@tangle-network/agent-runtime 0.95.0 → 0.97.0

package/dist/{chunk-Z5I642SY.js → chunk-WYC2XJF2.js}

@@ -8,7 +8,7 @@ import {
   DELEGATION_STATUS_DESCRIPTION,
   DELEGATION_STATUS_INPUT_SCHEMA,
   DELEGATION_STATUS_TOOL_NAME
-} from "./chunk-IADLKE7I.js";
+} from "./chunk-UQ6PNNXM.js";
 
 // src/mcp/openai-tools.ts
 function buildTool(name, description, parameters) {
@@ -45,4 +45,4 @@ export {
   mcpToolsForRuntimeMcp,
   mcpToolsForRuntimeMcpSubset
 };
-//# sourceMappingURL=chunk-Z5I642SY.js.map
+//# sourceMappingURL=chunk-WYC2XJF2.js.map

package/dist/{chunk-ZEYAT33L.js → chunk-Y3SRWZMP.js}

@@ -1,7 +1,7 @@
 import {
   buildLoopOtelSpans,
   createOtelExporter
-} from "./chunk-ISTDY47H.js";
+} from "./chunk-HZDEXTSL.js";
 
 // src/mcp/trace-propagation.ts
 function readTraceContextFromEnv() {
@@ -49,4 +49,4 @@ export {
   createPropagatingTraceEmitter,
   traceContextToEnv
 };
-//# sourceMappingURL=chunk-ZEYAT33L.js.map
+//# sourceMappingURL=chunk-Y3SRWZMP.js.map

package/dist/{chunk-WTZ37EQY.js → chunk-YOLKCWRV.js}

@@ -2892,11 +2892,60 @@ function safeAdd(left, right, label) {
 }
 
 // src/candidate-execution/protected-redaction.ts
+import { createHmac, randomBytes as randomBytes2 } from "crypto";
 import {
   DEFAULT_REDACTION_RULES,
   REDACTION_VERSION,
   redactString
 } from "@tangle-network/agent-eval";
+function createProtectedRecordRedactor(protectedValues) {
+  const identityKey = randomBytes2(32);
+  const aggregate = {
+    version: REDACTION_VERSION,
+    redactionCount: 0,
+    byRule: {}
+  };
+  const mergeReport = (report) => {
+    aggregate.version = report.version;
+    aggregate.redactionCount += report.redactionCount;
+    for (const [rule, count] of Object.entries(report.byRule)) {
+      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count;
+    }
+  };
+  const redactScalar = (value, record) => {
+    const redacted = redactProtectedValue(value, protectedValues);
+    if (record) mergeReport(redacted.report);
+    return redacted.value;
+  };
+  const identifier = (value, record) => {
+    const redacted = redactScalar(value, record);
+    if (redacted === value) return value;
+    const digest = createHmac("sha256", identityKey).update(value).digest("hex");
+    return `${redacted}:hmac-sha256:${digest}`;
+  };
+  const transform = (value, record) => {
+    const transformed = transformProtectedRecord(
+      value,
+      void 0,
+      record,
+      redactScalar,
+      identifier
+    );
+    assertNoProtectedEvidence(transformed, protectedValues);
+    return transformed;
+  };
+  return Object.freeze({
+    record: (value) => transform(value, true),
+    query: (value) => transform(value, false),
+    identifier: (value) => identifier(value, false),
+    traceIdentity: (trace) => transform(trace, false),
+    report: () => ({
+      version: aggregate.version,
+      redactionCount: aggregate.redactionCount,
+      byRule: { ...aggregate.byRule }
+    })
+  });
+}
 function redactProtectedValue(value, protectedValues) {
   const report = {
     version: REDACTION_VERSION,
@@ -2984,6 +3033,65 @@ function redactNode(value, protectedValues, rules, report) {
   }
   return value;
 }
+function transformProtectedRecord(value, fieldName, record, redactScalar, redactIdentifier) {
+  if (value instanceof Uint8Array) return redactScalar(value, record);
+  if (typeof value === "string") {
+    return fieldName && isIdentifierFieldName(fieldName) ? redactIdentifier(value, record) : redactScalar(value, record);
+  }
+  if (Array.isArray(value)) {
+    return value.map(
+      (entry) => transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier)
+    );
+  }
+  if (!value || typeof value !== "object") return value;
+  if (fieldName === "tags") {
+    return transformTagMap(value, record, redactScalar, redactIdentifier);
+  }
+  if (fieldName === "tag") {
+    return transformTagFilter(value, record, redactScalar, redactIdentifier);
+  }
+  const entries = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactScalar(key, record);
+    if (seenKeys.has(redactedKey)) {
+      throw new Error("protected evidence redaction produced an ambiguous object key");
+    }
+    seenKeys.add(redactedKey);
+    entries.push([
+      redactedKey,
+      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
+    ]);
+  }
+  return Object.fromEntries(entries);
+}
+function transformTagMap(value, record, redactScalar, redactIdentifier) {
+  const entries = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactIdentifier(key, record);
+    if (seenKeys.has(redactedKey)) {
+      throw new Error("protected evidence redaction produced an ambiguous trace tag");
+    }
+    seenKeys.add(redactedKey);
+    entries.push([
+      redactedKey,
+      typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
+    ]);
+  }
+  return Object.fromEntries(entries);
+}
+function transformTagFilter(value, record, redactScalar, redactIdentifier) {
+  const output = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactScalar(key, record);
+    output[redactedKey] = (key === "key" || key === "value") && typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier);
+  }
+  return output;
+}
+function isIdentifierFieldName(name) {
+  return /ids?$/i.test(name);
+}
 function protectedRedactionRules(protectedValues) {
   const exactRules = protectedValueVariants(protectedValues).sort((left, right) => right.length - left.length || left.localeCompare(right)).map((value, index) => ({
     id: `candidate-access-${index}`,
@@ -3031,7 +3139,7 @@ function escapeRegularExpression(value) {
 }
 
