@quolu/lattice 0.12.20 → 0.12.22

package/README.md

@@ -95,6 +95,12 @@ LANや外部reverse proxyから閲覧するoptional bridgeは既定で無効で
 凡例の件数バッジを押すと全工程を描いた図へ切り替わり、`lattice todo gantt --scope all`は最初から全件を
 描きます。表示規約は[ADR 0066](docs/adr/0066-gantt-live-scope-drops-finished-work.md)が正です。
 
+右ペインは概要・選択工程・全工程の3面で、いずれもToDo storeを表示します（元plan Markdown本文は
+再表示しません。元文書へは各工程の詳細が持つ行対応から辿ります）。全工程一覧は動いているplanを
+最終活動の新しい順で上に、全工程が図から外れた完走planを古い順で下にまとめ、plan内は登録順です。
+決着済みPhaseと図から外した工程は既定で畳み、開けば読めます。規約は
+[ADR 0067](docs/adr/0067-right-pane-shows-the-store-and-orders-by-activity.md)が正です。
+
 静的工程表は`lattice todo gantt status`で`current / stale / missing`を確認でき、HTMLまたは
 digest付きsidecarの欠落・改ざんはtyped failureになります。
 dashboard daemonは起動時に読み込んだ版数をhealthで名乗り、installされた版と食い違えば`lattice status`の

package/docs/schemas/lattice.executor_packet.v1.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.executor_packet.v1.schema.json",
+  "title": "lattice.executor_packet.v1",
+  "description": "The single context packet issued at dispatch. It is the machine record of the context an executor received.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes, the self-digest rule for `packet_digest`, and that `context_content_digest` equals the SHA-256 of the canonical JSON projection of exactly {todo_id, task_ref, scope, base_sha, verifier_refs, forbidden_operations} — plan attribution fields are excluded so that an epoch rebind is provably content-preserving.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "packet_id",
+    "todo_id",
+    "task_ref",
+    "scope",
+    "base_sha",
+    "plan_ref",
+    "plan_epoch",
+    "verifier_refs",
+    "forbidden_operations",
+    "context_content_digest",
+    "packet_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.executor_packet.v1" },
+    "packet_id": { "$ref": "#/$defs/identifier" },
+    "todo_id": {
+      "$ref": "#/$defs/identifier",
+      "$comment": "Carried through from `run_request.v1`. It is not qualified by any TODO store project/plan/revision identity."
+    },
+    "task_ref": { "$ref": "#/$defs/identifier" },
+    "scope": { "type": "object" },
+    "base_sha": { "$ref": "#/$defs/gitSha" },
+    "plan_ref": { "$ref": "#/$defs/identifier" },
+    "plan_epoch": { "type": "integer", "minimum": 0 },
+    "verifier_refs": {
+      "type": "array",
+      "maxItems": 256,
+      "items": { "type": "string" }
+    },
+    "forbidden_operations": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": { "type": "string" }
+    },
+    "context_content_digest": { "$ref": "#/$defs/digest" },
+    "packet_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }
+  }
+}

package/docs/schemas/lattice.executor_receipt.v1.schema.json

@@ -0,0 +1,66 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.executor_receipt.v1.schema.json",
+  "title": "lattice.executor_receipt.v1",
+  "description": "The receipt an executor returns for one dispatched packet. `packet_digest` is what attributes it to the packet it received.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes and the self-digest rule for `receipt_digest`. Acceptance is decided by event order, not by the receipt's own claims: the binding is checked against the `executor_dispatched` / `epoch_rebound` event that recorded the handle, worktree and packet digest for that TODO.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "receipt_id",
+    "executor_handle",
+    "worktree_id",
+    "base_sha",
+    "plan_epoch",
+    "packet_digest",
+    "todo_id",
+    "checkpoint_digest",
+    "observed_diff",
+    "receipt_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.executor_receipt.v1" },
+    "receipt_id": { "$ref": "#/$defs/identifier" },
+    "executor_handle": { "$ref": "#/$defs/identifier" },
+    "worktree_id": { "$ref": "#/$defs/identifier" },
+    "base_sha": { "$ref": "#/$defs/gitSha" },
+    "plan_epoch": { "type": "integer", "minimum": 0 },
+    "packet_digest": {
+      "$ref": "#/$defs/digest",
+      "$comment": "Attribution to the received `executor_packet.v1`. This is the only link back to the dispatch."
+    },
+    "todo_id": {
+      "$ref": "#/$defs/identifier",
+      "$comment": "Carried through from `run_request.v1`. It is not qualified by any TODO store project/plan/revision identity, so a receipt alone does not prove which TODO store task it belongs to."
+    },
+    "checkpoint_digest": { "$ref": "#/$defs/digest" },
+    "observed_diff": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "change"],
+        "properties": {
+          "path": { "$ref": "#/$defs/repoRelativePath" },
+          "change": { "enum": ["added", "modified", "deleted"] }
+        }
+      }
+    },
+    "receipt_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "repoRelativePath": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+$"
+    }
+  }
+}

