@phamvuhoang/otto-core 0.18.0 → 0.20.0

package/dist/journal-gate.js

@@ -0,0 +1,135 @@
+/**
+ * The P12 outbound secrecy gate (issue #67). Layered, default-deny: a journal
+ * note is published only if it passes every gate. Gate 1 (here) is the pure,
+ * deterministic deny-list — the backbone. Gates 2 (generalization) and 3
+ * (adversarial judge) are added in later slices. ZERO-LEAK is the hard gate:
+ * anything ambiguous is denied, and a thrown check denies rather than crashes.
+ */
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+/** Built-in secret/identifier deny patterns. Each is intentionally broad — this
+ *  gate is biased to over-deny. The pattern NAME is logged, never the match. */
+const DENY = [
+    { name: "openai-key", re: /\bsk-[A-Za-z0-9_-]{12,}/ },
+    { name: "github-token", re: /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/ },
+    { name: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
+    { name: "aws-key", re: /\bAKIA[0-9A-Z]{16}\b/ },
+    { name: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+    { name: "bearer", re: /\bBearer\s+[A-Za-z0-9._-]{8,}/i },
+    {
+        name: "assignment-secret",
+        re: /\b(password|passwd|secret|api[_-]?key|token|access[_-]?key)\b\s*[:=]\s*\S+/i,
+    },
+    { name: "url", re: /\bhttps?:\/\/\S+/i },
+    { name: "abs-path", re: /(^|\s)(\/[\w.-]+){2,}/ },
+    { name: "rel-path", re: /(^|\s)\.{1,2}\/[\w./-]+/ },
+    { name: "win-path", re: /\b[A-Za-z]:\\[\\\w.-]+/ },
+    { name: "code-fence", re: /```/ },
+    { name: "code-span", re: /`[^`]+`/ },
+    { name: "scoped-pkg", re: /(^|\s)@[a-z0-9-]+\/[a-z0-9-]+/i },
+    { name: "import-stmt", re: /\b(import\s.+\sfrom\s|require\s*\()/ },
+];
+/** Build a word-ish, case-insensitive matcher for a repo identifier. */
+function identifierRe(id) {
+    const trimmed = id.trim();
+    if (trimmed.length < 3)
+        return null; // too short → too many false denials
+    const escaped = trimmed.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^A-Za-z0-9])${escaped}([^A-Za-z0-9]|$)`, "i");
+}
+/**
+ * Gate 1: deny if the entry matches any built-in secret/identifier pattern, any
+ * repo self-identifier, or any policy secretPattern. A malformed policy pattern
+ * is treated as a denial (fail closed). Pure; never mutates inputs.
+ */
+export function screenGate1(entry, ctx) {
+    for (const { name, re } of DENY) {
+        if (re.test(entry))
+            return { ok: false, gate: 1, reason: `deny:${name}` };
+    }
+    for (const id of ctx.repoIdentifiers) {
+        const re = identifierRe(id);
+        if (re && re.test(entry)) {
+            return { ok: false, gate: 1, reason: "deny:repo-identifier" };
+        }
+    }
+    for (const pattern of ctx.secretPatterns) {
+        let re;
+        try {
+            re = new RegExp(pattern, "i");
+        }
+        catch {
+            // a malformed policy pattern fails closed — we cannot prove safety.
+            return { ok: false, gate: 1, reason: "deny:malformed-policy-pattern" };
+        }
+        if (re.test(entry)) {
+            return { ok: false, gate: 1, reason: "deny:policy-secret-pattern" };
+        }
+    }
+    return { ok: true };
+}
+export const MAX_ENTRY_CHARS = 500;
+export const MIN_ENTRY_CHARS = 20;
+/** Shapes that betray a specific task/ticket. */
+const TASK_KEY_RE = /\b(issue-\d+|[A-Z]{2,}-\d+)\b/;
+/**
+ * Gate 2: the note must read as GENERIC craft. Deny task-key shapes, any term
+ * carried from the source record (scope globs / taskKey / run id), and notes
+ * outside the length bounds. Pure.
+ */
+export function screenGate2(entry, ctx) {
+    const text = entry.trim();
+    if (text.length < MIN_ENTRY_CHARS || text.length > MAX_ENTRY_CHARS) {
+        return { ok: false, gate: 2, reason: "deny:length" };
+    }
+    if (TASK_KEY_RE.test(text)) {
+        return { ok: false, gate: 2, reason: "deny:task-key" };
+    }
+    for (const term of ctx.forbiddenTerms) {
+        const t = term.trim();
+        if (t.length >= 3 &&
+            new RegExp(t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i").test(text)) {
+            return { ok: false, gate: 2, reason: "deny:forbidden-term" };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Run the full gate: 1 (deny-list) → 2 (generalization) → 3 (judge, optional).
+ * Default-deny: an empty entry, any non-pass gate, or a thrown judge denies. The
+ * judge runs LAST and only on an entry the deterministic gates already passed.
+ */
+export async function screenEntry(entry, ctx, judge) {
+    if (!entry || !entry.trim()) {
+        return { ok: false, gate: 1, reason: "deny:empty" };
+    }
+    const g1 = screenGate1(entry, ctx);
+    if (!g1.ok)
+        return g1;
+    const g2 = screenGate2(entry, ctx);
+    if (!g2.ok)
+        return g2;
+    if (judge) {
+        try {
+            const safe = await judge(entry);
+            if (!safe)
+                return { ok: false, gate: 3, reason: "deny:judge-unsafe" };
+        }
+        catch {
+            return { ok: false, gate: 3, reason: "deny:judge-error" };
+        }
+    }
+    return { ok: true };
+}
+/** Append one JSON line to the journal audit trail. Never throws. */
+export function appendAudit(workspaceDir, line) {
+    try {
+        const path = join(workspaceDir, ".otto", "journal", "audit.log");
+        mkdirSync(dirname(path), { recursive: true });
+        appendFileSync(path, JSON.stringify(line) + "\n", "utf8");
+    }
+    catch {
+        // the audit log is best-effort; never crash a run over it.
+    }
+}
+//# sourceMappingURL=journal-gate.js.map

