@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/agentexecution/submit-file-decision.js

@@ -0,0 +1,286 @@
+/**
+ * SubmitFileDecision — ports controller/submit_file_decision.go: the
+ * backend-owned writer of FILE_DECIDED events on the append-only
+ * file_review stream (apply-then-review HITL). FileChangeSet.decisions is
+ * the derived projection; the runner's reconcile applies the approved
+ * bytes — this RPC records the decision and enforces that
+ * expected_digest still matches the captured content the user reviewed
+ * ("what you approve is what gets applied").
+ *
+ * Chain mirrors the approval pipeline: ValidateProto → LoadExisting →
+ * ValidateDecision → RecordFileDecision → SignalWorkflow →
+ * BuildResponse. The signal is the SAME approvalGateResolved — the HITL
+ * gate is unified, so a turn blocked on file review (and possibly tool
+ * approvals too) resumes through one signal and one wait. Unlike
+ * approvals, a file REJECT has no immediate-resume shortcut — every file
+ * in the set must be decided (or one CHANGE_SET-scoped decision cover
+ * them) before the runner reconciles.
+ *
+ * Idempotency: a decision with the same deterministic event id already on
+ * the stream is a no-op answering current state.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ConnectError } from "@connectrpc/connect";
+import { AgentExecutionSchema, AgentExecutionStatusSchema, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
+import { ExecutionPhase, ExecutionPhaseSchema, FileDecisionAction, FileDecisionActionSchema, FileDecisionScope, FileDecisionScopeSchema, FileReviewEventType, MessageType, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { enumToJson } from "@bufbuild/protobuf";
+import { failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "../../pipeline/errors.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { EngineWorkflowNotFoundError } from "./engine.js";
+import { buildFileDecision, eventId as fileReviewEventId, findChange, findChangeSet, approveBlockedReason, recordFileDecisionEvent, targetDigest, } from "./filereview/author.js";
+import { countAwaitingReview, gateResolved } from "./filereview/gate.js";
+import { projectFileChangeSets } from "./filereview/project.js";
+import { notifyStatusObservers } from "./status-observers.js";
+import { settleInterruptedToolCalls } from "./tool-call-settle.js";
+// Go's key strings, verbatim.
+const FILE_DECISION_IDEMPOTENT_KEY = "isIdempotentFileDecision";
+const TARGET_RESOURCE_KEY = "targetResource";
+export async function submitFileDecision(deps, input, identity) {
+    const reqCtx = new RequestContext(AgentExecutionCommandController.method.submitFileDecision.input, input, identity, ApiResourceKind.agent_execution);
+    await newPipeline("agent-execution-submit-file-decision", deps.logger)
+        .addStep(newAuthorizeStep(AgentExecutionCommandController.method.submitFileDecision, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep({
+        name: "LoadExisting",
+        async execute(ctx) {
+            const executionId = ctx.input.agentExecutionId;
+            if (executionId === "") {
+                throw invalidArgumentError("agent_execution_id is required");
+            }
+            let execution;
+            try {
+                execution = await deps.store.getResource(ApiResourceKind.agent_execution, executionId, AgentExecutionSchema);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    throw notFoundError("agent_execution", executionId);
+                }
+                throw internalError(error, "failed to load agent execution");
+            }
+            ctx.set(TARGET_RESOURCE_KEY, execution);
+        },
+    })
+        .addStep({
+        name: "ValidateDecision",
+        execute(ctx) {
+            const execution = ctx.get(TARGET_RESOURCE_KEY);
+            validateFileDecisionTarget(execution, ctx.input);
+            // Idempotency: the same deterministic event id already on the
+            // stream means this exact decision was recorded.
+            if (streamHasFileDecision(execution.status?.fileReviewEventStream, ctx.input)) {
+                deps.logger.info("IDEMPOTENT: file decision already recorded", {
+                    executionId: execution.metadata?.id ?? "",
+                    changeSetId: ctx.input.changeSetId,
+                    fileChangeId: ctx.input.fileChangeId,
+                });
+                ctx.set(FILE_DECISION_IDEMPOTENT_KEY, true);
+            }
+        },
+    })
+        .addStep({
+        name: "RecordFileDecision",
+        async execute(ctx) {
+            if (ctx.get(FILE_DECISION_IDEMPOTENT_KEY) === true) {
+                return;
+            }
+            const executionId = ctx.input.agentExecutionId;
+            const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+            // OSS is single-user with no multi-tenant auth context, so the
+            // reviewer is empty; the Cloud edition populates reviewer_id from
+            // the authenticated caller.