package/docs/schemas/lattice.run_request.v1.schema.json

@@ -0,0 +1,238 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.run_request.v1.schema.json",
+  "title": "lattice.run_request.v1",
+  "description": "Canonical run request accepted by `lattice plan compile --request` and `lattice run start --request`.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes and the self-digest rule: `request_digest` is the SHA-256 of the canonical JSON of the request with `request_digest` removed. Rejections are reported as `lattice.cli_error.v2` with `detail.reason` and `detail.path`.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "request_id",
+    "repo",
+    "capacity",
+    "todos",
+    "manual_witness",
+    "sensor_query_set",
+    "executor_capability",
+    "claim_mode",
+    "request_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.run_request.v1" },
+    "request_id": { "$ref": "#/$defs/identifier" },
+    "repo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["base_sha", "root_kind"],
+      "properties": {
+        "base_sha": { "$ref": "#/$defs/gitSha" },
+        "root_kind": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "capacity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executors"],
+      "properties": { "executors": { "type": "integer", "minimum": 1 } }
+    },
+    "todos": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["todo_id"],
+        "properties": { "todo_id": { "$ref": "#/$defs/identifier" } }
+      },
+      "$comment": "`todo_id` is chosen by the host. It is not qualified by any TODO store project/plan/revision identity."
+    },
+    "manual_witness": {
+      "type": "object",
+      "description": "Keys must be exactly the `todo_id` values listed in `todos`.",
+      "additionalProperties": { "$ref": "#/$defs/manualWitness" }
+    },
+    "sensor_query_set": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["queries"],
+      "properties": {
+        "queries": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/sensorQuery" }
+        }
+      }
+    },
+    "executor_capability": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["adapters"],
+      "properties": {
+        "adapters": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/identifier" }
+        }
+      }
+    },
+    "claim_mode": { "const": "exact_minimum" },
+    "request_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "repoRelativePath": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Repo-relative path. Absolute paths, `..` traversal, empty segments, control characters and `\\` separators are rejected.",
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+$"
+    },
+    "repoRelativePathOrPrefix": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Same as `repoRelativePath` but a trailing `/` is allowed to declare a directory write prefix.",
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+/?$"
+    },
+    "sensorQuery": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "operation"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "operation": {
+          "enum": ["status", "query", "callers", "callees", "impact", "affected"]
+        },
+        "target": { "type": "string", "minLength": 1 }
+      },
+      "$comment": "`id` must be unique across the query set."
+    },
+    "sensorExpect": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "name", "path"],
+          "properties": {
+            "kind": { "const": "symbol" },
+            "name": { "type": "string", "minLength": 1 },
+            "path": { "$ref": "#/$defs/repoRelativePath" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "path"],
+          "properties": {
+            "kind": { "enum": ["path", "affected"] },
+            "path": { "$ref": "#/$defs/repoRelativePath" }
+          }
+        }
+      ]
+    },
+    "manualWitness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "owns",
+        "reads",
+        "writes",
+        "resources",
+        "state_effects",
+        "sensor_provenance",
+        "affected_tests",
+        "unknowns"
+      ],
+      "properties": {
+        "owns": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "target"],
+            "properties": {
+              "kind": { "enum": ["symbol", "path"] },
+              "target": { "type": "string", "minLength": 1, "maxLength": 1024 }
+            }
+          }
+        },
+        "reads": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePath" }
+        },
+        "writes": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePathOrPrefix" }
+        },
+        "resources": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/identifier" }
+        },
+        "state_effects": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["resource_id", "kind"],
+            "properties": {
+              "resource_id": { "$ref": "#/$defs/identifier" },
+              "kind": {
+                "enum": ["state", "schema", "invariant", "effect", "external_effect"]
+              }
+            }
+          }
+        },
+        "sensor_provenance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["queries"],
+          "properties": {
+            "queries": {
+              "type": "array",
+              "maxItems": 256,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["query_id", "expect"],
+                "properties": {
+                  "query_id": { "$ref": "#/$defs/identifier" },
+                  "expect": { "$ref": "#/$defs/sensorExpect" }
+                }
+              }
+            }
+          }
+        },
+        "affected_tests": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePath" }
+        },
+        "unknowns": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "ref"],
+            "properties": {
+              "kind": { "$ref": "#/$defs/identifier" },
+              "ref": { "type": "string", "minLength": 1 }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.12.20",
+  "version": "0.12.22",
   "description": "Lattice — phase-aware TODO graph compiler and conflict-aware orchestration runtime",
   "type": "module",
   "license": "MIT",
@@ -21,6 +21,9 @@
     "docs/schemas/lattice.plan_create_input.v1.schema.json",
     "docs/schemas/lattice.plan_create_input.v2.schema.json",
     "docs/schemas/lattice.plan_create_input.v3.schema.json",
+    "docs/schemas/lattice.run_request.v1.schema.json",
+    "docs/schemas/lattice.executor_packet.v1.schema.json",
+    "docs/schemas/lattice.executor_receipt.v1.schema.json",
     "docs/bridge-setup.md",
     "sensor/dist",
     "!sensor/dist/bin/lattice-sensor.*",

