@stigmer/server 3.14.0-dev.20260910084630

package/dist/temporal/schedule/run-starter.d.ts

@@ -0,0 +1,122 @@
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { ScheduleFireCallerMint } from "../../extensions/schedule-fire-caller.js";
+import type { Store } from "../../store/interface.js";
+import type { ScheduleTemporalConfig } from "./config.js";
+/**
+ * The scheduled session's pinned subject prefix — cross-edition contract
+ * (an explicit subject also opts the session out of LLM titling,
+ * deliberately: a reminder session names itself). Go SessionSubjectPrefix.
+ */
+export declare const SESSION_SUBJECT_PREFIX = "Scheduled run: ";
+/**
+ * The audit link stamped on every schedule-created execution — the same
+ * key the cloud edition's scope step writes (Go ScheduleIDLabelKey).
+ *
+ * In OSS the label is also the environment-resolution key: the execution
+ * context step reads it to merge the schedule's environment_refs (DD-017
+ * D-4). Cloud deliberately resolves through the validated token claim
+ * instead — a client-suppliable label must not widen what a cloud sandbox
+ * reads — but OSS is single-user with no trust boundary, and it has no
+ * tokens to carry a claim (the DD-015 divergence posture).
+ */
+export declare const SCHEDULE_ID_LABEL_KEY = "stigmer.ai/schedule-id";
+/** The sealed outcome set of startRun (Go RunOutcomeResult). */
+export type RunOutcomeResult = 
+/** The run exists (created now, or found from a prior attempt at the same fire). */
+{
+    kind: "started";
+    executionId: string;
+    alreadyExisted: boolean;
+}
+/** The referenced agent no longer exists — the deterministic dangling-reference failure (no cascade by contract). */
+ | {
+    kind: "targetMissing";
+    reason: string;
+}
+/** A launch gate refused deterministically — retrying cannot help, the streak should know. */
+ | {
+    kind: "refused";
+    reason: string;
+};
+/**
+ * The narrow slice of the in-process agent-execution client the run
+ * starter needs (Go ExecutionCreator; satisfied through
+ * src/boot/inprocess.ts). `fireCaller`, when present, is the composed
+ * edition identity the fire acts as — the implementation propagates it
+ * through the R5 in-process header; absent, the create enters as the
+ * `internal` class (the OSS default, byte-identical).
+ */
+export interface ScheduleExecutionCreator {
+    create(execution: AgentExecution, fireCaller?: CallerIdentity): Promise<AgentExecution>;
+}
+/**
+ * THE idempotency key: schedule id (lowercased, underscores to hyphens —
+ * already slug-safe) plus the nominal fire time truncated to whole seconds
+ * in the cloud's "yyyyMMdd't'HHmmss'z'" layout. Byte-identical to the
+ * cloud's scheduledExecutionName, pinned by tests on both sides: two
+ * editions must never name the same fire's run differently (Go
+ * ScheduledExecutionName).
+ */
+export declare function scheduledExecutionName(scheduleResourceId: string, nominalFireTime: Date): string;
+/**
+ * Appends the fire-context line to the schedule's message, rendered in the
+ * schedule's own time zone (an unloadable zone degrades to UTC — a
+ * slightly wrong-timezone reminder beats a dead fire). Format-pinned: Go
+ * and the cloud produce the identical bytes, and the runner injects no
+ * current date into any prompt — this line is the ONLY way the model knows
+ * "today" (Go ComposeMessage, fireContextLayout "Monday, 2006-01-02 15:04").
+ */
+export declare function composeMessage(schedule: Schedule, nominalFireTime: Date): string;
+export interface RunStarterDeps {
+    readonly store: Store;
+    readonly config: ScheduleTemporalConfig;
+    readonly executions: ScheduleExecutionCreator;
+    /** The composed fire-caller mint, or undefined (the OSS internal lane). */
+    readonly fireCallerMint?: ScheduleFireCallerMint;
+    readonly logger: Logger;
+}
+export declare class RunStarter {
+    private readonly deps;
+    constructor(deps: RunStarterDeps);
+    /**
+     * Starts (or finds) this fire's run and stamps status.last_execution_id.
