@veil-runtime/core 0.1.3 → 0.3.0

package/dist/runtime/execution/governed-value.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernedValueError = void 0;
+exports.captureGovernedValue = captureGovernedValue;
+exports.copyGovernedValue = copyGovernedValue;
+const node_util_1 = require("node:util");
+const MAX_DEPTH = 128;
+const MAX_CONTAINERS = 10_000;
+const MAX_EDGES = 100_000;
+const MAX_STRING_UNITS = 1_048_576;
+class GovernedValueError extends Error {
+    constructor() {
+        super('Value is not a supported governed representation');
+        this.name = 'GovernedValueError';
+    }
+}
+exports.GovernedValueError = GovernedValueError;
+function reject() {
+    throw new GovernedValueError();
+}
+function primitive(value) {
+    if (value === null || value === undefined)
+        return true;
+    switch (typeof value) {
+        case 'boolean':
+        case 'string':
+        case 'number':
+        case 'bigint':
+            return true;
+        default:
+            return false;
+    }
+}
+function excludedBrand(value) {
+    if (node_util_1.types.isProxy(value))
+        return true;
+    if (node_util_1.types.isDate(value) ||
+        node_util_1.types.isMap(value) ||
+        node_util_1.types.isSet(value) ||
+        node_util_1.types.isRegExp(value) ||
+        node_util_1.types.isBoxedPrimitive(value) ||
+        node_util_1.types.isAnyArrayBuffer(value) ||
+        node_util_1.types.isArrayBufferView(value) ||
+        node_util_1.types.isDataView(value) ||
+        node_util_1.types.isWeakMap(value) ||
+        node_util_1.types.isWeakSet(value) ||
+        node_util_1.types.isPromise(value))
+        return true;
+    const iteratorTypes = [
+        node_util_1.types.isMapIterator,
+        node_util_1.types.isSetIterator,
+        node_util_1.types.isGeneratorObject,
+    ];
+    return iteratorTypes.some((check) => check?.(value) === true);
+}
+function inspect(value, counters) {
+    if (excludedBrand(value))
+        reject();
+    const prototype = Object.getPrototypeOf(value);
+    const isArray = Array.isArray(value);
+    if (isArray && prototype !== Array.prototype)
+        reject();
+    if (!isArray && prototype !== Object.prototype && prototype !== null)
+        reject();
+    const keys = Reflect.ownKeys(value);
+    const entries = [];
+    let length = 0;
+    if (isArray) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+        if (!lengthDescriptor ||
+            lengthDescriptor.enumerable ||
+            !('value' in lengthDescriptor) ||
+            typeof lengthDescriptor.value !== 'number' ||
+            !Number.isSafeInteger(lengthDescriptor.value) ||
+            lengthDescriptor.value < 0)
+            reject();
+        length = lengthDescriptor.value;
+    }
+    for (const key of keys) {
+        if (typeof key !== 'string')
+            reject();
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !('value' in descriptor))
+            reject();
+        if (isArray && key === 'length') {
+            if (descriptor.enumerable || typeof descriptor.value !== 'number' || descriptor.value !== length)
+                reject();
+            continue;
+        }
+        if (!descriptor.enumerable)
+            reject();
+        if (typeof descriptor.value === 'string')
+            counters.stringUnits += descriptor.value.length;
+        counters.stringUnits += key.length;
+        if (counters.stringUnits > MAX_STRING_UNITS)
+            reject();
+        if (isArray) {
+            const index = Number(key);
+            if (!Number.isInteger(index) || index < 0 || String(index) !== key || index >= length)
+                reject();
+        }
+        entries.push({ key, value: descriptor.value });
+    }
+    if (isArray) {
+        if (!Number.isSafeInteger(length) || length < 0)
+            reject();
+        for (let index = 0; index < length; index += 1) {
+            if (!entries.some((entry) => entry.key === String(index)))
+                reject();
+        }
+        counters.edges += entries.length;
+        if (counters.edges > MAX_EDGES)
+            reject();
+        return { target: new Array(length), entries };
+    }
+    counters.edges += entries.length;
+    if (counters.edges > MAX_EDGES)
+        reject();
+    return {
+        target: Object.create(prototype === null ? null : Object.prototype),
+        entries,
+    };
+}
+function clone(value, freeze) {
+    const counters = { containers: 0, edges: 0, stringUnits: 0 };
+    const memo = new Map();
+    const active = new Set();
+    const stack = [];
+    const make = (candidate, depth) => {
+        if (primitive(candidate)) {
+            if (typeof candidate === 'string') {
+                counters.stringUnits += candidate.length;
+                if (counters.stringUnits > MAX_STRING_UNITS)
+                    reject();
+            }
+            return candidate;
+        }
+        if (typeof candidate !== 'object' || candidate === null)
+            reject();
+        if (depth > MAX_DEPTH)
+            reject();
+        const source = candidate;
+        const existing = memo.get(source);
+        if (existing) {
+            if (active.has(source))
+                reject();
+            return existing;
+        }
+        counters.containers += 1;
+        if (counters.containers > MAX_CONTAINERS)
+            reject();
+        const inspected = inspect(source, counters);
+        memo.set(source, inspected.target);
+        active.add(source);
+        stack.push({ source, target: inspected.target, entries: inspected.entries, index: 0 });
+        return inspected.target;
+    };
+    const root = make(value, 0);
+    while (stack.length > 0) {
+        const frame = stack[stack.length - 1];
+        if (frame.index >= frame.entries.length) {
+            active.delete(frame.source);
+            stack.pop();
+            continue;
+        }
+        const entry = frame.entries[frame.index++];
+        const child = make(entry.value, stack.length);
+        Object.defineProperty(frame.target, entry.key, {
+            value: child,
+            enumerable: true,
+            configurable: true,
+            writable: true,
+        });
+    }
+    if (freeze && typeof root === 'object' && root !== null) {
+        const pending = [root];
+        const seen = new Set();
+        while (pending.length > 0) {
+            const current = pending.pop();
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            for (const key of Object.keys(current)) {
+                const child = current[key];
+                if (typeof child === 'object' && child !== null)
+                    pending.push(child);
+            }
+            Object.freeze(current);
+        }
+    }
+    return root;
+}
+function captureGovernedValue(value) {
+    return clone(value, false);
+}
+function copyGovernedValue(value, frozen = false) {
+    return clone(value, frozen);
+}

