@petepetrash/circuit 0.1.0

package/dist/runtime/run/slice-corridor.js

@@ -0,0 +1,99 @@
+// The slice-corridor state machine.
+//
+// Under deep depth, Build implements and verifies the plan's slices one at a
+// time. This object owns the slice-loop lifecycle the graph-runner loop
+// consults: which steps form the loop body, which completedStepCounts key a
+// loop-body step uses (slice-scoped, so re-entering for the next slice reads
+// as a fresh attempt rather than an illegal cycle), whether a completed tail
+// step should advance to the next slice, and which slice's metadata to
+// surface to the worker.
+//
+// Modeled on RecoveryCorridor: pure decisions plus one injected async reader
+// for the lazy slice-list load. It performs no IO of its own. See
+// docs/ideas/build-slice-decomposition.md.
+// CompiledDepth labels ordered least-to-most thorough. The slice loop only activates
+// at or above the flag's activateWhenDepthAtLeast.
+const DEPTH_ORDER = ['low', 'medium', 'high', 'tournament', 'autonomous'];
+function depthAtLeast(depth, floor) {
+    const current = DEPTH_ORDER.indexOf((depth ?? 'medium'));
+    const minimum = DEPTH_ORDER.indexOf(floor);
+    if (current < 0 || minimum < 0)
+        return false;
+    return current >= minimum;
+}
+export class SliceCorridor {
+    deps;
+    flag;
+    activeForDepth;
+    slices;
+    index = 0;
+    constructor(deps) {
+        this.deps = deps;
+        this.flag = deps.flag;
+        this.activeForDepth =
+            deps.flag !== undefined && depthAtLeast(deps.depth, deps.flag.activateWhenDepthAtLeast);
+    }
+    // True when this flow has a slice loop AND the run's depth activates it.
+    // Every method below is inert (single-pass behavior) when this is false.
+    isActive() {
+        return this.activeForDepth;
+    }
+    // True when stepId is the loop body's head or tail step.
+    isLoopBodyStep(stepId) {
+        if (!this.activeForDepth || this.flag === undefined)
+            return false;
+        return stepId === this.flag.headStep || stepId === this.flag.tailStep;
+    }
+    // Lazily load the ordered slice list (idempotent), capped at maxSlices.
+    async ensureInitialized() {
+        if (!this.activeForDepth || this.flag === undefined || this.slices !== undefined)
+            return;
+        const raw = await this.deps.readSlices();
+        this.slices = raw.slice(0, this.flag.maxSlices);
+    }
+    sliceCount() {
+        return this.slices?.length ?? 0;
+    }
+    currentSliceIndex() {
+        return this.index;
+    }
+    currentSlice() {
+        return this.slices?.[this.index];
+    }
+    // The completedStepCounts key for a step at a given slice index:
+    // slice-scoped for loop-body steps when active, else the bare stepId. The
+    // caller passes the index that applies to the entry being keyed (the live
+    // index for the incoming guard / target guard; a captured snapshot for the
+    // step's own trace + completion count, taken before any advance).
+    countKey(stepId, sliceIndex) {
+        if (!this.activeForDepth || !this.isLoopBodyStep(stepId))
+            return stepId;
+        return `${stepId}#s${sliceIndex}`;
+    }
+    // True when the just-completed tail step took its forward route (to a step
+    // that is not the loop head) and more slices remain. The caller resolves
+    // the route's target step id (undefined for a terminal route).
+    shouldAdvance(input) {
+        if (!this.activeForDepth || this.flag === undefined)
+            return false;
+        if (input.stepId !== this.flag.tailStep)
+            return false;
+        // A terminal route (e.g. stop) is not a slice advance.
+        if (input.targetStepId === undefined)
+            return false;
+        // A route back to the head step is an in-slice recovery retry, not an
+        // advance to the next slice.
+        if (input.targetStepId === this.flag.headStep)
+            return false;
+        return this.index + 1 < this.sliceCount();
+    }
+    // Advance to the next slice; returns the head step id to re-enter.
+    advance() {
+        if (this.flag === undefined) {
+            throw new Error('SliceCorridor.advance called without a slice-loop flag');
+        }
+        this.index += 1;
+        return this.flag.headStep;
+    }
+}
+//# sourceMappingURL=slice-corridor.js.map

