@sixb/core 0.1.1 → 0.1.2

package/src/logging/execution.ts

@@ -0,0 +1,28 @@
+import { assertAuthorized } from "../authorization"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type { LoggingService, LogsPage, LogsReadInput, LogsTailInput } from "./service"
+
+export interface LogsRuntime {
+  assertObservable(): void
+  read(input?: LogsReadInput): Promise<LogsPage>
+  tail(input?: LogsTailInput): Promise<LogsPage>
+}
+
+export function createLogsRuntime(
+  runtime: SixbRuntimeContext,
+  source: LoggingService
+): LogsRuntime {
+  const assertObservable = () => assertAuthorized(runtime, { kind: "logs.observe" })
+
+  return {
+    assertObservable,
+    read: (input) => {
+      assertObservable()
+      return source.read(input)
+    },
+    tail: (input) => {
+      assertObservable()
+      return source.tail(input)
+    },
+  }
+}

package/src/logging/index.ts

@@ -5,16 +5,16 @@ export {
   noopLoggerProvider,
 } from "./console-logger"
 export {
+  LoggingService,
+  type LoggingServiceOptions,
   type LogsObservabilityOptions,
   type LogsPage,
   type LogsReadInput,
-  LogsRuntime,
-  type LogsRuntimeOptions,
   type LogsSubscribeInput,
   type LogsTailInput,
   type ObservabilityOptions,
-  resolveLogsRuntime,
-} from "./runtime"
+  resolveLoggingService,
+} from "./service"
 export {
   DEFAULT_LOGS_MAX_BYTES,
   DEFAULT_LOGS_RETENTION,

package/src/logging/{runtime.ts → service.ts}

@@ -75,7 +75,7 @@ export interface ObservabilityOptions {
   readonly logs?: LogsObservabilityOptions
 }
 
-export interface LogsRuntimeOptions {
+export interface LoggingServiceOptions {
   readonly projectId: string
   /** Broker backing the `__logs` stream. Absent means output-only logging. */
   readonly broker?: Broker
@@ -86,8 +86,8 @@ export interface LogsRuntimeOptions {
   readonly stream?: BrokerStreamDefinition
 }
 
-/** Project-scoped logger factory and broker capture runtime. */
-export class LogsRuntime {
+/** Project-scoped logger factory and broker capture service. */
+export class LoggingService {
   private readonly projectId: string
   private readonly broker?: Broker
   private readonly provider: LoggerProvider
@@ -99,7 +99,7 @@ export class LogsRuntime {
   private readonly stream: BrokerStreamDefinition
   private ensureStreamPromise?: Promise<void>
 
-  constructor(options: LogsRuntimeOptions) {
+  constructor(options: LoggingServiceOptions) {
     const config = options.observability ?? {}
     this.projectId = options.projectId
     this.broker = options.broker
@@ -271,9 +271,9 @@ export class LogsRuntime {
   }
 }
 
-/** Resolve a worker runtime, falling back to a silent output-only runtime. */
-export function resolveLogsRuntime(projectId: string, logs?: LogsRuntime): LogsRuntime {
-  return logs ?? new LogsRuntime({ projectId, logger: noopLoggerProvider })
+/** Resolve the logging service, falling back to a silent output-only service. */
+export function resolveLoggingService(projectId: string, logging?: LoggingService): LoggingService {
+  return logging ?? new LoggingService({ projectId, logger: noopLoggerProvider })
 }
 
 function normalizeRedactPaths(paths: readonly string[]): readonly string[] {

package/src/materialization/events.ts

@@ -13,6 +13,7 @@ interface OntologyMaterializationEventBase {
   readonly schemaVersion: 1
   readonly projectId: string
   readonly occurredAt: string
+  readonly correlationId: string
   readonly actor?: EventActor
   readonly origin: OntologyMaterializationOrigin
   readonly commitId: string

package/src/materialization/index.ts

@@ -30,11 +30,13 @@ export type {
   ExpectedLinkScopeRevision,
   ExpectedObjectRevision,
   LinkOverride,
+  LinkSlotOverride,
   MaterializationItemError,
   ObjectOverride,
   OntologyEditCommit,
   OntologyEditOperation,
   OntologyLinkRef,
+  OntologyLinkScopeRef,
   OntologyMaterializationOrigin,
   OntologyMaterializationPropertyChange,
   OntologyMaterializationPropertyChangeMap,