package/dist/runtime/execution/plan-admission-error.d.ts

@@ -0,0 +1,22 @@
+/** Structured admission evidence. Legacy Error.message is not safe wire data. */
+export type PlanAdmissionIssueCode = 'UNSUPPORTED_PLAN_VERSION' | 'EMPTY_PLAN' | 'DUPLICATE_STEP_ID' | 'UNKNOWN_CAPABILITY' | 'CAPABILITY_VERSION_MISMATCH' | 'REQUIRED_INPUT_MISSING' | 'INPUT_TYPE_MISMATCH' | 'UNSUPPORTED_INPUT_SCHEMA' | 'INVALID_RESULT_REFERENCE' | 'RESULT_REFERENCE_NOT_EARLIER';
+export interface PlanAdmissionIssue {
+    readonly code: PlanAdmissionIssueCode;
+    readonly message: string;
+    readonly stepIndex?: number;
+    readonly field?: string;
+}
+export interface PlanAdmissionError extends Error {
+    readonly code: 'PLAN_ADMISSION_REJECTED';
+    readonly issues: readonly PlanAdmissionIssue[];
+}
+export type AdmissionOwner = object;
+/** Local issuance only; current-call certainty requires the direct executePlan boundary. */
+export declare function isPlanAdmissionError(value: unknown): value is PlanAdmissionError;
+export declare function issuePlanAdmissionError(owner: AdmissionOwner, message: string, issues: readonly {
+    code: PlanAdmissionIssueCode;
+    stepIndex?: number;
+    field?: string;
+}[]): PlanAdmissionError;
+/** Prevent a genuine diagnostic from another submission becoming this call's evidence. */
+export declare function containForeignAdmissionError(owner: AdmissionOwner, error: unknown): unknown;