package/dist/runtime/run/slice-corridor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slice-corridor.js","sourceRoot":"","sources":["../../../src/runtime/run/slice-corridor.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,yBAAyB;AACzB,EAAE;AACF,6EAA6E;AAC7E,kEAAkE;AAClE,2CAA2C;AAI3C,qFAAqF;AACrF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAEnF,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAiC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAqC,CAAC,CAAC;IAC3E,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AAYD,MAAM,OAAO,aAAa;IAMK;IALZ,IAAI,CAAkC;IACtC,cAAc,CAAU;IACjC,MAAM,CAAiC;IACvC,KAAK,GAAG,CAAC,CAAC;IAElB,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,cAAc;YACjB,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC5F,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,yDAAyD;IACzD,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClE,OAAO,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IACxE,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,iEAAiE;IACjE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,QAAQ,CAAC,MAAc,EAAE,UAAkB;QACzC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACxE,OAAO,GAAG,MAAM,KAAK,UAAU,EAAE,CAAC;IACpC,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,+DAA+D;IAC/D,aAAa,CAAC,KAA2D;QACvE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,uDAAuD;QACvD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnD,sEAAsE;QACtE,6BAA6B;QAC7B,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAC5C,CAAC;IAED,mEAAmE;IACnE,OAAO;QACL,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;CACF"}

package/dist/runtime/run/trace-evidence.d.ts

@@ -0,0 +1,34 @@
+import type { GuidanceDecisionTraceEntryBody } from '../../schemas/guidance-decision.js';
+import type { RecoveryRouteBindingV0 } from '../../schemas/recovery-route-kind.js';
+import type { Ref } from '../../schemas/ref.js';
+import type { ProofAssessedTraceEntry } from '../../schemas/trace-entry.js';
+import type { SkillHookInjectionChannel } from '../../skill-hooks/injection.js';
+import type { TraceEntry } from '../domain/trace.js';
+import type { RecoveryFailureEvidence } from './recovery-binding-verdict.js';
+import type { RunContext } from './run-context.js';
+import type { SliceCorridor } from './slice-corridor.js';
+export declare function latestRecoveryFailureEvidence(input: {
+    readonly context: RunContext;
+    readonly stepId: string;
+    readonly attempt: number;
+    readonly details: Record<string, unknown>;
+    readonly sliceIndex?: number;
+}): RecoveryFailureEvidence | undefined;
+export declare function latestStepReportOrRelayRef(input: {
+    readonly context: RunContext;
+    readonly stepId: string;
+    readonly attempt: number;
+}): Ref | undefined;
+export declare function reportSelectedCheckpointBoundaryEvidence(input: {
+    readonly context: RunContext;
+    readonly stepId: string;
+    readonly attempt: number;
+    readonly details: Record<string, unknown>;
+    readonly binding: RecoveryRouteBindingV0 | undefined;
+}): RecoveryFailureEvidence | undefined;
+export declare function seedSkillHookInjectionsFromTrace(entries: readonly TraceEntry[], channel: SkillHookInjectionChannel | undefined): void;
+export declare function completedStepCountsFromTrace(entries: readonly TraceEntry[], corridor: SliceCorridor): Map<string, number>;
+export declare function recordValue(value: unknown): Record<string, unknown>;
+export declare function traceScope(entry: GuidanceDecisionTraceEntryBody | ProofAssessedTraceEntry): Record<string, unknown>;
+export declare function proofPolicyRequirementKey(entry: GuidanceDecisionTraceEntryBody): string;
+//# sourceMappingURL=trace-evidence.d.ts.map

package/dist/runtime/run/trace-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-evidence.d.ts","sourceRoot":"","sources":["../../../src/runtime/run/trace-evidence.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmBzD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,uBAAuB,GAAG,SAAS,CAoCtC;AAQD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GAAG,GAAG,GAAG,SAAS,CAYlB;AAED,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACtD,GAAG,uBAAuB,GAAG,SAAS,CAMtC;AAWD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,yBAAyB,GAAG,SAAS,GAC7C,IAAI,CAaN;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,QAAQ,EAAE,aAAa,GACtB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAYrB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAInE;AAMD,wBAAgB,UAAU,CACxB,KAAK,EAAE,8BAA8B,GAAG,uBAAuB,GAC9D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,GAAG,MAAM,CAUvF"}