package/src/cli-help.mjs

@@ -24,12 +24,14 @@ Commands:
   create --schema --json
   create --schema-version <2|3> --json
   compile --request <request.json>
+  compile --schema --json            # lattice.run_request.v1 の JSON Schema を出す
   verify --request <request.json> --plan <plan.json>
 `,
   run: `Usage: lattice run <command> [options]
 
 Commands:
   start --request <request.json> --executor <adapter>
+  start --schema --json              # lattice.run_request.v1 の JSON Schema を出す
   observe --run .lattice/runs/<id>
   status --run .lattice/runs/<id>
   resume --run .lattice/runs/<id>
@@ -43,6 +45,7 @@ Commands:
 
 Read commands:
   status [--json]
+  bindings [--plan <key>] [--json]   # compile_binding付きTaskをTODO identityつきで投影する
   verify [--plan <key>] [--json]
   snapshot --rebuild --plan <key>
   gantt [--out <file>] [--scope live|all]  # 既定live: 完走した工程を図から除く（一覧には残る）
@@ -97,9 +100,9 @@ registerはLATTICE_BRIDGE_REGISTRAR_SSH_HOSTとLATTICE_BRIDGE_REGISTRAR_SCRIPT
 
 const SUBCOMMAND_USAGE = Object.freeze({
   'plan create': 'plan create --input <file> | --schema --json | --schema-version <2|3> --json',
-  'plan compile': 'plan compile --request <request.json>',
+  'plan compile': 'plan compile --request <request.json> | --schema --json',
   'plan verify': 'plan verify --request <request.json> --plan <plan.json>',
-  'run start': 'run start --request <request.json> --executor <adapter>',
+  'run start': 'run start --request <request.json> --executor <adapter> | --schema --json',
   'run observe': 'run observe --run .lattice/runs/<id>',
   'run status': 'run status --run .lattice/runs/<id>',
   'run resume': 'run resume --run .lattice/runs/<id>',
@@ -108,6 +111,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'run list': 'run list --json',
   'event verify': 'event verify --run .lattice/runs/<id>',
   'todo status': 'todo status [--json]',
+  'todo bindings': 'todo bindings [--plan <key>] [--json]',
   'todo verify': 'todo verify [--plan <key>] [--json]',
   'todo snapshot': 'todo snapshot --rebuild --plan <key>',
   'todo gantt': 'todo gantt [--out <file>] [--scope live|all] | status [--out <file>] | serve --port <port> [--scope live|all]',

package/src/runtime-cli.mjs

@@ -24,6 +24,7 @@ import {
   evidenceFromCollectedOutcomes,
 } from './runtime-front-end.mjs';
 import {
+  explainRunRequest,
   validateRunRequest,
   validateRuntimeBoundaryManifest,
   validateRuntimePlan,
@@ -247,10 +248,31 @@ function canonicalNow() {
   return new Date().toISOString();
 }
 