+            const reviewerId = "";
+            let updated;
+            try {
+                updated = await deps.store.updateResource(ApiResourceKind.agent_execution, executionId, AgentExecutionSchema, (execution) => {
+                    // Re-validate under the write lock against the
+                    // freshly-loaded state (guards against a capture/decision
+                    // that landed between the pre-lock validation and this
+                    // update).
+                    validateFileDecisionTarget(execution, ctx.input);
+                    if (execution.status === undefined) {
+                        execution.status = create(AgentExecutionStatusSchema);
+                    }
+                    const decision = buildFileDecision(ctx.input.changeSetId, ctx.input.fileChangeId, ctx.input.scope, ctx.input.action, ctx.input.expectedDigest, reviewerId, now, ctx.input.reason, ctx.input.acknowledgeUnreviewable);
+                    recordFileDecisionEvent(execution.status, executionId, decision);
+                    // Recompute file_change_sets from the authored ledger via
+                    // the single projection seam, so the new decision reflects
+                    // immediately and consistently with the source of truth.
+                    execution.status.fileChangeSets = projectFileChangeSets(execution.status.phase, execution.status.fileReviewEventStream);
+                });
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    throw notFoundError("agent_execution", executionId);
+                }
+                // A precondition failure re-detected under the lock is already a
+                // status error (client fault); surface it verbatim rather than
+                // masking it as INTERNAL.
+                if (error instanceof ConnectError) {
+                    throw error;
+                }
+                throw internalError(error, "failed to persist file decision");
+            }
+            deps.broker.broadcast(updated);
+            ctx.set(TARGET_RESOURCE_KEY, updated);
+        },
+    })
+        .addStep({
+        name: "SignalWorkflow",
+        async execute(ctx) {
+            if (ctx.get(FILE_DECISION_IDEMPOTENT_KEY) === true) {
+                deps.logger.debug("Skipping workflow signal for idempotent file decision");
+                return;
+            }
+            const engine = deps.engineState();
+            if (!engine.connected) {
+                deps.logger.warn("Workflow creator not available - skipping Temporal signal");
+                return;
+            }
+            const execution = ctx.get(TARGET_RESOURCE_KEY);
+            const executionId = execution.metadata?.id ?? "";
+            const status = execution.status;
+            // Resume only when the WHOLE gate is clear: no change set awaiting
+            // review and no tool approval pending.
+            if (status === undefined || !gateResolved(status)) {
+                deps.logger.info("File decision recorded, HITL gate not yet resolved — waiting", {
+                    executionId,
+                    changeSetId: ctx.input.changeSetId,
+                    pendingApprovalsRemaining: status?.pendingApprovals.length ?? 0,
+                    changeSetsAwaitingReview: countAwaitingReview(status?.fileChangeSets ?? []),
+                });
+                return;
+            }
+            deps.logger.info("HITL gate resolved by file decision — sending approvalGateResolved signal", { executionId, changeSetId: ctx.input.changeSetId });
+            try {
+                await engine.engine.signalApprovalGateResolved(executionId);
+            }
+            catch (error) {
+                if (error instanceof EngineWorkflowNotFoundError) {
+                    deps.logger.warn("Workflow not found - reconciling stale execution status to FAILED", { executionId });
+                    await reconcileStaleFileReviewExecution(deps, execution);
+                    throw failedPreconditionError(`workflow not running for execution ${executionId} - the backing workflow has terminated unexpectedly and the execution has been marked as failed`);
+                }
+                throw unavailableError(`failed to signal workflow: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            deps.logger.info("Successfully sent approvalGateResolved signal to workflow", { executionId });
+        },
+    })
+        .addStep({
+        name: "BuildResponse",
+        execute(ctx) {
+            const execution = ctx.get(TARGET_RESOURCE_KEY);
+            deps.logger.info("AUDIT: File decision submitted", {
+                executionId: execution.metadata?.id ?? "",
+                org: execution.metadata?.org ?? "",
+                changeSetId: ctx.input.changeSetId,
+                fileChangeId: ctx.input.fileChangeId,
+                scope: enumToJson(FileDecisionScopeSchema, ctx.input.scope),
+                action: enumToJson(FileDecisionActionSchema, ctx.input.action),
+            });
+        },
+    })
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * Enforces the preconditions against the current projection: non-terminal
+ * execution, change set (and file) existence, the FILE-scope
+ * file_change_id requirement, the APPROVE completeness gate, and the
+ * expected_digest enforcement gate. Shared by the pre-lock validate step
+ * and the under-lock re-check (Go validateFileDecisionTarget).