package/dist/runtime/execution/plan-admission-error.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPlanAdmissionError = isPlanAdmissionError;
+exports.issuePlanAdmissionError = issuePlanAdmissionError;
+exports.containForeignAdmissionError = containForeignAdmissionError;
+const messages = {
+    UNSUPPORTED_PLAN_VERSION: 'The plan version is not supported.',
+    EMPTY_PLAN: 'The plan contains no steps.',
+    DUPLICATE_STEP_ID: 'A step identifier is repeated.',
+    UNKNOWN_CAPABILITY: 'The requested capability is not registered.',
+    CAPABILITY_VERSION_MISMATCH: 'The requested capability version does not match.',
+    REQUIRED_INPUT_MISSING: 'A required input field is missing.',
+    INPUT_TYPE_MISMATCH: 'An input field has an incompatible type.',
+    UNSUPPORTED_INPUT_SCHEMA: 'An input field cannot be validated with the declared schema.',
+    INVALID_RESULT_REFERENCE: 'A result reference was not accepted by the admission parser.',
+    RESULT_REFERENCE_NOT_EARLIER: 'A result reference must target an earlier declared step.',
+};
+const issued = new WeakMap();
+/** Local issuance only; current-call certainty requires the direct executePlan boundary. */
+function isPlanAdmissionError(value) {
+    return typeof value === 'object' && value !== null && issued.has(value);
+}
+function issuePlanAdmissionError(owner, message, issues) {
+    const details = Object.freeze(issues.map(issue => Object.freeze({
+        code: issue.code,
+        message: messages[issue.code],
+        ...(issue.stepIndex === undefined ? {} : { stepIndex: issue.stepIndex }),
+        ...(issue.field === undefined ? {} : { field: issue.field }),
+    })));
+    const error = new Error(message);
+    Object.defineProperties(error, {
+        code: { value: 'PLAN_ADMISSION_REJECTED', writable: false, configurable: false, enumerable: false },
+        issues: { value: details, writable: false, configurable: false, enumerable: false },
+    });
+    issued.set(error, { owner, message });
+    return error;
+}
+/** Prevent a genuine diagnostic from another submission becoming this call's evidence. */
+function containForeignAdmissionError(owner, error) {
+    if (!isPlanAdmissionError(error))
+        return error;
+    const record = issued.get(error);
+    return record.owner === owner ? error : new Error(record.message, { cause: error });
+}

package/dist/runtime/execution/plan-validator.d.ts

@@ -1,5 +1,8 @@
+import type { PlanAdmissionIssueCode } from './plan-admission-error.js';
 import { ExecutionStep } from '../planner/planner.js';
 export interface PlanValidationError {
+    code: PlanAdmissionIssueCode;
+    stepIndex?: number;
     stepId: string;
     capability: string;
     field?: string;

package/dist/runtime/execution/plan-validator.js

@@ -23,6 +23,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'REQUIRED_INPUT_MISSING',
                 message: `Required input '${field}' is missing for capability '${step.capability}'`,
             });
             continue;
@@ -36,6 +37,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'UNSUPPORTED_INPUT_SCHEMA',
                 message: `Unsupported schema type '${definition.type}' for capability '${step.capability}'`,
             });
         }
@@ -44,6 +46,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'INPUT_TYPE_MISMATCH',
                 message: `Input '${field}' must be of type '${definition.type}' for capability '${step.capability}'`,
             });
         }
@@ -68,6 +71,7 @@ function validateStepInput(step, input) {
             errors: [{
                     stepId: step.id,
                     capability: step.capability,
+                    code: 'UNKNOWN_CAPABILITY',
                     message: `Unknown capability: ${step.capability}`,
                 }],
         };
@@ -78,21 +82,34 @@ function validateStepInput(step, input) {
 function validatePlan(steps) {
     const errors = [];
     const seenStepIds = new Set();
-    for (const step of steps) {
+    for (const [stepIndex, step] of steps.entries()) {
+        const firstIssue = errors.length;
+        if (seenStepIds.has(step.id)) {
+            errors.push({
+                stepId: step.id,
+                capability: step.capability,
+                code: 'DUPLICATE_STEP_ID',
+                message: `Duplicate step ID: ${step.id}`,
+            });
+        }
         const capability = registry_js_1.capabilityRegistry.get(step.capability);
         if (!capability) {
             errors.push({
                 stepId: step.id,
                 capability: step.capability,
+                code: 'UNKNOWN_CAPABILITY',
                 message: `Unknown capability: ${step.capability}`,
             });
+            for (let i = firstIssue; i < errors.length; i++)
+                errors[i].stepIndex = stepIndex;
             seenStepIds.add(step.id);
             continue;
         }
-        if (step.capabilityVersion && step.capabilityVersion !== capability.version) {
+        if (step.capabilityVersion !== undefined && step.capabilityVersion !== capability.version) {
             errors.push({
                 stepId: step.id,
                 capability: step.capability,
+                code: 'CAPABILITY_VERSION_MISMATCH',
                 message: `Capability version mismatch for '${step.capability}': requested ${step.capabilityVersion}, registered ${capability.version}`,
             });
         }
@@ -104,6 +121,7 @@ function validatePlan(steps) {
                     errors.push({
                         stepId: step.id,
                         capability: step.capability,
+                        code: 'RESULT_REFERENCE_NOT_EARLIER',
                         message: `Result reference must target an earlier step: ${reference}`,
                     });
                 }
@@ -112,10 +130,13 @@ function validatePlan(steps) {
                 errors.push({
                     stepId: step.id,
                     capability: step.capability,
+                    code: 'INVALID_RESULT_REFERENCE',
                     message: error instanceof Error ? error.message : 'Invalid result reference',
                 });
             }
         }
+        for (let i = firstIssue; i < errors.length; i++)
+            errors[i].stepIndex = stepIndex;
         seenStepIds.add(step.id);
     }
     return { valid: errors.length === 0, errors };

