@taskforcehq/taskforce 0.3.329 → 0.3.330

package/dist/shared/executorPhaseAApprovalGoldenVector.json

@@ -0,0 +1,269 @@
+{
+    "schema": "taskforce.executor-phase-a-authorization-golden-vector/v4",
+    "cloudPublicKeySpkiBase64": "MCowBQYDK2VwAyEASGK8PgIza/iCcosylG6r+hAbUJ77ecVMmVAt9dO964w=",
+    "brokerPublicKeySpkiBase64": "MCowBQYDK2VwAyEAaT6jZmvWCBpuW1RZKO+YLOoH+OpN7zpRxaT+t5qozjE=",
+    "receipt": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-approval-receipt-payload/v3",
+            "receiptId": "approval-receipt-golden0002",
+            "issuer": "https://performance-app.taskforcehq.ai",
+            "audience": "taskforce-agent-executor-phase-a",
+            "environment": "performance",
+            "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+            "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+            "taskReference": "T-1653",
+            "actorUserId": "user-01abc234def56789",
+            "runId": "phase-a-golden-0002",
+            "preflightSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "logicalEnvelopeSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            "accountId": "123456789012",
+            "readPrincipalArn": "arn:aws:sts::123456789012:assumed-role/taskforce-phase-a-read/golden",
+            "mutationRoles": {
+                "bootstrap": "arn:aws:iam::123456789012:role/taskforce-phase-a-bootstrap",
+                "ami-build": "arn:aws:iam::123456789012:role/taskforce-phase-a-ami-build",
+                "provenance": "arn:aws:iam::123456789012:role/taskforce-phase-a-provenance",
+                "runtime": "arn:aws:iam::123456789012:role/taskforce-phase-a-runtime",
+                "cleanup": "arn:aws:iam::123456789012:role/taskforce-phase-a-cleanup"
+            },
+            "roleMapSha256": "6458f011cdb6e16971e797cab1b736b5e95df41795b54e3dba4e9af571f593b0",
+            "oidcIssuer": "https://phase-a-issuer.taskforcehq.ai",
+            "oidcAudience": "taskforce-agent-executor-phase-a",
+            "brokerPublicKeySpkiBase64": "MCowBQYDK2VwAyEAaT6jZmvWCBpuW1RZKO+YLOoH+OpN7zpRxaT+t5qozjE=",
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "region": "us-west-2",
+            "availabilityZone": "us-west-2a",
+            "budgets": {
+                "temporaryUsdMicros": 50000,
+                "alarmUsdMicros": 25000,
+                "foundationMonthlyCeilingUsdMicros": 100000000
+            },
+            "sourceCommit": "cccccccccccccccccccccccccccccccccccccccc",
+            "approvedAt": "2026-08-21T12:00:00Z",
+            "expiresAt": "2026-08-21T12:30:00Z",
+            "mutationDeadline": "2026-08-21T20:00:00Z",
+            "cleanupDeadline": "2026-08-21T22:00:00Z",
+            "receiptKind": "main",
+            "originalCapabilityId": null,
+            "residualInventorySha256": null
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "phase-a-golden-2026",
+            "payloadSha256": "82067c52c778076a39e4b01fc00b9e4f207ab2b977e1041ef2b8660518781c7d",
+            "signature": "9aOuBv9FnCRDwlAXIPQfSvCmwhIbxvdEnv4upLctvyElViwSn2LVlWH3V3pt_CTA7CQawSCKdHYJWzYLJG5fCA"
+        }
+    },
+    "receiptSha256": "a1c322a8f19afa7bdab3b72e35383967a8803056bfe4cf5cd7cc9eebc2e20e32",
+    "runCapability": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-run-capability-payload/v1",
+            "capabilityId": "run-capability-golden0002",
+            "capabilityKind": "main",
+            "originalCapabilityId": null,
+            "receiptId": "approval-receipt-golden0002",
+            "receiptSha256": "a1c322a8f19afa7bdab3b72e35383967a8803056bfe4cf5cd7cc9eebc2e20e32",
+            "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+            "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+            "actorUserId": "user-01abc234def56789",
+            "runId": "phase-a-golden-0002",
+            "accountId": "123456789012",
+            "region": "us-west-2",