+ */
+function validateFileDecisionTarget(execution, input) {
+    const executionId = execution.metadata?.id ?? "";
+    const phase = execution.status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
+    const changeSets = projectFileChangeSets(phase, execution.status?.fileReviewEventStream);
+    if (changeSets.length === 0) {
+        throw failedPreconditionError(`execution ${executionId} has no actionable file change sets (phase ${enumToJson(ExecutionPhaseSchema, phase)})`);
+    }
+    const cs = findChangeSet(changeSets, input.changeSetId);
+    if (cs === undefined) {
+        throw failedPreconditionError(`change set ${input.changeSetId} not found for execution ${executionId}`);
+    }
+    if (input.scope === FileDecisionScope.FILE) {
+        if (input.fileChangeId === "") {
+            throw invalidArgumentError("file_change_id is required for FILE scope");
+        }
+        if (findChange(cs, input.fileChangeId) === undefined) {
+            throw failedPreconditionError(`file change ${input.fileChangeId} not found in change set ${input.changeSetId}`);
+        }
+    }
+    // Completeness precondition: a non-COMPLETE diff can never be approved
+    // as if complete. Gated before the digest check and only for APPROVE,
+    // so an unreviewable change stays discardable (REJECT) and the turn can
+    // still resume.
+    if (input.action === FileDecisionAction.APPROVE) {
+        const reason = approveBlockedReason(cs, input.scope, input.fileChangeId, input.acknowledgeUnreviewable);
+        if (reason !== "") {
+            throw failedPreconditionError(reason);
+        }
+    }
+    const target = targetDigest(cs, input.scope, input.fileChangeId);
+    if (input.expectedDigest !== target) {
+        throw invalidArgumentError(`expected_digest mismatch for change set ${input.changeSetId}: the captured content changed since it was reviewed`);
+    }
+}
+function streamHasFileDecision(stream, input) {
+    let scopeId = input.changeSetId;
+    if (input.scope === FileDecisionScope.FILE) {
+        scopeId = input.fileChangeId;
+    }
+    const id = fileReviewEventId(input.changeSetId, scopeId, FileReviewEventType.FILE_DECIDED);
+    return (stream?.events ?? []).some((ev) => ev.eventId === id);
+}
+/**
+ * Marks an execution FAILED when its backing workflow is gone — the
+ * file-review twin of the approval path's reconcile; BOTH append-only
+ * ledgers are preserved verbatim for the audit trail, the projections
+ * left empty (terminal).
+ */
+async function reconcileStaleFileReviewExecution(deps, execution) {
+    const executionId = execution.metadata?.id ?? "";
+    const reconciled = create(AgentExecutionSchema, {
+        apiVersion: execution.apiVersion,
+        kind: execution.kind,
+        metadata: execution.metadata,
+        spec: execution.spec,
+        status: {
+            phase: ExecutionPhase.EXECUTION_FAILED,
+            error: "Workflow backing this execution is no longer running. Execution has been marked as failed.",
+            messages: execution.status?.messages ?? [],
+            audit: execution.status?.audit,
+            approvalEventStream: execution.status?.approvalEventStream,
+            fileReviewEventStream: execution.status?.fileReviewEventStream,
+        },
+    });
+    reconciled.status?.messages.push(create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content: "The workflow backing this execution is no longer running. This can happen due to infrastructure issues or manual termination. The execution has been marked as failed.",
+    }));
+    // Any in-flight tool call is still non-terminal; this write
+    // terminalizes the execution, so settle them (issue #207).
