+        if (rule.commandId === null)
+            continue;
+        const routeKey = `${rule.commandId}\0`;
+        const command = commands.find(({ id }) => id === rule.commandId);
+        if (!command)
+            fail('POLICY_RECOVERY_INVALID');
+        const values = recoveryByRoute.get(routeKey) ?? [];
+        values.push(rule.category);
+        recoveryByRoute.set(routeKey, values);
+    }
+    const rows = [];
+    for (const command of commands) {
+        const invocation = invocationByCommand.get(command.id);
+        if ((command.visibility === 'public') !== Boolean(invocation)) {
+            fail('POLICY_INVOCATION_MISMATCH');
+        }
+        for (const route of [command, ...command.subcommands]) {
+            const operationId = route === command ? null : route.id;
+            const routeKey = `${command.id}\0${operationId ?? ''}`;
+            const isStatus = command.id === 'status' || operationId === 'status';
+            const base = deepFreeze({
+                routeKey,
+                commandId: command.id,
+                operationId,
+                aliases: Object.freeze([...route.aliases].sort(compareBytes)),
+                visibility: route.visibility,
+                invocation: invocation ? routeInvocation(invocation) : null,
+                policy: exactPolicy(route.policy, isStatus),
+                compatibility: exactCompatibility(route.compatibility),
+                recoveryCategories: Object.freeze([...(recoveryByRoute.get(routeKey) ?? [])].sort(compareBytes)),
+                statusCapability: isStatus ? 'read-only-observation' : 'not-status',
+            });
+            rows.push(deepFreeze({
+                ...base,
+                rowHash: canonicalHash('p220-executable-policy-recovery-row-v1', base),
+            }));
+        }
+    }
+    rows.sort((left, right) => compareBytes(left.routeKey, right.routeKey));
+    if (new Set(rows.map(({ routeKey }) => routeKey)).size !== rows.length) {
+        fail('POLICY_ROUTE_MISMATCH');
+    }
+    const publicRoutes = rows.filter(({ visibility }) => visibility === 'public').length;
+    const counts = deepFreeze({
+        routes: rows.length,
+        publicRoutes,
+        internalRoutes: rows.length - publicRoutes,
+        commands: commands.length,
+        subcommands: commands.reduce((sum, command) => sum + command.subcommands.length, 0),
+        aliases: rows.reduce((sum, row) => sum + row.aliases.length, 0),
+        options: input.invocationSchema.optionCount,
+        positionals: input.invocationSchema.positionalCount,
+        statusRoutes: rows.filter(({ statusCapability }) => statusCapability === 'read-only-observation').length,
+        recoveryCategories: recovery.rules.length,
+        recoveryCandidates: recovery.candidates,
+        recoverySentinels: recovery.sentinels,
+    });
+    const base = deepFreeze({
+        schemaVersion: EXECUTABLE_POLICY_RECOVERY_SCHEMA,
+        registryVersion: registry.registryVersion,
+        registryChecksum,
+        invocationSchemaChecksum: input.invocationSchema.schemaChecksum,
+        recoveryCatalogHash: recovery.catalogHash,
+        operationalBudgetHash,
+        rows: Object.freeze(rows),
+        counts,
+        evidenceId: EXECUTABLE_POLICY_RECOVERY_EVIDENCE_ID,
+        publicSafe: true,
+    });
+    return deepFreeze({
+        ...base,
+        projectionHash: canonicalHash('p220-executable-policy-recovery-projection-v1', base),
+    });
+}

