@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/build/lib/core/runtime/runControl.d.ts

@@ -0,0 +1,44 @@
+import type { ToolResultPart } from "ai";
+import { type RunControlStore } from "./runControlStore";
+export interface RunControlOptions {
+    runId: string;
+    executionAttemptId: string;
+    store: RunControlStore;
+    /** Tool names whose dispatch requires a persisted operator approval. */
+    requiredTools: readonly string[];
+    /** Host cancellation (CLI signal, deadline). Persists stop before aborting. */
+    abortSignal?: AbortSignal;
+    pollIntervalMs?: number;
+}
+export interface RunControl {
+    /** Aborts when a persisted stop is observed or a critical store failure latches. */
+    signal: AbortSignal;
+    /** Dispatch gate: pause/stop intent or a foreign control owner interrupts. */
+    beforeDispatch(): Promise<void>;
+    /**
+     * Tool gate. Undefined → proceed. A denied required tool resolves the
+     * stable blocked result — no tool intent, no effect. Stop interrupts.
+     */
+    beforeTool(input: {
+        toolCallId: string;
+        toolName: string;
+        input: unknown;
+    }): Promise<ToolResultPart["output"] | undefined>;
+    /**
+     * Drains queued writes; throws the latched storage failure first, then a
+     * gate-observed interruption. A merely-polled pause intent never throws.
+     */
+    flush(): Promise<void>;
+    /**
+     * Clears timers/listeners, settles pending approval waits with the
+     * blocked result, and awaits ongoing work; never throws or latches.
+     */
+    dispose(): Promise<void>;
+}
+/**
+ * Executor-side durable control for one recorded run. Clients write commands
+ * to the store; this controller enforces them at dispatch/tool boundaries,
+ * polls only to propagate a persisted stop to its own AbortController, and
+ * latches terminal causes so flush() surfaces what SDK machinery swallowed.
+ */
+export declare function createRunControl(options: RunControlOptions): RunControl;

package/build/lib/core/runtime/runControlStore.d.ts

@@ -0,0 +1,83 @@
+import type { ContextReference } from "./runContext";
+export type RunControlIntent = "run" | "pause" | "stop";
+export type ApprovalDecision = "approved" | "denied";
+/** Durable control state for one recorded run, enrolled by its executor. */
+export interface RunControlRecord {
+    schemaVersion: 1;
+    runId: string;
+    executionAttemptId: string;
+    intent: RunControlIntent;
+    /** CAS token for commands; starts at 0 on enrollment. */
+    revision: number;
+    updatedAt: string;
+}
+/**
+ * One pending or resolved operator approval. The record binds the exact
+ * validated input and the admitted spec digest, so a decision can never
+ * authorize different bytes. Unique per run and toolCallId; resolved once.
+ */
+export interface RecordedApproval {
+    schemaVersion: 1;
+    approvalId: string;
+    runId: string;
+    executionAttemptId: string;
+    toolCallId: string;
+    toolName: string;
+    input: unknown;
+    specDigest: string;
+    context: ContextReference;
+    state: "pending" | "approved" | "denied";
+    reason?: "user_rejected" | "run_stopped";
+    createdAt: string;
+    decidedAt?: string;
+}
+export interface RunControlStore {
+    /**
+     * Executor-side enrollment immediately after admission; admitted or
+     * running only, so a pre-aborted run can persist stop before session
+     * creation. Idempotent per owner; terminal runs never enroll.
+     */
+    initializeControl(runId: string, executionAttemptId: string): Promise<void>;
+    /** Read-only; works on terminal records; undefined when never enrolled. */
+    getControl(runId: string): Promise<RunControlRecord | undefined>;
+    /**
+     * Client-side command with revision CAS. Identical intent is idempotent;
+     * stop dominates (a pause after stop rejects) and denies every pending
+     * approval (reason `run_stopped`) in the same transaction.
+     */
+    requestControl(runId: string, intent: "pause" | "stop", expectedRevision: number): Promise<RunControlRecord>;
+    /**
+     * Executor-side approval request bound to (toolCallId, validated input,
+     * spec digest, context). Identical repeat returns the saved record; a
+     * changed toolName or input rejects.
+     */
+    requestApproval(runId: string, executionAttemptId: string, request: {
+        toolCallId: string;
+        toolName: string;
+        input: unknown;
+    }): Promise<RecordedApproval>;
+    getApproval(runId: string, approvalId: string): Promise<RecordedApproval | undefined>;
+    listApprovals(runId: string): Promise<RecordedApproval[]>;
+    /**
+     * Resolve-once CAS: pending → approved|denied. Identical decision is
+     * idempotent; a conflicting decision rejects. Approving requires the run
+     * to be running. Denials record `user_rejected`.
+     */
+    resolveApproval(runId: string, approvalId: string, decision: ApprovalDecision): Promise<RecordedApproval>;
+}
+/**
+ * CAS conflict on a control command's expected revision. Retryable by
+ * re-reading the control record and re-issuing — never conflate with
+ * storage failures, which must not be blindly retried.
+ */
+export declare class RunControlConflictError extends Error {
+    constructor(message: string);
+}
+/**
+ * Nonretryable control interruption (pause/stop, denied or unapproved
+ * gate). Never subclasses storage failure — latched persistence errors and
+ * operator intent are distinct failure classes.
+ */
+export declare class RunControlInterruption extends Error {
+    constructor(message: string);
+}