+    settleInterruptedToolCalls(reconciled.status, new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));
+    try {
+        await deps.store.saveResource(ApiResourceKind.agent_execution, executionId, AgentExecutionSchema, reconciled);
+    }
+    catch (error) {
+        deps.logger.error("Failed to reconcile stale execution status - execution will remain in WAITING_FOR_APPROVAL until next attempt", {
+            executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    deps.logger.info("RECONCILIATION: Updated stale file-review execution status to FAILED", { executionId });
+    // O4 site 5 of 5 (status-observers.ts): the reconcile's →FAILED stamp
+    // is a persisted terminal transition.
+    await notifyStatusObservers(deps, reconciled, execution.status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED, ExecutionPhase.EXECUTION_FAILED);
+}
+//# sourceMappingURL=submit-file-decision.js.map

package/dist/domain/agentexecution/submit-file-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submit-file-decision.js","sourceRoot":"","sources":["../../../src/domain/agentexecution/submit-file-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,GACZ,MAAM,8DAA8D,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iEAAiE,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAIjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,OAAO,IAAI,iBAAiB,EAC5B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAiBnE,8BAA8B;AAC9B,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AAChE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B,EAC5B,KAA8B,EAC9B,QAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAC/D,KAAK,EACL,QAAQ,EACR,eAAe,CAAC,eAAe,CAChC,CAAC;IACF,MAAM,WAAW,CACf,sCAAsC,EACtC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,kBAAkB,EACzD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC;QACP,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC/C,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACvB,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,SAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CACtC,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;SACD,OAAO,CAAC;QACP,IAAI,EAAE,kBAAkB;QACxB,OAAO,CAAC,GAAG;YACT,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAmB,CAAC;YACjE,0BAA0B,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAEjD,8DAA8D;YAC9D,iDAAiD;YACjD,IACE,qBAAqB,CACnB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EACvC,GAAG,CAAC,KAAK,CACV,EACD,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBAC7D,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACzC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW;oBAClC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY;iBACrC,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KACF,CAAC;SACD,OAAO,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/D,+DAA+D;YAC/D,kEAAkE;YAClE,4BAA4B;YAC5B,MAAM,UAAU,GAAG,EAAE,CAAC;YAEtB,IAAI,OAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CACvC,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,EACpB,CAAC,SAAS,EAAE,EAAE;oBACZ,+CAA+C;oBAC/C,0DAA0D;oBAC1D,uDAAuD;oBACvD,WAAW;oBACX,0BAA0B,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;oBACjD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACnC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBACxD,CAAC;oBAED,MAAM,QAAQ,GAAG,iBAAiB,CAChC,GAAG,CAAC,KAAK,CAAC,WAAW,EACrB,GAAG,CAAC,KAAK,CAAC,YAAY,EACtB,GAAG,CAAC,KAAK,CAAC,KAAK,EACf,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,GAAG,CAAC,KAAK,CAAC,cAAc,EACxB,UAAU,EACV,GAAG,EACH,GAAG,CAAC,KAAK,CAAC,MAAM,EAChB,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAClC,CAAC;oBACF,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;oBAEjE,0DAA0D;oBAC1D,2DAA2D;oBAC3D,yDAAyD;oBACzD,SAAS,CAAC,MAAM,CAAC,cAAc,GAAG,qBAAqB,CACrD,SAAS,CAAC,MAAM,CAAC,KAAK,EACtB,SAAS,CAAC,MAAM,CAAC,qBAAqB,CACvC,CAAC;gBACJ,CAAC,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACtD,CAAC;gBACD,iEAAiE;gBACjE,+DAA+D;gBAC/D,0BAA0B;gBAC1B,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;SACD,OAAO,CAAC;QACP,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uDAAuD,CACxD,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,CAC5D,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAmB,CAAC;YACjE,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAEhC,mEAAmE;YACnE,uCAAuC;YACvC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8DAA8D,EAC9D;oBACE,WAAW;oBACX,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW;oBAClC,yBAAyB,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,IAAI,CAAC;oBAC/D,wBAAwB,EAAE,mBAAmB,CAC3C,MAAM,EAAE,cAAc,IAAI,EAAE,CAC7B;iBACF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2EAA2E,EAC3E,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CACpD,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mEAAmE,EACnE,EAAE,WAAW,EAAE,CAChB,CAAC;oBACF,MAAM,iCAAiC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACzD,MAAM,uBAAuB,CAC3B,sCAAsC,WAAW,iGAAiG,CACnJ,CAAC;gBACJ,CAAC;gBACD,MAAM,gBAAgB,CACpB,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D,EAAE,WAAW,EAAE,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;SACD,OAAO,CAAC;QACP,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAG;YACT,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAmB,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACjD,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACzC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAClC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW;gBAClC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY;gBACpC,KAAK,EAAE,UAAU,CAAC,uBAAuB,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC3D,MAAM,EAAE,UAAU,CAAC,wBAAwB,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;SACD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAmB,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CACjC,SAAyB,EACzB,KAA8B;IAE9B,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,KAAK,GACT,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,CAAC;IAExE,MAAM,UAAU,GAAG,qBAAqB,CACtC,KAAK,EACL,SAAS,CAAC,MAAM,EAAE,qBAAqB,CACxC,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,uBAAuB,CAC3B,aAAa,WAAW,8CAA8C,UAAU,CAAC,oBAAoB,EAAE,KAAK,CAAW,GAAG,CAC3H,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,uBAAuB,CAC3B,cAAc,KAAK,CAAC,WAAW,4BAA4B,WAAW,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CAAC,2CAA2C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,uBAAuB,CAC3B,eAAe,KAAK,CAAC,YAAY,4BAA4B,KAAK,CAAC,WAAW,EAAE,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,gBAAgB;IAChB,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,oBAAoB,CACjC,EAAE,EACF,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,uBAAuB,CAC9B,CAAC;QACF,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,oBAAoB,CACxB,2CAA2C,KAAK,CAAC,WAAW,sDAAsD,CACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyC,EACzC,KAA8B;IAE9B,IAAI,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,GAAG,iBAAiB,CAC1B,KAAK,CAAC,WAAW,EACjB,OAAO,EACP,mBAAmB,CAAC,YAAY,CACjC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iCAAiC,CAC9C,IAA4B,EAC5B,SAAyB;IAEzB,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAEjD,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,EAAE;QAC9C,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE;YACN,KAAK,EAAE,cAAc,CAAC,gBAAgB;YACtC,KAAK,EACH,4FAA4F;YAC9F,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE;YAC1C,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK;YAC9B,mBAAmB,EAAE,SAAS,CAAC,MAAM,EAAE,mBAAmB;YAC1D,qBAAqB,EAAE,SAAS,CAAC,MAAM,EAAE,qBAAqB;SAC/D;KACF,CAAC,CAAC;IACH,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAC9B,MAAM,CAAC,kBAAkB,EAAE;QACzB,IAAI,EAAE,WAAW,CAAC,cAAc;QAChC,OAAO,EACL,wKAAwK;KAC3K,CAAC,CACH,CAAC;IAEF,4DAA4D;IAC5D,2DAA2D;IAC3D,0BAA0B,CACxB,UAAU,CAAC,MAAM,EACjB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAC3B,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,EACpB,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+GAA+G,EAC/G;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sEAAsE,EACtE,EAAE,WAAW,EAAE,CAChB,CAAC;IAEF,sEAAsE;IACtE,sCAAsC;IACtC,MAAM,qBAAqB,CACzB,IAAI,EACJ,UAAU,EACV,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,EACrE,cAAc,CAAC,gBAAgB,CAChC,CAAC;AACJ,CAAC"}

package/dist/domain/agentexecution/subscribe.d.ts

@@ -0,0 +1,16 @@
+import type { HandlerContext } from "@connectrpc/connect";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecutionId } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { Store } from "../../store/interface.js";
+import type { StreamBroker } from "./stream-broker.js";
+export interface SubscribeDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    readonly broker: StreamBroker;
+    /** The composed authorization seam — the pre-stream check below (C2 Stage 4). */
+    readonly authorizer: Authorizer;
+}
+export declare function subscribeExecution(deps: SubscribeDeps, executionId: AgentExecutionId, context: HandlerContext): AsyncGenerator<AgentExecution>;
+//# sourceMappingURL=subscribe.d.ts.map

package/dist/domain/agentexecution/subscribe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../../src/domain/agentexecution/subscribe.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAElG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4DAA4D,CAAC;AAKnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAOjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,wBAAuB,kBAAkB,CACvC,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,gBAAgB,EAC7B,OAAO,EAAE,cAAc,GACtB,cAAc,CAAC,cAAc,CAAC,CA+FhC"}

package/dist/domain/agentexecution/subscribe.js

@@ -0,0 +1,120 @@
+/**
+ * Subscribe — ports controller/subscribe.go: the real-time execution
+ * stream (ADR 011 read path). The first DOMAIN server-streaming RPC on
+ * the TS server; the generator shape follows transport/health.ts watch,
+ * the transport's proven streaming idiom.