+            "availabilityZone": "us-west-2a",
+            "sourceCommit": "cccccccccccccccccccccccccccccccccccccccc",
+            "preflightSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "logicalEnvelopeSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            "budgetsSha256": "6096abf53672347efaf50c60d7c444cc7b628103f090e69951821fe4cef1cbaf",
+            "readPrincipalArn": "arn:aws:sts::123456789012:assumed-role/taskforce-phase-a-read/golden",
+            "mutationRoles": {
+                "bootstrap": "arn:aws:iam::123456789012:role/taskforce-phase-a-bootstrap",
+                "ami-build": "arn:aws:iam::123456789012:role/taskforce-phase-a-ami-build",
+                "provenance": "arn:aws:iam::123456789012:role/taskforce-phase-a-provenance",
+                "runtime": "arn:aws:iam::123456789012:role/taskforce-phase-a-runtime",
+                "cleanup": "arn:aws:iam::123456789012:role/taskforce-phase-a-cleanup"
+            },
+            "roleMapSha256": "6458f011cdb6e16971e797cab1b736b5e95df41795b54e3dba4e9af571f593b0",
+            "oidcIssuer": "https://phase-a-issuer.taskforcehq.ai",
+            "oidcAudience": "taskforce-agent-executor-phase-a",
+            "brokerPublicKeySpkiBase64": "MCowBQYDK2VwAyEAaT6jZmvWCBpuW1RZKO+YLOoH+OpN7zpRxaT+t5qozjE=",
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "allowedPhases": [
+                "bootstrap",
+                "ami-build",
+                "provenance",
+                "runtime",
+                "cleanup"
+            ],
+            "issuedAt": "2026-08-21T12:00:00Z",
+            "expiresAt": "2026-08-21T22:00:00Z",
+            "mutationDeadline": "2026-08-21T20:00:00Z",
+            "cleanupDeadline": "2026-08-21T22:00:00Z",
+            "residualInventorySha256": null
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "phase-a-golden-2026",
+            "payloadSha256": "f5ed898a3d5b9ed46b98760b500f7d8b9322c87eaebb215eeabf95d7eae6163b",
+            "signature": "J_KBFtIXsk6A0N085d_Ok3Blcd-a01oPMkGI-qKHLH6IGquaKZJy56gdOuy1XZRfI6JNGEP2EyNU2mYyXRk9CQ"
+        }
+    },
+    "runCapabilitySha256": "d4d68e72837082ef85f7135a70f34925003d0a84e839e40138f1e66d15adab10",
+    "senderProof": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-sender-proof-payload/v1",
+            "capabilityId": "run-capability-golden0002",
+            "nonceId": "nonce-golden0002",
+            "requestSha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+            "phase": "ami-build",
+            "createdAt": "2026-08-21T12:01:00Z",
+            "expiresAt": "2026-08-21T12:03:00Z"
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "broker-key",
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "payloadSha256": "74aa7efa77735d794f852e15ebe4b5943eff85e81416cfa6e69cffeb85721710",
+            "signature": "cOKE81mY1809qetQs0PCzQDN8kPzR_Ee2xpciSJuGylyv-_8ihA9IyirHdMfX3rIBOTFFhYg_LpF2byYaEW1Aw"
+        }
+    },
+    "senderProofSha256": "7ef9d47f26a0a86bff6224b2b1b2b68e42fe6d2286519c24ddd0d4200f9f1b93",
+    "workloadGrant": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-workload-grant-payload/v1",
+            "grantId": "workload-grant-golden0002",
+            "capabilityId": "run-capability-golden0002",
+            "capabilitySha256": "d4d68e72837082ef85f7135a70f34925003d0a84e839e40138f1e66d15adab10",
+            "receiptId": "approval-receipt-golden0002",
+            "receiptSha256": "a1c322a8f19afa7bdab3b72e35383967a8803056bfe4cf5cd7cc9eebc2e20e32",
+            "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+            "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+            "actorUserId": "user-01abc234def56789",
+            "runId": "phase-a-golden-0002",
+            "phase": "ami-build",
+            "roleArn": "arn:aws:iam::123456789012:role/taskforce-phase-a-ami-build",
+            "accountId": "123456789012",
+            "region": "us-west-2",
