@quantiya/codevibe-core 2.0.6 → 2.0.8

package/dist/orchestration-shell/emit-shell-event.d.ts

@@ -1,10 +1,12 @@
 import { AppSyncClient } from '../appsync';
+import { type Session } from '../types';
+import type { E1ProducerKind } from '../e1';
 /**
  * §3 LOCK lines 173-181. Names + per-type metadata shapes are part of
  * the Stage A contract. CP-1.a ships the union; CP-1.b/c/d add call
  * sites for each emit type.
  */
-export type NewEventTypeKind = 'MODE_SELECTED' | 'PLANNER_DECISION' | 'PLANNER_CACHE_HIT' | 'PLANNER_DEGRADED' | 'PLANNER_OUTAGE' | 'PLANNER_RECOVERED' | 'SLASH_COMMAND_INVOKED' | 'STRUCTURAL_SUMMARY_GENERATED' | 'LOCAL_AUTHORITY_REFUSAL' | 'NOTIFICATION' | 'ASSISTANT_RESPONSE' | 'USER_PROMPT';
+export type NewEventTypeKind = 'MODE_SELECTED' | 'PLANNER_DECISION' | 'PLANNER_CACHE_HIT' | 'PLANNER_DEGRADED' | 'PLANNER_OUTAGE' | 'PLANNER_RECOVERED' | 'SLASH_COMMAND_INVOKED' | 'STRUCTURAL_SUMMARY_GENERATED' | 'LOCAL_AUTHORITY_REFUSAL' | 'NOTIFICATION' | 'TEAM_DECOMPOSED' | 'TEAM_TRACK_STATUS' | 'TEAM_GROUP_RESOLVED' | 'ASSISTANT_RESPONSE' | 'USER_PROMPT' | 'INTERACTIVE_PROMPT';
 /**
  * §3 LOCK lines 160-170. ShellEventEmit contract.
  *
@@ -29,6 +31,16 @@ export interface ShellEventEmit {
     isEncrypted: true;
     /** RFC3339; if omitted, server fills in via existing VTL. */
     timestamp?: string;
+    /** Pre-minted nonce when encrypted metadata must bind the response nonce. */
+    writerEventNonce?: string;
+    /** Proven local key mismatch: emit the safe legacy joined fallback. */
+    disableWriterAttestation?: boolean;
+    ownerToken?: string;
+    promptId?: string;
+    producerKind?: E1ProducerKind;
+    mobileActionable?: boolean;
+    resolvedPromptId?: string;
+    resolutionAt?: string;
 }
 /**
  * Test seam — allows the unit tests to swap the AppSync client without
@@ -38,27 +50,43 @@ export interface ShellEventEmit {
 export interface EmitShellEventDeps {
     appsyncClient: Pick<AppSyncClient, 'createEvent'>;
     getSessionKey: (sessionId: string) => Promise<string | null>;
-    getCohortFlag: (name: string, sessionId: string) => Promise<boolean>;
+    session?: Session;
 }
+export type ShellEventEmitResult = {
+    emitted: true;
+    eventId: string;
+    sessionId: string;
+    type: NewEventTypeKind;
+    source: 'DESKTOP';
+    writer?: {
+        authenticated: true;
+        eventNonce: string;
+        contentCiphertextSha256: string;
+        metadataCiphertextSha256: string;
+    };
+} | {
+    emitted: false;
+    reason: 'missing_session_key' | 'auth_required' | 'auth_unavailable' | 'create_failed' | 'definitive_rejection' | 'invalid_response' | 'writer_ineligible';
+    error?: unknown;
+};
 /**
- * §3 LOCK lines 184-207. Single chokepoint enforcing the cohort-flag
- * gate + encryption invariants for all 9 new EventTypes.
+ * §3 LOCK lines 184-207. Single chokepoint enforcing the encryption
+ * invariants for all 9 new EventTypes.
  *
- * When the cohort flag is off: log at debug and return without
- * touching AppSync. When on: encrypt content + metadata under the
- * session key, call `createEvent` via Pattern B Lambda resolver
- * (existing surface, no schema change).
+ * Encrypts content + metadata under the session key, then calls
+ * `createEvent` via Pattern B Lambda resolver (existing surface, no
+ * schema change). Emits unconditionally (the cohort gate was removed).
  *
  * `deps` is the test seam. Production callers omit it and the function
  * resolves the default `keychainManager` + `cryptoService` references.
  * The AppSync client is REQUIRED — there is no global default in
  * codevibe-core (each plugin instantiates its own `AppSyncClient`).
  */
-export declare function emitShellEvent(args: ShellEventEmit, deps: EmitShellEventDeps): Promise<void>;
+export declare function emitShellEvent(args: ShellEventEmit, deps: EmitShellEventDeps): Promise<ShellEventEmitResult>;
 /**
  * Convenience helper for production callers — binds default
- * dependencies (`keychainManager` for session-key lookup,
- * `getCohortFlag` for the flag read) and accepts the AppSync client
- * separately because there's no global default in `codevibe-core`.
+ * dependencies (`keychainManager` for session-key lookup) and accepts
+ * the AppSync client separately because there's no global default in
+ * `codevibe-core`.
  */
-export declare function createShellEventEmitter(appsyncClient: Pick<AppSyncClient, 'createEvent'>): (args: ShellEventEmit) => Promise<void>;
+export declare function createShellEventEmitter(appsyncClient: Pick<AppSyncClient, 'createEvent'>, session?: Session): (args: ShellEventEmit) => Promise<ShellEventEmitResult>;