 // src/candidate-execution/finalize.ts
-async function finalizeAgentCandidateRun(state, capture, traceStore, settlement, evidence, protectedValues, writeRedactionReport, signal) {
+async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdentity, settlement, evidence, protectedValues, writeRedactionReport, signal) {
   let termination;
   try {
     signal?.throwIfAborted();
@@ -3042,12 +3150,12 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
     if (termination.kind === "timeout" && termination.timeoutMs !== state.executionPlan.value.material.limits.timeoutMs) {
       throw new Error("timeout termination does not match the frozen execution limit");
     }
-    const run = await traceStore.getRun(state.trace.runId);
-    if (!run) throw new Error(`protected trace run is missing: ${state.trace.runId}`);
+    const run = await traceStore.getRun(traceIdentity.runId);
+    if (!run) throw new Error(`protected trace run is missing: ${traceIdentity.runId}`);
     if (run.status === "running" || run.endedAt === void 0) {
       throw new Error("protected trace run is not terminal");
     }
-    assertTraceBindings(run.tags, state);
+    assertTraceBindings(run.tags, traceIdentity.tags);
     const [spans, events, budget, artifacts] = await Promise.all([
       traceStore.spans({ runId: run.runId }),
       traceStore.events({ runId: run.runId }),
@@ -3163,8 +3271,7 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
     };
   }
 }
-function assertTraceBindings(tags, state) {
-  const expected = state.trace.tags;
+function assertTraceBindings(tags, expected) {
   for (const name of Object.values(CANDIDATE_TRACE_TAGS)) {
     if (tags?.[name] !== expected[name]) {
       throw new Error(`protected trace is not bound to prepared execution tag ${name}`);
@@ -3815,81 +3922,60 @@ function assertUnitScore(value, label) {
 }
 