+     * Deterministic refusals come back as outcomes (the streak should count
+     * them); infrastructure failures come back as thrown errors (the tick
+     * activity retries, the deterministic name absorbs it). Go StartRun.
+     */
+    startRun(schedule: Schedule, nominalFireTime: Date): Promise<RunOutcomeResult>;
+    /**
+     * Loads the referenced agent, the reference's org defaulting to the
+     * schedule's own. An undefined agent with a reason means the
+     * deterministic dangling-reference failure (Go resolveTargetAgent).
+     */
+    private resolveTargetAgent;
+    /**
+     * Shapes the run: fresh session per fire with the pinned subject, the
+     * fire-context message, and the unattended execution profile.
+     * approval_mode=UNATTENDED is a correctness requirement, not a
+     * preference: a gated tool with no approver would park the execution
+     * forever (the agent workflow deliberately has no run timeout), which
+     * under tracking becomes a silently-burned budget every fire (Go
+     * buildExecutionRequest).
+     */
+    private buildExecutionRequest;
+    /**
+     * Records the run pointer on status. Failing this write throws so the
+     * activity retries and converges the pointer — the deterministic name
+     * makes the retry harmless (Go stampLastExecutionID).
+     */
+    private stampLastExecutionId;
+}
+/**
+ * Merges one owner-set run bound with its platform cap: zero (or negative)
+ * means "unset" on either side, and when both are set the LOWER value wins
+ * — the platform profile is a guardrail, never a floor (Go
+ * clampedRunBoundInt/Float, one function here because JS numbers carry
+ * both).
+ */
+export declare function clampedRunBound(owner: number, platform: number): number;
+//# sourceMappingURL=run-starter.d.ts.map

package/dist/temporal/schedule/run-starter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-starter.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/run-starter.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAWlG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAOtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGvF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAI1D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,gEAAgE;AAChE,MAAM,MAAM,gBAAgB;AAC1B,oFAAoF;AAClF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE;AACnE,qHAAqH;GACnH;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC3C,8FAA8F;GAC5F;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,CACJ,SAAS,EAAE,cAAc,EACzB,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,kBAAkB,EAAE,MAAM,EAC1B,eAAe,EAAE,IAAI,GACpB,MAAM,CAGR;AAQD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,IAAI,GACpB,MAAM,CAKR;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,cAAc;IAEjD;;;;;OAKG;IACG,QAAQ,CACZ,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,IAAI,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAiJ5B;;;;OAIG;YACW,kBAAkB;IAoChC;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAyF7B;;;;OAIG;YACW,oBAAoB;CAyBnC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQvE"}

package/dist/temporal/schedule/run-starter.js

@@ -0,0 +1,406 @@
+/**
+ * The RunStarter — ports pkg/domain/schedule/temporal/runstarter.go: turns
+ * one schedule fire into one AgentExecution through the in-process gRPC
+ * client, so the FULL create pipeline runs (session auto-create, execution
+ * context, persist, workflow start). Where the cloud starter mints a
+ * schedule token and re-enters the pipeline behind FGA gates, OSS has no
+ * caller identity by design (DD-015 D-G): the org is stamped from the
+ * schedule's own metadata. A composition restores the Java posture through
+ * the scheduleFireCaller driver point (stigmer-cloud#572): when composed,
+ * every fire mints its caller and the create propagates it via the R5
+ * in-process header; a mint failure propagates like any infrastructure
+ * fault (the tick activity retries, the trigger surfaces it).
+ *
+ * Idempotency is the CLOCK's job here (DD-015 D-F): the OSS create
+ * pipeline deliberately has no duplicate check (it would tax every
+ * execution create in the product), so the starter looks up its own
+ * deterministic execution name before creating. Within one tick activity
+ * retries are sequential, and across fires the nominal time disambiguates —
+ * one reminder per fire, by construction.
+ *
+ * Serves BOTH fire paths: the tick's start-run activity (origin=cron) and
+ * the trigger RPC's direct-run step (origin=manual, DD-017 D-5).