package/packages/shared/dist/invocation/index.d.ts

@@ -3,6 +3,8 @@ export * from './project-identity-migration.js';
 export * from './state-projection.js';
 export * from './strict-effect-receipt.js';
 export * from './public-diagnostics.js';
+export * from './recovery-route-compiler.js';
+export * from './executable-policy-recovery.js';
 export declare const EXACT_INVOCATION_POLICY: "p205-exact-invocation-v1";
 export declare const INVOCATION_SCHEMA_VERSION: "p205-invocation-schema-v1";
 export declare const INVOCATION_LIMITS: Readonly<{
@@ -120,7 +122,7 @@ export interface InvocationCommandSchemaV1 {
     readonly positionals: readonly InvocationPositionalSchemaV1[];
     readonly terminator: true;
 }
-export declare const INVOCATION_SCHEMA_CHECKSUM: "92a7a79243c60f0c53071b28dbdfbbf8587fb1cccde2e213aae89d4d2de6c329";
+export declare const INVOCATION_SCHEMA_CHECKSUM: "15e75fe8a4d8251414b661821c52eb0a9e92a3b7bca0f0d05fcb1827c4e24ce2";
 export interface InvocationSchemaManifestV1 {
     readonly schemaVersion: typeof INVOCATION_SCHEMA_VERSION;
     readonly registryVersion: string;

package/packages/shared/dist/invocation/index.js

@@ -9,11 +9,14 @@ import { createHash } from 'node:crypto';
 import { COMMAND_REGISTRY_CHECKSUM, COMMAND_REGISTRY_VERSION, GENERATED_SHARED_COMMANDS, } from '../generated/command-registry.generated.js';
 import { GENERATED_INVOCATION_SCHEMA_MANIFEST, GENERATED_INVOCATION_SCHEMAS, } from '../generated/invocation-schema.generated.js';
 import { canonicalizeCommandRegistryJcs } from '../command-registry-contract.js';
+import { CONTINUITY_GOAL_OPERATION_IDS } from '../continuity/goal-operation-authority.js';
 export * from './input-envelope.js';
 export * from './project-identity-migration.js';
 export * from './state-projection.js';
 export * from './strict-effect-receipt.js';
 export * from './public-diagnostics.js';
+export * from './recovery-route-compiler.js';
+export * from './executable-policy-recovery.js';
 export const EXACT_INVOCATION_POLICY = 'p205-exact-invocation-v1';
 export const INVOCATION_SCHEMA_VERSION = 'p205-invocation-schema-v1';
 export const INVOCATION_LIMITS = Object.freeze({
@@ -477,6 +480,39 @@ function admitArguments(schema, tokens) {
         return positionalFailure;
     return freeze({ options, positionals });
 }
+function boundedEditDistance(left, right, limit) {
+    if (Math.abs(left.length - right.length) > limit)
+        return limit + 1;
+    let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+    for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
+        const current = [leftIndex];
+        let rowMinimum = current[0];
+        for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) {
+            const substitution = previous[rightIndex - 1] + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1);
+            const value = Math.min(previous[rightIndex] + 1, current[rightIndex - 1] + 1, substitution);
+            current.push(value);
+            rowMinimum = Math.min(rowMinimum, value);
+        }
+        if (rowMinimum > limit)
+            return limit + 1;
+        previous = current;
+    }
+    return previous[right.length];
+}
+function resemblesGoalOperation(candidate, tokens) {
+    const value = candidate.value;
+    const lower = value.toLowerCase();
+    if (CONTINUITY_GOAL_OPERATION_IDS.some((id) => id === lower
+        || id === lower.replaceAll('_', '-')
+        || id.startsWith(lower)
+        || lower.startsWith(id)
+        || boundedEditDistance(lower, id, 2) <= 2))
+        return true;
+    const joined = tokens.slice(0, 3).map((token) => token.value.toLowerCase()).join('-');
+    if (CONTINUITY_GOAL_OPERATION_IDS.some((id) => joined === id))
+        return true;
+    return tokens.slice(1).some((token) => /^@?goal-G\d{3,}$/i.test(token.value));
+}
 function admitOperation(schema, tokens) {
     if (!schema.operation.operations.length)
         return { rest: tokens };
@@ -484,11 +520,14 @@ function admitOperation(schema, tokens) {
         return schema.operation.required ? 'operation_required' : { rest: tokens };
     }
     const candidate = tokens[0];
-    const normalized = candidate.value.toLowerCase();
+    const normalized = schema.commandId === 'goal' ? candidate.value : candidate.value.toLowerCase();
     const operation = schema.operation.operations.find((entry) => entry.id === normalized || entry.aliases.includes(normalized));
     if (operation && !candidate.whollyUnquoted)
         return 'operation_quoted';
     if (!operation) {
+        if (schema.commandId === 'goal' && resemblesGoalOperation(candidate, tokens)) {
+            return candidate.whollyUnquoted ? 'operation_unknown' : 'operation_quoted';
+        }
         const resemblesOperation = schema.operation.operations.some((entry) => entry.id.startsWith(normalized) || normalized.startsWith(entry.id)
             || entry.aliases.some((alias) => alias.startsWith(normalized) || normalized.startsWith(alias)));
         if (resemblesOperation)