package/build/lib/core/runtime/runDeadline.d.ts

@@ -0,0 +1,4 @@
+export declare function runDeadline(deadlineAt?: string, parent?: AbortSignal): {
+    signal: AbortSignal | undefined;
+    dispose(): void;
+};

package/build/lib/core/runtime/runEvidence.d.ts

@@ -0,0 +1,37 @@
+import type { SessionInfo } from "../session";
+export interface EvidenceReference {
+    /** POSIX path relative to the session root. */
+    path: string;
+    /** Lowercase hex SHA-256 of the file bytes at collection time. */
+    sha256: string;
+    /** Byte size of the file at collection time. */
+    bytes: number;
+}
+export type EvidenceCheck = {
+    status: "match";
+    ref: EvidenceReference;
+} | {
+    status: "missing";
+    ref: EvidenceReference;
+} | {
+    status: "modified";
+    ref: EvidenceReference;
+    sha256: string;
+    bytes: number;
+} | {
+    status: "error";
+    ref: EvidenceReference;
+    reason: string;
+};
+/**
+ * Inventory the session's evidence artifacts as digest references; the
+ * session's domain files stay authoritative. Walks exactly the known
+ * locations and throws on unreadable or root-escaping entries.
+ */
+export declare function collectSessionEvidence(session: SessionInfo): Promise<EvidenceReference[]>;
+/**
+ * Verify references one at a time (bounded open files) against the session's
+ * current files. Missing, modified, and error are distinct; nothing is
+ * restored.
+ */
+export declare function inspectSessionEvidence(session: Pick<SessionInfo, "rootPath">, refs: EvidenceReference[]): Promise<EvidenceCheck[]>;

package/build/lib/core/runtime/runInference.d.ts

@@ -0,0 +1,9 @@
+import type { InferenceRecorder } from "../ai";
+import { type RunModelStore } from "./runModelStore";
+interface RunInferenceRecorderOptions {
+    runId: string;
+    executionAttemptId: string;
+    store: RunModelStore;
+}
+export declare function createRunInferenceRecorder(options: RunInferenceRecorderOptions): InferenceRecorder;
+export {};