+            "sourceIdentity": "tfr.mAjqWDYqeRMM0vP2z-eOD8jFSpImdaXqMXlHnow5n0Q.ami-build",
+            "sessionTags": {
+                "TaskforceRun": "phase-a-golden-0002",
+                "TaskforceReceipt": "approval-receipt-golden0002",
+                "TaskforcePhase": "ami-build",
+                "TaskforceWorkspaceHash": "0ccf09445ddd740e3517b30c74f5b994dedc4f6e4cdcfa0ae2d0b7f8f6277e64",
+                "TaskforceSource": "cccccccccccccccccccccccccccccccccccccccc"
+            },
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "nonceId": "nonce-golden0002",
+            "senderProofSha256": "7ef9d47f26a0a86bff6224b2b1b2b68e42fe6d2286519c24ddd0d4200f9f1b93",
+            "policySha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+            "issuedAt": "2026-08-21T12:01:00Z",
+            "expiresAt": "2026-08-21T12:03:00Z"
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "phase-a-golden-2026",
+            "payloadSha256": "1f4c8fe624944220015a362db89ba1232e588d2b7154913edcbf6fe06c4d4d5b",
+            "signature": "NZyvkfxLipBpHiYfzau86G2hQjdnJVQWEb16umf2d6FiG449Gq1YvpGExNDFoWQwZfOGB1KYT48lafKuMsXOBQ"
+        }
+    },
+    "workloadGrantSha256": "e1c3f52460f10df2b56fe36102388e9b7471a578988e67319871baab6df671f3",
+    "cleanupReceipt": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-approval-receipt-payload/v3",
+            "receiptId": "approval-receipt-cleanupgolden0001",
+            "issuer": "https://performance-app.taskforcehq.ai",
+            "audience": "taskforce-agent-executor-phase-a",
+            "environment": "performance",
+            "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+            "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+            "taskReference": "T-1653",
+            "actorUserId": "user-02abc234def56789",
+            "runId": "phase-a-golden-0002",
+            "preflightSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "logicalEnvelopeSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            "accountId": "123456789012",
+            "readPrincipalArn": "arn:aws:sts::123456789012:assumed-role/taskforce-phase-a-read/golden",
+            "mutationRoles": {
+                "bootstrap": "arn:aws:iam::123456789012:role/taskforce-phase-a-bootstrap",
+                "ami-build": "arn:aws:iam::123456789012:role/taskforce-phase-a-ami-build",
+                "provenance": "arn:aws:iam::123456789012:role/taskforce-phase-a-provenance",
+                "runtime": "arn:aws:iam::123456789012:role/taskforce-phase-a-runtime",
+                "cleanup": "arn:aws:iam::123456789012:role/taskforce-phase-a-cleanup"
+            },
+            "roleMapSha256": "6458f011cdb6e16971e797cab1b736b5e95df41795b54e3dba4e9af571f593b0",
+            "oidcIssuer": "https://phase-a-issuer.taskforcehq.ai",
+            "oidcAudience": "taskforce-agent-executor-phase-a",
+            "brokerPublicKeySpkiBase64": "MCowBQYDK2VwAyEAaT6jZmvWCBpuW1RZKO+YLOoH+OpN7zpRxaT+t5qozjE=",
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "region": "us-west-2",
+            "availabilityZone": "us-west-2a",
+            "budgets": {
+                "temporaryUsdMicros": 50000,
+                "alarmUsdMicros": 25000,
+                "foundationMonthlyCeilingUsdMicros": 100000000
+            },
+            "sourceCommit": "cccccccccccccccccccccccccccccccccccccccc",
+            "approvedAt": "2026-08-21T13:00:00Z",
+            "expiresAt": "2026-08-21T14:00:00Z",
+            "mutationDeadline": "2026-08-21T13:00:00Z",
+            "cleanupDeadline": "2026-08-21T15:00:00Z",
+            "receiptKind": "cleanup-only",
+            "originalCapabilityId": "run-capability-golden0002",
+            "residualInventorySha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "phase-a-golden-2026",
+            "payloadSha256": "f31f1c6f00bced512d3679d8640787bb7810302c8f3b2f8f96f49efb8670157d",
+            "signature": "GM96-VWTmBHsGQ-r5ybg2Dscz0f6gwzjhNlB0VGqtp4GUYa25Sz-DDzShhx09TmjQQHntCjAdVkAYvgRUkiTAQ"