package/packages/shared/dist/invocation/recovery-route-compiler.d.ts

@@ -0,0 +1,56 @@
+/** P220.10 registry-valid, root-owned yoloop recovery candidates. */
+import type { SubscriptionTier } from '../types/api-contracts.js';
+import { type FailureCategory } from '../yoloop/recovery-types.js';
+import { type InvocationAdmissionReceiptV1 } from './index.js';
+export declare const RECOVERY_CATALOG_EVIDENCE_ID: "P220-EV-RECOVERY-CATALOG";
+export declare const RECOVERY_FAILURE_CATEGORIES: readonly FailureCategory[];
+export type RecoveryCatalogReasonCode = 'recovery-catalog-accepted' | 'recovery-catalog-schema-invalid' | 'recovery-category-unknown' | 'recovery-category-duplicate' | 'recovery-category-missing' | 'recovery-sentinel-invalid' | 'recovery-target-unknown' | 'recovery-target-not-allowed' | 'recovery-target-cycle' | 'recovery-template-invalid' | 'recovery-budget-invalid' | 'recovery-tier-invalid' | 'recovery-tier-authority-expanded' | 'recovery-invocation-rejected' | 'recovery-catalog-fallback' | 'recovery-catalog-defaults-invalid';
+export interface RecoveryRuleInput {
+    readonly category: FailureCategory;
+    readonly recovery_trigger: string;
+    readonly trigger_args_template: string;
+    readonly max_attempts_per_story: number;
+    readonly applicable_tiers: readonly SubscriptionTier[];
+}
+export interface CompiledRecoveryRule extends RecoveryRuleInput {
+    readonly commandId: 'refactor' | 'resolve-conflicts' | null;
+}
+export interface RecoveryCatalogReceiptV1 {
+    readonly schemaVersion: 1;
+    readonly evidenceId: typeof RECOVERY_CATALOG_EVIDENCE_ID;
+    readonly outcome: 'accepted' | 'rejected' | 'fallback';
+    readonly registryVersion: string;
+    readonly registryChecksumPrefix: string;
+    readonly schemaChecksumPrefix: string;
+    readonly catalogDigestPrefix?: string;
+    readonly ruleCount: number;
+    readonly candidateRuleCount: number;
+    readonly sentinelRuleCount: number;
+    readonly reasonCodes: readonly RecoveryCatalogReasonCode[];
+    readonly publicSafe: true;
+}
+export type RecoveryCatalogCompilation = {
+    readonly ok: true;
+    readonly rules: readonly CompiledRecoveryRule[];
+    readonly catalogHash: string;
+    readonly receipt: RecoveryCatalogReceiptV1;
+} | {
+    readonly ok: false;
+    readonly reasonCodes: readonly RecoveryCatalogReasonCode[];
+    readonly receipt: RecoveryCatalogReceiptV1;
+};
+export type RecoveryCandidateResult = {
+    readonly kind: 'candidate';
+    readonly action: string;
+    readonly commandId: Exclude<CompiledRecoveryRule['commandId'], null>;
+    readonly admissionReceipt: InvocationAdmissionReceiptV1;
+} | {
+    readonly kind: 'terminal';
+    readonly reasonCode: 'recovery-no-candidate' | 'recovery-story-id-invalid' | 'recovery-invocation-rejected';
+};
+export interface CompileRecoveryCatalogOptions {
+    readonly receiptOutcome?: 'accepted' | 'fallback';
+    readonly additionalReasonCodes?: readonly Extract<RecoveryCatalogReasonCode, 'recovery-catalog-fallback' | 'recovery-catalog-defaults-invalid'>[];
+}
+export declare function compileRecoveryCatalog(input: unknown, options?: CompileRecoveryCatalogOptions): RecoveryCatalogCompilation;
+export declare function materializeRecoveryCandidate(rule: CompiledRecoveryRule, storyId: string): RecoveryCandidateResult;