package/build/lib/core/runtime/runModelStore.d.ts

@@ -0,0 +1,27 @@
+import type { InferenceAttempt, ModelRetryDecision, ObservedModelToolCall } from "../ai";
+import type { RunCheckpointStore } from "./runCheckpointStore";
+import type { ContextReference } from "./runContext";
+export interface RecordedModelAttempt {
+    schemaVersion: 1;
+    attempt: InferenceAttempt;
+    context: ContextReference | null;
+    toolCalls: ObservedModelToolCall[];
+    startedAt: string;
+    updatedAt: string;
+}
+export interface RecordedRetry extends ModelRetryDecision {
+    sequence: number;
+    scheduledAt: string;
+    dueAt: string;
+}
+export interface RunModelStore extends RunCheckpointStore {
+    startModelAttempt(runId: string, executionAttemptId: string, attempt: InferenceAttempt): Promise<void>;
+    observeModelToolCall(runId: string, executionAttemptId: string, attemptId: string, call: ObservedModelToolCall): Promise<void>;
+    settleModelAttempt(runId: string, executionAttemptId: string, attempt: InferenceAttempt): Promise<void>;
+    recordRetry(runId: string, executionAttemptId: string, decision: ModelRetryDecision): Promise<void>;
+    listModelAttempts(runId: string): Promise<RecordedModelAttempt[]>;
+    listRetries(runId: string): Promise<RecordedRetry[]>;
+}
+export declare class RunLimitError extends Error {
+    constructor(message: string);
+}

package/build/lib/core/runtime/runObservation.d.ts

@@ -0,0 +1,19 @@
+import type { ContextStore } from "./runContext";
+import type { RecordedApproval, RunControlRecord } from "./runControlStore";
+import type { RunRecord } from "./runStore";
+/** The canonical committed context, as returned by ContextStore.getContext. */
+export type RunContextSnapshot = NonNullable<Awaited<ReturnType<ContextStore["getContext"]>>>;
+/**
+ * One internally-consistent read of a run's durable state, taken in a single
+ * SQLite read transaction. Nulls mean "absent"; corruption throws instead.
+ */
+export interface RunObservation {
+    record: RunRecord | null;
+    context: RunContextSnapshot | null;
+    control: RunControlRecord | null;
+    approvals: RecordedApproval[];
+}
+/** Store surface for clients that observe without holding the execution lock. */
+export interface RunObservationStore {
+    observe(runId: string): Promise<RunObservation>;
+}

package/build/lib/core/runtime/runRecoveryContext.d.ts

@@ -0,0 +1,20 @@
+import type { ModelMessage } from "ai";
+import type { SessionInfo } from "../session";
+import type { ContextReference } from "./runContext";
+import type { RunRecord } from "./runStore";
+export interface RestoreRunContextInput {
+    record: RunRecord;
+    session: SessionInfo;
+    context: ContextReference & {
+        messages: ModelMessage[];
+        system: string | null;
+    };
+}
+export interface RestoredRunContext {
+    /** Conversation head without any leading system message. */
+    messages: ModelMessage[];
+    /** Saved base prompt; the agent re-appends current runtime facts, assets, and workspace. */
+    baseSystem: string;
+}
+/** Restores the committed conversation and base prompt without retaining transient harness sections. */
+export declare function restoreRunContext(input: RestoreRunContextInput): RestoredRunContext;

package/build/lib/core/runtime/runRecoveryPlan.d.ts

@@ -0,0 +1,38 @@
+import type { ModelMessage } from "ai";
+import type { RecordedApproval } from "./runControlStore";
+import type { RecordedModelAttempt, RecordedRetry } from "./runModelStore";
+import type { RecoveryReconstructionSummary, RecoveryRecord } from "./runRecoveryStore";
+import type { RunRecord } from "./runStore";
+import type { RecordedToolOperation } from "./runToolStore";
+/** Canonical head as returned by the checkpoint store's getContext. */
+export interface RecoveryPlanContext {
+    epoch: number;
+    revision: number;
+    messages: ModelMessage[];
+    system: string | null;
+}
+export interface RecoveryPlanInput {
+    record: RunRecord;
+    context: RecoveryPlanContext;
+    attempts: RecordedModelAttempt[];
+    operations: RecordedToolOperation[];
+    approvals: RecordedApproval[];
+    retries: RecordedRetry[];
+    recoveries: RecoveryRecord[];
+}
+export type RecoveryPlan = {
+    ok: false;
+    blockers: string[];
+} | {
+    ok: true;
+    messages: ModelMessage[];
+    reconstruction: RecoveryReconstructionSummary;
+};
+/**
+ * Pure recovery planner: validates the canonical history and, only when the
+ * current-revision exchange is provably reconstructible, synthesizes the
+ * saved settled tool exchanges (plus an explicit interruption note) onto
+ * the canonical head. Never executes tools, never fabricates approvals,
+ * never silently drops ambiguity — anything unprovable becomes a blocker.
+ */
+export declare function planRunRecovery(input: RecoveryPlanInput): RecoveryPlan;