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionSpecSchema, ExecutionConfigSchema, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { ApprovalMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import { SessionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { scheduleModelPinningRefusal } from "./model-pinning.js";
+import { ensureStatus, bumpStatusAudit } from "./status-writes.js";
+/**
+ * The scheduled session's pinned subject prefix — cross-edition contract
+ * (an explicit subject also opts the session out of LLM titling,
+ * deliberately: a reminder session names itself). Go SessionSubjectPrefix.
+ */
+export const SESSION_SUBJECT_PREFIX = "Scheduled run: ";
+/**
+ * The audit link stamped on every schedule-created execution — the same
+ * key the cloud edition's scope step writes (Go ScheduleIDLabelKey).
+ *
+ * In OSS the label is also the environment-resolution key: the execution
+ * context step reads it to merge the schedule's environment_refs (DD-017
+ * D-4). Cloud deliberately resolves through the validated token claim
+ * instead — a client-suppliable label must not widen what a cloud sandbox
+ * reads — but OSS is single-user with no trust boundary, and it has no
+ * tokens to carry a claim (the DD-015 divergence posture).
+ */
+export const SCHEDULE_ID_LABEL_KEY = "stigmer.ai/schedule-id";
+/**
+ * THE idempotency key: schedule id (lowercased, underscores to hyphens —
+ * already slug-safe) plus the nominal fire time truncated to whole seconds
+ * in the cloud's "yyyyMMdd't'HHmmss'z'" layout. Byte-identical to the
+ * cloud's scheduledExecutionName, pinned by tests on both sides: two
+ * editions must never name the same fire's run differently (Go
+ * ScheduledExecutionName).
+ */
+export function scheduledExecutionName(scheduleResourceId, nominalFireTime) {
+    const idPart = scheduleResourceId.toLowerCase().replaceAll("_", "-");
+    return `${idPart}-${executionNameFireTime(nominalFireTime)}`;
+}
+/** Go executionNameFireTimeLayout "20060102t150405z", UTC whole seconds. */
+function executionNameFireTime(nominal) {
+    const p = utcParts(nominal);
+    return `${p.year}${p.month}${p.day}t${p.hour}${p.minute}${p.second}z`;
+}
+/**
+ * Appends the fire-context line to the schedule's message, rendered in the
+ * schedule's own time zone (an unloadable zone degrades to UTC — a
+ * slightly wrong-timezone reminder beats a dead fire). Format-pinned: Go
+ * and the cloud produce the identical bytes, and the runner injects no
+ * current date into any prompt — this line is the ONLY way the model knows
+ * "today" (Go ComposeMessage, fireContextLayout "Monday, 2006-01-02 15:04").
+ */
+export function composeMessage(schedule, nominalFireTime) {
+    const requested = schedule.spec?.timeZone ?? "";
+    const { zoneName, formatted } = fireContextLine(requested, nominalFireTime);
+    const baseMessage = invocationOf(schedule)?.message ?? "";
+    return `${baseMessage}\n\n(Scheduled fire time: ${formatted} (${zoneName}))`;
+}
+/**
+ * Renders "Monday, 2006-01-02 15:04" in the zone, with Go's zone-name
+ * echo: LoadLocation("") is UTC and prints "UTC"; an unloadable name
+ * degrades to UTC (ComposeMessage's fallback); a loadable name echoes
+ * byte-for-byte as given.
+ */
+function fireContextLine(requestedZone, nominal) {
+    let zone = requestedZone;
+    let parts;
+    try {
+        parts = fireContextFormatter(zone === "" ? "UTC" : zone).formatToParts(nominal);
+        if (zone === "") {
+            zone = "UTC";
+        }
+    }
+    catch {
+        zone = "UTC";
+        parts = fireContextFormatter("UTC").formatToParts(nominal);
+    }
+    const get = (type) => parts.find((part) => part.type === type)?.value ?? "";
+    const formatted = `${get("weekday")}, ${get("year")}-${get("month")}-${get("day")} ${get("hour")}:${get("minute")}`;
+    return { zoneName: zone, formatted };
+}
+function fireContextFormatter(timeZone) {
+    return new Intl.DateTimeFormat("en-US", {
+        timeZone,
+        weekday: "long",
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        hourCycle: "h23",
+    });
+}
+function utcParts(date) {
+    const pad = (value, width) => String(value).padStart(width, "0");
+    return {
+        year: pad(date.getUTCFullYear(), 4),
+        month: pad(date.getUTCMonth() + 1, 2),
+        day: pad(date.getUTCDate(), 2),
+        hour: pad(date.getUTCHours(), 2),
+        minute: pad(date.getUTCMinutes(), 2),
+        second: pad(date.getUTCSeconds(), 2),
+    };
+}
+function invocationOf(schedule) {
+    return schedule.spec?.target.case === "agent"
+        ? schedule.spec.target.value
+        : undefined;
+}
+export class RunStarter {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Starts (or finds) this fire's run and stamps status.last_execution_id.
