@tomflow/proflow-platform-host 0.1.17 → 0.1.19

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-platform-host
 
+## 0.1.19
+
+### Patch Changes
+
+- Release the verified Real-3 B1 task recovery, exact execution identity, durable observer resume, bounded gateway error, and matching Agent Action contract fixes.
+
+## 0.1.18
+
+### Patch Changes
+
+- Close Real-3 node generation identity fencing across Platform Host admission, durable Execution idempotency, and Observer/Approval resume provenance.
+
 ## 0.1.17
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -6,7 +6,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             data: {
                 endpoint: string;
                 stateRoot: string;
@@ -24,7 +24,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.19";
         };
         observedEffects: string[];
     }>;
@@ -34,7 +34,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             data: {
                 setupStatus: "READY";
                 runtimeStatus: "RUNNING" | "STOPPED";
@@ -55,7 +55,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             data: {
                 endpoint: string;
                 stateRoot: string;
@@ -73,7 +73,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             data: {
                 docs: string;
             };
@@ -86,7 +86,7 @@ export declare const behaviorAdapter: {
             ok: true;
             status: "SUCCEEDED";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             data: {
                 host: string;
                 port: number;
@@ -97,7 +97,7 @@ export declare const behaviorAdapter: {
         result: {
             contract: "deployment.result.v1";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             ok: false;
             status: "FAILED";
             error: {
@@ -114,7 +114,7 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.19";
         };
         observedEffects: string[];
     } | {
@@ -123,11 +123,11 @@ export declare const behaviorAdapter: {
             readonly ok: true;
             readonly status: "SUCCEEDED";
             readonly moduleRef: "platform-host";
-            readonly moduleVersion: "0.1.17";
+            readonly moduleVersion: "0.1.19";
         } | {
             contract: "deployment.result.v1";
             moduleRef: "platform-host";
-            moduleVersion: "0.1.17";
+            moduleVersion: "0.1.19";
             ok: false;
             status: "FAILED";
             error: {

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "platform-host";
     readonly packageName: "@tomflow/proflow-platform-host";
-    readonly moduleVersion: "0.1.17";
+    readonly moduleVersion: "0.1.19";
     readonly kind: "service";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "platform-host",
     packageName: "@tomflow/proflow-platform-host",
-    moduleVersion: "0.1.17",
+    moduleVersion: "0.1.19",
     kind: "service",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",

package/dist/src/index.d.ts

@@ -192,6 +192,7 @@ export type PlatformHostTaskDriverPorts = {
         } | null;
         canDrive: boolean;
         blockedReason: string | null;
+        resumeSignalRef: string | null;
     }>;
     getNodeContext(taskId: string, nodeId: string): Promise<{
         task: {