package/dist/journal-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal-gate.js","sourceRoot":"","sources":["../src/journal-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAe1C;gFACgF;AAChF,MAAM,IAAI,GAAgD;IACxD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACrD,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,0CAA0C,EAAE;IACxE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC7D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,sBAAsB,EAAE;IAC/C,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,oCAAoC,EAAE;IACjE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gCAAgC,EAAE;IACxD;QACE,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,6EAA6E;KAClF;IACD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE;IACxC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE;IACjD,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACnD,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,wBAAwB,EAAE;IAClD,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE;IACjC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,gCAAgC,EAAE;IAC5D,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,qCAAqC,EAAE;CACnE,CAAC;AAEF,wEAAwE;AACxE,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qCAAqC;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,IAAI,MAAM,CAAC,mBAAmB,OAAO,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAAgB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACzC,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iDAAiD;AACjD,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAAgB;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IACE,CAAC,CAAC,MAAM,IAAI,CAAC;YACb,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACpE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,GAAgB,EAChB,KAAkB;IAElB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CACzB,YAAoB,EACpB,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC"}

package/dist/journal-ledger.d.ts

@@ -0,0 +1,13 @@
+export type PostedEntry = {
+    memoryId: string;
+    contentHash: string;
+    postedAt: string;
+    postId?: string;
+};
+/** Stable short content hash, used for dedup of near-identical notes. */
+export declare function hashContent(s: string): string;
+export declare function readLedger(workspaceDir: string): PostedEntry[];
+export declare function appendLedger(workspaceDir: string, entry: PostedEntry): void;
+/** True if the newest post is younger than `minDays` before `now`. */
+export declare function recentlyPosted(ledger: PostedEntry[], minDays: number, now: Date): boolean;
+//# sourceMappingURL=journal-ledger.d.ts.map

package/dist/journal-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal-ledger.d.ts","sourceRoot":"","sources":["../src/journal-ledger.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAKF,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAO9D;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAK3E;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EAAE,EACrB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR,OAAO,CAKT"}