package/build/lib/core/runtime/runRecoveryStore.d.ts

@@ -0,0 +1,77 @@
+/** Environment identity captured from the actual filesystem at enrollment. */
+export interface RecoveryEnvironment {
+    runtimeVersion: string;
+    host: string;
+    platform: string;
+    arch: string;
+    databasePath: string;
+    databaseDev: number;
+    databaseIno: number;
+    cwdPath: string;
+    cwdDev: number;
+    cwdIno: number;
+    sessionRootPath: string;
+    sessionRootDev: number;
+    sessionRootIno: number;
+}
+export interface RecoveryEnrollment {
+    schemaVersion: 1;
+    runId: string;
+    protocol: 1;
+    enrolledAt: string;
+    executionAttemptId: string;
+    environment: RecoveryEnvironment;
+}
+export interface RecoveryReconstructionSummary {
+    sourceContext: {
+        epoch: number;
+        revision: number;
+    };
+    /** Tool calls whose settled effects were reconstructed into context. */
+    reconstructedToolCalls: Array<{
+        toolCallId: string;
+        operationId: string;
+    }>;
+    /** Model attempts accepted as safely restartable (zero accepted effects). */
+    restartedModelAttempts: string[];
+    /** Denied approvals reconstructed as blocked tool results. */
+    deniedToolCalls: string[];
+    discardedUncommitted: boolean;
+}
+export interface RecoveryClaimInput {
+    expectedAttemptId: string;
+    expectedContext: {
+        epoch: number;
+        revision: number;
+    };
+    expectedControlRevision: number;
+    reconstruction: RecoveryReconstructionSummary;
+}
+export interface RecoveryRecord {
+    schemaVersion: 1;
+    recoveryId: string;
+    runId: string;
+    claimedAt: string;
+    fromAttemptId: string;
+    toAttemptId: string;
+    fromContext: {
+        epoch: number;
+        revision: number;
+    };
+    input: RecoveryClaimInput;
+}
+/** Local execution exclusion and auditable ownership changes. */
+export interface RunRecoveryStore {
+    acquireExecutionLock(runId: string): Promise<ExecutionLock>;
+    /** Requires a held lock and a fresh admission through this store instance. */
+    enrollRecovery(runId: string, executionAttemptId: string, sessionRoot: string): Promise<RecoveryEnrollment>;
+    getRecoveryEnrollment(runId: string): Promise<RecoveryEnrollment | undefined>;
+    /** Rotate owners atomically after checking the expected context and control revisions. */
+    claimRecovery(runId: string, input: RecoveryClaimInput): Promise<RecoveryRecord>;
+    listRecoveries(runId: string): Promise<RecoveryRecord[]>;
+}
+export interface ExecutionLock {
+    readonly runId: string;
+    /** Release = close the dedicated connection. Idempotent; never throws. */
+    release(): void;
+}