package/dist/runtime/run/trace-evidence.js

@@ -0,0 +1,148 @@
+// Trace and evidence reading for the graph runner.
+//
+// Pure readers over a run's trace entries and reports: failure evidence for
+// recovery routes, report/relay refs, resume-time projections (completed step
+// counts, skill-hook injections), and proof-policy scope helpers. Nothing here
+// drives execution or appends trace entries.
+import { CompiledFlowId, RunId, StepId } from '../../schemas/ids.js';
+import { isAcceptanceRetryFeedback } from '../acceptance-criteria.js';
+function traceRefForEntry(input) {
+    return {
+        kind: 'trace',
+        ref: `trace.ndjson#sequence=${input.sequence}`,
+        run_id: RunId.parse(input.context.runId),
+        flow_id: CompiledFlowId.parse(input.context.flow.id),
+        step_id: StepId.parse(input.stepId),
+        attempt: input.attempt,
+        sequence: input.sequence,
+    };
+}
+export function latestRecoveryFailureEvidence(input) {
+    for (const entry of [...input.context.trace.getAll()].reverse()) {
+        if (entry.kind !== 'check.evaluated' && entry.kind !== 'relay.failed')
+            continue;
+        if (entry.step_id !== input.stepId || entry.attempt !== input.attempt)
+            continue;
+        if (input.sliceIndex !== undefined &&
+            'slice_index' in entry &&
+            entry.slice_index !== input.sliceIndex) {
+            continue;
+        }
+        if (entry.kind === 'check.evaluated') {
+            if (entry.outcome !== 'fail')
+                continue;
+            return {
+                ref: traceRefForEntry({
+                    context: input.context,
+                    stepId: input.stepId,
+                    attempt: input.attempt,
+                    sequence: entry.sequence,
+                }),
+                cause: isAcceptanceRetryFeedback(input.details.acceptance_feedback)
+                    ? 'failed_acceptance_criteria'
+                    : 'failed_check',
+            };
+        }
+        return {
+            ref: traceRefForEntry({
+                context: input.context,
+                stepId: input.stepId,
+                attempt: input.attempt,
+                sequence: entry.sequence,
+            }),
+            cause: 'relay_connector_failed',
+        };
+    }
+    return undefined;
+}
+// Unlike latestRecoveryFailureEvidence, this needs no slice filter: every
+// loop-body execution writes a report/result, so under the slice loop the
+// current slice's entry is always the latest-by-sequence match for
+// (step_id, attempt) and reverse iteration returns it. (A clean slice has no
+// failure entry of its own, which is why the failure resolver — not this one —
+// must filter by slice to avoid crossing an earlier slice's failure.)
+export function latestStepReportOrRelayRef(input) {
+    for (const entry of [...input.context.trace.getAll()].reverse()) {
+        if (entry.kind !== 'step.report_written' && entry.kind !== 'relay.result')
+            continue;
+        if (entry.step_id !== input.stepId || entry.attempt !== input.attempt)
+            continue;
+        return traceRefForEntry({
+            context: input.context,
+            stepId: input.stepId,
+            attempt: input.attempt,
+            sequence: entry.sequence,
+        });
+    }
+    return undefined;
+}
+export function reportSelectedCheckpointBoundaryEvidence(input) {
+    if (!routeSelectedFromReport(input.details))
+        return undefined;
+    if (input.binding?.kind !== 'checkpoint_authority')
+        return undefined;
+    if (!input.binding.allowed_failure_causes.includes('checkpoint_boundary'))
+        return undefined;
+    const ref = latestStepReportOrRelayRef(input);
+    return ref === undefined ? undefined : { ref, cause: 'checkpoint_boundary' };
+}
+// On checkpoint resume the injection channel is recreated empty, but `auto`
+// hooks that fired in the PRIOR process recorded their injections durably as
+// run.skill-hook events. Re-seed the channel from those events so a later
+// implementer step in the resumed process sees the same injected skill set a
+// single-process run would. Without this, an injection from a step that is not
+// re-executed on resume is silently lost and the resumed run can feed a later
+// step a different skill set (and different check outcomes) than a single-process
+// run. Mirrors the live actuator gate exactly: auto policy, no pending decision
+// packet, at least one resolved skill.
+export function seedSkillHookInjectionsFromTrace(entries, channel) {
+    if (channel === undefined)
+        return;
+    for (const entry of entries) {
+        if (entry.kind !== 'run.skill-hook')
+            continue;
+        const event = entry.event;
+        if (event.policy.mode === 'auto' &&
+            event.decision_packet_id === undefined &&
+            event.triggered_skills.length > 0) {
+            channel.add(event.triggered_skills.map((skill) => skill.id));
+        }
+    }
+}
+export function completedStepCountsFromTrace(entries, corridor) {
+    const counts = new Map();
+    for (const entry of entries) {
+        if (entry.kind !== 'step.completed' || entry.step_id === undefined)
+            continue;
+        // Loop-body completions are keyed per slice so a resumed run restarts the
+        // next slice at attempt 1 (matching the live keying below). The recorded
+        // slice_index is load-bearing here; non-loop steps key on the bare id.
+        const sliceIndex = typeof entry.slice_index === 'number' ? entry.slice_index : 0;
+        const key = corridor.countKey(entry.step_id, sliceIndex);
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return counts;
+}
+export function recordValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function routeSelectedFromReport(details) {
+    return details.route_source === 'report';
+}
+export function traceScope(entry) {
+    return recordValue(entry.scope);
+}
+export function proofPolicyRequirementKey(entry) {
+    const scope = traceScope(entry);
+    const selected = recordValue(entry.selected);
+    return JSON.stringify({
+        flow_id: scope.flow_id,
+        step_id: scope.step_id,
+        proof_profile: selected.proof_profile,
+        required_claim_kinds: selected.required_claim_kinds,
+        required_evidence_kinds: selected.required_evidence_kinds,
+    });
+}
+//# sourceMappingURL=trace-evidence.js.map