package/dist/orchestration-shell/explicit-tty-exit.d.ts

@@ -0,0 +1,17 @@
+export interface ExplicitTtyExitDeps {
+    runTeardown: () => Promise<void>;
+    unmount: () => void;
+}
+export interface ExplicitTtyExitCoordinator {
+    completion: Promise<void>;
+    start: () => void;
+}
+/**
+ * Owns the explicit `/exit` and `/quit` boundary for the Ink shell.
+ *
+ * Ink's `waitUntilExit()` normally resolves after `unmount()`, but terminal
+ * stream teardown can leave that promise pending. The explicit completion
+ * promise lets the shell continue into its catch-all cleanup after the durable
+ * session retirement has finished, independent of Ink's internal exit promise.
+ */
+export declare function createExplicitTtyExitCoordinator(deps: ExplicitTtyExitDeps): ExplicitTtyExitCoordinator;

package/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -152,6 +152,11 @@ export interface GroupDecisionSubmitDeps {
      * after an accept-family COMMIT. ABSENT → no-op (tests).
      */
     markAccepted?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Accept-family finalizer: retire PREPARED/APPLIED authority by exact base or
+     * post-image proof before marking accepted or clearing reviewed bundles.
+     */
+    finalizeAcceptedGroup: (taskGroupId: string) => Promise<void>;
     /**
      * HIGH-1 / LOCK #589-J — persist the CLAIMED-but-not-COMMITted decision to the
      * durable record, called IMMEDIATELY after the CLAIM phase mints `claimToken`
@@ -170,6 +175,12 @@ export interface GroupDecisionSubmitDeps {
      * (so a later reconcile never re-drives it). ABSENT → no-op (tests).
      */
     clearPendingDecision?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Reclaim terminal durable group bytes after COMMIT, convergence, lifecycle
+     * transition, reissue (when requested), and pending-decision removal. The
+     * durable store rechecks every crash-authority predicate before deleting.
+     */
+    gcTerminalGroup?: (taskGroupId: string) => Promise<void>;
     /**
      * Drive the per-track render flip through the SAME `emitGroupConvergence`
      * chokepoint (D2): accept-family → tracks stay/flip `Passed`; reject-family →