 // src/candidate-execution/protected-trace-store.ts
-import { REDACTION_VERSION as REDACTION_VERSION3 } from "@tangle-network/agent-eval";
-var ProtectedAgentCandidateTraceStore = class {
-  constructor(inner, protectedValues) {
-    this.inner = inner;
-    this.protectedValues = protectedValues;
-  }
-  inner;
-  protectedValues;
-  aggregate = {
-    version: REDACTION_VERSION3,
-    redactionCount: 0,
-    byRule: {}
-  };
-  report() {
-    return {
-      version: this.aggregate.version,
-      redactionCount: this.aggregate.redactionCount,
-      byRule: { ...this.aggregate.byRule }
-    };
-  }
-  async appendRun(run) {
-    await this.inner.appendRun(this.redact(run));
-  }
-  async updateRun(runId, patch) {
-    await this.inner.updateRun(this.redact(runId), this.redact(patch));
-  }
-  async appendSpan(span) {
-    if (span.kind === "llm") {
-      throw new Error("candidate executors cannot author protected model spans");
-    }
-    await this.inner.appendSpan(this.redact(span));
-  }
-  async updateSpan(spanId, patch) {
-    if (patch.kind === "llm") {
-      throw new Error("candidate executors cannot author protected model spans");
+function createProtectedAgentCandidateTraceAccess(inner, protectedValues) {
+  const redactor = createProtectedRecordRedactor(protectedValues);
+  const pendingWrites = /* @__PURE__ */ new Set();
+  let acceptsWrites = true;
+  const write = (operation) => {
+    if (!acceptsWrites) {
+      return Promise.reject(new Error("candidate trace writes are closed"));
     }
-    await this.inner.updateSpan(this.redact(spanId), this.redact(patch));
-  }
-  async appendEvent(event) {
-    await this.inner.appendEvent(this.redact(event));
-  }
-  async appendArtifact(artifact) {
-    await this.inner.appendArtifact(this.redact(artifact));
-  }
-  async appendBudgetEntry(entry) {
-    await this.inner.appendBudgetEntry(this.redact(entry));
-  }
-  getRun(...args) {
-    return this.inner.getRun(...args);
-  }
-  listRuns(...args) {
-    return this.inner.listRuns(...args);
-  }
-  spans(...args) {
-    return this.inner.spans(...args);
-  }
-  events(...args) {
-    return this.inner.events(...args);
-  }
-  budget(...args) {
-    return this.inner.budget(...args);
-  }
-  artifacts(...args) {
-    return this.inner.artifacts(...args);
-  }
-  redact(value) {
-    const redacted = redactProtectedValue(value, this.protectedValues);
-    this.aggregate.version = redacted.report.version;
-    this.aggregate.redactionCount += redacted.report.redactionCount;
-    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
-      this.aggregate.byRule[rule] = (this.aggregate.byRule[rule] ?? 0) + count;
+    let started;
+    try {
+      started = operation();
+    } catch (error) {
+      return Promise.reject(error);
     }
-    return redacted.value;
-  }
-};
+    let tracked;
+    tracked = started.finally(() => pendingWrites.delete(tracked));
+    pendingWrites.add(tracked);
+    return tracked;
+  };
+  const store = Object.freeze({
+    appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),
+    updateRun: (runId, patch) => write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),
+    appendSpan: (span) => write(async () => {
+      if (span.kind === "llm") {
+        throw new Error("candidate executors cannot author protected model spans");
+      }
+      await inner.appendSpan(redactor.record(span));
+    }),
+    updateSpan: (spanId, patch) => write(async () => {
+      if (patch.kind === "llm") {
+        throw new Error("candidate executors cannot author protected model spans");
+      }
+      await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch));
+    }),
+    appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),
+    appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),
+    appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),
+    getRun: async (runId) => inner.getRun(redactor.identifier(runId)),
+    listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : void 0),
+    spans: async (filter) => inner.spans(filter ? redactor.query(filter) : void 0),
+    events: async (filter) => inner.events(filter ? redactor.query(filter) : void 0),
+    budget: async (runId) => inner.budget(redactor.identifier(runId)),
+    artifacts: async (runId) => inner.artifacts(redactor.identifier(runId))
+  });
+  return Object.freeze({
+    store,
+    closeWrites: async () => {
+      acceptsWrites = false;
+      await Promise.all([...pendingWrites]);
+    },
+    identity: (trace) => redactor.traceIdentity(trace),
+    report: () => redactor.report()
+  });
+}
 var RecoveryAgentCandidateTraceStore = class {
   constructor(inner) {
     this.inner = inner;
@@ -4133,26 +4219,36 @@ async function executePreparedAgentCandidate(prepared, options) {
     );
   }
   const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
-  const protectedTraceStore = new ProtectedAgentCandidateTraceStore(
+  const protectedTrace = createProtectedAgentCandidateTraceAccess(
     options.traceStore,
     protectedValues
   );
+  const persistedTrace = protectedTrace.identity(state.trace);
   const execution = await runAndStopExecutor(
     options.executor,
     request,
     state.benchmarkTask.outcome,
-    protectedTraceStore,
+    protectedTrace.store,
     deadlineAtMs,
     cleanupTimeoutMs
   );
   beginPreparedCandidateSettlement(prepared);
   const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
   const accessReason = execution.kind === "timeout" || execution.termination?.kind === "timeout" ? "timeout" : execution.kind === "capture" ? "completed" : "failed";
-  const [memoryClose, settlementResult] = await Promise.all([
+  const traceClosure = withinCandidateCleanupDeadline(
+    () => protectedTrace.closeWrites(),
+    cleanupDeadlineAtMs,
+    "candidate trace write closure"
+  ).then(
+    () => ({ closed: true, error: void 0 }),
+    (error) => ({ closed: false, error })
+  );
+  const [traceClose, memoryClose, settlementResult] = await Promise.all([
+    traceClosure,
     closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),
     settleModelGrant(state, accessReason, cleanupDeadlineAtMs)
   ]);
-  if (!execution.processStopped || !settlementResult.settlement || !memoryClose.closed) {
+  if (!execution.processStopped || !traceClose.closed || !settlementResult.settlement || !memoryClose.closed) {
     consumePreparedCandidateExecution(prepared, "failed");
     return failedAgentCandidateRun(
       state,
@@ -4160,6 +4256,7 @@ async function executePreparedAgentCandidate(prepared, options) {
         joinErrors(
           execution.error,
           !execution.processStopped ? new Error("candidate process termination is not proven") : void 0,
+          traceClose.error,
           memoryClose.error,
           settlementResult.error ?? (!settlementResult.settlement ? new Error("model settlement failed") : void 0),
           new Error("candidate claim remains recoverable until protected cleanup is proven")
@@ -4226,7 +4323,7 @@ async function executePreparedAgentCandidate(prepared, options) {
         async (signal) => {
           await appendAuthoritativeModelSettlementSpans(
             options.traceStore,
-            state.trace.runId,
+            persistedTrace.runId,
             settlementResult.settlement
           );
           const { persistedCapture, taskOutcome } = await persistVerifiedAgentCandidateExecutorCapture(
@@ -4249,6 +4346,7 @@ async function executePreparedAgentCandidate(prepared, options) {
             state,
             capture,
             options.traceStore,
+            persistedTrace,
             settlementResult.settlement,
             {
               finalCapture: execution.finalCapture,
@@ -4259,7 +4357,7 @@ async function executePreparedAgentCandidate(prepared, options) {
               outputArtifacts: options.outputArtifacts
             },
             protectedValues,
-            protectedTraceStore.report(),
+            protectedTrace.report(),
             signal
           );
         },
@@ -4823,6 +4921,7 @@ function resourceKey(resource) {
 import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join3, posix } from "path";
+import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
 var CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
 var CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
 function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
@@ -4835,7 +4934,7 @@ function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
     ...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
   };
 }
-async function prepareAgentCandidateKnowledge(candidate, ports) {
+async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
   const knowledge = candidate.bundle.knowledge;
   if (!knowledge) return void 0;
   const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
@@ -4848,6 +4947,13 @@ async function prepareAgentCandidateKnowledge(candidate, ports) {
       archive,
       destination: root
     });
+    const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
+    const actualHash = `sha256:${await hashKnowledgeBase(root)}`;
+    if (actualHash !== expectedHash) {
+      throw new Error(
+        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`
+      );
+    }
     const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
     return Object.freeze({
       candidate: knowledge.candidate,
@@ -4865,7 +4971,7 @@ async function prepareAgentCandidateKnowledge(candidate, ports) {
 }
 