package/dist/journal-ledger.js

@@ -0,0 +1,33 @@
+/** Posted-entry ledger + cadence/dedup for the P12 journal (issue #67). */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname, join } from "node:path";
+const ledgerPath = (workspaceDir) => join(workspaceDir, ".otto", "journal", "posted.json");
+/** Stable short content hash, used for dedup of near-identical notes. */
+export function hashContent(s) {
+    return createHash("sha256").update(s.trim()).digest("hex").slice(0, 16);
+}
+export function readLedger(workspaceDir) {
+    try {
+        const raw = JSON.parse(readFileSync(ledgerPath(workspaceDir), "utf8"));
+        return Array.isArray(raw) ? raw : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function appendLedger(workspaceDir, entry) {
+    const path = ledgerPath(workspaceDir);
+    mkdirSync(dirname(path), { recursive: true });
+    const next = [...readLedger(workspaceDir), entry];
+    writeFileSync(path, JSON.stringify(next, null, 2), "utf8");
+}
+/** True if the newest post is younger than `minDays` before `now`. */
+export function recentlyPosted(ledger, minDays, now) {
+    if (ledger.length === 0 || minDays <= 0)
+        return false;
+    const newest = ledger.reduce((a, b) => (a.postedAt > b.postedAt ? a : b));
+    const ageMs = now.getTime() - new Date(newest.postedAt).getTime();
+    return ageMs < minDays * 24 * 60 * 60 * 1000;
+}
+//# sourceMappingURL=journal-ledger.js.map

package/dist/journal-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal-ledger.js","sourceRoot":"","sources":["../src/journal-ledger.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS1C,MAAM,UAAU,GAAG,CAAC,YAAoB,EAAU,EAAE,CAClD,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAExD,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,KAAkB;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,OAAe,EACf,GAAS;IAET,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAClE,OAAO,KAAK,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,CAAC"}

package/dist/journal-source.d.ts

@@ -0,0 +1,19 @@
+/** Select a journal-worthy memory record + derive its forbidden terms (#67 P12). */
+import type { MemoryRecord } from "./memory.js";
+/**
+ * Pick the best journal candidate: an ACTIVE record in a journal-worthy category
+ * that has not already been posted, ranked by confidence (ties → newer). Returns
+ * null when nothing qualifies.
+ */
+export declare function selectCandidate(records: MemoryRecord[], opts: {
+    categories: string[];
+    postedIds: Set<string>;
+    now: Date;
+}): MemoryRecord | null;
+/**
+ * Identifiers carried by a record that must not survive into a post: its
+ * taskKey, its sourceRun id, and the word-ish parts of its scope globs. Fed into
+ * the gate's `forbiddenTerms` so a leaked source term is denied at Gate 2.
+ */
+export declare function forbiddenTermsFor(record: MemoryRecord): string[];
+//# sourceMappingURL=journal-source.d.ts.map

package/dist/journal-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal-source.d.ts","sourceRoot":"","sources":["../src/journal-source.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,YAAY,EAAE,EACvB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,GAChE,YAAY,GAAG,IAAI,CAerB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAUhE"}

package/dist/journal-source.js

@@ -0,0 +1,38 @@
+import { memoryStatus } from "./memory.js";
+/**
+ * Pick the best journal candidate: an ACTIVE record in a journal-worthy category
+ * that has not already been posted, ranked by confidence (ties → newer). Returns
+ * null when nothing qualifies.
+ */
+export function selectCandidate(records, opts) {
+    const eligible = records.filter((r) => memoryStatus(r, opts.now) === "active" &&
+        r.category != null &&
+        opts.categories.includes(r.category) &&
+        !opts.postedIds.has(r.id));
+    if (eligible.length === 0)
+        return null;
+    eligible.sort((a, b) => b.confidence !== a.confidence
+        ? b.confidence - a.confidence
+        : b.createdAt.localeCompare(a.createdAt));
+    return eligible[0];
+}
+/**
+ * Identifiers carried by a record that must not survive into a post: its
+ * taskKey, its sourceRun id, and the word-ish parts of its scope globs. Fed into
+ * the gate's `forbiddenTerms` so a leaked source term is denied at Gate 2.
+ */
+export function forbiddenTermsFor(record) {
+    const terms = new Set();
+    if (record.taskKey)
+        terms.add(record.taskKey);
+    if (record.sourceRun)
+        terms.add(record.sourceRun);
+    for (const glob of record.scope) {
+        for (const part of glob.split(/[/*.\s]+/)) {
+            if (part.length >= 3)
+                terms.add(part);
+        }
+    }
+    return [...terms];
+}
+//# sourceMappingURL=journal-source.js.map

package/dist/journal-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal-source.js","sourceRoot":"","sources":["../src/journal-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAuB,EACvB,IAAiE;IAEjE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ;QACtC,CAAC,CAAC,QAAQ,IAAI,IAAI;QAClB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5B,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrB,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC3B,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;QAC7B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3C,CAAC;IACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/journal.d.ts