package/src/materialization/model.ts

@@ -1,7 +1,8 @@
-import type { EventActor, EventOrigin } from "../events/envelope"
+import type { SixbFailure } from "../errors/types"
+import type { EventOrigin } from "../events/envelope"
 import type { PropertyChange, PropertyChangeMap } from "../events/property-changes"
 import type { JsonValue } from "../json"
-import type { ProjectionProtocolIdentity } from "../projections/types"
+import type { ProjectionProtocolIdentity, ProjectionRunFailureCode } from "../projections/types"
 
 export type { ProjectionProtocolIdentity } from "../projections/types"
 
@@ -16,6 +17,12 @@ export interface OntologyLinkRef {
   readonly target: OntologyObjectRef
 }
 
+/** Identity of the single value slot owned by a cardinality-one link. */
+export interface OntologyLinkScopeRef {
+  readonly source: OntologyObjectRef
+  readonly linkId: string
+}
+
 export interface ProjectionSourceRef {
   readonly projectionId: string
 }
@@ -109,7 +116,6 @@ export type OntologyEditOperation =
     }
 
 interface BaseOntologyEditCommit {
-  readonly actor?: EventActor
   readonly operations: readonly OntologyEditOperation[]
 }
 
@@ -171,6 +177,7 @@ interface ProjectionRunFinishBase {
   readonly source: ProjectionSourceRef
   readonly datasetVersion: PinnedDatasetVersion
   readonly execution: ProjectionExecution
+  readonly finishedAt?: Date
 }
 
 export type ProjectionRunTerminalDecision =
@@ -188,7 +195,7 @@ export type ProjectionRunTerminalDecision =
   | {
       readonly protocol: ProjectionProtocolIdentity["protocol"]
       readonly status: "failed" | "cancelled"
-      readonly errorMessage?: string
+      readonly error?: SixbFailure<ProjectionRunFailureCode>
       readonly inputExhausted?: never
     }
 
@@ -229,7 +236,6 @@ export interface TelemetryAppend {
         /** True when this batch consumed the final row of the immutable dataset version. */
         readonly inputExhausted: boolean
       }
-  readonly actor?: EventActor
   readonly points: readonly TelemetryPointWrite[]
 }
 
@@ -361,19 +367,6 @@ export interface TelemetryCommitResult extends BaseCommitResult {
   readonly latestObjectsChanged: number
 }
 
-export interface OntologyMaterializer {
-  readonly edits: {
-    commit(input: OntologyEditCommit): Promise<EditCommitResult>
-  }
-  readonly projections: {
-    replace(input: ProjectionSourceReplacement): Promise<ProjectionCommitResult>
-    finishRun(input: ProjectionRunFinishInput): Promise<void>
-  }
-  readonly telemetry: {
-    append(input: TelemetryAppend): Promise<TelemetryCommitResult>
-  }
-}
-
 export type ObjectOverride =
   | {
       readonly kind: "create"
@@ -392,3 +385,22 @@ export type LinkOverride =
       readonly properties?: Readonly<Record<string, JsonValue>>
     }
   | { readonly kind: "delete" }
+
+/**
+ * Managed authority for a link slot: the single-valued `(source, linkId)` identity of a
+ * cardinality-one link.
+ *
+ * The target is part of the value, not the authority identity. A clear keeps the target that was
+ * removed as an operation anchor so the existing target-shaped reset API remains deterministic;
+ * it still suppresses every projected value in the scope.
+ */
+export type LinkSlotOverride =
+  | {
+      readonly kind: "set"
+      readonly target: OntologyObjectRef
+      readonly properties?: Readonly<Record<string, JsonValue>>
+    }
+  | {
+      readonly kind: "clear"
+      readonly target: OntologyObjectRef
+    }