package/dist/runtime/execution/result-reference.js

@@ -9,8 +9,15 @@ function isResultReference(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return false;
     }
-    const record = value;
-    return Object.keys(record).length === 1 && typeof record.$ref === 'string';
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== 1 || keys[0] !== '$ref') {
+        return false;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, '$ref');
+    return descriptor !== undefined
+        && descriptor.enumerable === true
+        && Object.hasOwn(descriptor, 'value')
+        && typeof descriptor.value === 'string';
 }
 function parseResultReference(reference) {
     if (!reference.startsWith(REFERENCE_PREFIX)) {
@@ -39,7 +46,7 @@ function resolveResultReferences(value, completedSteps) {
         }
         let resolved = step.result;
         for (const segment of path) {
-            if (!resolved || typeof resolved !== 'object' || !(segment in resolved)) {
+            if (!resolved || typeof resolved !== 'object' || !Object.hasOwn(resolved, segment)) {
                 throw new Error(`Result reference path not found: ${value.$ref}`);
             }
             resolved = resolved[segment];

package/dist/runtime/jobs/job-manager.d.ts

@@ -1,3 +1,4 @@
+import { AdmissionOwner } from '../execution/plan-admission-error.js';
 import { ExecutionAuthorizer } from '../permissions/execution-authorizer.js';
 import { ExecutionPlan } from '../planner/planner.js';
 import { ExecutionCaller } from '../execution/execution-context.js';
@@ -5,12 +6,12 @@ import { Job, JobOutcome } from './job.js';
 import { JobStatus } from './job-status.js';
 import { JobListFilter } from './job-store.js';
 declare class JobManager {
-    executePlan(plan: ExecutionPlan, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer): Promise<Job>;
+    executePlan(plan: ExecutionPlan, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer, admissionOwner?: AdmissionOwner, enabledVersions?: ReadonlySet<string>): Promise<Job>;
     create(goal: string, planner?: string): Promise<Job>;
     get(id: string): Promise<Job | undefined>;
     list(filter?: JobListFilter): Promise<Job[]>;
     setStatus(id: string, status: JobStatus): Promise<Job>;
-    execute(id: string, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer): Promise<Job>;
+    execute(id: string, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer, semanticVersion?: '1.0' | '2.0'): Promise<Job>;
     review(id: string, outcome: JobOutcome, notes?: string): Promise<Job>;
     private addEvent;
 }