@@ -0,0 +1,46 @@
+import type { AgentRuntimeId } from "./agent-runtime.js";
+export type JournalConfig = {
+    enabled: boolean;
+    autonomous: boolean;
+    categories: string[];
+    minDaysBetweenPosts: number;
+};
+export type JournalDeps = {
+    /** Rewrite a learning as a generic field note (or "SKIP"). */
+    generate: (learning: string) => Promise<string>;
+    /** Adversarial judge: true = SAFE to post. */
+    judge: (note: string) => Promise<boolean>;
+    /** Publish to Threads; absent ⇒ draft-only (default mode). */
+    publish?: (text: string) => Promise<{
+        id: string;
+    }>;
+    repoIdentifiers: string[];
+    secretPatterns: string[];
+    now: () => Date;
+};
+export type JournalAction = "disabled" | "no-candidate" | "skipped-cadence" | "denied" | "drafted" | "posted";
+export type JournalOutcome = {
+    action: JournalAction;
+    reason?: string;
+};
+/**
+ * The pure-ish orchestrator. Drafts by default; posts only when `autonomous`
+ * and a `publish` dep are both present AND every gate passes. Default-deny and
+ * never-throw are the invariants.
+ */
+export declare function runJournal(workspaceDir: string, config: JournalConfig, deps: JournalDeps): Promise<JournalOutcome>;
+/**
+ * Harness run-end hook (issue #67 P12): read the per-repo journal config (no-op
+ * when absent/disabled), build the real generate/judge/publish deps from the
+ * agent runtime + Threads client, and run the journal. Never throws — the
+ * journal must never affect a run's outcome.
+ */
+export declare function maybeJournal(args: {
+    workspaceDir: string;
+    packageDir: string;
+    iteration: number;
+    maxRetries: number;
+    agentId: AgentRuntimeId;
+    signal?: AbortSignal;
+}): Promise<JournalOutcome>;
+//# sourceMappingURL=journal.d.ts.map

package/dist/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,8CAA8C;IAC9C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,cAAc,GACd,iBAAiB,GACjB,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AACb,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,cAAc,CAAC,CA0EzB;AA2BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CA8C1B"}