+/**
+ * 同梱の`lattice.run_request.v1` JSON Schemaをstdoutへ出す（ADR 0123）。
+ * hostがrequestを推測で組まずに済むよう、契約を配布物から直接取れるようにする。
+ */
+async function runRequestSchema({ stdout }) {
+  const schemaUrl = new URL('../docs/schemas/lattice.run_request.v1.schema.json', import.meta.url);
+  const schema = JSON.parse(await readFile(schemaUrl, 'utf8'));
+  if (schema?.title !== 'lattice.run_request.v1') {
+    throw new CliContractError('CONTRACT_VIOLATION', '同梱run_request schemaが不正');
+  }
+  stdout.write(`${JSON.stringify(schema)}\n`);
+  return 0;
+}
+
 async function loadRequest(requestPath) {
   const request = await readBoundedJson(requestPath, 'run request');
-  if (!validateRunRequest(request)) {
-    throw new CliContractError('INVALID_RUN_REQUEST', 'run_request.v1 contractを満たさない');
+  const verdict = explainRunRequest(request);
+  if (!verdict.valid) {
+    // 拒否理由と違反箇所を返す（ADR 0123）。TODO面と同じdiagnosabilityへ揃え、
+    // hostがschemaを推測せずにrequestを直せるようにする。
+    throw new CliContractError(
+      'INVALID_RUN_REQUEST',
+      'run_request.v1 contractを満たさない',
+      { reason: verdict.reason, path: verdict.path },
+    );
   }
   return request;
 }
@@ -2753,6 +2775,14 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
   }
   let action = null;
   if (argv.length === 4
+    && argv[0] === 'plan' && argv[1] === 'compile'
+    && argv[2] === '--schema' && argv[3] === '--json') {
+    action = () => runRequestSchema({ stdout });
+  } else if (argv.length === 4
+    && argv[0] === 'run' && argv[1] === 'start'
+    && argv[2] === '--schema' && argv[3] === '--json') {
+    action = () => runRequestSchema({ stdout });
+  } else if (argv.length === 4
     && argv[0] === 'plan' && argv[1] === 'compile' && argv[2] === '--request'
     && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = () => planCompile({ requestPath: path.resolve(cwd, argv[3]), cwd, stdout });

package/src/runtime-contracts.mjs

@@ -164,7 +164,7 @@ function unknownEntry(value) {
     && value.ref.length > 0;
 }
 
-const MANUAL_WITNESS_FIELDS = Object.freeze([
+export const MANUAL_WITNESS_FIELDS = Object.freeze([
   'owns',
   'reads',
   'writes',
@@ -175,18 +175,8 @@ const MANUAL_WITNESS_FIELDS = Object.freeze([
   'unknowns',
 ]);
 
-function manualWitnessEntry(value) {
-  return plainObject(value)
-    && exactRecord(value, MANUAL_WITNESS_FIELDS)
-    && boundedArray(value.owns, ownEntry)
-    && repoPathArray(value.reads)
-    && repoPathArray(value.writes, { allowPrefix: true })
-    && boundedArray(value.resources, identifier)
-    && boundedArray(value.state_effects, stateEffectEntry)
-    && plainObject(value.sensor_provenance)
-    && repoPathArray(value.affected_tests)
-    && boundedArray(value.unknowns, unknownEntry);
-}
+// manual witness entryの判定は`explainRunRequest`だけが所有する。
+// 同じ規則をbooleanと診断の二箇所へ持たないための単一正本化（ADR 0123）。
 
 function boundedArray(value, predicate, { min = 0, max = MAX_COLLECTION } = {}) {
   return Array.isArray(value)
@@ -231,43 +221,139 @@ const WITNESS_PROVENANCE = Object.freeze([
   'manual_state_effect',
 ]);
 