package/dist/orchestration-shell/gate-prompts.d.ts

@@ -71,8 +71,8 @@ export interface GatePromptOption {
     readonly description: string;
     /**
      * PHASE-CP-10-MIN (#585) — the per-option target agent for the
-     * `continuation_offer_handoff` prompt (CLAUDE/CODEX/GEMINI/ANTIGRAVITY).
-     * On the wire the 3-4 agent options all carry `id: "CONTINUE_WITH"` (a valid
+     * `continuation_offer_handoff` prompt (CLAUDE/CODEX/ANTIGRAVITY).
+     * On the wire the 3 agent options all carry `id: "CONTINUE_WITH"` (a valid
      * `UserDecisionKind`); the agent rides this NEW per-option `targetAgent`
      * field (Rust `OptionPayload.target_agent` with
      * `#[serde(rename="targetAgent", skip_serializing_if="Option::is_none")]`,
@@ -114,7 +114,7 @@ export interface GatePromptEnvelope {
     readonly verdictDetails?: GateVerdictDetails;
     /** The continuation offer's desktop-minted ULID (`metadata.offerId`). */
     readonly offerId?: string;
-    /** The agent that halted (closed enum CLAUDE/CODEX/GEMINI/ANTIGRAVITY; `metadata.sourceAgent`). */
+    /** The agent that halted (closed enum CLAUDE/CODEX/ANTIGRAVITY; `metadata.sourceAgent`). */
     readonly sourceAgent?: string;
     /** The authoritative 64-hex SHA-256 packet hash (`metadata.packetHash`). */
     readonly packetHash?: string;
@@ -429,12 +429,51 @@ export interface ReviewSummaryRoundModel {
     /** Aggregated REVISE seat findings (the auto-revision driver), or null. */
     readonly reviseNotes: string | null;
 }
+export interface ReviewSummaryTerminalModel {
+    readonly schemaVersion: number;
+    readonly requirements: {
+        readonly problem: string;
+        readonly expectedOutputs: ReadonlyArray<string>;
+    };
+    readonly implementors: ReadonlyArray<{
+        readonly agent: string;
+        readonly trackIndex: number | null;
+        readonly taskId: string;
+    }>;
+    readonly reviewQuorum: {
+        readonly seats: ReadonlyArray<{
+            readonly seatId: number;
+            readonly role: string;
+            readonly agent: string;
+        }>;
+        readonly roundCount: number;
+        readonly revisionCount: number;
+    };
+    readonly mergeGate: {
+        readonly applicable: boolean;
+        readonly outcome: string;
+        readonly resolution: string | null;
+    };
+    readonly durations: {
+        readonly taskElapsedMs: number | null;
+        readonly reviewerElapsedMs: number | null;
+        readonly availability: string;
+    };
+    readonly tokenUsage: {
+        readonly knownTotal: number | null;
+        readonly availability: string;
+        readonly unavailableRoles: ReadonlyArray<string>;
+    };
+    readonly residualRisks: ReadonlyArray<string>;
+}
 /**
  * The fully-extracted, render-ready per-round review summary model. PURE
  * function of the decrypted summary. `null`-attached (entry has no
  * `reviewSummary`) → the panel renders nothing extra (fail-open base prompt).
  */
 export interface ReviewSummaryPanelModel {
+    /** Additive P15 schema-v2 terminal header; null for legacy schema v1. */
+    readonly terminal: ReviewSummaryTerminalModel | null;
     readonly rounds: ReadonlyArray<ReviewSummaryRoundModel>;
     /** finalOutcome display value (proceed | auto_revise | escalate). */
     readonly finalOutcome: string;
@@ -448,6 +487,41 @@ export interface ReviewSummaryPanelModel {
  * object degrades to an empty/safe model, never throws.
  */
 export interface DecryptedReviewSummaryInput {
+    readonly schemaVersion?: number;
+    readonly requirements?: {
+        readonly problem?: string;
+        readonly expectedOutputs?: ReadonlyArray<string>;
+    };
+    readonly implementors?: ReadonlyArray<{
+        readonly agent?: string;
+        readonly trackIndex?: number;
+        readonly taskId?: string;
+    }>;
+    readonly reviewQuorum?: {
+        readonly seats?: ReadonlyArray<{
+            readonly seatId?: number;
+            readonly role?: string;
+            readonly agent?: string;
+        }>;
+        readonly roundCount?: number;
+        readonly revisionCount?: number;
+    };
+    readonly mergeGate?: {
+        readonly applicable?: boolean;
+        readonly outcome?: string;
+        readonly resolution?: string;
+    };
+    readonly durations?: {
+        readonly taskElapsedMs?: number;
+        readonly reviewerElapsedMs?: number;
+        readonly availability?: string;
+    };
+    readonly tokenUsage?: {
+        readonly knownTotal?: number;
+        readonly availability?: string;
+        readonly unavailableRoles?: ReadonlyArray<string>;
+    };
+    readonly residualRisks?: ReadonlyArray<string>;
     readonly rounds?: ReadonlyArray<{
         readonly round?: number;
         readonly proposal?: string;
@@ -458,6 +532,7 @@ export interface DecryptedReviewSummaryInput {
             readonly decision?: string;
             readonly reasoning?: string;
             readonly suggestedChanges?: ReadonlyArray<string>;
+            readonly residualObservations?: ReadonlyArray<string>;
         }>;
         readonly outcome?: string;
         readonly reviseNotes?: string;