+        }
+    },
+    "cleanupReceiptSha256": "f7ce22acc6d0f2aaafb2ab43ce4d997e4870e9f0590db7e8fa867759ce653fa5",
+    "cleanupRunCapability": {
+        "payload": {
+            "schema": "taskforce.executor-phase-a-run-capability-payload/v1",
+            "capabilityId": "run-capability-cleanupgolden0001",
+            "capabilityKind": "cleanup-only",
+            "originalCapabilityId": "run-capability-golden0002",
+            "receiptId": "approval-receipt-cleanupgolden0001",
+            "receiptSha256": "f7ce22acc6d0f2aaafb2ab43ce4d997e4870e9f0590db7e8fa867759ce653fa5",
+            "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+            "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+            "actorUserId": "user-02abc234def56789",
+            "runId": "phase-a-golden-0002",
+            "accountId": "123456789012",
+            "region": "us-west-2",
+            "availabilityZone": "us-west-2a",
+            "sourceCommit": "cccccccccccccccccccccccccccccccccccccccc",
+            "preflightSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "logicalEnvelopeSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            "budgetsSha256": "6096abf53672347efaf50c60d7c444cc7b628103f090e69951821fe4cef1cbaf",
+            "readPrincipalArn": "arn:aws:sts::123456789012:assumed-role/taskforce-phase-a-read/golden",
+            "mutationRoles": {
+                "bootstrap": "arn:aws:iam::123456789012:role/taskforce-phase-a-bootstrap",
+                "ami-build": "arn:aws:iam::123456789012:role/taskforce-phase-a-ami-build",
+                "provenance": "arn:aws:iam::123456789012:role/taskforce-phase-a-provenance",
+                "runtime": "arn:aws:iam::123456789012:role/taskforce-phase-a-runtime",
+                "cleanup": "arn:aws:iam::123456789012:role/taskforce-phase-a-cleanup"
+            },
+            "roleMapSha256": "6458f011cdb6e16971e797cab1b736b5e95df41795b54e3dba4e9af571f593b0",
+            "oidcIssuer": "https://phase-a-issuer.taskforcehq.ai",
+            "oidcAudience": "taskforce-agent-executor-phase-a",
+            "brokerPublicKeySpkiBase64": "MCowBQYDK2VwAyEAaT6jZmvWCBpuW1RZKO+YLOoH+OpN7zpRxaT+t5qozjE=",
+            "brokerKeyFingerprint": "5aeb974cc8feaf6f29fe953349d3bf7febd01a1ae9c467fd041ddaddae4337a1",
+            "allowedPhases": [
+                "cleanup"
+            ],
+            "issuedAt": "2026-08-21T13:00:00Z",
+            "expiresAt": "2026-08-21T15:00:00Z",
+            "mutationDeadline": "2026-08-21T13:00:00Z",
+            "cleanupDeadline": "2026-08-21T15:00:00Z",
+            "residualInventorySha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+        },
+        "envelope": {
+            "algorithm": "Ed25519",
+            "keyId": "phase-a-golden-2026",
+            "payloadSha256": "194c405f18c5d69edd8ea128158c7df991fa097f7f05751c5f9280881fce79cc",
+            "signature": "h2gZo7wxFiUx8era21j7aCX9cPWTMOyTzSmpvSONnJpLymjAfb1M41Dut3q1_-29DJXlow48F3b1QLjcrBoGAg"
+        }
+    },
+    "cleanupRunCapabilitySha256": "456f1d2cb28415ada9557b232f36be6f9b633e48511aadec3c5d9950831812fa"
+}

package/dist/shared/executorPhaseAApprovalReceipt.d.ts

@@ -0,0 +1,112 @@
+export declare const EXECUTOR_PHASE_A_PREFLIGHT_SCHEMA: "taskforce.executor-phase-a-preflight-report/v3";
+export declare const EXECUTOR_PHASE_A_RECEIPT_PAYLOAD_SCHEMA: "taskforce.executor-phase-a-approval-receipt-payload/v3";
+export declare const EXECUTOR_PHASE_A_TRUST_POLICY_SCHEMA: "taskforce.executor-phase-a-approval-trust-policy/v1";
+export declare const EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES: number;
+export declare const EXECUTOR_PHASE_A_MAX_PREFLIGHT_AGE_MS: number;
+export declare const EXECUTOR_PHASE_A_RECEIPT_TTL_MS: number;
+export declare const EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA: "taskforce.executor-phase-a-approval-issuance-request/v1";