 // src/candidate-execution/prepare.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
 import { isAbsolute, posix as posix2, relative as relative2, resolve as resolveHostPath } from "path";
 import {
@@ -4991,7 +5097,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   const profileActivation = profileApplication.profileActivation;
   const container = await resolveContainer(candidate, task, ports);
   const resolvedModel = await resolveModel(candidate, task, ports);
-  const preparationId = `candidate-preparation.${randomBytes2(32).toString("base64url")}`;
+  const preparationId = `candidate-preparation.${randomBytes3(32).toString("base64url")}`;
   const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs);
   const modelReservation = await withinCandidateCleanupDeadline(
     () => ports.models.reserveGrant({
@@ -5023,7 +5129,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       cleanupTimeoutMs
     );
     const memory = preparedMemory.value;
-    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports);
+    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm);
     const knowledgePaths = knowledge ? candidateKnowledgeExecutionPaths(
       task.executionRoots.taskRoot,
       knowledge.retrievalConfig !== void 0
@@ -5657,6 +5763,7 @@ export {
   createAgentCandidateProfileActivation,
   parseAgentCandidateProfileActivation,
   freezeGenericAgentCandidateProfile,
+  assertCandidateProfileBinding,
   parseExactAgentProfile,
   parseExactAgentProfileDiff,
   applyExactAgentProfileDiff,
@@ -5707,4 +5814,4 @@ export {
   candidateKnowledgeExecutionPaths,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-WTZ37EQY.js.map
+//# sourceMappingURL=chunk-YOLKCWRV.js.map