+ *
+ * Go drives the stream from inside a two-step pipeline by smuggling the
+ * gRPC stream object through the request context; ConnectRPC models
+ * server streams as async generators, which cannot yield from inside the
+ * pipeline executor — so the validate step collapses to the same guard
+ * inline and the StreamExecution step's body IS this generator. Every
+ * delivery rule ports verbatim:
+ *
+ *   - REGISTER-BEFORE-SNAPSHOT (the gap fix): the broker registration
+ *     happens before the snapshot read. Store writes serialize under the
+ *     per-resource write lock and UpdateStatus broadcasts only after its
+ *     persist commits, so any commit the snapshot missed broadcasts after
+ *     our registration — nothing lands in the old lossy window.
+ *   - The overlap frame (a commit the snapshot DID observe) arrives
+ *     value-equal to the snapshot; the consecutive-duplicate guard drops
+ *     it (Go sameFrame/proto.Equal) so clients never re-render an
+ *     identical state.
+ *   - The stream ends on a terminal BROADCAST frame; a terminal SNAPSHOT
+ *     leaves the stream open (Go sends the snapshot and parks in the
+ *     loop). Faithful port.
+ *   - Subscribe's terminal set is COMPLETED/FAILED/CANCELLED — it OMITS
+ *     TERMINATED, so a stream over a terminated execution never
+ *     self-closes. Known Go quirk, ported byte-faithfully; disclosed as a
+ *     both-editions issue candidate at the sub-project wrap-up.
+ *   - Registration and the loop share one owner so the unsubscribe fires
+ *     on every exit path (Go's defer → the generator's finally, which
+ *     ConnectRPC runs on client disconnect too).
+ */
+import { equals } from "@bufbuild/protobuf";
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { AgentExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/query_pb";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
+import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { isTranscriptTerminalPhase } from "./phases.js";
+export async function* subscribeExecution(deps, executionId, context) {
+    // Go ValidateSubscribeInputStep.
+    if (executionId.value === "") {
+        throw invalidArgumentError("execution id is required");
+    }
+    // The annotation's can_view check, once at subscription start — the
+    // Java AgentExecutionSubscribeHandler order (validate → authorize).
+    // The composed authorizer's guest-isolation arm rides this same check
+    // (the G2 per-visitor cookie match), matching Java's GuestVisitorScope
+    // filter on this stream. C2 Stage 4.
+    await authorizeDirect(AgentExecutionQueryController.method.subscribe, deps.authorizer, callerIdentityOf(context), executionId);
+    const id = executionId.value;
+    deps.logger.info("Starting execution subscription", { executionId: id });
+    // Register FIRST so no broadcast can slip through the window before the
+    // snapshot read (the happens-before argument in the module header).
+    const subscription = deps.broker.subscribe(id);
+    try {
+        let snapshot;
+        try {
+            snapshot = await deps.store.getResource(ApiResourceKind.agent_execution, id, AgentExecutionSchema);
+        }
+        catch {
+            // Go converts every load failure here to the same NotFound.
+            throw notFoundError("AgentExecution", id);
+        }
+        yield snapshot;
+        deps.logger.debug("Sent initial execution state, streaming live updates", {
+            executionId: id,
+        });
+        // The consecutive-duplicate anchor (Go lastSent).