package/dist/runtime/run/trace-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-evidence.js","sourceRoot":"","sources":["../../../src/runtime/run/trace-evidence.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,6CAA6C;AAG7C,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAMtE,SAAS,gBAAgB,CAAC,KAKzB;IACC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,yBAAyB,KAAK,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAW7C;IACC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAChF,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,SAAS;QAChF,IACE,KAAK,CAAC,UAAU,KAAK,SAAS;YAC9B,aAAa,IAAI,KAAK;YACtB,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM;gBAAE,SAAS;YACvC,OAAO;gBACL,GAAG,EAAE,gBAAgB,CAAC;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC;gBACF,KAAK,EAAE,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;oBACjE,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,cAAc;aACnB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,EAAE,gBAAgB,CAAC;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC;YACF,KAAK,EAAE,wBAAwB;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,mEAAmE;AACnE,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QACpF,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,SAAS;QAChF,OAAO,gBAAgB,CAAC;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wCAAwC,CAAC,KAMxD;IACC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5F,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;AAC/E,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,uCAAuC;AACvC,MAAM,UAAU,gCAAgC,CAC9C,OAA8B,EAC9B,OAA8C;IAE9C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IACE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YAC5B,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACtC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EACjC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA8B,EAC9B,QAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QAC7E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAA+D;IAE/D,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;KAC1D,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/run/until-budget.d.ts

@@ -0,0 +1,12 @@
+import type { TraceEntry } from '../domain/trace.js';
+export interface UntilBudgetCaps {
+    readonly usdCap?: number;
+    readonly tokenCap?: number;
+}
+export interface UntilBudgetVerdict {
+    readonly overCap: boolean;
+    readonly nearCap: boolean;
+    readonly reason?: string;
+}
+export declare function evaluateUntilBudget(entries: readonly TraceEntry[], caps: UntilBudgetCaps): UntilBudgetVerdict;
+//# sourceMappingURL=until-budget.d.ts.map

package/dist/runtime/run/until-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"until-budget.d.ts","sourceRoot":"","sources":["../../../src/runtime/run/until-budget.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAGjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAG1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAG1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAkCD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,IAAI,EAAE,eAAe,GACpB,kBAAkB,CA2DpB"}