package/src/materializer/README.md

@@ -13,11 +13,7 @@ runtime object/link     -> edits.commit  (mode: "atomic" | "continue", origin: r
 runtime telemetry       -> telemetry.append (origin: telemetry/runtime)
 ```
 
-`Sixb` constructs one Materializer and threads it through its internal runtime context, so the typed
-`objects(...)` SDK, the dynamic `Sixb` methods, and the Action worker all commit through the same
-engine. Runtime single calls are atomic; runtime batches use `continue` mode and map per-item
-outcomes back to caller positions. No ingress appends domain events or writes object, link, or
-timeseries providers directly.
+`SixbHost` owns one unbound Materializer. `withScope(...)` closes its mutation port over one validated execution before the typed `objects(...)` SDK or a trusted worker can use it. The host never exposes a raw mutation port. Runtime single calls are atomic; runtime batches use `continue` mode and map per-item outcomes back to caller positions. No ingress appends domain events or writes object, link, or timeseries providers directly.
 
 Committed facts are published from the transactional outbox after the commit resolves.
 `OntologyOutboxDispatcher` owns that protocol: ingresses call `notify()` for prompt, non-blocking
@@ -29,7 +25,9 @@ best effort — delivery may lag, but a committed fact is never lost.
 ```text
 normalize + validate intent
   -> derive deterministic identity
-  -> verify execution when run-backed and check replay
+  -> validate the execution/authority binding
+  -> persist or verify the durable execution
+  -> verify run ownership when run-backed and check replay
   -> begin serializable materialization session
   -> resolve effective state
   -> diff against committed state
@@ -51,9 +49,9 @@ ontology storage  -> sources, effective state, telemetry, commits, and outbox
 Materializer      -> semantic planning and cross-store transaction orchestration
 ```
 
-Ontology commit `origin` is the canonical correlation to an Action or projection run. Run records
-do not duplicate ontology commit ids or semantic commit history. Replacement projections need no
-resume checkpoint; projection telemetry stores only its next batch/row checkpoint on the run.
+Every ontology commit references its immutable execution through `executionId`. Storage providers enforce that reference. `origin` remains the semantic idempotency and run-correlation key: it says which runtime request, Action, projection replacement, or telemetry batch the commit represents; the execution says under which durable authority it ran. Neither field duplicates the other.
+
+Run records do not duplicate ontology commit ids or semantic commit history. Replacement projections need no resume checkpoint; projection telemetry stores only its next batch/row checkpoint on the run.
 
 Logical origins are unique in the ontology ledger: one commit per Action run, one per replacement
 run, and one per telemetry run/batch ordinal. Exact origin lookup is used for correctness; commit
@@ -83,7 +81,7 @@ then applies the fenced run transition.
 ```text
 ordered edit operations
   -> transaction-local EditWorkingState
-  -> update object/link overrides
+  -> update object, link-edge, and link-slot overrides
   -> validate effective objects, endpoints, and cardinality
   -> diff final working state against commit-start state
   -> plan and finalize one commit
@@ -94,9 +92,7 @@ its mutable overrides let operation N+1 observe operation N. In `continue` mode,
 operation rolls back only its working override; provider and infrastructure failures abort the
 whole transaction.
 
-Action-backed edits verify the matching running Action before work and again inside the commit
-transaction. Their semantic result lives only in the ontology commit, correlated by Action origin;
-the Action run is not a second commit ledger.
+Action-backed edits validate the trusted Action execution, the run's immutable `executionId`, and the running-state fence inside the commit transaction before new work. Exact replay remains valid after the run becomes terminal. Their semantic result lives only in the ontology commit, correlated by Action origin; the Action run is not a second commit ledger.
 
 ## Telemetry append
 

package/src/materializer/edits/commit.ts

@@ -1,4 +1,7 @@
-import { MaterializationValidationError } from "../../materialization/errors"
+import {
+  MaterializationConflictError,
+  MaterializationValidationError,
+} from "../../materialization/errors"
 import type {
   EditCommitResult,
   OntologyEditCommit,
@@ -10,7 +13,16 @@ import type { Storage } from "../../storage"
 import type { MaterializationSession, OntologyCommitWrite } from "../../storage/ontology"
 import type { MaterializerContext, MaterializerStorage } from "../context"
 import { replayCommit, withSerializationRetry } from "../execution/commit-lifecycle"
+import {
+  assertMaterializerRunExecution,
+  assertRuntimeMutationExecution,
+  assertTrustedPrimitiveMutationExecution,
+  ensureMaterializerExecution,
+  type MaterializerExecution,
+  prepareMaterializerExecution,
+} from "../execution/scope"
 import { drainStagedEvents, drainStagedWork } from "../execution/work-executor"
+import type { MaterializerCommand } from "../materializer"
 import {
   createActionIdempotencyKey,
   createRuntimeIdempotencyKey,
@@ -20,13 +32,9 @@ import {
 import { normalizeOntologyEditCommit } from "../shared/normalize"
 import { compileEditExecutionUnits, type EditExecutionUnit } from "./execution-units"
 import { loadEditWorkingState } from "./load-state"
-import {
-  applyEditOperation,
-  type EditUndoJournal,
-  type EditWorkingState,
-  undoEditJournal,
-} from "./operations"
+import { applyEditOperation, type EditUndoJournal, undoEditJournal } from "./operations"
 import { stageEditPlan } from "./plan"
+import type { EditWorkingState } from "./working-state"
 