package/build/lib/core/runtime/runStore.d.ts

@@ -0,0 +1,133 @@
+import { z } from "zod";
+export declare const RecordedRunSpecSchema: z.ZodObject<{
+    scope: z.ZodObject<{
+        allowedHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowedPorts: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+        allowDestructiveActions: z.ZodDefault<z.ZodBoolean>;
+        allowRateLimitTesting: z.ZodDefault<z.ZodBoolean>;
+        version: z.ZodLiteral<1>;
+        strictScope: z.ZodBoolean;
+    }, z.core.$strict>;
+    credentialRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    schemaVersion: z.ZodLiteral<1>;
+    configVersion: z.ZodLiteral<1>;
+    runId: z.ZodString;
+    prompt: z.ZodString;
+    target: z.ZodString;
+    model: z.ZodString;
+    system: z.ZodOptional<z.ZodString>;
+    activeTools: z.ZodArray<z.ZodEnum<{
+        http_request: "http_request";
+        execute_command: "execute_command";
+        document_vulnerability: "document_vulnerability";
+        read_file: "read_file";
+        list_files: "list_files";
+        grep: "grep";
+        create_task: "create_task";
+        update_task: "update_task";
+        list_tasks: "list_tasks";
+        write_plan: "write_plan";
+    }>>;
+    environment: z.ZodObject<{
+        kind: z.ZodLiteral<"local">;
+        cwd: z.ZodString;
+    }, z.core.$strict>;
+    approval: z.ZodOptional<z.ZodObject<{
+        requiredTools: z.ZodArray<z.ZodEnum<{
+            http_request: "http_request";
+            execute_command: "execute_command";
+            document_vulnerability: "document_vulnerability";
+            read_file: "read_file";
+            list_files: "list_files";
+            grep: "grep";
+            create_task: "create_task";
+            update_task: "update_task";
+            list_tasks: "list_tasks";
+            write_plan: "write_plan";
+        }>>;
+    }, z.core.$strict>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        maxModelAttempts: z.ZodOptional<z.ZodNumber>;
+        deadlineAt: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type RecordedRunSpec = z.output<typeof RecordedRunSpecSchema>;
+export declare const RunRecordSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    spec: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        configVersion: z.ZodLiteral<1>;
+        runId: z.ZodString;
+        prompt: z.ZodString;
+        target: z.ZodString;
+        model: z.ZodString;
+        system: z.ZodOptional<z.ZodString>;
+        activeTools: z.ZodArray<z.ZodEnum<{
+            http_request: "http_request";
+            execute_command: "execute_command";
+            document_vulnerability: "document_vulnerability";
+            read_file: "read_file";
+            list_files: "list_files";
+            grep: "grep";
+            create_task: "create_task";
+            update_task: "update_task";
+            list_tasks: "list_tasks";
+            write_plan: "write_plan";
+        }>>;
+        environment: z.ZodObject<{
+            kind: z.ZodLiteral<"local">;
+            cwd: z.ZodString;
+        }, z.core.$strict>;
+        scope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            allowedHosts: z.ZodArray<z.ZodString>;
+            allowedPorts: z.ZodArray<z.ZodNumber>;
+            strictScope: z.ZodBoolean;
+            allowDestructiveActions: z.ZodBoolean;
+            allowRateLimitTesting: z.ZodBoolean;
+        }, z.core.$strict>;
+        credentialRefs: z.ZodArray<z.ZodString>;
+        approval: z.ZodOptional<z.ZodObject<{
+            requiredTools: z.ZodArray<z.ZodEnum<{
+                http_request: "http_request";
+                execute_command: "execute_command";
+                document_vulnerability: "document_vulnerability";
+                read_file: "read_file";
+                list_files: "list_files";
+                grep: "grep";
+                create_task: "create_task";
+                update_task: "update_task";
+                list_tasks: "list_tasks";
+                write_plan: "write_plan";
+            }>>;
+        }, z.core.$strict>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            maxModelAttempts: z.ZodOptional<z.ZodNumber>;
+            deadlineAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    sessionId: z.ZodString & z.ZodType<import("../id/id").SessionID, string, z.core.$ZodTypeInternals<import("../id/id").SessionID, string>>;
+    attemptId: z.ZodString;
+    runtimeVersion: z.ZodString;
+    status: z.ZodEnum<{
+        completed: "completed";
+        failed: "failed";
+        running: "running";
+        admitted: "admitted";
+        paused: "paused";
+        cancelled: "cancelled";
+    }>;
+    admittedAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type RunRecord = z.output<typeof RunRecordSchema>;
+export interface RunStore {
+    /** Atomically admit once; identical retries return the record, changed inputs reject. */
+    admit(spec: RecordedRunSpec): Promise<{
+        created: boolean;
+        record: RunRecord;
+    }>;
+    get(runId: string): Promise<RunRecord | undefined>;
+    list(): Promise<RunRecord[]>;
+    transition(runId: string, attemptId: string, status: "running" | "paused" | "completed" | "failed" | "cancelled"): Promise<RunRecord>;
+}