+export declare const EXECUTOR_PHASE_A_MUTATION_TTL_MS: number;
+export declare const EXECUTOR_PHASE_A_ORDINARY_CLEANUP_TTL_MS: number;
+export declare const EXECUTOR_PHASE_A_PHASES: readonly ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"];
+export type ExecutorPhaseAPhase = typeof EXECUTOR_PHASE_A_PHASES[number];
+export type ExecutorPhaseARoleMap = Record<ExecutorPhaseAPhase, string>;
+export interface ExecutorPhaseAApprovalTrustKey {
+    keyId: string;
+    publicKeySpkiBase64: string;
+    status: 'active' | 'retired' | 'disabled';
+    validFrom: string;
+    validUntil: string;
+}
+export interface ExecutorPhaseAApprovalTrustPolicy {
+    schema: typeof EXECUTOR_PHASE_A_TRUST_POLICY_SCHEMA;
+    issuer: string;
+    audience: string;
+    environment: 'performance';
+    workspaceId: string;
+    taskId: string;
+    taskReference: 'T-1653';
+    keys: ExecutorPhaseAApprovalTrustKey[];
+}
+export interface ExecutorPhaseAPreflight {
+    schema: typeof EXECUTOR_PHASE_A_PREFLIGHT_SCHEMA;
+    runId: string;
+    collectedAt: string;
+    expiresAt: string;
+    status: 'pass';
+    failures: [];
+    approvalContext: {
+        environment: 'performance';
+        workspaceId: string;
+        taskId: string;
+        taskReference: 'T-1653';
+    };
+    target: {
+        accountId: string;
+        readPrincipalArn: string;
+        mutationRoles: ExecutorPhaseARoleMap;
+        oidcIssuer: string;
+        oidcAudience: string;
+        brokerPublicKeySpkiBase64: string;
+        brokerKeyFingerprint: string;
+        region: 'us-west-2';
+        availabilityZone: string;
+        [key: string]: unknown;
+    };
+    source: {
+        commit: string;
+        baselineCommit: string;
+        clean: true;
+    };
+    budgets: {
+        temporaryUsdMicros: number;
+        alarmUsdMicros: number;
+        foundationMonthlyCeilingUsdMicros: number;
+    };
+    logicalEnvelopeSha256: string;
+    [key: string]: unknown;
+}
+export interface ExecutorPhaseAApprovalReceiptPayload {
+    schema: typeof EXECUTOR_PHASE_A_RECEIPT_PAYLOAD_SCHEMA;
+    receiptId: string;
+    receiptKind: 'main' | 'cleanup-only';
+    originalCapabilityId: string | null;
+    residualInventorySha256: string | null;
+    issuer: string;
+    audience: string;
+    environment: 'performance';
+    workspaceId: string;
+    taskId: string;
+    taskReference: 'T-1653';
+    actorUserId: string;
+    runId: string;
+    preflightSha256: string;
+    logicalEnvelopeSha256: string;
+    accountId: string;
+    readPrincipalArn: string;
+    mutationRoles: ExecutorPhaseARoleMap;
+    roleMapSha256: string;
+    oidcIssuer: string;
+    oidcAudience: string;
+    brokerPublicKeySpkiBase64: string;
+    brokerKeyFingerprint: string;
+    region: 'us-west-2';
+    availabilityZone: string;
+    budgets: ExecutorPhaseAPreflight['budgets'];
+    sourceCommit: string;
+    approvedAt: string;
+    expiresAt: string;
+    mutationDeadline: string;
+    cleanupDeadline: string;
+}
+export interface ExecutorPhaseAApprovalReceipt {
+    payload: ExecutorPhaseAApprovalReceiptPayload;
+    envelope: {
+        algorithm: 'Ed25519';
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}
+/** RFC 8785/JCS bytes using ECMAScript JSON number and string serialization. */
+export declare function canonicalizeExecutorPhaseAJson(value: unknown): Buffer;
+export declare function sha256ExecutorPhaseABytes(bytes: Uint8Array): string;

package/dist/shared/executorPhaseAApprovalReceipt.js

@@ -0,0 +1,58 @@
+import { createHash } from 'crypto';
+export const EXECUTOR_PHASE_A_PREFLIGHT_SCHEMA = 'taskforce.executor-phase-a-preflight-report/v3';
+export const EXECUTOR_PHASE_A_RECEIPT_PAYLOAD_SCHEMA = 'taskforce.executor-phase-a-approval-receipt-payload/v3';
+export const EXECUTOR_PHASE_A_TRUST_POLICY_SCHEMA = 'taskforce.executor-phase-a-approval-trust-policy/v1';
+export const EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES = 256 * 1024;