 type NormalizedEditCommit = ReturnType<typeof normalizeOntologyEditCommit>
 
@@ -34,24 +42,22 @@ interface PreparedEditCommit {
   readonly input: NormalizedEditCommit
   readonly identity: TimedCommitIdentity
   readonly origin: OntologyMaterializationOrigin
+  readonly execution: MaterializerExecution
 }
 
 export async function commitEdits(
   context: MaterializerContext,
-  raw: OntologyEditCommit
+  raw: MaterializerCommand<OntologyEditCommit>
 ): Promise<EditCommitResult> {
   const command = prepareEditCommit(context, raw)
-  const replay = await replayEditCommit(context, command)
-  if (replay) return replay
-
   return executeEditCommit(context, command)
 }
 
 function prepareEditCommit(
   context: Pick<MaterializerContext, "projectId" | "clock">,
-  raw: OntologyEditCommit
+  raw: MaterializerCommand<OntologyEditCommit>
 ): PreparedEditCommit {
-  const input = normalizeOntologyEditCommit(raw)
+  const input = normalizeOntologyEditCommit(raw.input)
   const idempotencyKey = editIdempotencyKey(input)
   const identity = createTimedCommitIdentity({
     projectId: context.projectId,
@@ -59,7 +65,12 @@ function prepareEditCommit(
     normalizedCallerIntent: input,
     now: context.clock(),
   })
-  return { input, identity, origin: input.source }
+  return {
+    input,
+    identity,
+    origin: input.source,
+    execution: prepareMaterializerExecution(context.projectId, raw.scope),
+  }
 }
 
 function editIdempotencyKey(input: NormalizedEditCommit): string {
@@ -72,7 +83,8 @@ function editIdempotencyKey(input: NormalizedEditCommit): string {
 async function lockActionRunForMaterialization(
   storage: Storage,
   projectId: string,
-  input: NormalizedEditCommit
+  input: NormalizedEditCommit,
+  execution: MaterializerExecution
 ): Promise<void> {
   if (input.source.kind !== "action") return
   if (!storage.actionRuns) {
@@ -80,18 +92,45 @@ async function lockActionRunForMaterialization(
       "Storage does not provide Action run capabilities required by this commit."
     )
   }
-  await storage.actionRuns.lockForMaterialization({
+  const run = await storage.actionRuns.lockForMaterialization({
     projectId,
     actionId: input.source.actionId,
     runId: input.source.runId,
   })
+  assertMaterializerRunExecution(execution, run.executionId, `Action run '${run.id}'`)
 }
 
-function replayEditCommit(
-  context: MaterializerContext,
-  command: PreparedEditCommit
-): Promise<EditCommitResult | null> {
-  return replayCommit<EditCommitResult>(context, command.identity)
+async function validateMutationExecution(
+  storage: Storage,
+  projectId: string,
+  input: NormalizedEditCommit,
+  execution: MaterializerExecution
+): Promise<void> {
+  if (input.source.kind !== "action") {
+    assertRuntimeMutationExecution(execution)
+    return
+  }
+  assertTrustedPrimitiveMutationExecution(execution, {
+    kind: "action",
+    id: input.source.actionId,
+    runId: input.source.runId,
+  })
+  if (!storage.actionRuns) {
+    throw new MaterializationValidationError(
+      "Storage does not provide Action run capabilities required by this commit."
+    )
+  }
+  const run = await storage.actionRuns.getById({ projectId, id: input.source.runId })
+  if (!run) {
+    throw new MaterializationValidationError(`Action run '${input.source.runId}' was not found.`)
+  }
+  if (run.actionId !== input.source.actionId) {
+    throw new MaterializationConflictError(
+      "run-correlation",
+      `Action run '${run.id}' does not belong to action '${input.source.actionId}'.`
+    )
+  }
+  assertMaterializerRunExecution(execution, run.executionId, `Action run '${run.id}'`)
 }
 