package/build/lib/core/runtime/runStorePath.d.ts

@@ -0,0 +1 @@
+export declare function resolveRunDatabasePath(filename?: string): string;

package/build/lib/core/runtime/runToolStore.d.ts

@@ -0,0 +1,50 @@
+import type { ToolResultPart } from "ai";
+import type { ContextReference } from "./runContext";
+import type { EvidenceReference } from "./runEvidence";
+export type RecordedToolPolicy = "read_only" | "external_effect" | "local_mutation" | "shell_state";
+export interface RecordedToolInput {
+    toolCallId: string;
+    toolName: string;
+    input: unknown;
+    policy: RecordedToolPolicy;
+}
+export interface RecordedToolOperation extends RecordedToolInput {
+    schemaVersion: 1;
+    operationId: string;
+    executionAttemptId: string;
+    sequence: number;
+    context: ContextReference;
+    state: "started" | "settled" | "outcome_unknown";
+    output?: ToolResultPart["output"];
+    evidence?: {
+        rootPath: string;
+        files: EvidenceReference[];
+    };
+    startedAt: string;
+    updatedAt: string;
+}
+export interface RunToolStore {
+    initializeToolJournal(runId: string, executionAttemptId: string): Promise<void>;
+    hasToolJournal(runId: string): Promise<boolean>;
+    startToolOperation(runId: string, executionAttemptId: string, input: RecordedToolInput): Promise<{
+        created: boolean;
+        operation: RecordedToolOperation;
+    }>;
+    settleToolOperation(runId: string, executionAttemptId: string, toolCallId: string, output: ToolResultPart["output"], evidence: {
+        rootPath: string;
+        files: EvidenceReference[];
+    }): Promise<void>;
+    markToolOutcomeUnknown(runId: string, executionAttemptId: string, toolCallId: string): Promise<void>;
+    listToolOperations(runId: string): Promise<RecordedToolOperation[]>;
+}
+export interface ToolExecutionRecorder {
+    beforeExecute(input: Omit<RecordedToolInput, "policy">): Promise<{
+        kind: "execute";
+    } | {
+        kind: "reuse";
+        output: ToolResultPart["output"];
+    }>;
+    settle(toolCallId: string, output: ToolResultPart["output"]): Promise<void>;
+    unknown(toolCallId: string): Promise<void>;
+    flush(): Promise<void>;
+}

package/build/lib/core/runtime/runTools.d.ts

@@ -0,0 +1,16 @@
+import type { ToolResultPart } from "ai";
+import type { RecordedToolInput, RunToolStore, ToolExecutionRecorder } from "./runToolStore";
+export interface RunToolRecorderOptions {
+    /** Logical run id (B1 run spec) — never a session id. */
+    runId: string;
+    /** Logical execution-attempt id (B1 run record). */
+    executionAttemptId: string;
+    store: RunToolStore;
+    beforeTool?: (input: Omit<RecordedToolInput, "policy">) => Promise<ToolResultPart["output"] | undefined>;
+    /** Collects evidence references to commit alongside a settled output. */
+    collectEvidence: () => Promise<{
+        rootPath: string;
+        files: import("./runEvidence").EvidenceReference[];
+    }>;
+}
+export declare function createRunToolRecorder(options: RunToolRecorderOptions): ToolExecutionRecorder;