package/dist/journal.js

@@ -0,0 +1,158 @@
+/**
+ * P12 journal orchestrator (issue #67): select a memory learning → generate a
+ * field note → run the default-deny secrecy gate → draft (default) or post
+ * (autonomous). All model/network I/O is injected; never throws.
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { appendAudit, screenEntry } from "./journal-gate.js";
+import { forbiddenTermsFor, selectCandidate } from "./journal-source.js";
+import { appendLedger, hashContent, readLedger, recentlyPosted, } from "./journal-ledger.js";
+import { readMemoryRecords } from "./memory.js";
+import { git } from "./git.js";
+import { readJournalConfig } from "./journal-config.js";
+import { readSafetyPolicy } from "./safety-policy.js";
+import { executeStage } from "./stage-exec.js";
+import { STAGES } from "./stages.js";
+import { createThreadsClient, resolveThreadsAuth } from "./threads-api.js";
+/**
+ * The pure-ish orchestrator. Drafts by default; posts only when `autonomous`
+ * and a `publish` dep are both present AND every gate passes. Default-deny and
+ * never-throw are the invariants.
+ */
+export async function runJournal(workspaceDir, config, deps) {
+    try {
+        if (!config.enabled)
+            return { action: "disabled" };
+        const now = deps.now();
+        const ledger = readLedger(workspaceDir);
+        if (recentlyPosted(ledger, config.minDaysBetweenPosts, now)) {
+            return { action: "skipped-cadence" };
+        }
+        const postedIds = new Set(ledger.map((e) => e.memoryId));
+        const candidate = selectCandidate(readMemoryRecords(workspaceDir), {
+            categories: config.categories,
+            postedIds,
+            now,
+        });
+        if (!candidate)
+            return { action: "no-candidate" };
+        const note = (await deps.generate(candidate.content)).trim();
+        const ctx = {
+            repoIdentifiers: deps.repoIdentifiers,
+            secretPatterns: deps.secretPatterns,
+            forbiddenTerms: forbiddenTermsFor(candidate),
+        };
+        const verdict = note === "SKIP" || note === ""
+            ? { ok: false, gate: 1, reason: "deny:generation-skip" }
+            : await screenEntry(note, ctx, deps.judge);
+        if (!verdict.ok) {
+            appendAudit(workspaceDir, {
+                at: now.toISOString(),
+                memoryId: candidate.id,
+                decision: "denied",
+                gate: verdict.gate,
+                reason: verdict.reason,
+            });
+            return { action: "denied", reason: verdict.reason };
+        }
+        // Passed every gate. Default mode drafts; autonomous posts.
+        if (!config.autonomous || !deps.publish) {
+            const dir = join(workspaceDir, ".otto", "journal", "drafts");
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(join(dir, `${candidate.id}.md`), note + "\n", "utf8");
+            appendAudit(workspaceDir, {
+                at: now.toISOString(),
+                memoryId: candidate.id,
+                decision: "drafted",
+            });
+            return { action: "drafted" };
+        }
+        const { id } = await deps.publish(note);
+        appendLedger(workspaceDir, {
+            memoryId: candidate.id,
+            contentHash: hashContent(note),
+            postedAt: now.toISOString(),
+            postId: id,
+        });
+        appendAudit(workspaceDir, {
+            at: now.toISOString(),
+            memoryId: candidate.id,
+            decision: "posted",
+            postId: id,
+        });
+        return { action: "posted" };
+    }
+    catch (err) {
+        appendAudit(workspaceDir, {
+            decision: "error",
+            reason: err.message,
+        });
+        return { action: "denied", reason: "error" };
+    }
+}
+/** Collect this repo's own identifiers so the gate can deny self-references. */
+function repoIdentifiers(workspaceDir) {
+    const ids = new Set([basename(workspaceDir)]);
+    const remote = git(["remote", "get-url", "origin"], workspaceDir);
+    if (remote) {
+        for (const part of remote.split(/[/:@.]/)) {
+            const p = part.trim();
+            if (p.length >= 3 &&
+                !["https", "http", "git", "com", "org", "www", "ssh"].includes(p.toLowerCase())) {
+                ids.add(p);
+            }
+        }
+    }
+    return [...ids];
+}
+/** The judge stage must emit exactly <journal-verdict>SAFE</journal-verdict>. */
+function parseVerdict(result) {
+    return /<journal-verdict>\s*SAFE\s*<\/journal-verdict>/i.test(result);
+}
+/**
+ * Harness run-end hook (issue #67 P12): read the per-repo journal config (no-op
+ * when absent/disabled), build the real generate/judge/publish deps from the
+ * agent runtime + Threads client, and run the journal. Never throws — the
+ * journal must never affect a run's outcome.
+ */
+export async function maybeJournal(args) {
+    try {
+        const config = readJournalConfig(args.workspaceDir);
+        if (!config)
+            return { action: "disabled" };
+        const stageArgs = {
+            workspaceDir: args.workspaceDir,
+            packageDir: args.packageDir,
+            iteration: args.iteration,
+            maxRetries: args.maxRetries,
+            agentId: args.agentId,
+            signal: args.signal,
+        };
+        // Resolve a Threads client only for an autonomous, credentialed run.
+        const auth = config.autonomous ? resolveThreadsAuth() : null;
+        const client = auth ? createThreadsClient(auth) : undefined;
+        return await runJournal(args.workspaceDir, config, {
+            generate: async (learning) => (await executeStage({
+                ...stageArgs,
+                stage: STAGES.journalWrite,
+                vars: { INPUTS: learning, RESUME: "" },
+                logLabel: "journal-write",
+            })).result,
+            judge: async (note) => parseVerdict((await executeStage({
+                ...stageArgs,
+                stage: STAGES.journalScreen,
+                vars: { INPUTS: note, RESUME: "" },
+                logLabel: "journal-screen",
+            })).result),
+            publish: client ? (text) => client.publish(text) : undefined,
+            repoIdentifiers: repoIdentifiers(args.workspaceDir),
+            secretPatterns: readSafetyPolicy(args.workspaceDir).secretPatterns,
+            now: () => new Date(),
+        });
+    }
+    catch {
+        return { action: "denied", reason: "hook-error" };
+    }
+}
+//# sourceMappingURL=journal.js.map