+     * Deterministic refusals come back as outcomes (the streak should count
+     * them); infrastructure failures come back as thrown errors (the tick
+     * activity retries, the deterministic name absorbs it). Go StartRun.
+     */
+    async startRun(schedule, nominalFireTime) {
+        const { store, logger } = this.deps;
+        const scheduleId = schedule.metadata?.id ?? "";
+        const org = schedule.metadata?.org ?? "";
+        const resolved = await this.resolveTargetAgent(schedule);
+        if (resolved.agent === undefined) {
+            logger.warn("Schedule fire has no target agent", {
+                schedule_id: scheduleId,
+                reason: resolved.missingReason,
+            });
+            return { kind: "targetMissing", reason: resolved.missingReason };
+        }
+        // Launch backstop of the unattended model-pinning rule (#362):
+        // write-time validation holds this bar on every create and update, but
+        // rows written before the rule existed must refuse here rather than
+        // run Auto at the account default's price. A deterministic refusal
+        // feeds the failure streak, so a broken config pauses the schedule
+        // instead of burning silently every fire.
+        const pinningRefusal = scheduleModelPinningRefusal(schedule.spec);
+        if (pinningRefusal !== "") {
+            logger.error("Schedule fire refused by the model-pinning backstop", {
+                schedule_id: scheduleId,
+                reason: pinningRefusal,
+            });
+            return { kind: "refused", reason: pinningRefusal };
+        }
+        const executionName = scheduledExecutionName(scheduleId, nominalFireTime);
+        // The clock's own idempotency: a retried activity (or a duplicated
+        // fire at the same nominal time) finds the winner instead of sending
+        // the reminder twice. The deterministic name IS the execution's slug
+        // (every character is already slug-shaped, pinned by test).
+        let existing;
+        try {
+            existing = await findResourceBySlug(store, ApiResourceKind.agent_execution, AgentExecutionSchema, executionName, org);
+        }
+        catch (error) {
+            // Go's wrap label (runstarter.go): the activity retries either way;
+            // the label keeps history/trigger diagnostics identical.
+            throw new Error(`look up execution ${executionName}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+        if (existing !== undefined) {
+            const executionId = existing.metadata?.id ?? "";
+            logger.info("Schedule fire already has its execution (idempotent retry)", {
+                schedule_id: scheduleId,
+                execution_id: executionId,
+            });
+            await this.stampLastExecutionId(scheduleId, executionId);
+            return { kind: "started", executionId, alreadyExisted: true };
+        }
+        // The composed fire-caller mint (stigmer-cloud#572): minted per fire,
+        // after the idempotency lookup (a found winner needs no credential)
+        // and before the create it authenticates. Failure is an
+        // infrastructure fault — thrown, so the tick activity retries under
+        // the deterministic name and a manual trigger surfaces it.
+        let fireCaller;
+        if (this.deps.fireCallerMint !== undefined) {
+            try {
+                fireCaller = await this.deps.fireCallerMint.mintFireCaller(org, scheduleId);
+            }
+            catch (error) {
+                throw new Error(`mint schedule fire caller for ${scheduleId}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+            }
+        }
+        let created;
+        try {
+            created = await this.deps.executions.create(this.buildExecutionRequest(schedule, resolved.agent, executionName, nominalFireTime), fireCaller);
+        }
+        catch (error) {
+            if (!(error instanceof ConnectError)) {
+                throw error;
+            }
+            switch (error.code) {
+                case Code.AlreadyExists: {
+                    // The session auto-create's duplicate check can refuse even
+                    // though the execution create has none — re-read the winner. A
+                    // re-find ERROR carries the same diagnostic wrapper as a missing
+                    // winner (Go wraps findErr != nil || !found identically).