package/dist/src/index.js

@@ -324,6 +324,11 @@ function string(value, name) {
         throw new TypeError(`${name} must be a non-empty string`);
     return value;
 }
+function positiveInteger(value, name) {
+    if (!Number.isInteger(value) || Number(value) <= 0)
+        throw new TypeError(`${name} must be a positive integer`);
+    return Number(value);
+}
 function unwrap(result) {
     if (!result.ok || result.data === undefined)
         throw new Error(`OWNER_CONTRACT_FAILED:${JSON.stringify(result.error)}`);
@@ -389,6 +394,7 @@ async function constructGraph(config, executionCredential, modelCredential) {
         return {
             taskId: value.taskId,
             status: value.status,
+            currentNodeId: value.currentNodeId,
             roleBindings: value.roleBindings,
         };
     };
@@ -627,6 +633,37 @@ async function constructGraph(config, executionCredential, modelCredential) {
         }
         return rawRecord;
     };
+    const admissionError = (code, httpStatus = 403) => {
+        throw Object.assign(new Error(code), { httpStatus });
+    };
+    const admitExactNodeExecution = async (input, authenticatedRoleRef) => {
+        const taskId = string(input.taskId, "taskId");
+        const nodeId = string(input.nodeId, "nodeId");
+        const runNo = positiveInteger(input.runNo, "runNo");
+        const workerRef = await admitTaskParticipant(taskId, authenticatedRoleRef);
+        await agent.validateWorker({ authenticatedRoleRef, taskId, workerRef });
+        const taskFact = taskFacts(taskId);
+        const nodeContext = unwrap(task.queries.getNodeContext({ taskId, nodeId }));
+        if (taskFact.status !== "ACTIVE")
+            admissionError("EXECUTION_TASK_NOT_ACTIVE");
+        if (taskFact.currentNodeId !== nodeId)
+            admissionError("EXECUTION_NODE_NOT_CURRENT");
+        if (nodeContext.node.status !== "IN_PROGRESS")
+            admissionError("EXECUTION_NODE_NOT_RUNNING");
+        if (nodeContext.node.runNo !== runNo)
+            admissionError("EXECUTION_GENERATION_MISMATCH");
+        const nodeBinding = taskFact.roleBindings.find((binding) => binding.agentPackageRef === nodeContext.node.requiredAgentPackageRef);
+        if (!nodeBinding)
+            throw Object.assign(new Error("TASK_ROLE_BINDING_REQUIRED"), {
+                httpStatus: 403,
+            });
+        if (nodeBinding.roleRef !== authenticatedRoleRef)
+            admissionError("EXECUTION_ROLE_SCOPE_MISMATCH");
+        if (nodeBinding.workerRef !== workerRef ||
+            nodeContext.node.workerRef !== workerRef)
+            admissionError("EXECUTION_WORKER_SCOPE_MISMATCH");
+        return { taskId, nodeId, runNo, workerRef };
+    };
     const route = async (operationId, authenticatedRoleRef, rawInput, context) => {
         const role = agent.getRegisteredRole(authenticatedRoleRef);
         if (!roleOperations[role.agentPackageRef]?.has(operationId))
@@ -689,23 +726,16 @@ async function constructGraph(config, executionCredential, modelCredential) {
             return taskResult;
         }
         if (operationId === "executeCapability") {
-            const taskId = typeof input.taskId === "string" ? input.taskId : undefined;
-            let canonicalWorkerRef;
-            if (taskId) {
-                canonicalWorkerRef = await admitTaskParticipant(taskId, authenticatedRoleRef, typeof input.workerRef === "string" ? input.workerRef : undefined);
-                await agent.validateWorker({
-                    authenticatedRoleRef,
-                    taskId,
-                    workerRef: canonicalWorkerRef,
-                });
-            }
+            const scope = await admitExactNodeExecution(input, authenticatedRoleRef);
+            const { workerRef: _suppliedWorkerRef, projectRoot: _suppliedProjectRoot, roleRef: _suppliedRoleRef, callerRef: _suppliedCallerRef, ...ownerInput } = input;
             const result = await execution.invoke(operationId, {
-                ...input,
+                ...ownerInput,
                 callerRef: authenticatedRoleRef,
                 roleRef: authenticatedRoleRef,
-                ...(canonicalWorkerRef !== undefined
-                    ? { workerRef: canonicalWorkerRef }
-                    : {}),
+                taskId: scope.taskId,
+                nodeId: scope.nodeId,
+                runNo: scope.runNo,
+                workerRef: scope.workerRef,
             });
             // A normal Action may complete synchronously inside the current Worker Turn.
             // Do not manufacture a Browser RESUME for every terminal Execution record.
@@ -823,7 +853,11 @@ async function constructGraph(config, executionCredential, modelCredential) {
             if (request.projectRoot &&
                 resolve(request.projectRoot) !== config.workspaceRoot)
                 return false;
-            if ((request.nodeId || request.runNo) && !request.taskId)
+            const nodeScoped = request.nodeId !== undefined || request.runNo !== undefined;
+            if (nodeScoped &&
+                (request.nodeId === undefined || request.runNo === undefined))
+                return false;