+        let lastSent = snapshot;
+        const abort = new Promise((resolve) => {
+            context.signal.addEventListener("abort", () => resolve(), {
+                once: true,
+            });
+        });
+        while (!context.signal.aborted) {
+            if (subscription.closed) {
+                // Go's closed-channel arm: end quietly.
+                deps.logger.warn("Updates channel closed unexpectedly", {
+                    executionId: id,
+                });
+                return;
+            }
+            if (subscription.queue.length === 0) {
+                await Promise.race([
+                    abort,
+                    new Promise((resolve) => (subscription.notify = resolve)),
+                ]);
+                subscription.notify = undefined;
+                continue;
+            }
+            const updated = subscription.queue.shift();
+            if (updated === undefined) {
+                continue;
+            }
+            // Suppress the at-or-before-snapshot overlap frame (and any other
+            // exact repeat) so the client never re-renders an identical state.
+            if (equals(AgentExecutionSchema, updated, lastSent)) {
+                continue;
+            }
+            yield updated;
+            lastSent = updated;
+            // Subscribe's close set is the NARROW transcript-terminal set
+            // (phases.ts) — TERMINATED absent, the disclosed quirk.
+            const phase = updated.status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
+            if (isTranscriptTerminalPhase(phase)) {
+                deps.logger.info("Execution reached terminal state, ending subscription", { executionId: id, phase: ExecutionPhase[phase] });
+                return;
+            }
+        }
+        deps.logger.info("Subscription cancelled by client", { executionId: id });
+    }
+    finally {
+        deps.broker.unsubscribe(id, subscription);
+    }
+}
+//# sourceMappingURL=subscribe.js.map

package/dist/domain/agentexecution/subscribe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe.js","sourceRoot":"","sources":["../../../src/domain/agentexecution/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAE9F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAI9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAWxD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,kBAAkB,CACvC,IAAmB,EACnB,WAA6B,EAC7B,OAAuB;IAEvB,iCAAiC;IACjC,IAAI,WAAW,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IACzD,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,uEAAuE;IACvE,qCAAqC;IACrC,MAAM,eAAe,CACnB,6BAA6B,CAAC,MAAM,CAAC,SAAS,EAC9C,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,OAAO,CAAC,EACzB,WAAW,CACZ,CAAC;IACF,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CACrC,eAAe,CAAC,eAAe,EAC/B,EAAE,EACF,oBAAoB,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,MAAM,aAAa,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;YACxE,WAAW,EAAE,EAAE;SAChB,CAAC,CAAC;QAEH,kDAAkD;QAClD,IAAI,QAAQ,GAAG,QAAQ,CAAC;QAExB,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC1C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;gBACxD,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;gBACxB,wCAAwC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;oBACtD,WAAW,EAAE,EAAE;iBAChB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,KAAK;oBACL,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;iBAChE,CAAC,CAAC;gBACH,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC;gBAChC,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,MAAM,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,CAAC;YACd,QAAQ,GAAG,OAAO,CAAC;YAEnB,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,CAAC;YACtE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uDAAuD,EACvD,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAClD,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/domain/agentexecution/temporal/config.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Agent-execution Temporal config — ports
+ * pkg/domain/agentexecution/temporal/config.go: the queue names, routing
+ * mode, and default execution target for agent-execution dispatch.
+ *
+ * resolveExecutionTarget is the SINGLE definition of the
+ * UNSPECIFIED-resolution rule (oss#397) — dispatch (the agentexecution
+ * domain, #17/#18) and policy enforcement (the session update pipeline's
+ * execution-target immutability step) must both use it rather than
+ * re-deriving the default, so they can never disagree about where an
+ * execution runs. Mirrors the cloud edition's
+ * AgentExecutionTemporalConfig.resolveExecutionTarget.
+ *
+ * This module is the first resident of the agentexecution domain directory
+ * (the domain itself is a later sub-project); the tree corresponds to Go's,
+ * same precedent as src/domain/mcpserver/enabledtools/.
+ */
+import { ExecutionTarget } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+/**
+ * Routes all activities to the shared global queue (runnerQueue, default
+ * stigmer_runner) — the default for OSS local development where a single
+ * runner polls one queue for all sessions (Go RoutingGlobal).