package/dist/runtime/run/until-budget.js

@@ -0,0 +1,102 @@
+// Cumulative budget evaluation for the until loop.
+//
+// An until loop can re-enter its body many times, so a runaway or low-progress
+// loop is the spend risk the iteration cap alone does not bound (a cap of 8 says
+// nothing about cost per pass). The cumulative cap closes that: at the tail seam
+// the engine sums the per-relay usage already recorded on the trace and, at or
+// above the cap, exits to needs-attention rather than spending another pass.
+//
+// FAIL CLOSED is the rule that makes this honest. A spend cap you cannot measure
+// is not a cap. If any relay reported no usage (codex and custom connectors
+// leave it absent), or a USD cap is set but no relay reported a cost, the engine
+// cannot prove the loop is under budget — so it treats the loop as over budget.
+// A flow that runs usage-less connectors simply does not set a cap.
+//
+// Usage parsing mirrors the operator-summary spend rollup
+// (src/app/operator-summary/writer.ts): same RelayUsageEvidence parse, same
+// missing-usage accounting.
+import { RelayUsageEvidence } from '../../schemas/trace-entry.js';
+// The soft-warning threshold: at or above this fraction of a cap the loop is
+// still allowed to continue, but a closure-priority steer is attached to the
+// carried note so the next pass knows to wrap up.
+const SOFT_THRESHOLD = 0.8;
+// Sum the run's per-relay spend from the trace. costUsd is undefined when NO
+// relay reported a cost (a USD cap then cannot be enforced). Token totals are
+// always summable from a present usage block; relaysMissingUsage counts relays
+// with no usage block at all, the fail-closed trigger for any cap.
+function summarizeSpend(entries) {
+    let costUsd;
+    let tokens = 0;
+    let relaysMissingUsage = 0;
+    for (const entry of entries) {
+        if (entry.kind !== 'relay.completed')
+            continue;
+        const usage = RelayUsageEvidence.safeParse(entry.usage);
+        if (!usage.success) {
+            relaysMissingUsage += 1;
+            continue;
+        }
+        tokens += usage.data.input_tokens + usage.data.output_tokens;
+        if (usage.data.total_cost_usd_reported !== undefined) {
+            costUsd = (costUsd ?? 0) + usage.data.total_cost_usd_reported;
+        }
+    }
+    return { costUsd, inputPlusOutputTokens: tokens, relaysMissingUsage };
+}
+// Evaluate the run's cumulative spend against the caps. No cap set => always
+// clear (the default loop is uncapped). With a cap set, an unmeasurable spend
+// fails closed to overCap.
+export function evaluateUntilBudget(entries, caps) {
+    if (caps.usdCap === undefined && caps.tokenCap === undefined) {
+        return { overCap: false, nearCap: false };
+    }
+    const spend = summarizeSpend(entries);
+    // Fail closed: a cap is set but at least one relay reported no usage, so the
+    // total is a floor, not the truth. We cannot prove we are under the cap.
+    if (spend.relaysMissingUsage > 0) {
+        return {
+            overCap: true,
+            nearCap: false,
+            reason: `cumulative budget cannot be enforced: ${spend.relaysMissingUsage} relay(s) reported no usage, so spend is unmeasurable (failing closed)`,
+        };
+    }
+    if (caps.usdCap !== undefined) {
+        // Fail closed: a USD cap with no reported cost anywhere is unenforceable.
+        if (spend.costUsd === undefined) {
+            return {
+                overCap: true,
+                nearCap: false,
+                reason: `cumulative USD cap $${caps.usdCap} cannot be enforced: no relay reported a cost (failing closed)`,
+            };
+        }
+        if (spend.costUsd >= caps.usdCap) {
+            return {
+                overCap: true,
+                nearCap: false,
+                reason: `cumulative spend $${spend.costUsd.toFixed(4)} reached the USD cap $${caps.usdCap}`,
+            };
+        }
+    }
+    if (caps.tokenCap !== undefined && spend.inputPlusOutputTokens >= caps.tokenCap) {
+        return {
+            overCap: true,
+            nearCap: false,
+            reason: `cumulative ${spend.inputPlusOutputTokens} tokens reached the token cap ${caps.tokenCap}`,
+        };
+    }
+    // Under both caps. Flag the soft threshold so the next pass can prioritize
+    // closing out before the hard cap forces an exit.
+    const usdNear = caps.usdCap !== undefined &&
+        spend.costUsd !== undefined &&
+        spend.costUsd >= caps.usdCap * SOFT_THRESHOLD;
+    const tokenNear = caps.tokenCap !== undefined && spend.inputPlusOutputTokens >= caps.tokenCap * SOFT_THRESHOLD;
+    if (usdNear || tokenNear) {
+        return {
+            overCap: false,
+            nearCap: true,
+            reason: 'nearing the cumulative budget cap; prioritize closing out the goal this pass',
+        };
+    }
+    return { overCap: false, nearCap: false };
+}
+//# sourceMappingURL=until-budget.js.map