+            if (nodeScoped && !request.taskId)
                 return false;
             if (request.workerRef && !request.taskId)
                 return false;
@@ -842,12 +876,30 @@ async function constructGraph(config, executionCredential, modelCredential) {
                         taskId: request.taskId,
                         workerRef: request.workerRef,
                     });
-                if (request.nodeId)
-                    unwrap(task.queries.getNodeContext({
+                if (request.nodeId) {
+                    const nodeContext = unwrap(task.queries.getNodeContext({
                         taskId: request.taskId,
                         nodeId: request.nodeId,
-                        ...(request.runNo ? { runNo: request.runNo } : {}),
                     }));
+                    if (taskFact.status !== "ACTIVE")
+                        return false;
+                    if (taskFact.currentNodeId !== nodeContext.node.nodeId)
+                        return false;
+                    if (request.runNo !== nodeContext.node.runNo)
+                        return false;
+                    if (!browserCapability && nodeContext.node.status !== "IN_PROGRESS")
+                        return false;
+                    const nodeBinding = taskFact.roleBindings.find((candidate) => candidate.agentPackageRef ===
+                        nodeContext.node.requiredAgentPackageRef);
+                    if (!nodeBinding?.workerRef)
+                        return false;
+                    const scopedRoleRef = request.roleRef ??
+                        (internalBrowserCaller ? undefined : request.callerRef);
+                    if (scopedRoleRef !== nodeBinding.roleRef)
+                        return false;
+                    if (request.workerRef !== nodeBinding.workerRef)
+                        return false;
+                }
                 const browserInput = object(request.input, "execution input");
                 if (browserCapability) {
                     const targetRoleRef = string(browserInput.roleRef, "input.roleRef");
@@ -861,6 +913,30 @@ async function constructGraph(config, executionCredential, modelCredential) {
                         const targetWorkerRef = string(browserInput.workerRef, "input.workerRef");
                         if (binding.workerRef !== targetWorkerRef)
                             return false;
+                        if (request.capability === "worker.wake" &&
+                            (targetRoleRef !== request.roleRef ||
+                                targetWorkerRef !== request.workerRef ||
+                                browserInput.taskId !== request.taskId ||
+                                browserInput.nodeId !== request.nodeId ||
+                                browserInput.runNo !== request.runNo))
+                            return false;
+                        if (request.capability === "worker.wake") {
+                            const nodeContext = unwrap(task.queries.getNodeContext({
+                                taskId: request.taskId,
+                                nodeId: string(browserInput.nodeId, "input.nodeId"),
+                            }));
+                            const trigger = string(browserInput.trigger, "input.trigger");
+                            const readyWake = nodeContext.node.status === "READY" &&
+                                ((trigger === "NODE_READY" && nodeContext.node.runNo === 1) ||
+                                    (trigger === "REOPEN" && nodeContext.node.runNo > 1));
+                            const resumeWake = nodeContext.node.status === "IN_PROGRESS" &&
+                                (trigger === "RECOVERY_RESUME" ||
+                                    trigger === "EXECUTION_RESULT_READY" ||
+                                    trigger === "TASK_RESUMED" ||
+                                    trigger === "PEER_REPLY_READY");
+                            if (!readyWake && !resumeWake)
+                                return false;
+                        }
                     }
                 }
             }
@@ -1111,6 +1187,22 @@ async function constructGraph(config, executionCredential, modelCredential) {
                     actorRef: "extension:human",
                     idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
                 }));
+            if (operation === "message.acknowledge")
+                return unwrap(task.commands.acknowledgeMessage({
+                    messageId: string(value.messageId, "messageId"),
+                    ...(typeof value.resolution === "string"
+                        ? { resolution: value.resolution }
+                        : {}),
+                    actorRef: "extension:human",
+                    idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
+                }));
+            if (operation === "task.resume")
+                return unwrap(task.commands.resumeTask({
+                    taskId: string(value.taskId, "taskId"),
+                    expectedTaskVersion: positiveInteger(value.expectedTaskVersion, "expectedTaskVersion"),
