@pellux/goodvibes-contracts 1.6.1 → 1.7.1

package/dist/core-verbs.js

@@ -127,6 +127,13 @@ export const EXEMPT_VERB_CATEGORIES = {
         // verb (auth, OTLP ingestion, contract introspection, GraphQL execution).
         'login', 'current', 'contract', 'schema', 'execute', 'logs', 'metrics', 'traces', 'web',
     ],
+    'relay-step-up-ceremony': [
+        // The relay WebAuthn step-up ceremony: `mint` issues a single-use challenge a
+        // surface signs with a passkey before a mutating relay call — named for the
+        // cryptographic act, not a generic CRUD lifecycle. (Credential `register` is
+        // already a CORE_VERB.)
+        'mint',
+    ],
     'ingest-and-content': [
         // Content-shaped verbs describing what is being brought in or produced,
         // not a generic lifecycle action.
@@ -147,8 +154,11 @@ export const EXEMPT_VERB_CATEGORIES = {
     ],
     'reporting-and-diagnostics': [
         // Read-shaped diagnostic/reporting endpoints named for their specific
-        // report, not a generic "get"/"list".
-        'doctor', 'stats', 'capacity', 'settings', 'catalog', 'reject', 'review-queue',
+        // report, not a generic "get"/"list". `report` is the feature-flag
+        // graduation report (flags.graduation.report) — a whole-report read whose
+        // shape (per-flag state + evidence + release-blocker list) is a named
+        // report, not a generic get of one record.
+        'doctor', 'stats', 'capacity', 'settings', 'catalog', 'reject', 'review-queue', 'report',
     ],
     'memory-record-store': [
         // The daemon-owned canonical memory store mirrors the MemoryStore engine's
@@ -173,6 +183,45 @@ export const EXEMPT_VERB_CATEGORIES = {
         // core verbs (push.subscriptions.create/list/delete, push.vapid.get).
         'verify',
     ],
+    'rewind-safety': [
+        // The unified message-anchored rewind (rewind.plan / rewind.apply): a
+        // terraform-style dry-run/apply pair over the platform's existing history
+        // stores. `plan` computes exactly what a rewind to a turn anchor would
+        // change and mints a single-use confirm token (read-only); `apply` consumes
+        // it to restore files and/or conversation, recording an undo point so the
+        // rewind is reversible. Not generic CRUD/lifecycle words — a safety-gated
+        // whole-session rewind surface, sibling to checkpoint-restore-safety.
+        'plan', 'apply',
+    ],
+    'hunk-revert-safety': [
+        // Per-hunk reverse-apply on the live working tree (checkpoints.revertHunkPreview /
+        // checkpoints.revertHunk): the comment-on-hunk review surfaces hand back ONE
+        // unified-diff hunk and ask for exactly it to be undone. `revertHunkPreview`
+        // validates the hunk still reverse-applies cleanly and mints a single-use
+        // confirm token (read-only); `revertHunk` consumes it to snapshot-then-reverse-
+        // apply that one hunk, emitting a receipt. Not generic CRUD/lifecycle words —
+        // a safety-gated per-hunk workspace mutation, sibling to checkpoint-restore-safety.
+        'revertHunk', 'revertHunkPreview',
+    ],
+    'checkpoint-restore-safety': [
+        // Server-side confirmation preview for the destructive checkpoints.restore:
+        // checkpoints.restorePreview computes what a restore would change and mints
+        // a short-lived, single-use confirmToken authorizing the matching restore.
+        // Read-only (no workspace rewrite) — a distinct verb from `restore` so the
+        // preview can hold read scope while restore keeps write scope. Not a generic
+        // CRUD/lifecycle word: it is a safety-gate operation specific to the
+        // whole-workspace rewind surface.
+        'restorePreview',
+    ],
+    'best-of-n-attempts': [
+        // Best-of-N sibling attempts on the fleet surface (fleet.attempts.pick /
+        // fleet.attempts.judge; fleet.attempts.list uses the core `list`). `pick`
+        // accepts one attempt as the winner (merging it, cleaning the losers);
+        // `judge` runs a model to PROPOSE a winner with reasons (clearly model
+        // judgment, never an auto-pick unless opted in). Not generic CRUD/lifecycle
+        // words — a best-of-N resolution surface over held-merge candidate groups.
+        'pick', 'judge',
+    ],
     'fleet-archive': [
         // Session-scoped fleet archive transitions (runtime/fleet/archive.ts):
         // moving a FINISHED process subtree out of the live fleet view and back.