package/build/lib/core/runtime/sqliteControlStore.d.ts

@@ -0,0 +1,41 @@
+import type { ContextReference } from "./runContext";
+import { type RecordedApproval, type RunControlRecord, type RunControlStore } from "./runControlStore";
+import type { RunRecord } from "./runStore";
+export declare const CONTROL_STORE_SCHEMA_SQL = "\n  CREATE TABLE run_controls (\n    run_id TEXT PRIMARY KEY NOT NULL REFERENCES runs(run_id),\n    record_json TEXT NOT NULL\n  );\n  CREATE TABLE tool_approvals (\n    run_id TEXT NOT NULL REFERENCES runs(run_id),\n    approval_id TEXT NOT NULL,\n    tool_call_id TEXT NOT NULL,\n    record_json TEXT NOT NULL,\n    PRIMARY KEY(run_id, approval_id),\n    UNIQUE(run_id, tool_call_id)\n  );\n";
+interface ControlDatabase {
+    prepare(sql: string): {
+        get(...values: (string | number)[]): unknown;
+        all(...values: (string | number)[]): unknown[];
+        run(...values: (string | number)[]): unknown;
+    };
+}
+export declare function createSqliteControlStore(input: {
+    db: ControlDatabase;
+    transaction<T>(operation: () => T): T;
+    getRun(runId: string): RunRecord | undefined;
+    assertExecutionLock?(runId: string): void;
+    getContextReference(runId: string): ContextReference | null;
+}): {
+    methods: RunControlStore;
+    /**
+     * Synchronous read of the enrolled control record: lets status-write
+     * transactions atomically honor stop dominance and paused eligibility.
+     */
+    readControl(runId: string): RunControlRecord | undefined;
+    /** Synchronous approvals read for snapshot transactions. */
+    readApprovals(runId: string): RecordedApproval[];
+    /**
+     * Synchronous, no transaction of its own: called inside model/tool start
+     * transactions. Validates the control owner; absent enrollment allows
+     * dispatch only for specs that require no approvals.
+     */
+    assertDispatchAllowed(runId: string): void;
+    /**
+     * Synchronous gate called inside the tool-intent transaction with C1's
+     * accepted identity: dispatch must be allowed, the tool must be admitted,
+     * and gated tools need an approved record matching the toolCallId, tool
+     * name, exact input, owner attempt, and admitted spec digest.
+     */
+    assertToolApproved(runId: string, toolName: string, toolCallId: string, candidateInput: unknown): void;
+};
+export {};

package/build/lib/core/runtime/sqliteModelStore.d.ts

@@ -0,0 +1,20 @@
+import type { ContextReference } from "./runContext";
+import { type RunModelStore } from "./runModelStore";
+import type { RunRecord } from "./runStore";
+export declare const MODEL_STORE_SCHEMA_SQL = "\n  CREATE TABLE model_attempts (\n    run_id TEXT NOT NULL REFERENCES runs(run_id),\n    attempt_id TEXT NOT NULL,\n    record_json TEXT NOT NULL,\n    PRIMARY KEY(run_id, attempt_id)\n  );\n  CREATE TABLE model_retries (\n    run_id TEXT NOT NULL REFERENCES runs(run_id),\n    sequence INTEGER NOT NULL,\n    record_json TEXT NOT NULL,\n    PRIMARY KEY(run_id, sequence)\n  );\n";
+interface ModelDatabase {
+    prepare(sql: string): {
+        get(...values: (string | number)[]): unknown;
+        all(...values: (string | number)[]): unknown[];
+        run(...values: (string | number)[]): unknown;
+    };
+}
+type ModelMethods = Pick<RunModelStore, "startModelAttempt" | "observeModelToolCall" | "settleModelAttempt" | "recordRetry" | "listModelAttempts" | "listRetries">;
+export declare function createSqliteModelStore(input: {
+    db: ModelDatabase;
+    transaction<T>(operation: () => T): T;
+    getRun(runId: string): RunRecord | undefined;
+    getContextReference(runId: string): ContextReference | null;
+    assertDispatchAllowed?(runId: string): void;
+}): ModelMethods;
+export {};