+export const RUN_REQUEST_FIELDS = Object.freeze([
+  'schema',
+  'request_id',
+  'repo',
+  'capacity',
+  'todos',
+  'manual_witness',
+  'sensor_query_set',
+  'executor_capability',
+  'claim_mode',
+  'request_digest',
+]);
+
+export const RUN_REQUEST_CLAIM_MODE = 'exact_minimum';
+
+/**
+ * `sensor_query_set.queries[].operation`のclosed set。
+ * runtime front-endはこの定数を輸入して使う（同じ閉集合を二箇所へ持たない）。
+ */
+export const SENSOR_QUERY_OPERATIONS = Object.freeze([
+  'status',
+  'query',
+  'callers',
+  'callees',
+  'impact',
+  'affected',
+]);
+
+/** `manual_witness[].sensor_provenance.queries[].expect.kind`のclosed set。 */
+export const SENSOR_EXPECT_KINDS = Object.freeze(['symbol', 'path', 'affected']);
+
+/** `sensor_provenance` entryのexpectを検査する（front-end adapter契約と同一規則）。 */
+function sensorExpect(value) {
+  if (!plainObject(value) || !SENSOR_EXPECT_KINDS.includes(value.kind)) return false;
+  if (value.kind === 'symbol') {
+    return exactRecord(value, ['kind', 'name', 'path'])
+      && typeof value.name === 'string' && value.name.length > 0
+      && repoRelativePath(value.path);
+  }
+  return exactRecord(value, ['kind', 'path']) && repoRelativePath(value.path);
+}
+
+/**
+ * `lattice.run_request.v1`の唯一の判定正本（ADR 0123）。
+ * 受理は`{ valid: true }`、拒否は最初の違反の`reason`と`path`を返す。
+ * `validateRunRequest`は本関数へ委譲するため、boolean判定と診断が乖離しない。
+ */
+export function explainRunRequest(value) {
+  const reject = (reason, at) => ({ valid: false, reason, path: at });
+  try {
+    canonicalizeArtifact(value);
+  } catch {
+    return reject('non_canonical_request_bytes', '');
+  }
+  if (!exactRecord(value, RUN_REQUEST_FIELDS)) return reject('unexpected_or_missing_top_level_keys', '');
+  if (value.schema !== 'lattice.run_request.v1') return reject('schema_mismatch', '/schema');
+  if (!identifier(value.request_id)) return reject('invalid_identifier', '/request_id');
+  if (!exactRecord(value.repo, ['base_sha', 'root_kind'])) return reject('unexpected_or_missing_keys', '/repo');
+  if (!gitSha(value.repo.base_sha)) return reject('invalid_git_sha', '/repo/base_sha');
+  if (!identifier(value.repo.root_kind)) return reject('invalid_identifier', '/repo/root_kind');
+  if (!exactRecord(value.capacity, ['executors'])) return reject('unexpected_or_missing_keys', '/capacity');
+  if (!positiveInteger(value.capacity.executors)) return reject('not_a_positive_integer', '/capacity/executors');
+  if (!Array.isArray(value.todos) || value.todos.length < 1 || value.todos.length > MAX_COLLECTION) {
+    return reject('bounded_collection_violation', '/todos');
+  }
+  for (const [index, todo] of value.todos.entries()) {
+    if (!exactRecord(todo, ['todo_id'])) return reject('unexpected_or_missing_keys', `/todos/${index}`);
+    if (!identifier(todo.todo_id)) return reject('invalid_identifier', `/todos/${index}/todo_id`);
+  }
+  const todoIds = value.todos.map((todo) => todo.todo_id);
+  if (new Set(todoIds).size !== todoIds.length) return reject('duplicate_todo_id', '/todos');
+  if (!plainObject(value.manual_witness)) return reject('not_an_object', '/manual_witness');
+  if (!exactRecord(value.manual_witness, todoIds)) {
+    return reject('manual_witness_keys_must_equal_todo_ids', '/manual_witness');
+  }
+  for (const todoId of todoIds) {
+    const witness = value.manual_witness[todoId];
+    const at = `/manual_witness/${todoId}`;
+    if (!plainObject(witness)) return reject('not_an_object', at);
+    if (!exactRecord(witness, MANUAL_WITNESS_FIELDS)) return reject('unexpected_or_missing_keys', at);
+    if (!boundedArray(witness.owns, ownEntry)) return reject('invalid_own_entries', `${at}/owns`);
+    if (!repoPathArray(witness.reads)) return reject('invalid_repo_relative_paths', `${at}/reads`);
+    if (!repoPathArray(witness.writes, { allowPrefix: true })) return reject('invalid_repo_relative_paths', `${at}/writes`);
+    if (!boundedArray(witness.resources, identifier)) return reject('invalid_identifier', `${at}/resources`);
+    if (!boundedArray(witness.state_effects, stateEffectEntry)) return reject('invalid_state_effect_entries', `${at}/state_effects`);
+    // sensor_provenanceもfront-end adapter契約のshapeまで検査する（ADR 0123）。
+    const provenanceAt = `${at}/sensor_provenance`;
+    if (!exactRecord(witness.sensor_provenance, ['queries'])) return reject('unexpected_or_missing_keys', provenanceAt);