package/dist/runtime/run/until-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"until-budget.js","sourceRoot":"","sources":["../../../src/runtime/run/until-budget.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,gFAAgF;AAChF,oEAAoE;AACpE,EAAE;AACF,0DAA0D;AAC1D,4EAA4E;AAC5E,4BAA4B;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGlE,6EAA6E;AAC7E,6EAA6E;AAC7E,kDAAkD;AAClD,MAAM,cAAc,GAAG,GAAG,CAAC;AAyB3B,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,mEAAmE;AACnE,SAAS,cAAc,CAAC,OAA8B;IACpD,IAAI,OAA2B,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,kBAAkB,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;QAC7D,IAAI,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AACxE,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,2BAA2B;AAC3B,MAAM,UAAU,mBAAmB,CACjC,OAA8B,EAC9B,IAAqB;IAErB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,CAAC,kBAAkB,wEAAwE;SAClJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uBAAuB,IAAI,CAAC,MAAM,gEAAgE;aAC3G,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,qBAAqB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,MAAM,EAAE;aAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,cAAc,KAAK,CAAC,qBAAqB,iCAAiC,IAAI,CAAC,QAAQ,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,KAAK,SAAS;QACzB,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC;IAChD,MAAM,SAAS,GACb,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;IAC/F,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC"}

package/dist/runtime/run/until-corridor.d.ts

@@ -0,0 +1,32 @@
+import type { UntilLoopEngineFlag } from '../../flows/types.js';
+export type UntilDisposition = 'stop-clean' | 'reenter' | 'needs-attention';
+export interface UntilCorridorDeps {
+    readonly flag: UntilLoopEngineFlag | undefined;
+    readonly depth: string | undefined;
+}
+export declare class UntilCorridor {
+    private readonly flag;
+    private readonly activeForDepth;
+    private readonly bodySteps;
+    private index;
+    private lastMarker;
+    private observedMarker;
+    private consecutiveNoProgress;
+    constructor(deps: UntilCorridorDeps);
+    isActive(): boolean;
+    isLoopBodyStep(stepId: string): boolean;
+    currentIterationIndex(): number;
+    countKey(stepId: string, iterationIndex: number): string;
+    shouldReenter(input: {
+        stepId: string;
+        route: string;
+    }): boolean;
+    canReenter(): boolean;
+    advance(): string;
+    disposeIteration(input: {
+        goalProposed: boolean;
+        evidenceConfirms: boolean;
+    }): UntilDisposition;
+    recordProgressMarker(marker: unknown): number;
+}
+//# sourceMappingURL=until-corridor.d.ts.map

package/dist/runtime/run/until-corridor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"until-corridor.d.ts","sourceRoot":"","sources":["../../../src/runtime/run/until-corridor.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAOhE,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAc5E,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAE/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkC;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,KAAK,CAAK;IAOlB,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,qBAAqB,CAAK;gBAEtB,IAAI,EAAE,iBAAiB;IASnC,QAAQ,IAAI,OAAO;IAMnB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAKvC,qBAAqB,IAAI,MAAM;IAS/B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM;IASxD,aAAa,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAYhE,UAAU,IAAI,OAAO;IAMrB,OAAO,IAAI,MAAM;IAqBjB,gBAAgB,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,GAAG,gBAAgB;IAc/F,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM;CAgB9C"}