+                    let winner;
+                    try {
+                        winner = await findResourceBySlug(store, ApiResourceKind.agent_execution, AgentExecutionSchema, executionName, org);
+                    }
+                    catch (findError) {
+                        throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${findError instanceof Error ? findError.message : String(findError)}`, { cause: findError });
+                    }
+                    if (winner === undefined) {
+                        throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${error.message}`, { cause: error });
+                    }
+                    const executionId = winner.metadata?.id ?? "";
+                    await this.stampLastExecutionId(scheduleId, executionId);
+                    return { kind: "started", executionId, alreadyExisted: true };
+                }
+                case Code.FailedPrecondition:
+                case Code.PermissionDenied:
+                case Code.NotFound:
+                case Code.InvalidArgument:
+                case Code.ResourceExhausted:
+                    logger.error("Schedule fire refused by a launch gate", {
+                        schedule_id: scheduleId,
+                        org,
+                        code: Code[error.code],
+                        reason: error.rawMessage,
+                    });
+                    return { kind: "refused", reason: error.rawMessage };
+                default:
+                    throw error;
+            }
+        }
+        const executionId = created.metadata?.id ?? "";
+        await this.stampLastExecutionId(scheduleId, executionId);
+        return { kind: "started", executionId, alreadyExisted: false };
+    }
+    /**
+     * Loads the referenced agent, the reference's org defaulting to the
+     * schedule's own. An undefined agent with a reason means the
+     * deterministic dangling-reference failure (Go resolveTargetAgent).
+     */
+    async resolveTargetAgent(schedule) {
+        const ref = invocationOf(schedule)?.agentRef;
+        const slug = ref?.slug ?? "";
+        if (slug === "") {
+            return { missingReason: "schedule has no agent target" };
+        }
+        let org = ref?.org ?? "";
+        if (org === "") {
+            org = schedule.metadata?.org ?? "";
+        }
+        let agent;
+        try {
+            agent = await findResourceBySlug(this.deps.store, ApiResourceKind.agent, AgentSchema, slug, org);
+        }
+        catch (error) {
+            throw new Error(`resolve target agent ${org}/${slug}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+        if (agent === undefined) {
+            // The deterministic start-failure copy — cross-edition contract (the
+            // conformance firing suite asserts the pause reason built from it,
+            // byte-for-byte).
+            return { missingReason: `target agent ${org}/${slug} not found` };
+        }
+        return { agent, missingReason: "" };
+    }
+    /**
+     * Shapes the run: fresh session per fire with the pinned subject, the
+     * fire-context message, and the unattended execution profile.
+     * approval_mode=UNATTENDED is a correctness requirement, not a
+     * preference: a gated tool with no approver would park the execution
+     * forever (the agent workflow deliberately has no run timeout), which
+     * under tracking becomes a silently-burned budget every fire (Go
+     * buildExecutionRequest).
+     */
+    buildExecutionRequest(schedule, agent, executionName, nominalFireTime) {
+        const invocation = invocationOf(schedule);
+        const runConfig = invocation?.runConfig;
+        const executionConfig = create(ExecutionConfigSchema, {
+            approvalMode: ApprovalMode.UNATTENDED,
+            // The platform profile, then the schedule's own run_config CLAMPED
+            // by it (DD-017 D-3): per field, min(owner, platform) when the
+            // platform cap is set; the owner value stands when the platform cap
+            // is unset. The owner can lower spend, never raise it past the
+            // platform.
+            maxToolRounds: clampedRunBound(runConfig?.maxToolRounds ?? 0, this.deps.config.executionProfileMaxToolRounds),
+            maxCostUsd: clampedRunBound(runConfig?.maxCostUsd ?? 0, this.deps.config.executionProfileMaxCostUsd),
+        });
+        const model = (runConfig?.modelName ?? "").trim();
+        if (model !== "") {
+            executionConfig.modelName = model;
+        }
+        // service_tier stamps when the owner set one — there is no platform
+        // tier knob (unset resolves to STANDARD in the runner, never the
+        // provider account default). Tier-model coherence was validated
+        // fail-closed at execution create (#357).