+export const EXECUTOR_PHASE_A_MAX_PREFLIGHT_AGE_MS = 60 * 60 * 1000;
+export const EXECUTOR_PHASE_A_RECEIPT_TTL_MS = 60 * 60 * 1000;
+export const EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA = 'taskforce.executor-phase-a-approval-issuance-request/v1';
+export const EXECUTOR_PHASE_A_MUTATION_TTL_MS = 8 * 60 * 60 * 1000;
+export const EXECUTOR_PHASE_A_ORDINARY_CLEANUP_TTL_MS = 10 * 60 * 60 * 1000;
+export const EXECUTOR_PHASE_A_PHASES = [
+    'bootstrap',
+    'ami-build',
+    'provenance',
+    'runtime',
+    'cleanup',
+];
+function canonicalizeValue(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string') {
+        if (/[\uD800-\uDFFF]/u.test(value.replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/gu, ''))) {
+            throw new TypeError('Canonical JSON strings must contain valid Unicode scalar values.');
+        }
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('Canonical JSON numbers must be finite.');
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalizeValue).join(',')}]`;
+    if (typeof value === 'object') {
+        const record = value;
+        const keys = Object.keys(record).sort();
+        return `{${keys.map((key) => {
+            if (/[\uD800-\uDFFF]/u.test(key.replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/gu, ''))) {
+                throw new TypeError('Canonical JSON object keys must contain valid Unicode scalar values.');
+            }
+            const child = record[key];
+            if (child === undefined || typeof child === 'function' || typeof child === 'symbol' || typeof child === 'bigint') {
+                throw new TypeError(`Unsupported canonical JSON value at ${key}.`);
+            }
+            return `${JSON.stringify(key)}:${canonicalizeValue(child)}`;
+        }).join(',')}}`;
+    }
+    throw new TypeError('Unsupported canonical JSON value.');
+}
+/** RFC 8785/JCS bytes using ECMAScript JSON number and string serialization. */
+export function canonicalizeExecutorPhaseAJson(value) {
+    return Buffer.from(canonicalizeValue(value), 'utf8');
+}
+export function sha256ExecutorPhaseABytes(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}

package/dist/shared/executorPhaseAApprovalTrustPolicy.json

@@ -0,0 +1,10 @@
+{
+    "schema": "taskforce.executor-phase-a-approval-trust-policy/v1",
+    "issuer": "https://performance-app.taskforcehq.ai",
+    "audience": "taskforce-agent-executor-phase-a",
+    "environment": "performance",
+    "workspaceId": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2",
+    "taskId": "task-62fecb296bbe07ca535b6e6630fc458f",
+    "taskReference": "T-1653",
+    "keys": []
+}

package/dist/shared/executorPhaseADriftContracts.d.ts

@@ -0,0 +1,37 @@
+import { type KeyObject } from 'node:crypto';
+import type { VerifiedExecutorPhaseARunCapability } from './executorPhaseARunAuthorization.js';
+export declare const EXECUTOR_PHASE_A_DRIFT_REQUEST_PAYLOAD_SCHEMA: "taskforce.executor-phase-a-drift-request-payload/v1";
+export declare const EXECUTOR_PHASE_A_DRIFT_REQUEST_TTL_MS = 60000;
+export interface ExecutorPhaseADriftRequest {
+    payload: {
+        schema: typeof EXECUTOR_PHASE_A_DRIFT_REQUEST_PAYLOAD_SCHEMA;
+        requestId: string;
+        capabilityId: string;
+        capabilitySha256: string;
+        receiptId: string;
+        receiptSha256: string;
+        workspaceId: string;
+        taskId: string;
+        runId: string;
+        accountId: string;
+        region: 'us-west-2';
+        sourceCommit: string;
+        logicalEnvelopeSha256: string;
+        budgetsSha256: string;
+        issuedAt: string;
+        expiresAt: string;
+    };
+    envelope: {
+        algorithm: 'Ed25519';
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}
+declare const verifiedDriftRequestBrand: unique symbol;
+export type VerifiedExecutorPhaseADriftRequest = ExecutorPhaseADriftRequest & {
+    readonly [verifiedDriftRequestBrand]: true;
+};