 async function executeEditCommit(
@@ -110,11 +149,24 @@ async function executeEditTransaction(
   storage: MaterializerStorage,
   command: PreparedEditCommit
 ): Promise<EditCommitResult> {
-  await lockActionRunForMaterialization(storage, context.projectId, command.input)
+  await ensureMaterializerExecution(storage.executions, command.execution)
+  await validateMutationExecution(storage, context.projectId, command.input, command.execution)
 
-  const replay = await replayCommit<EditCommitResult>(context, command.identity, storage)
+  const replay = await replayCommit<EditCommitResult>(
+    context,
+    command.identity,
+    command.execution.executionId,
+    storage
+  )
   if (replay) return replay
 
+  await lockActionRunForMaterialization(
+    storage,
+    context.projectId,
+    command.input,
+    command.execution
+  )
+
   const session = await beginEditMaterialization(context, storage, command)
   const workingState = await loadEditWorkingState(
     context,
@@ -175,6 +227,7 @@ function buildEditCommit(
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
+    executionId: command.execution.executionId,
     origin: command.origin,
     ontologyRevision: context.projectionRegistry.ontologyRevision,
     intent: {
@@ -184,8 +237,8 @@ function buildEditCommit(
     },
     committedAt: command.identity.committedAt,
   }
-  if (command.input.actor === undefined) return commit
-  return { ...commit, actor: command.input.actor }
+  if (command.execution.actor === undefined) return commit
+  return { ...commit, actor: command.execution.actor }
 }
 
 function editExpectations(input: NormalizedEditCommit) {
@@ -293,9 +346,13 @@ function isRecoverableEditValidation(
 }
 
 function editPlanContext(command: PreparedEditCommit) {
-  const context = { identity: command.identity, origin: command.origin }
-  if (command.input.actor === undefined) return context
-  return { ...context, actor: command.input.actor }
+  const context = {
+    identity: command.identity,
+    origin: command.origin,
+    correlationId: command.execution.correlationId,
+  }
+  if (command.execution.actor === undefined) return context
+  return { ...context, actor: command.execution.actor }
 }
 
 async function finalizeEditMaterialization(

package/src/materializer/edits/load-state.ts

@@ -8,13 +8,15 @@ import type {
 } from "../../storage/ontology"
 import type { MaterializerContext } from "../context"
 import { loadState, oneStateRequest } from "../effective/load-state"
-import type { EditWorkingState } from "./operations"
-import { buildEditReadSet, isKnownLinkRef } from "./read-set"
+import { resolveEffectiveLinkSlotMember, usableLinkSlotOverride } from "../effective/resolve"
+import { buildEditReadSet, isKnownLinkRef, linkCardinality } from "./read-set"
 import {
   distinctCardinalityOneScopes,
+  type EditWorkingState,
   mergeWorkingState,
-  resolveLink,
-  workingLinkFromState,
+  resolveLinkEdge,
+  resolveObject,
+  workingLinkEdgeFromState,
 } from "./working-state"
 