+        if (runConfig !== undefined &&
+            runConfig.serviceTier !== ServiceTier.UNSPECIFIED) {
+            executionConfig.serviceTier = runConfig.serviceTier;
+        }
+        // thinking_mode under the same contract as service_tier: only when the
+        // owner set one; capability-model coherence was validated fail-closed
+        // at execution create (#772).
+        if (runConfig !== undefined &&
+            runConfig.thinkingMode !== ThinkingMode.UNSPECIFIED) {
+            executionConfig.thinkingMode = runConfig.thinkingMode;
+        }
+        // The fresh per-fire session speaks the invocation's session half
+        // (DD-018 D-3): harness and workspace come from the owner's spec. An
+        // unspecified harness stays unset — the platform default applies (OSS:
+        // native). Workspace entries are git-only by write-time validation;
+        // credentials, when a repo is private, ride an org-shared environment
+        // holding GITHUB_TOKEN (DD-018 D-4).
+        const sessionSpec = create(SessionSpecSchema, {
+            subject: SESSION_SUBJECT_PREFIX + (schedule.metadata?.slug ?? ""),
+            workspaceEntries: invocation?.workspaceEntries ?? [],
+        });
+        if (invocation !== undefined &&
+            invocation.harness !== Harness.UNSPECIFIED) {
+            sessionSpec.harness = invocation.harness;
+        }
+        return create(AgentExecutionSchema, {
+            apiVersion: "agentic.stigmer.ai/v1",
+            kind: "AgentExecution",
+            metadata: create(ApiResourceMetadataSchema, {
+                name: executionName,
+                // Cloud deliberately omits the org (its token scope step forces it
+                // from the validated claim); OSS has no token, so the schedule's
+                // own org is stamped directly — it is load-bearing for the session
+                // and execution context.
+                org: schedule.metadata?.org ?? "",
+                // The audit link (DD-008 D4) AND this edition's
+                // environment-resolution key — see SCHEDULE_ID_LABEL_KEY.
+                labels: { [SCHEDULE_ID_LABEL_KEY]: schedule.metadata?.id ?? "" },
+            }),
+            spec: create(AgentExecutionSpecSchema, {
+                agentId: agent.metadata?.id ?? "",
+                message: composeMessage(schedule, nominalFireTime),
+                sessionSpec,
+                executionConfig,
+            }),
+        });
+    }
+    /**
+     * Records the run pointer on status. Failing this write throws so the
+     * activity retries and converges the pointer — the deterministic name
+     * makes the retry harmless (Go stampLastExecutionID).
+     */
+    async stampLastExecutionId(scheduleId, executionId) {
+        try {
+            await this.deps.store.updateResource(ApiResourceKind.schedule, scheduleId, ScheduleSchema, (live) => {
+                const status = ensureStatus(live);
+                status.lastExecutionId = executionId;
+                bumpStatusAudit(status);
+            });
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return; // deleted mid-fire: nothing to stamp
+            }
+            throw new Error(`stamp last_execution_id on schedule ${scheduleId}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+    }
+}
+/**
+ * Merges one owner-set run bound with its platform cap: zero (or negative)
+ * means "unset" on either side, and when both are set the LOWER value wins
+ * — the platform profile is a guardrail, never a floor (Go
+ * clampedRunBoundInt/Float, one function here because JS numbers carry
+ * both).