+export declare function assertVerifiedExecutorPhaseADriftRequest(request: VerifiedExecutorPhaseADriftRequest): void;
+export declare function verifyExecutorPhaseADriftRequest(request: ExecutorPhaseADriftRequest, capability: VerifiedExecutorPhaseARunCapability, cloudPublicKey: KeyObject, now?: Date): VerifiedExecutorPhaseADriftRequest;
+export {};

package/dist/shared/executorPhaseADriftContracts.js

@@ -0,0 +1,63 @@
+import { createHash, verify } from 'node:crypto';
+import { canonicalizeExecutorPhaseAJson } from './executorPhaseAApprovalReceipt.js';
+import { assertExecutorPhaseASchema } from './executorPhaseASchemaValidation.js';
+import { EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS } from './executorPhaseATiming.js';
+export const EXECUTOR_PHASE_A_DRIFT_REQUEST_PAYLOAD_SCHEMA = 'taskforce.executor-phase-a-drift-request-payload/v1';
+export const EXECUTOR_PHASE_A_DRIFT_REQUEST_TTL_MS = 60_000;
+const verifiedDriftRequestBrand = Symbol('verifiedExecutorPhaseADriftRequest');
+const verifiedDriftRequests = new WeakSet();
+function deepFreeze(value) {
+    if (!value || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return Object.freeze(value);
+}
+export function assertVerifiedExecutorPhaseADriftRequest(request) {
+    if (!request || typeof request !== 'object' || !verifiedDriftRequests.has(request)) {
+        throw new TypeError('The drift collector requires a runtime-verified request.');
+    }
+}
+function timestamp(value, field) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new TypeError(`${field} is invalid.`);
+    return parsed;
+}
+export function verifyExecutorPhaseADriftRequest(request, capability, cloudPublicKey, now = new Date()) {
+    assertExecutorPhaseASchema('driftRequest', request);
+    if (cloudPublicKey.asymmetricKeyType !== 'ed25519')
+        throw new TypeError('The drift request key must be Ed25519.');
+    const payloadBytes = canonicalizeExecutorPhaseAJson(request.payload);
+    const signature = Buffer.from(request.envelope.signature, 'base64url');
+    const issuedAt = timestamp(request.payload.issuedAt, 'driftRequest.issuedAt');
+    const expiresAt = timestamp(request.payload.expiresAt, 'driftRequest.expiresAt');
+    const nowMs = now.getTime();
+    const capabilitySha256 = createHash('sha256').update(canonicalizeExecutorPhaseAJson(capability)).digest('hex');
+    const payload = capability.payload;
+    if (request.envelope.payloadSha256 !== createHash('sha256').update(payloadBytes).digest('hex')
+        || signature.length !== 64 || signature.toString('base64url') !== request.envelope.signature
+        || !verify(null, payloadBytes, cloudPublicKey, signature)
+        || issuedAt > nowMs + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS
+        || nowMs >= expiresAt + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS
+        || expiresAt <= issuedAt
+        || expiresAt - issuedAt > EXECUTOR_PHASE_A_DRIFT_REQUEST_TTL_MS
+        || request.payload.capabilityId !== payload.capabilityId
+        || request.payload.capabilitySha256 !== capabilitySha256
+        || request.payload.receiptId !== payload.receiptId
+        || request.payload.receiptSha256 !== payload.receiptSha256
+        || request.payload.workspaceId !== payload.workspaceId
+        || request.payload.taskId !== payload.taskId
+        || request.payload.runId !== payload.runId
+        || request.payload.accountId !== payload.accountId
+        || request.payload.region !== payload.region
+        || request.payload.sourceCommit !== payload.sourceCommit
+        || request.payload.logicalEnvelopeSha256 !== payload.logicalEnvelopeSha256
+        || request.payload.budgetsSha256 !== payload.budgetsSha256) {
+        throw new TypeError('The drift request is stale, forged, or bound to another run capability.');
+    }
+    const verified = Object.assign(structuredClone(request), { [verifiedDriftRequestBrand]: true });
+    deepFreeze(verified);