package/dist/runtime/jobs/job-manager.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jobManager = void 0;
+const plan_admission_error_js_1 = require("../execution/plan-admission-error.js");
 const node_crypto_1 = require("node:crypto");
 const registry_js_1 = require("../registry/registry.js");
 const execution_authorizer_js_1 = require("../permissions/execution-authorizer.js");
 const plan_validator_js_1 = require("../execution/plan-validator.js");
 const result_reference_js_1 = require("../execution/result-reference.js");
+const governed_value_js_1 = require("../execution/governed-value.js");
 const memory_event_bus_js_1 = require("../events/memory-event-bus.js");
 const job_store_js_1 = require("./job-store.js");
 const console_execution_logger_js_1 = require("../execution/console-execution-logger.js");
@@ -13,21 +15,43 @@ const console_log_sink_js_1 = require("../logging/console-log-sink.js");
 const composite_log_sink_js_1 = require("../logging/composite-log-sink.js");
 const sqlite_log_sink_js_1 = require("../logging/sqlite-log-sink.js");
 class JobManager {
-    async executePlan(plan, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer) {
-        if (!plan.steps.length) {
-            throw new Error('Execution plan contains no steps');
+    async executePlan(plan, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer, admissionOwner = {}, enabledVersions = new Set(['1.0'])) {
+        const version = plan.version;
+        if ((version !== '1.0' && version !== '2.0') || !enabledVersions.has(version)) {
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, "Execution plan version is not supported; expected '1.0'.", [{ code: 'UNSUPPORTED_PLAN_VERSION' }]);
         }
-        const validation = (0, plan_validator_js_1.validatePlan)(plan.steps);
+        // Own the structural envelope before admission; nested input remains shared.
+        const capturedGoal = plan.goal;
+        const idempotencyKey = plan.idempotencyKey;
+        const submittedSteps = plan.steps;
+        const steps = new Array(submittedSteps.length);
+        for (let index = 0; index < steps.length; index += 1) {
+            if (!(index in submittedSteps))
+                continue;
+            const step = submittedSteps[index];
+            steps[index] = {
+                id: step.id,
+                capability: step.capability,
+                capabilityVersion: step.capabilityVersion,
+                input: step.input,
+                reason: step.reason,
+                idempotencyKey: step.idempotencyKey,
+            };
+        }
+        if (!steps.length) {
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, 'Execution plan contains no steps', [{ code: 'EMPTY_PLAN' }]);
+        }
+        const validation = (0, plan_validator_js_1.validatePlan)(steps);
         if (!validation.valid) {
-            throw new Error(`Execution plan failed validation: ${validation.errors
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, `Execution plan failed validation: ${validation.errors
                 .map((error) => error.message)
-                .join('; ')}`);
+                .join('; ')}`, validation.errors);
         }
-        const goal = plan.goal?.trim() ||
+        const goal = capturedGoal?.trim() ||
             'External execution plan';
         const job = await this.create(goal);
-        job.idempotencyKey = plan.idempotencyKey;
-        job.steps = plan.steps.map((step) => ({
+        job.idempotencyKey = idempotencyKey;
+        job.steps = steps.map((step) => ({
             ...step,
             status: 'pending',
             createdAt: new Date().toISOString(),
@@ -35,7 +59,7 @@ class JobManager {
         job.updatedAt =
             new Date().toISOString();
         await job_store_js_1.jobStore.update(job);
-        return this.execute(job.id, caller, authorizer);
+        return this.execute(job.id, caller, authorizer, version);
     }
     async create(goal, planner) {
         if (!goal?.trim()) {
@@ -74,7 +98,7 @@ class JobManager {
         await job_store_js_1.jobStore.update(job);
         return job;
     }
-    async execute(id, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer) {
+    async execute(id, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer, semanticVersion = '1.0') {
         const job = await job_store_js_1.jobStore.get(id);
         if (!job) {
             throw new Error(`Job not found: ${id}`);
@@ -94,26 +118,48 @@ class JobManager {
                 }
                 try {
                     const completedSteps = job.steps.slice(0, job.steps.indexOf(step));
+                    // ADR-0011 begins after the existing resolver. Reference traversal
+                    // may retain its legacy getter/Proxy behavior; capture governs only
+                    // the representation returned by that resolver.
                     const resolvedInput = (0, result_reference_js_1.resolveResultReferences)(step.input, completedSteps);
-                    const inputValidation = (0, plan_validator_js_1.validateStepInput)(step, resolvedInput);
+                    const governedInput = semanticVersion === '2.0'
+                        ? (0, governed_value_js_1.captureGovernedValue)(resolvedInput)
+                        : resolvedInput;
+                    const inputValidation = (0, plan_validator_js_1.validateStepInput)(step, governedInput);
                     if (!inputValidation.valid) {
                         throw new Error(inputValidation.errors
                             .map((validationError) => validationError.message)
                             .join('; '));
                     }
-                    const authorization = await authorizer.authorize({
-                        jobId: job.id,
-                        stepId: step.id,
-                        capability: {
-                            name: capability.name,
-                            version: capability.version,
-                            risk: capability.risk,
-                        },
-                        input: resolvedInput,
-                        caller,
-                    });
-                    if (authorization.decision === 'deny') {
-                        const message = authorization.reason ??
+                    const authorization = semanticVersion === '2.0'
+                        ? await authorizer.authorize(createGovernedAuthorizationContext(job.id, step.id, capability, (0, governed_value_js_1.copyGovernedValue)(governedInput, true), caller))
+                        : await authorizer.authorize({
+                            jobId: job.id,
+                            stepId: step.id,
+                            capability: {
+                                name: capability.name,
+                                version: capability.version,
+                                risk: capability.risk,
+                            },
+                            input: resolvedInput,
+                            caller,
+                        });
+                    if (typeof authorization !== 'object' ||
+                        authorization === null ||
+                        Array.isArray(authorization) ||
+                        !Object.hasOwn(authorization, 'decision')) {
+                        throw new Error('Invalid authorization decision');
+                    }
+                    const decision = authorization.decision;
+                    if (decision !== 'allow' && decision !== 'deny') {
+                        throw new Error('Invalid authorization decision');
+                    }
+                    if (decision === 'deny') {
+                        const reason = authorization.reason;
+                        if (reason !== undefined && typeof reason !== 'string') {
+                            throw new Error('Invalid authorization decision');
+                        }
+                        const message = reason ??
                             `Capability not permitted: ${step.capability}`;
                         step.status = 'failed';
                         step.error = message;
@@ -122,10 +168,15 @@ class JobManager {
                             stepId: step.id,
                             capability: capability.name,
                             risk: capability.risk,
-                            reason: authorization.reason,
+                            reason,
                         });
                         throw new AuthorizationDeniedError(message);
                     }
+                    // ADR-0011 requires the detached v2 entry value to exist before the
+                    // running/start transition. V1 retains its historical shared input.
+                    const capabilityInput = semanticVersion === '2.0'
+                        ? (0, governed_value_js_1.copyGovernedValue)(governedInput)
+                        : resolvedInput;
                     step.status = 'running';
                     step.startedAt = new Date().toISOString();
                     this.addEvent(job, 'capability.started', {
@@ -136,7 +187,7 @@ class JobManager {
                         new console_log_sink_js_1.ConsoleLogSink(),
                         new sqlite_log_sink_js_1.SQLiteLogSink(),
                     ]));
-                    const result = await capability.execute(resolvedInput, {
+                    const result = await capability.execute(capabilityInput, {
                         jobId: job.id,
                         stepId: step.id,
                         logger,
@@ -234,6 +285,25 @@ class JobManager {
         return event;
     }
 }
+function createGovernedAuthorizationContext(jobId, stepId, capability, input, caller) {
+    const context = {
+        jobId,
+        stepId,
+        capability: {
+            name: capability.name,
+            version: capability.version,
+            risk: capability.risk,
+        },
+        caller,
+    };
+    Object.defineProperty(context, 'input', {
+        value: input,
+        enumerable: true,
+        configurable: false,
+        writable: false,
+    });
+    return context;
+}
 class AuthorizationDeniedError extends Error {
 }
 exports.jobManager = new JobManager();