package/packages/shared/dist/invocation/recovery-route-compiler.js

@@ -0,0 +1,214 @@
+/** P220.10 registry-valid, root-owned yoloop recovery candidates. */
+import { createHash } from 'node:crypto';
+import { canonicalizeCommandRegistryJcs } from '../command-registry-contract.js';
+import { COMMAND_REGISTRY_CHECKSUM, COMMAND_REGISTRY_VERSION, GENERATED_SHARED_COMMANDS, } from '../generated/command-registry.generated.js';
+import { GENERATED_INVOCATION_SCHEMA_MANIFEST } from '../generated/invocation-schema.generated.js';
+import { YOLOOP_FAILURE_CATEGORIES, } from '../yoloop/recovery-types.js';
+import { admitInvocation, createInvocationAdmissionReceipt, } from './index.js';
+export const RECOVERY_CATALOG_EVIDENCE_ID = 'P220-EV-RECOVERY-CATALOG';
+export const RECOVERY_FAILURE_CATEGORIES = YOLOOP_FAILURE_CATEGORIES;
+const KNOWN_CATEGORIES = new Set(RECOVERY_FAILURE_CATEGORIES);
+const KNOWN_TIERS = new Set(['free', 'pro', 'enterprise']);
+const TIER_RANK = Object.freeze({
+    free: 0,
+    pro: 1,
+    enterprise: 2,
+});
+const RULE_KEYS = Object.freeze([
+    'applicable_tiers',
+    'category',
+    'max_attempts_per_story',
+    'recovery_trigger',
+    'trigger_args_template',
+]);
+const STORY_TEMPLATE = '@docs/stories/{storyId}.story.md';
+const SYNTHETIC_STORY_ID = 'P220.10';
+const ROUTE_POLICY = Object.freeze({
+    lint_failure: 'refactor',
+    merge_conflict: 'resolve-conflicts',
+    runtime_local_reproducible_fixable: 'refactor',
+});
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function uniqueReasons(reasons) {
+    return Object.freeze([...new Set(reasons)].sort().slice(0, 16));
+}
+function receipt(outcome, ruleCount, candidateRuleCount, sentinelRuleCount, reasonCodes, catalogDigestPrefix) {
+    return Object.freeze({
+        schemaVersion: 1,
+        evidenceId: RECOVERY_CATALOG_EVIDENCE_ID,
+        outcome,
+        registryVersion: COMMAND_REGISTRY_VERSION,
+        registryChecksumPrefix: COMMAND_REGISTRY_CHECKSUM.slice(0, 12),
+        schemaChecksumPrefix: GENERATED_INVOCATION_SCHEMA_MANIFEST.schemaChecksum.slice(0, 12),
+        ...(catalogDigestPrefix ? { catalogDigestPrefix } : {}),
+        ruleCount,
+        candidateRuleCount,
+        sentinelRuleCount,
+        reasonCodes: uniqueReasons(reasonCodes),
+        publicSafe: true,
+    });
+}
+function reject(ruleCount, reasons) {
+    const reasonCodes = uniqueReasons(reasons.length ? reasons : ['recovery-catalog-schema-invalid']);
+    return Object.freeze({
+        ok: false,
+        reasonCodes,
+        receipt: receipt('rejected', ruleCount, 0, 0, reasonCodes),
+    });
+}
+function isSentinelShape(rule) {
+    return rule.recovery_trigger === ''
+        && rule.trigger_args_template === ''
+        && rule.max_attempts_per_story === 0
+        && Array.isArray(rule.applicable_tiers)
+        && rule.applicable_tiers.length === 0;
+}
+function hasSentinelField(rule) {
+    return rule.recovery_trigger === ''
+        || rule.trigger_args_template === ''
+        || rule.max_attempts_per_story === 0
+        || (Array.isArray(rule.applicable_tiers) && rule.applicable_tiers.length === 0);
+}
+export function compileRecoveryCatalog(input, options = {}) {
+    if (!isObject(input) || input.schema_version !== 1 || !Array.isArray(input.rules)) {