+    if (!Array.isArray(witness.sensor_provenance.queries)
+      || witness.sensor_provenance.queries.length > MAX_COLLECTION) {
+      return reject('bounded_collection_violation', `${provenanceAt}/queries`);
+    }
+    for (const [index, entry] of witness.sensor_provenance.queries.entries()) {
+      const entryAt = `${provenanceAt}/queries/${index}`;
+      if (!exactRecord(entry, ['query_id', 'expect'])) return reject('unexpected_or_missing_keys', entryAt);
+      if (!identifier(entry.query_id)) return reject('invalid_identifier', `${entryAt}/query_id`);
+      if (!sensorExpect(entry.expect)) return reject('invalid_sensor_expect', `${entryAt}/expect`);
+    }
+    if (!repoPathArray(witness.affected_tests)) return reject('invalid_repo_relative_paths', `${at}/affected_tests`);
+    if (!boundedArray(witness.unknowns, unknownEntry)) return reject('invalid_unknown_entries', `${at}/unknowns`);
+  }
+  // sensor_query_set／executor_capabilityは、runtime front-endとrun startが実際に要求する
+  // shapeまで検査する。schemaで通ってから後段で落ちる契約分裂を残さない（ADR 0123）。
+  if (!exactRecord(value.sensor_query_set, ['queries'])) return reject('unexpected_or_missing_keys', '/sensor_query_set');
+  if (!Array.isArray(value.sensor_query_set.queries) || value.sensor_query_set.queries.length > MAX_COLLECTION) {
+    return reject('bounded_collection_violation', '/sensor_query_set/queries');
+  }
+  const queryIds = new Set();
+  for (const [index, query] of value.sensor_query_set.queries.entries()) {
+    const at = `/sensor_query_set/queries/${index}`;
+    const keys = plainObject(query) && Object.hasOwn(query, 'target')
+      ? ['id', 'operation', 'target'] : ['id', 'operation'];
+    if (!exactRecord(query, keys)) return reject('unexpected_or_missing_keys', at);
+    if (!identifier(query.id)) return reject('invalid_identifier', `${at}/id`);
+    if (!SENSOR_QUERY_OPERATIONS.includes(query.operation)) return reject('unknown_sensor_query_operation', `${at}/operation`);
+    if (keys.includes('target') && (typeof query.target !== 'string' || query.target.length === 0)) {
+      return reject('empty_query_target', `${at}/target`);
+    }
+    if (queryIds.has(query.id)) return reject('duplicate_query_id', `${at}/id`);
+    queryIds.add(query.id);
+  }
+  if (!exactRecord(value.executor_capability, ['adapters'])) return reject('unexpected_or_missing_keys', '/executor_capability');
+  if (!uniqueIdentifierArray(value.executor_capability.adapters, { min: 1 })) {
+    return reject('invalid_adapter_identifiers', '/executor_capability/adapters');
+  }
+  if (value.claim_mode !== RUN_REQUEST_CLAIM_MODE) return reject('claim_mode_must_be_exact_minimum', '/claim_mode');
+  if (!selfDigestValid(value, 'request_digest')) return reject('request_digest_mismatch', '/request_digest');
+  return { valid: true };
+}
+
 /** `lattice.run_request.v1`。manual witnessはTODOごとに完備でなければならない。 */
 export function validateRunRequest(value) {
-  return validateSafely(value, (request) => {
-    if (!exactRecord(request, [
-      'schema',
-      'request_id',
-      'repo',
-      'capacity',
-      'todos',
-      'manual_witness',
-      'sensor_query_set',
-      'executor_capability',
-      'claim_mode',
-      'request_digest',
-    ])
-      || request.schema !== 'lattice.run_request.v1'
-      || !identifier(request.request_id)
-      || !exactRecord(request.repo, ['base_sha', 'root_kind'])
-      || !gitSha(request.repo.base_sha)
-      || !identifier(request.repo.root_kind)
-      || !exactRecord(request.capacity, ['executors'])
-      || !positiveInteger(request.capacity.executors)
-      || !boundedArray(request.todos, (todo) => (
-        exactRecord(todo, ['todo_id']) && identifier(todo.todo_id)
-      ), { min: 1 })) {
-      return false;
-    }
-    const todoIds = request.todos.map((todo) => todo.todo_id);
-    if (new Set(todoIds).size !== todoIds.length) return false;
-    return plainObject(request.manual_witness)
-      && exactRecord(request.manual_witness, todoIds)
-      && Object.values(request.manual_witness).every(manualWitnessEntry)
-      && plainObject(request.sensor_query_set)
-      && plainObject(request.executor_capability)
-      && request.claim_mode === 'exact_minimum'
-      && selfDigestValid(request, 'request_digest');
-  });
+  return explainRunRequest(value).valid;
 }
 