package/dist/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../src/journal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA8B3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,YAAoB,EACpB,MAAqB,EACrB,IAAiB;IAEjB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE;YACjE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS;YACT,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAElD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAgB;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,iBAAiB,CAAC,SAAS,CAAC;SAC7C,CAAC;QACF,MAAM,OAAO,GACX,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;YAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,CAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAC1E,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,WAAW,CAAC,YAAY,EAAE;gBACxB,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;gBACrB,QAAQ,EAAE,SAAS,CAAC,EAAE;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YACpE,WAAW,CAAC,YAAY,EAAE;gBACxB,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;gBACrB,QAAQ,EAAE,SAAS,CAAC,EAAE;gBACtB,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,YAAY,CAAC,YAAY,EAAE;YACzB,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC;YAC9B,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;YAC3B,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,WAAW,CAAC,YAAY,EAAE;YACxB,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;YACrB,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,YAAY,EAAE;YACxB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAG,GAAa,CAAC,OAAO;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,YAAoB;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IACE,CAAC,CAAC,MAAM,IAAI,CAAC;gBACb,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAC5D,CAAC,CAAC,WAAW,EAAE,CAChB,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,iDAAiD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAOlC;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAE3C,MAAM,SAAS,GAAG;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5D,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE;YACjD,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3B,CACE,MAAM,YAAY,CAAC;gBACjB,GAAG,SAAS;gBACZ,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;gBACtC,QAAQ,EAAE,eAAe;aAC1B,CAAC,CACH,CAAC,MAAM;YACV,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACpB,YAAY,CACV,CACE,MAAM,YAAY,CAAC;gBACjB,GAAG,SAAS;gBACZ,KAAK,EAAE,MAAM,CAAC,aAAa;gBAC3B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;gBAClC,QAAQ,EAAE,gBAAgB;aAC3B,CAAC,CACH,CAAC,MAAM,CACT;YACH,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5D,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;YACnD,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,cAAc;YAClE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/loop.d.ts

@@ -1,4 +1,5 @@
 import { type AgentRuntimeId } from "./agent-runtime.js";
+import { type TierLadder } from "./model-tier.js";
 import type { Stage } from "./stages.js";
 import { type TokenMode, type TokenUsage } from "./tokens.js";
 import { nextActionFor } from "./next-action.js";
@@ -40,6 +41,18 @@ export type LoopOptions = {
     /** Injectable resolver for an iteration's changed paths (default: git diff since
      *  the iteration-start HEAD). Used only when `adaptiveRouter` is on. */
     resolveChangedPaths?: (workspaceDir: string) => string[];
+    /** Opt-in per-stage model routing (issue #66 P11): route each stage to a model
+     *  tier by difficulty + change risk, escalating on repeated failure. A pinned
+     *  model overrides it. When off, every stage uses the runtime default model. */
+    modelRouting?: boolean;
+    /** tier → model ladder consulted when `modelRouting` resolves a tier. */
+    tierLadder?: TierLadder;
+    /** Opt-in sub-agent fan-out (issue #66 P11): on the first iteration, run the
+     *  independent tasks of a `.otto/tasks/<key>/tasks.json` as isolated worktree
+     *  sub-agents before the sequential loop. No valid tasks.json → no-op. */
+    fanOut?: boolean;
+    /** Max concurrent sub-agents per fan-out wave (default 3). */
+    fanOutConcurrency?: number;
     /** Injected AbortSignal for daemon callers (e.g. watch mode). When provided,
      *  runLoop skips wake-lock acquisition and process signal handler installation;
      *  the caller owns both. */

package/dist/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../src/loop.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AA4C9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,CAAC;AAoBzB,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0B3D;AAYD,MAAM,MAAM,WAAW,GAAG;IAGxB,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mHAAmH;IACnH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;0FACsF;IACtF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;6EAEyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACzD;;gCAE4B;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;wCACoC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,iHAAiH;IACjH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;wEACoE;IACpE,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,gFAAgF;IAChF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;uFACmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;yDAEqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC;AAqFF,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA6tBrE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../src/loop.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAa9E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAuCrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,CAAC;AAoBzB,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA0B3D;AAYD,MAAM,MAAM,WAAW,GAAG;IAGxB,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mHAAmH;IACnH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;0FACsF;IACtF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;6EAEyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;4EACwE;IACxE,mBAAmB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACzD;;oFAEgF;IAChF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;8EAE0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;gCAE4B;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;wCACoC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,iHAAiH;IACjH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;wEACoE;IACpE,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,gFAAgF;IAChF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;uFACmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;yDAEqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC;AAqFF,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA6zBrE"}