+        return reject(0, ['recovery-catalog-schema-invalid']);
+    }
+    const reasons = [];
+    const compiled = [];
+    const seen = new Set();
+    for (const candidate of input.rules) {
+        if (!isObject(candidate) || Object.keys(candidate).sort().join('\0') !== RULE_KEYS.join('\0')) {
+            reasons.push('recovery-catalog-schema-invalid');
+            continue;
+        }
+        if (typeof candidate.category !== 'string' || !KNOWN_CATEGORIES.has(candidate.category)) {
+            reasons.push('recovery-category-unknown');
+            continue;
+        }
+        const category = candidate.category;
+        if (seen.has(category)) {
+            reasons.push('recovery-category-duplicate');
+            continue;
+        }
+        seen.add(category);
+        if (isSentinelShape(candidate)) {
+            compiled.push(Object.freeze({
+                category,
+                recovery_trigger: '',
+                trigger_args_template: '',
+                max_attempts_per_story: 0,
+                applicable_tiers: Object.freeze([]),
+                commandId: null,
+            }));
+            continue;
+        }
+        if (hasSentinelField(candidate))
+            reasons.push('recovery-sentinel-invalid');
+        if (typeof candidate.recovery_trigger !== 'string'
+            || typeof candidate.trigger_args_template !== 'string'
+            || typeof candidate.max_attempts_per_story !== 'number'
+            || !Array.isArray(candidate.applicable_tiers)) {
+            reasons.push('recovery-catalog-schema-invalid');
+            continue;
+        }
+        const match = /^\*([a-z0-9][a-z0-9-]*)$/.exec(candidate.recovery_trigger);
+        const commandId = match?.[1];
+        const command = GENERATED_SHARED_COMMANDS.find((entry) => entry.id === commandId);
+        if (!commandId || !command) {
+            reasons.push('recovery-target-unknown');
+            continue;
+        }
+        if (commandId === 'yolo' || commandId === 'yoloop') {
+            reasons.push('recovery-target-cycle');
+            continue;
+        }
+        if (command.category !== 'recovery' || ROUTE_POLICY[category] !== commandId) {
+            reasons.push('recovery-target-not-allowed');
+            continue;
+        }
+        if (candidate.recovery_trigger !== `*${command.id}`) {
+            reasons.push('recovery-target-not-allowed');
+        }
+        if (candidate.trigger_args_template !== STORY_TEMPLATE) {
+            reasons.push('recovery-template-invalid');
+        }
+        if (!Number.isInteger(candidate.max_attempts_per_story)
+            || candidate.max_attempts_per_story < 1
+            || candidate.max_attempts_per_story > 2) {
+            reasons.push('recovery-budget-invalid');
+        }
+        const tiers = candidate.applicable_tiers;
+        if (tiers.some((tier) => typeof tier !== 'string' || !KNOWN_TIERS.has(tier))
+            || new Set(tiers).size !== tiers.length) {
+            reasons.push('recovery-tier-invalid');
+        }
+        else if (tiers.some((tier) => TIER_RANK[tier] < TIER_RANK[command.policy.minimumTier])) {
+            reasons.push('recovery-tier-authority-expanded');
+        }
+        const action = `${candidate.recovery_trigger} ${candidate.trigger_args_template.replace('{storyId}', SYNTHETIC_STORY_ID)}`;