+                    actorRef: "extension:human",
+                    idempotencyKey: string(value.idempotencyKey, "idempotencyKey"),
+                }));
             if (operation === "node.reopen")
                 return unwrap(task.commands.reopenNode({
                     taskId: string(value.taskId, "taskId"),
@@ -1164,6 +1256,26 @@ async function constructGraph(config, executionCredential, modelCredential) {
             const value = object(rawInput, "observer application input");
             if (operation === "task.projection")
                 return taskDriverPorts.getTaskDriveProjection(string(value.taskId, "taskId"));
+            if (operation === "approval.executionContext") {
+                const approval = object(await execution.invoke("getExecutionApproval", {
+                    approvalRef: string(value.approvalRef, "approvalRef"),
+                }), "approval fact");
+                const executionFact = object(await execution.invoke("getExecution", {
+                    executionRef: string(approval.executionRef, "executionRef"),
+                    callerRef: string(approval.callerRef, "callerRef"),
+                }), "execution fact");
+                const runNo = Number(executionFact.runNo);
+                if (!Number.isInteger(runNo) || runNo <= 0)
+                    throw new Error("EXECUTION_RUN_GENERATION_REQUIRED");
+                return {
+                    executionRef: string(executionFact.executionRef, "executionRef"),
+                    taskId: string(executionFact.taskId, "taskId"),
+                    nodeId: string(executionFact.nodeId, "nodeId"),
+                    runNo,
+                    roleRef: string(executionFact.roleRef, "roleRef"),
+                    workerRef: string(executionFact.workerRef, "workerRef"),
+                };
+            }
             if (operation === "browser.permission.classify") {
                 const roleRef = string(value.roleRef, "roleRef");
                 const taskId = string(value.taskId, "taskId");
@@ -1392,15 +1504,16 @@ async function constructGraph(config, executionCredential, modelCredential) {
                     });
                     return admitExecutionRead(authenticatedRoleRef, record);
                 }
-                const taskId = typeof value.taskId === "string" ? value.taskId : undefined;
-                let canonicalWorkerRef;
-                if (taskId)
-                    canonicalWorkerRef = await admitTaskParticipant(taskId, authenticatedRoleRef, typeof value.workerRef === "string" ? value.workerRef : undefined);
+                const scope = await admitExactNodeExecution(value, authenticatedRoleRef);
+                const { workerRef: _suppliedWorkerRef, projectRoot: _suppliedProjectRoot, roleRef: _suppliedRoleRef, callerRef: _suppliedCallerRef, ...ownerInput } = value;
                 const record = await execution.invoke("lookupExecutionIntent", {
-                    ...value,
+                    ...ownerInput,
                     callerRef: authenticatedRoleRef,
                     roleRef: authenticatedRoleRef,
-                    ...(canonicalWorkerRef ? { workerRef: canonicalWorkerRef } : {}),
+                    taskId: scope.taskId,
+                    nodeId: scope.nodeId,
+                    runNo: scope.runNo,
+                    workerRef: scope.workerRef,
                 });
                 return admitExecutionRead(authenticatedRoleRef, record);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-platform-host",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -24,19 +24,19 @@
   ],
   "dependencies": {
     "zod": "4.1.12",
-    "@tomflow/proflow-task-migration-runner": "^0.1.11",
-    "@tomflow/proflow-execution-browser-extension": "^0.1.38",
-    "@tomflow/proflow-task-orchestration": "^0.1.10",
-    "@tomflow/proflow-task-store-sqlite": "^0.1.11",
     "@tomflow/proflow-agent-runtime": "^0.1.13",
+    "@tomflow/proflow-execution-contracts": "^0.1.10",
+    "@tomflow/proflow-execution-browser-extension": "^0.1.45",
     "@tomflow/proflow-module-contract": "^0.1.13",
-    "@tomflow/proflow-execution-contracts": "^0.1.10"
+    "@tomflow/proflow-task-migration-runner": "^0.1.11",
+    "@tomflow/proflow-task-orchestration": "^0.1.11",
+    "@tomflow/proflow-task-store-sqlite": "^0.1.11"
   },
   "devDependencies": {
-    "@tomflow/proflow-model-runtime": "^0.1.22",
-    "@tomflow/proflow-deployment-conformance": "^0.1.13",
-    "@tomflow/proflow-agent-gateway": "^0.1.15",
-    "@tomflow/proflow-execution-runtime": "^0.1.17"
+    "@tomflow/proflow-agent-gateway": "^0.1.16",
+    "@tomflow/proflow-execution-runtime": "^0.1.18",
+    "@tomflow/proflow-model-runtime": "^0.1.24",
+    "@tomflow/proflow-deployment-conformance": "^0.1.13"
   },
   "description": "Provides the ProFlow local application composition root that binds Task, Agent, Execution and Model owner transports.",
   "keywords": [

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "platform-host",
 	"packageName": "@tomflow/proflow-platform-host",
-	"moduleVersion": "0.1.17",
+	"moduleVersion": "0.1.19",
 	"kind": "service",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",