package/dist/runtime/run/until-corridor.js

@@ -0,0 +1,161 @@
+// The until-corridor state machine.
+//
+// An until-loop re-enters its body once per iteration until a stop condition
+// holds: a while loop for flows, the third control shape after run-once and the
+// counted for-each of the slice loop. This object owns the loop lifecycle the
+// graph-runner consults: which steps form the body, which completedStepCounts
+// key a body step uses (iteration-scoped, so re-entering for the next iteration
+// reads as a fresh attempt rather than an illegal cycle), and whether a
+// completed tail step should re-enter the head for another iteration.
+//
+// Forked from SliceCorridor with three generalizations:
+//   - isLoopBodyStep is true for ANY step in the body span, not just head and
+//     tail. The slice loop's head and tail are adjacent, so it only scopes those
+//     two; an until-loop body can hold intermediate steps, and every one needs
+//     the iteration-scoped key or the first intermediate step aborts as an
+//     illegal re-entry on the second pass.
+//   - countKey keys on the iteration index (#i) rather than a slice index (#s).
+//   - the count-driven slice advance becomes a count-driven re-enter: there is
+//     no precomputed list to exhaust, so the loop runs until maxIterations.
+//
+// Two advance modes, both pure (no IO): a flag with no stopJudge runs the
+// count-driven slice-1 form (shouldReenter/advance, a fixed maxIterations); a
+// flag with a stopJudge runs the slice-2 form (disposeIteration), where the
+// caller reads the tail's goal-met proposal and an evidence signal and the
+// corridor decides stop-clean / reenter / needs-attention. The honesty ledger
+// that backs the evidence floor with latch state is a later slice. See
+// docs/ideas/until-loop.md.
+// CompiledDepth labels ordered least-to-most thorough. The until loop only
+// activates at or above the flag's activateWhenDepthAtLeast. Duplicated from
+// slice-corridor.ts so the fork stays self-contained; neither is exported.
+const DEPTH_ORDER = ['low', 'medium', 'high', 'tournament', 'autonomous'];
+function depthAtLeast(depth, floor) {
+    const current = DEPTH_ORDER.indexOf((depth ?? 'medium'));
+    const minimum = DEPTH_ORDER.indexOf(floor);
+    if (current < 0 || minimum < 0)
+        return false;
+    return current >= minimum;
+}
+export class UntilCorridor {
+    flag;
+    activeForDepth;
+    bodySteps;
+    index = 0;
+    // Slice 6 (no-progress steering). The engine treats the judge's progress
+    // marker as OPAQUE: it serializes it and compares only for equality across
+    // iterations, never interpreting the value. `lastMarker` holds the prior
+    // iteration's serialized marker, `observed` distinguishes "no prior marker
+    // yet" from "prior marker was absent", and `consecutiveNoProgress` counts how
+    // many iterations in a row left the marker unchanged.
+    lastMarker;
+    observedMarker = false;
+    consecutiveNoProgress = 0;
+    constructor(deps) {
+        this.flag = deps.flag;
+        this.activeForDepth =
+            deps.flag !== undefined && depthAtLeast(deps.depth, deps.flag.activateWhenDepthAtLeast);
+        this.bodySteps = new Set(deps.flag?.bodySteps ?? []);
+    }
+    // True when this flow has an until loop AND the run's depth activates it.
+    // Every method below is inert (single-pass behavior) when this is false.
+    isActive() {
+        return this.activeForDepth;
+    }
+    // True when stepId is any step in the loop body span (head, tail, or an
+    // intermediate). This is the generalization the slice loop lacks.
+    isLoopBodyStep(stepId) {
+        if (!this.activeForDepth)
+            return false;
+        return this.bodySteps.has(stepId);
+    }
+    currentIterationIndex() {
+        return this.index;
+    }
+    // The completedStepCounts key for a body step at a given iteration index:
+    // iteration-scoped for loop-body steps when active, else the bare stepId. The
+    // caller passes the index that applies to the entry being keyed (the live
+    // index for the incoming guard / target guard; a captured snapshot for the
+    // step's own trace + completion count, taken before any re-enter advance).
+    countKey(stepId, iterationIndex) {
+        if (!this.activeForDepth || !this.isLoopBodyStep(stepId))
+            return stepId;
+        return `${stepId}#i${iterationIndex}`;
+    }
+    // True when the just-completed tail step took a forward (non-re-enter) route
+    // and the iteration count has not yet reached maxIterations. The caller has
+    // already resolved the route the tail selected; a route that is itself the
+    // re-enter route is an in-iteration loop-back, not a fresh forward exit.
+    shouldReenter(input) {
+        if (!this.activeForDepth || this.flag === undefined)
+            return false;
+        if (input.stepId !== this.flag.tailStep)
+            return false;
+        if (input.route === this.flag.reenterRoute)
+            return false;
+        return this.index + 1 < this.flag.maxIterations;
+    }
+    // True when at least one more iteration is allowed within the cap. The
+    // abort-intercept consults this to decide whether an exhausted body step
+    // re-enters a fresh iteration or, at the cap, exits to needs-attention. Same
+    // cap arithmetic as disposeIteration so the two never disagree about when the
+    // loop is out of iterations.
+    canReenter() {
+        if (!this.activeForDepth || this.flag === undefined)
+            return false;
+        return this.index + 1 < this.flag.maxIterations;
+    }
+    // Advance to the next iteration; returns the head step id to re-enter.
+    advance() {
+        if (this.flag === undefined) {
+            throw new Error('UntilCorridor.advance called without an until-loop flag');
+        }
+        this.index += 1;
+        return this.flag.headStep;
+    }
+    // Slice 2: dispose the tail's goal-met proposal against an independent evidence
+    // signal, within the iteration cap. Pure — the caller reads the judge boolean
+    // (goalProposed) and computes evidenceConfirms, then acts on the disposition.
+    //
+    // The honest core is two rules, in order:
+    //   1. A clean stop happens ONLY on a goal the evidence confirms. The judge's
+    //      claim alone is never enough; a met-claim the evidence rejects is a
+    //      blocked false-done that falls through to rule 2.
+    //   2. Anything not a confirmed stop wants another pass, but the iteration cap
+    //      bounds it. At the cap the loop exits to needs-attention, never to a
+    //      clean stop: the loop never reports done by running out of iterations.
+    // This keeps "the loop succeeded" unreachable through exhaustion, and a
+    // hallucinating judge cannot end the loop on a claim the engine cannot back.
+    disposeIteration(input) {
+        if (input.goalProposed && input.evidenceConfirms)
+            return 'stop-clean';
+        const maxIterations = this.flag?.maxIterations ?? 0;
+        if (this.index + 1 >= maxIterations)
+            return 'needs-attention';
+        return 'reenter';
+    }
+    // Slice 6: record this iteration's opaque progress marker and report how many
+    // iterations IN A ROW have left it unchanged. The engine never interprets the
+    // marker; it serializes it and compares for equality only. The first observed
+    // marker can never be a stall (there is nothing to compare it to), so it
+    // returns 0. A changed marker resets the run to 0; an unchanged marker
+    // increments it. The caller uses the count to attach a first-stall steer (== 1)
+    // and to exit at the no-progress ceiling.
+    recordProgressMarker(marker) {
+        const serialized = JSON.stringify(marker);
+        if (!this.observedMarker) {
+            this.observedMarker = true;
+            this.lastMarker = serialized;
+            this.consecutiveNoProgress = 0;
+            return 0;
+        }
+        if (serialized === this.lastMarker) {
+            this.consecutiveNoProgress += 1;
+        }
+        else {
+            this.consecutiveNoProgress = 0;
+            this.lastMarker = serialized;
+        }
+        return this.consecutiveNoProgress;
+    }
+}
+//# sourceMappingURL=until-corridor.js.map