+        const admission = admitInvocation(action);
+        if (admission.outcome !== 'resolved'
+            || admission.selection.commandId !== command.id
+            || Object.keys(admission.selection.options).length !== 0) {
+            reasons.push('recovery-invocation-rejected');
+        }
+        if (reasons.length === 0) {
+            compiled.push(Object.freeze({
+                category,
+                recovery_trigger: candidate.recovery_trigger,
+                trigger_args_template: candidate.trigger_args_template,
+                max_attempts_per_story: candidate.max_attempts_per_story,
+                applicable_tiers: Object.freeze([...tiers].sort((left, right) => TIER_RANK[left] - TIER_RANK[right])),
+                commandId: command.id,
+            }));
+        }
+    }
+    if (seen.size !== RECOVERY_FAILURE_CATEGORIES.length)
+        reasons.push('recovery-category-missing');
+    if (reasons.length || compiled.length !== RECOVERY_FAILURE_CATEGORIES.length) {
+        return reject(input.rules.length, reasons);
+    }
+    const rules = Object.freeze([...compiled].sort((left, right) => left.category.localeCompare(right.category)));
+    const canonical = canonicalizeCommandRegistryJcs({
+        schema_version: 1,
+        rules: rules.map(({ commandId: _commandId, ...rule }) => rule),
+    });
+    const catalogHash = createHash('sha256').update(`p220-recovery-catalog-v1\0${canonical}`).digest('hex');
+    const catalogDigestPrefix = catalogHash.slice(0, 12);
+    const candidateRuleCount = rules.filter((rule) => rule.commandId !== null).length;
+    const sentinelRuleCount = rules.length - candidateRuleCount;
+    const outcome = options.receiptOutcome ?? 'accepted';
+    const reasonCodes = uniqueReasons([
+        outcome === 'fallback' ? 'recovery-catalog-fallback' : 'recovery-catalog-accepted',
+        ...(options.additionalReasonCodes ?? []),
+    ]);
+    return Object.freeze({
+        ok: true,
+        rules,
+        catalogHash,
+        receipt: receipt(outcome, rules.length, candidateRuleCount, sentinelRuleCount, reasonCodes, catalogDigestPrefix),
+    });
+}
+export function materializeRecoveryCandidate(rule, storyId) {
+    if (rule.commandId === null) {
+        return Object.freeze({ kind: 'terminal', reasonCode: 'recovery-no-candidate' });
+    }
+    if (!/^P\d+\.\d+$/.test(storyId)) {
+        return Object.freeze({ kind: 'terminal', reasonCode: 'recovery-story-id-invalid' });
+    }
+    const action = `${rule.recovery_trigger} ${rule.trigger_args_template.replace('{storyId}', storyId)}`;
+    const admission = admitInvocation(action);
+    if (admission.outcome !== 'resolved'
+        || admission.selection.commandId !== rule.commandId
+        || Object.keys(admission.selection.options).length !== 0) {
+        return Object.freeze({ kind: 'terminal', reasonCode: 'recovery-invocation-rejected' });
+    }
+    return Object.freeze({
+        kind: 'candidate',
+        action,
+        commandId: rule.commandId,
+        admissionReceipt: createInvocationAdmissionReceipt(admission, 'shared'),
+    });
+}

package/packages/shared/dist/state/index.d.ts

@@ -0,0 +1 @@
+export * from './state-migration.js';

package/packages/shared/dist/state/index.js

@@ -0,0 +1 @@
+export * from './state-migration.js';