+ */
+export function clampedRunBound(owner, platform) {
+    if (owner <= 0) {
+        return Math.max(platform, 0);
+    }
+    if (platform <= 0) {
+        return owner;
+    }
+    return Math.min(owner, platform);
+}
+//# sourceMappingURL=run-starter.js.map

package/dist/temporal/schedule/run-starter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-starter.js","sourceRoot":"","sources":["../../../src/temporal/schedule/run-starter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EACL,WAAW,EACX,YAAY,GACb,MAAM,8DAA8D,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAGvF,OAAO,EAAE,OAAO,EAAE,MAAM,uDAAuD,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AAKvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AA0B9D;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,kBAA0B,EAC1B,eAAqB;IAErB,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,GAAG,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,SAAS,qBAAqB,CAAC,OAAa;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,eAAqB;IAErB,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAChD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1D,OAAO,GAAG,WAAW,6BAA6B,SAAS,KAAK,QAAQ,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,aAAqB,EACrB,OAAa;IAEb,IAAI,IAAI,GAAG,aAAa,CAAC;IACzB,IAAI,KAAgC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,KAAK,CAAC;QACb,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAqC,EAAU,EAAE,CAC5D,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QACtC,QAAQ;QACR,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAQ1B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CACnD,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB;IACtC,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,OAAO;QAC3C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAWD,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;IAAG,CAAC;IAErD;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,QAAkB,EAClB,eAAqB;QAErB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC/C,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,QAAQ,CAAC,aAAa;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnE,CAAC;QAED,+DAA+D;QAC/D,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,0CAA0C;QAC1C,MAAM,cAAc,GAAG,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE;gBAClE,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAE1E,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,4DAA4D;QAC5D,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,kBAAkB,CACjC,KAAK,EACL,eAAe,CAAC,eAAe,EAC/B,oBAAoB,EACpB,aAAa,EACb,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;gBACxE,WAAW,EAAE,UAAU;gBACvB,YAAY,EAAE,WAAW;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,wDAAwD;QACxD,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,UAAsC,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CACxD,GAAG,EACH,UAAU,CACX,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,iCAAiC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CACzC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,CAAC,EACpF,UAAU,CACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;oBACxB,4DAA4D;oBAC5D,+DAA+D;oBAC/D,iEAAiE;oBACjE,0DAA0D;oBAC1D,IAAI,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,GAAG,MAAM,kBAAkB,CAC/B,KAAK,EACL,eAAe,CAAC,eAAe,EAC/B,oBAAoB,EACpB,aAAa,EACb,GAAG,CACJ,CAAC;oBACJ,CAAC;oBAAC,OAAO,SAAS,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CACb,oDAAoD,aAAa,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAC1I,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,IAAI,KAAK,CACb,oDAAoD,aAAa,KAAK,KAAK,CAAC,OAAO,EAAE,EACrF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;oBACJ,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;oBAC9C,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;oBACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;gBAChE,CAAC;gBACD,KAAK,IAAI,CAAC,kBAAkB,CAAC;gBAC7B,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,KAAK,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,IAAI,CAAC,eAAe,CAAC;gBAC1B,KAAK,IAAI,CAAC,iBAAiB;oBACzB,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;wBACrD,WAAW,EAAE,UAAU;wBACvB,GAAG;wBACH,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBACtB,MAAM,EAAE,KAAK,CAAC,UAAU;qBACzB,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvD;oBACE,MAAM,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC9B,QAAkB;QAElB,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,aAAa,EAAE,8BAA8B,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,KAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,kBAAkB,CAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,EACf,eAAe,CAAC,KAAK,EACrB,WAAW,EACX,IAAI,EACJ,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,IAAI,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAChG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,qEAAqE;YACrE,mEAAmE;YACnE,kBAAkB;YAClB,OAAO,EAAE,aAAa,EAAE,gBAAgB,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAC3B,QAAkB,EAClB,KAAY,EACZ,aAAqB,EACrB,eAAqB;QAErB,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,UAAU,EAAE,SAAS,CAAC;QAExC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,EAAE;YACpD,YAAY,EAAE,YAAY,CAAC,UAAU;YACrC,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY;YACZ,aAAa,EAAE,eAAe,CAC5B,SAAS,EAAE,aAAa,IAAI,CAAC,EAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAC/C;YACD,UAAU,EAAE,eAAe,CACzB,SAAS,EAAE,UAAU,IAAI,CAAC,EAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC5C;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,eAAe,CAAC,SAAS,GAAG,KAAK,CAAC;QACpC,CAAC;QACD,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;QAChE,0CAA0C;QAC1C,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EACjD,CAAC;YACD,eAAe,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QACtD,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,8BAA8B;QAC9B,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,CAAC,YAAY,KAAK,YAAY,CAAC,WAAW,EACnD,CAAC;YACD,eAAe,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QACxD,CAAC;QAED,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,EAAE;YAC5C,OAAO,EAAE,sBAAsB,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YACjE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,IAAI,EAAE;SACrD,CAAC,CAAC;QACH,IACE,UAAU,KAAK,SAAS;YACxB,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAC1C,CAAC;YACD,WAAW,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAC3C,CAAC;QAED,OAAO,MAAM,CAAC,oBAAoB,EAAE;YAClC,UAAU,EAAE,uBAAuB;YACnC,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,MAAM,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,aAAa;gBACnB,mEAAmE;gBACnE,iEAAiE;gBACjE,mEAAmE;gBACnE,yBAAyB;gBACzB,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBACjC,gDAAgD;gBAChD,0DAA0D;gBAC1D,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE;aACjE,CAAC;YACF,IAAI,EAAE,MAAM,CAAC,wBAAwB,EAAE;gBACrC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACjC,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC;gBAClD,WAAW;gBACX,eAAe;aAChB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAAkB,EAClB,WAAmB;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAClC,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,cAAc,EACd,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,eAAe,GAAG,WAAW,CAAC;gBACrC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,CAAC,qCAAqC;YAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uCAAuC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC"}

package/dist/temporal/schedule/status-writes.d.ts

@@ -0,0 +1,14 @@
+import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import type { ScheduleStatus } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/status_pb";
+/**
+ * Returns the schedule's status, materializing the nested message a fresh
+ * row may lack (Go ensureStatus).
+ */
+export declare function ensureStatus(schedule: Schedule): ScheduleStatus;
+/**
+ * Stamps the status-audit trail for a runtime write — updated_at + event
+ * "updated", nothing else (Go bumpStatusAudit; see the module header for
+ * why this is not setAuditFieldsForUpdate).
+ */
+export declare function bumpStatusAudit(status: ScheduleStatus): void;
+//# sourceMappingURL=status-writes.d.ts.map

package/dist/temporal/schedule/status-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-writes.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0DAA0D,CAAC;AAM/F;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAK/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAS5D"}

package/dist/temporal/schedule/status-writes.js

@@ -0,0 +1,43 @@
+/**
+ * The clock's status-write helpers — port the ensureStatus/bumpStatusAudit
+ * pair of pkg/domain/schedule/temporal/syncer.go.
+ *
+ * bumpStatusAudit is DELIBERATELY narrower than the shared
+ * setAuditFieldsForUpdate: Go's clock stamps only status-audit
+ * updated_at + event ("the same two leaves every cloud runtime patch
+ * bumps") and never an actor — the clock is the platform, not an operator.
+ * Controller-side status writes (trigger's last_fire_at stamp, resume's
+ * clear) use the FULL shared helper instead, exactly as Go splits
+ * steps.SetAuditFieldsForUpdate from the clock's bump. Two flavors, two
+ * writers, both wire-visible — keep them distinct.
+ */
+import { create } from "@bufbuild/protobuf";
+import { timestampNow } from "@bufbuild/protobuf/wkt";
+import { ScheduleStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/status_pb";
+import { ApiResourceAuditInfoSchema, ApiResourceAuditSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+/**
+ * Returns the schedule's status, materializing the nested message a fresh
+ * row may lack (Go ensureStatus).
+ */
+export function ensureStatus(schedule) {
+    if (schedule.status === undefined) {
+        schedule.status = create(ScheduleStatusSchema);
+    }
+    return schedule.status;
+}
+/**
+ * Stamps the status-audit trail for a runtime write — updated_at + event
+ * "updated", nothing else (Go bumpStatusAudit; see the module header for
+ * why this is not setAuditFieldsForUpdate).
+ */
+export function bumpStatusAudit(status) {
+    if (status.audit === undefined) {
+        status.audit = create(ApiResourceAuditSchema);
+    }
+    if (status.audit.statusAudit === undefined) {
+        status.audit.statusAudit = create(ApiResourceAuditInfoSchema);
+    }
+    status.audit.statusAudit.updatedAt = timestampNow();
+    status.audit.statusAudit.event = "updated";
+}
+//# sourceMappingURL=status-writes.js.map

package/dist/temporal/schedule/status-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-writes.js","sourceRoot":"","sources":["../../../src/temporal/schedule/status-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0DAA0D,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,SAAS,CAAC;AAC7C,CAAC"}