package/dist/runtime/operator-runtime.d.ts

@@ -1,3 +1,4 @@
+import type { CapabilityDescriptor } from './registry/capability.js';
 import { Job } from './jobs/job.js';
 import { JobListFilter } from './jobs/job-store.js';
 import { ExecutionCaller } from './execution/execution-context.js';
@@ -14,22 +15,19 @@ export interface ExecutePlanOptions {
 }
 export interface OperatorRuntimeOptions {
     readonly authorizer?: ExecutionAuthorizer;
+    readonly planVersions?: readonly string[];
 }
 export declare class OperatorRuntime {
     private readonly authorizer;
+    private readonly planVersions;
     constructor(options?: OperatorRuntimeOptions);
     use(module: CapabilityModule): void;
     executePlan(plan: ExecutionPlan, options?: ExecutePlanOptions): Promise<Job>;
     run(goal: string, options?: RunJobOptions): Promise<Job>;
     getJob(id: string): Promise<Job | undefined>;
     listJobs(filter?: JobListFilter): Promise<Job[]>;
-    listCapabilities(): {
-        name: string;
-        version: string;
-        description: string;
-        risk: import("./registry/capability.js").CapabilityRisk;
-        inputSchema: Record<string, import("./registry/capability.js").CapabilityInputField>;
-    }[];
+    listCapabilities(): CapabilityDescriptor[];
+    describeCapability(name: string, version?: string): CapabilityDescriptor | undefined;
     listPlanners(): {
         name: string;
     }[];