+ */
+export declare const ROUTING_GLOBAL = "global";
+/**
+ * Derives a per-session task queue (session:{session_id}) for each
+ * execution — for deployments where each session has a dedicated runner
+ * (desktop app with embedded runners, or cloud sandboxes; Go
+ * RoutingSession).
+ */
+export declare const ROUTING_SESSION = "session";
+/**
+ * Resolves UNSPECIFIED to LOCAL — OSS/self-hosted deployments (Go
+ * DefaultExecutionTargetLocal).
+ */
+export declare const DEFAULT_EXECUTION_TARGET_LOCAL = "local";
+/**
+ * Resolves UNSPECIFIED to CLOUD — the managed cloud service (Go
+ * DefaultExecutionTargetCloud).
+ */
+export declare const DEFAULT_EXECUTION_TARGET_CLOUD = "cloud";
+/**
+ * Configuration for agent-execution Temporal workers (Go temporal.Config).
+ *
+ * Queue architecture:
+ *   - stigmerQueue: server workflows on agent_execution_stigmer
+ *   - runnerQueue: unified-runner activities on stigmer_runner (global) or
+ *     session:{id} (per-session)
+ */
+export declare class AgentExecutionTemporalConfig {
+    /** Task queue for server workflows. Default: agent_execution_stigmer. */
+    readonly stigmerQueue: string;
+    /**
+     * Default task queue for runner activities (stigmer_runner). In global
+     * routing mode all activities route here; in session routing mode it is
+     * the fallback when the session id is empty.
+     */
+    readonly runnerQueue: string;
+    /** ROUTING_GLOBAL or ROUTING_SESSION. */
+    readonly activityRouting: string;
+    /**
+     * Resolves EXECUTION_TARGET_UNSPECIFIED on sessions:
+     * DEFAULT_EXECUTION_TARGET_LOCAL (client's runner polls the queue) or
+     * DEFAULT_EXECUTION_TARGET_CLOUD (server provisions a sandbox).
+     */
+    readonly defaultExecutionTarget: string;
+    constructor(
+    /** Task queue for server workflows. Default: agent_execution_stigmer. */
+    stigmerQueue: string, 
+    /**
+     * Default task queue for runner activities (stigmer_runner). In global
+     * routing mode all activities route here; in session routing mode it is
+     * the fallback when the session id is empty.
+     */
+    runnerQueue: string, 
+    /** ROUTING_GLOBAL or ROUTING_SESSION. */
+    activityRouting: string, 
+    /**
+     * Resolves EXECUTION_TARGET_UNSPECIFIED on sessions:
+     * DEFAULT_EXECUTION_TARGET_LOCAL (client's runner polls the queue) or
+     * DEFAULT_EXECUTION_TARGET_CLOUD (server provisions a sandbox).
+     */
+    defaultExecutionTarget: string);
+    /**
+     * Resolves a session's execution_target to its effective target:
+     * UNSPECIFIED becomes the configured default (LOCAL on OSS/self-hosted,
+     * CLOUD on the managed cloud service); explicit values pass through
+     * unchanged (Go Config.ResolveExecutionTarget).
+     */
+    resolveExecutionTarget(target: ExecutionTarget): ExecutionTarget;
+}
+/**
+ * Builds the config from environment variables with Go NewConfig's
+ * defaults. Env-derived strings only — no Temporal connection is made
+ * here (the temporal seam stays empty until the execution cluster
+ * sub-projects land).
+ */
+export declare function newConfigFromEnv(): AgentExecutionTemporalConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/domain/agentexecution/temporal/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/domain/agentexecution/temporal/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,8BAA8B,UAAU,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,UAAU,CAAC;AAEtD;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IAErC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,eAAe,EAAE,MAAM;IAChC;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM;;IAfvC,yEAAyE;IAChE,YAAY,EAAE,MAAM;IAC7B;;;;OAIG;IACM,WAAW,EAAE,MAAM;IAC5B,yCAAyC;IAChC,eAAe,EAAE,MAAM;IAChC;;;;OAIG;IACM,sBAAsB,EAAE,MAAM;IAGzC;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe;CASjE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,4BAA4B,CAgB/D"}