package/dist/runtime/run/until-corridor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"until-corridor.js","sourceRoot":"","sources":["../../../src/runtime/run/until-corridor.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,wDAAwD;AACxD,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,2CAA2C;AAC3C,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,uEAAuE;AACvE,4BAA4B;AAW5B,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAEnF,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAiC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAqC,CAAC,CAAC;IAC3E,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AASD,MAAM,OAAO,aAAa;IACP,IAAI,CAAkC;IACtC,cAAc,CAAU;IACxB,SAAS,CAAsB;IACxC,KAAK,GAAG,CAAC,CAAC;IAClB,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,sDAAsD;IAC9C,UAAU,CAAqB;IAC/B,cAAc,GAAG,KAAK,CAAC;IACvB,qBAAqB,GAAG,CAAC,CAAC;IAElC,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,cAAc;YACjB,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC1F,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,qBAAqB;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,QAAQ,CAAC,MAAc,EAAE,cAAsB;QAC7C,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACxE,OAAO,GAAG,MAAM,KAAK,cAAc,EAAE,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa,CAAC,KAAwC;QACpD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IAClD,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IAClD,CAAC;IAED,uEAAuE;IACvE,OAAO;QACL,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE;IACF,0CAA0C;IAC1C,8EAA8E;IAC9E,0EAA0E;IAC1E,wDAAwD;IACxD,+EAA+E;IAC/E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,gBAAgB,CAAC,KAA2D;QAC1E,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,gBAAgB;YAAE,OAAO,YAAY,CAAC;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,aAAa;YAAE,OAAO,iBAAiB,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,gFAAgF;IAChF,0CAA0C;IAC1C,oBAAoB,CAAC,MAAe;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC7B,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/dist/runtime/run-files/report-validator.d.ts

@@ -0,0 +1,3 @@
+export type ReportValidator = (schemaName: string, value: unknown) => void;
+export declare const validateReportValue: ReportValidator;
+//# sourceMappingURL=report-validator.d.ts.map