 /**

package/src/runtime-front-end.mjs

@@ -6,6 +6,8 @@ import { portableSensorOutcome } from './sensor-adapter.mjs';
 import { compileSchedulabilityGraphV2 } from './schedulability-compiler-v2.mjs';
 import { verifySchedulabilityPlanV2 } from './schedulability-verifier-v2.mjs';
 import {
+  SENSOR_EXPECT_KINDS,
+  SENSOR_QUERY_OPERATIONS,
   selfDigest,
   validateRunRequest,
   validateRuntimeBoundaryManifest,
@@ -36,16 +38,10 @@ import {
  * portable outcome projectionのcanonical digestだけを入れる（Decision 10.4）。
  */
 
-const QUERY_OPERATIONS = Object.freeze([
-  'status',
-  'query',
-  'callers',
-  'callees',
-  'impact',
-  'affected',
-]);
+// 閉集合の正本はruntime-contracts。ここでは輸入して使う。
+const QUERY_OPERATIONS = SENSOR_QUERY_OPERATIONS;
 const STRUCTURE_OPERATIONS = new Set(['query', 'callers', 'callees', 'impact']);
-const EXPECT_KINDS = new Set(['symbol', 'path', 'affected']);
+const EXPECT_KINDS = new Set(SENSOR_EXPECT_KINDS);
 const IDENTIFIER = /^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$/;
 const STATE_KIND_MAP = Object.freeze({
   state: 'state',

package/src/todo-cli.mjs

@@ -46,7 +46,7 @@ import {
   appendTodoExtraction,
   validateTodoExtraction,
 } from './todo-migration.mjs';
-import { projectTodoStatus } from './todo-status.mjs';
+import { projectTodoBindings, projectTodoStatus } from './todo-status.mjs';
 import {
   parseTodoSourceRef, todoLegacyReconciliationDigest, validatePhaseTodoRevision,
   validateTodoRevision, validateTodoRevisionSet,
@@ -474,6 +474,10 @@ async function status({ repoRoot }) {
   return projectTodoStatus(await readTodoStore({ repoRoot }));
 }
 