+    verifiedDriftRequests.add(verified);
+    return verified;
+}

package/dist/shared/executorPhaseAIssuerContracts.d.ts

@@ -0,0 +1,75 @@
+import { type KeyObject } from 'node:crypto';
+import { type ExecutorPhaseAApprovalReceipt } from './executorPhaseAApprovalReceipt.js';
+import { type ExecutorPhaseARunCapability, type ExecutorPhaseASenderProof, type ExecutorPhaseAWorkloadGrant } from './executorPhaseARunAuthorization.js';
+export declare const EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH: "/api/taskforce/internal/executor/phase-a/redemptions";
+export declare const EXECUTOR_PHASE_A_ISSUER_REDEMPTION_REQUEST_SCHEMA: "taskforce.executor-phase-a-issuer-redemption-request/v1";
+export declare const EXECUTOR_PHASE_A_ISSUER_PROOF_PAYLOAD_SCHEMA: "taskforce.executor-phase-a-issuer-proof-payload/v1";
+export declare const EXECUTOR_PHASE_A_ISSUER_PROOF_SCHEMA: "taskforce.executor-phase-a-issuer-proof/v1";
+export declare const EXECUTOR_PHASE_A_ISSUER_PROOF_TYPE: "TF-ISSUER-PROOF";
+export declare const EXECUTOR_PHASE_A_ISSUER_REDEMPTION_RESPONSE_PAYLOAD_SCHEMA: "taskforce.executor-phase-a-issuer-redemption-response-payload/v1";
+export declare const EXECUTOR_PHASE_A_ISSUER_PROOF_DOMAIN: Buffer<ArrayBuffer>;
+export declare const EXECUTOR_PHASE_A_ISSUER_PROOF_TTL_MS = 60000;
+export interface ExecutorPhaseAIssuerProofPayload {
+    schema: typeof EXECUTOR_PHASE_A_ISSUER_PROOF_PAYLOAD_SCHEMA;
+    method: 'POST';
+    path: typeof EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH;
+    requestSha256: string;
+    grantId: string;
+    grantSha256: string;
+    senderProofSha256: string;
+    requestId: string;
+    issuedAt: string;
+    expiresAt: string;
+}
+export interface ExecutorPhaseAIssuerProof {
+    payload: ExecutorPhaseAIssuerProofPayload;
+    envelope: {
+        schema: typeof EXECUTOR_PHASE_A_ISSUER_PROOF_SCHEMA;
+        typ: typeof EXECUTOR_PHASE_A_ISSUER_PROOF_TYPE;
+        algorithm: 'RS256';
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}
+export interface ExecutorPhaseAIssuerRedemptionRequest {
+    schema: typeof EXECUTOR_PHASE_A_ISSUER_REDEMPTION_REQUEST_SCHEMA;
+    requestId: string;
+    approvalReceipt: ExecutorPhaseAApprovalReceipt;
+    runCapability: ExecutorPhaseARunCapability;
+    workloadGrant: ExecutorPhaseAWorkloadGrant;
+    senderProof: ExecutorPhaseASenderProof;
+    brokerRequestSha256: string;
+    expectedPolicySha256: string;
+    issuerProof: ExecutorPhaseAIssuerProof;
+}
+export interface ExecutorPhaseAIssuerRedemptionResponsePayload {
+    schema: typeof EXECUTOR_PHASE_A_ISSUER_REDEMPTION_RESPONSE_PAYLOAD_SCHEMA;
+    decision: 'redeemed';
+    requestId: string;
+    grantId: string;
+    grantSha256: string;
+    senderProofSha256: string;
+    auditSha256: string;
+    redeemedAt: string;
+}
+export interface ExecutorPhaseAIssuerRedemptionResponse {
+    payload: ExecutorPhaseAIssuerRedemptionResponsePayload;
+    envelope: {
+        algorithm: 'Ed25519';
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}
+export interface ExecutorPhaseAIssuerProofTrustKey {
+    keyId: string;
+    publicKeySpkiBase64: string;
+    status: 'active' | 'retiring' | 'disabled';
+    validFrom: string;
+    validUntil: string;
+}
+export declare function executorPhaseAIssuerRedemptionIntentSha256(request: Pick<ExecutorPhaseAIssuerRedemptionRequest, 'requestId' | 'approvalReceipt' | 'runCapability' | 'workloadGrant' | 'senderProof' | 'brokerRequestSha256' | 'expectedPolicySha256'>): string;
+export declare function executorPhaseAIssuerProofSignedBytes(payload: ExecutorPhaseAIssuerProofPayload): Buffer;
+export declare function verifyExecutorPhaseAIssuerProof(request: ExecutorPhaseAIssuerRedemptionRequest, trustedKeys: readonly ExecutorPhaseAIssuerProofTrustKey[], now?: Date): KeyObject;
+export declare function executorPhaseAIssuerRedemptionAuditSha256(payload: Omit<ExecutorPhaseAIssuerRedemptionResponsePayload, 'schema' | 'decision' | 'auditSha256'>): string;