 export async function loadEditWorkingState(
@@ -25,13 +27,21 @@ export async function loadEditWorkingState(
 ): Promise<EditWorkingState> {
   const state: EditWorkingState = {
     objects: new Map(),
-    links: new Map(),
-    scopeSnapshots: new Map(),
+    links: {
+      edges: new Map(),
+      slots: new Map(),
+    },
   }
   const readSet = buildEditReadSet(context.ontology, operations)
   const explicitLinkKeys = new Set(readSet.links.map(linkRefKey))
   const incidentLinks = new Map<string, MaterializationLinkState>()
-  const ignoredLinks: EditWorkingState["links"] = new Map()
+  const loadedState: EditWorkingState = {
+    objects: state.objects,
+    links: {
+      edges: new Map(),
+      slots: state.links.slots,
+    },
+  }
   const revivingObjects = new Set(
     operations.filter(isRevivingObjectOperation).map((operation) => objectRefKey(operation.ref))
   )
@@ -41,16 +51,22 @@ export async function loadEditWorkingState(
     requests: oneStateRequest(readSet),
     pageRows: context.batching.statePageRows,
   })) {
-    mergeWorkingState(state.objects, ignoredLinks, state.scopeSnapshots, page)
+    mergeWorkingState(context.ontology, loadedState, page)
     for (const link of page.links) {
       const key = linkRefKey(link.ref)
-      if (explicitLinkKeys.has(key) && !state.links.has(key)) {
-        state.links.set(key, workingLinkFromState(link))
+      if (
+        linkCardinality(context.ontology, link.ref) !== "one" &&
+        explicitLinkKeys.has(key) &&
+        !state.links.edges.has(key)
+      ) {
+        state.links.edges.set(key, workingLinkEdgeFromState(link))
       }
       if (readSet.incidentObjects.length > 0) incidentLinks.set(key, link)
     }
   }
 
+  await mergeMissingLinkSlotEndpoints(context, storage, session, state)
+
   await mergeIncidentState(
     context,
     storage,
@@ -111,12 +127,25 @@ async function mergeIncidentState(
     ) {
       return true
     }
-    return Boolean(resolveLink(context.ontology, workingLinkFromState(link), state.objects))
+    if (linkCardinality(context.ontology, link.ref) === "one") {
+      return Boolean(
+        resolveEffectiveLinkSlotMember({
+          ref: link.ref,
+          source: link.source,
+          override: usableLinkSlotOverride(link.slotOverride),
+          endpointExists: (ref) => {
+            const object = state.objects.get(objectRefKey(ref))
+            return Boolean(object && resolveObject(context.ontology, object))
+          },
+        })
+      )
+    }
+    return Boolean(resolveLinkEdge(context.ontology, workingLinkEdgeFromState(link), state.objects))
   })
   const missingScopes = distinctCardinalityOneScopes(
     context.ontology,
     relevantStates,
-    state.scopeSnapshots
+    state.links.slots
   )
   if (missingScopes.length > 0) {
     await mergeLoadedState(context, storage, session, state, {
@@ -128,12 +157,46 @@ async function mergeIncidentState(
     })
   }
 
+  await mergeMissingLinkSlotEndpoints(context, storage, session, state)
+
   for (const link of relevantStates) {
+    if (linkCardinality(context.ontology, link.ref) === "one") continue
     const key = linkRefKey(link.ref)
-    if (state.links.has(key)) continue
-    state.links.set(key, workingLinkFromState(link))
+    if (state.links.edges.has(key)) continue
+    state.links.edges.set(key, workingLinkEdgeFromState(link))
+  }
+  context.observeCoreBuffer?.(
+    "edits.incident-links",
+    state.links.edges.size + state.links.slots.size
+  )
+}
+
+async function mergeMissingLinkSlotEndpoints(
+  context: MaterializerContext,
+  storage: OntologyMaterializationStorage,
+  session: MaterializationSession,
+  state: EditWorkingState
+): Promise<void> {
+  const missing = new Map<string, OntologyObjectRef>()
+  for (const working of state.links.slots.values()) {
+    const refs = [
+      working.ref.source,
+      working.source?.assertion.ref.target,
+      working.override?.target,
+      working.before?.ref.target,
+    ]
+    for (const ref of refs) {
+      if (ref && !state.objects.has(objectRefKey(ref))) missing.set(objectRefKey(ref), ref)
+    }
   }
-  context.observeCoreBuffer?.("edits.incident-links", state.links.size)
+  if (missing.size === 0) return
+  await mergeLoadedState(context, storage, session, state, {
+    objects: [...missing.values()],
+    links: [],
+    linkScopes: [],
+    incidentObjects: [],
+    points: [],
+  })
 }
 
 async function mergeLoadedState(
@@ -144,5 +207,5 @@ async function mergeLoadedState(
   request: MaterializationStateRequestChunk
 ): Promise<void> {
   const loaded = await loadState(context, storage, session, request)
-  mergeWorkingState(state.objects, state.links, state.scopeSnapshots, loaded)
+  mergeWorkingState(context.ontology, state, loaded)
 }