+async function bindings({ repoRoot, requestedPlanKey }) {
+  return projectTodoBindings(await readTodoStore({ repoRoot }), { requestedPlanKey });
+}
+
 async function readNarrative(repoRoot, ref) {
   const canonicalRoot = await realpath(repoRoot);
   const source = parseTodoSourceRef(ref);
@@ -926,6 +930,13 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
   if ((argv.length === 1 && argv[0] === 'status')
     || (argv.length === 2 && argv[0] === 'status' && argv[1] === '--json')) {
     action = (repoRoot) => status({ repoRoot });
+  } else if ((argv.length === 1 && argv[0] === 'bindings')
+    || (argv.length === 2 && argv[0] === 'bindings' && argv[1] === '--json')) {
+    action = (repoRoot) => bindings({ repoRoot, requestedPlanKey: null });
+  } else if ((argv.length === 3 || argv.length === 4) && argv[0] === 'bindings'
+    && argv[1] === '--plan' && isTodoIdentifier(argv[2])
+    && (argv.length === 3 || argv[3] === '--json')) {
+    action = (repoRoot) => bindings({ repoRoot, requestedPlanKey: argv[2] });
   } else if ((argv.length === 1 && argv[0] === 'verify')
     || (argv.length === 2 && argv[0] === 'verify' && argv[1] === '--json')) {
     action = (repoRoot) => verify({ repoRoot, requestedPlanKey: null });

package/src/todo-status.mjs

@@ -338,3 +338,63 @@ export function projectTodoStatus(readModel) {
   }
   return result;
 }
+
+export const TODO_BINDING_PROJECTION_SCHEMA = 'lattice.todo_binding_projection.v1';
+
+/**
+ * `compile_binding`が設定されたTaskだけを、TODO正本のidentityつきで投影する（ADR 0124）。
+ *
+ * これはTODO工程storeとruntime実行を結ぶ唯一の公開読み取り面である。host は
+ * `compiled_plan_digest`で`runtime_plan.v1`を、`base_sha`でrun requestのbaseを照合し、
+ * plan→`executor_packet.v1`→`executor_receipt.v1`（`packet_digest`帰属）まで辿れる。
+ *
+ * `todo_status_result.v4`は変更しない。binding投影は加算の別面とし、v4を受理する
+ * 既存hostを壊さない。
+ */
+export function projectTodoBindings(readModel, { requestedPlanKey = null } = {}) {
+  if (!plain(readModel) || readModel.schema !== 'lattice.todo_store_read.v1'
+    || !isTodoIdentifier(readModel.project_id) || !Array.isArray(readModel.members)) {
+    fail('TODO_STATUS_INVALID_INPUT', 'todo_status_read_model_invalid');
+  }
+  if (requestedPlanKey !== null && !isTodoIdentifier(requestedPlanKey)) {
+    fail('TODO_STATUS_INVALID_INPUT', 'todo_binding_plan_key_invalid');
+  }
+  const members = [...readModel.members].sort((left, right) => {
+    const leftKey = left?.plan?.plan_key ?? '';
+    const rightKey = right?.plan?.plan_key ?? '';
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+  });
+  const bindings = [];
+  let matchedPlan = requestedPlanKey === null;
+  for (const member of members) {
+    const plan = member?.plan;
+    if (!plain(plan) || !Array.isArray(plan.tasks)) continue;
+    if (requestedPlanKey !== null && plan.plan_key !== requestedPlanKey) continue;
+    if (requestedPlanKey !== null) matchedPlan = true;
+    for (const task of plan.tasks) {
+      if (!plain(task) || task.compile_binding === null || task.compile_binding === undefined) continue;
+      bindings.push({
+        project_id: plan.project_id,
+        plan_key: plan.plan_key,
+        plan_version: plan.plan_version,
+        task_id: task.task_id,
+        compile_binding: task.compile_binding,
+      });
+      if (bindings.length > TODO_STATUS_LIST_LIMIT) {
+        fail('TODO_SCALE_EXCEEDED', 'todo_binding_projection_limit_exceeded', {
+          binding_limit: TODO_STATUS_LIST_LIMIT,
+        });
+      }
+    }
+  }
+  if (!matchedPlan) fail('TODO_STATUS_INVALID_INPUT', 'todo_binding_plan_not_found');
+  const result = {
+    schema: TODO_BINDING_PROJECTION_SCHEMA,
+    project_id: readModel.project_id,
+    plan_key: requestedPlanKey,
+    bindings,
+    result_digest: '',
+  };
+  result.result_digest = todoSelfDigest(result, 'result_digest');
+  return result;
+}