@veil-runtime/core 0.2.0 → 0.3.0

package/README.md

@@ -21,7 +21,7 @@ Requires Node.js 24+.
 
     npm install @veil-runtime/core
 
-This installs the published package. To verify v0.2.0 before publication, see [candidate installation](docs/getting-started/installation.md).
+This installs the published package. To verify the v0.3.0 candidate before publication, see [candidate installation](docs/getting-started/installation.md).
 
 ## Smallest working example
 
@@ -47,7 +47,7 @@ The default authorizer permits reads and denies write/destructive capabilities.
 
 ## Status and roadmap
 
-Release candidate: **v0.2.0**. See [release notes](docs/getting-started/v0.2.0.md). The latest published package remains **v0.1.3** until publication. ExecutionPlan v1 is linear. DAGs, parallel execution, conditionals, cancellation, and retry policies are roadmap work, not current behavior.
+Release candidate: **v0.3.0**. See the [v0.3.0 release notes](docs/getting-started/v0.3.0.md). The latest published package remains **v0.2.0** until publication. ExecutionPlan V1 remains the default; opt-in [ExecutionPlan V2](docs/reference/execution-plan-v2.md) adds governed receiving-value ownership. Both are linear. DAGs, parallel execution, conditionals, cancellation, and retry policies are roadmap work, not current behavior.
 
 ## Contributing
 

package/dist/index.d.ts

@@ -14,3 +14,5 @@ export type { JobEvent } from './runtime/jobs/job-event.js';
 export type { RuntimeEvent } from './runtime/events/runtime-event.js';
 export { McpAdapter } from './integrations/mcp/inbound/mcp-adapter.js';
 export * from './sdk/index.js';
+export { isPlanAdmissionError } from './runtime/execution/plan-admission-error.js';
+export type { PlanAdmissionError, PlanAdmissionIssue, PlanAdmissionIssueCode } from './runtime/execution/plan-admission-error.js';

package/dist/index.js

@@ -14,10 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpAdapter = exports.operatorRuntime = exports.OperatorRuntime = void 0;
+exports.isPlanAdmissionError = exports.McpAdapter = exports.operatorRuntime = exports.OperatorRuntime = void 0;
 var operator_runtime_js_1 = require("./runtime/operator-runtime.js");
 Object.defineProperty(exports, "OperatorRuntime", { enumerable: true, get: function () { return operator_runtime_js_1.OperatorRuntime; } });
 Object.defineProperty(exports, "operatorRuntime", { enumerable: true, get: function () { return operator_runtime_js_1.operatorRuntime; } });
 var mcp_adapter_js_1 = require("./integrations/mcp/inbound/mcp-adapter.js");
 Object.defineProperty(exports, "McpAdapter", { enumerable: true, get: function () { return mcp_adapter_js_1.McpAdapter; } });
 __exportStar(require("./sdk/index.js"), exports);
+var plan_admission_error_js_1 = require("./runtime/execution/plan-admission-error.js");
+Object.defineProperty(exports, "isPlanAdmissionError", { enumerable: true, get: function () { return plan_admission_error_js_1.isPlanAdmissionError; } });

package/dist/runtime/execution/governed-value.d.ts

@@ -0,0 +1,5 @@
+export declare class GovernedValueError extends Error {
+    constructor();
+}
+export declare function captureGovernedValue(value: unknown): unknown;
+export declare function copyGovernedValue(value: unknown, frozen?: boolean): unknown;

package/dist/runtime/execution/governed-value.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernedValueError = void 0;
+exports.captureGovernedValue = captureGovernedValue;
+exports.copyGovernedValue = copyGovernedValue;
+const node_util_1 = require("node:util");
+const MAX_DEPTH = 128;
+const MAX_CONTAINERS = 10_000;
+const MAX_EDGES = 100_000;
+const MAX_STRING_UNITS = 1_048_576;
+class GovernedValueError extends Error {
+    constructor() {
+        super('Value is not a supported governed representation');
+        this.name = 'GovernedValueError';
+    }
+}
+exports.GovernedValueError = GovernedValueError;
+function reject() {
+    throw new GovernedValueError();
+}
+function primitive(value) {
+    if (value === null || value === undefined)
+        return true;
+    switch (typeof value) {
+        case 'boolean':
+        case 'string':
+        case 'number':
+        case 'bigint':
+            return true;
+        default:
+            return false;
+    }
+}
+function excludedBrand(value) {
+    if (node_util_1.types.isProxy(value))
+        return true;
+    if (node_util_1.types.isDate(value) ||
+        node_util_1.types.isMap(value) ||
+        node_util_1.types.isSet(value) ||
+        node_util_1.types.isRegExp(value) ||
+        node_util_1.types.isBoxedPrimitive(value) ||
+        node_util_1.types.isAnyArrayBuffer(value) ||
+        node_util_1.types.isArrayBufferView(value) ||
+        node_util_1.types.isDataView(value) ||
+        node_util_1.types.isWeakMap(value) ||
+        node_util_1.types.isWeakSet(value) ||
+        node_util_1.types.isPromise(value))
+        return true;
+    const iteratorTypes = [
+        node_util_1.types.isMapIterator,
+        node_util_1.types.isSetIterator,
+        node_util_1.types.isGeneratorObject,
+    ];
+    return iteratorTypes.some((check) => check?.(value) === true);
+}
+function inspect(value, counters) {
+    if (excludedBrand(value))
+        reject();
+    const prototype = Object.getPrototypeOf(value);
+    const isArray = Array.isArray(value);
+    if (isArray && prototype !== Array.prototype)
+        reject();
+    if (!isArray && prototype !== Object.prototype && prototype !== null)
+        reject();
+    const keys = Reflect.ownKeys(value);
+    const entries = [];
+    let length = 0;
+    if (isArray) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+        if (!lengthDescriptor ||
+            lengthDescriptor.enumerable ||
+            !('value' in lengthDescriptor) ||
+            typeof lengthDescriptor.value !== 'number' ||
+            !Number.isSafeInteger(lengthDescriptor.value) ||
+            lengthDescriptor.value < 0)
+            reject();
+        length = lengthDescriptor.value;
+    }
+    for (const key of keys) {
+        if (typeof key !== 'string')
+            reject();
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !('value' in descriptor))
+            reject();
+        if (isArray && key === 'length') {
+            if (descriptor.enumerable || typeof descriptor.value !== 'number' || descriptor.value !== length)
+                reject();
+            continue;
+        }
+        if (!descriptor.enumerable)
+            reject();
+        if (typeof descriptor.value === 'string')
+            counters.stringUnits += descriptor.value.length;
+        counters.stringUnits += key.length;
+        if (counters.stringUnits > MAX_STRING_UNITS)
+            reject();
+        if (isArray) {
+            const index = Number(key);
+            if (!Number.isInteger(index) || index < 0 || String(index) !== key || index >= length)
+                reject();
+        }
+        entries.push({ key, value: descriptor.value });
+    }
+    if (isArray) {
+        if (!Number.isSafeInteger(length) || length < 0)
+            reject();
+        for (let index = 0; index < length; index += 1) {
+            if (!entries.some((entry) => entry.key === String(index)))
+                reject();
+        }
+        counters.edges += entries.length;
+        if (counters.edges > MAX_EDGES)
+            reject();
+        return { target: new Array(length), entries };
+    }
+    counters.edges += entries.length;
+    if (counters.edges > MAX_EDGES)
+        reject();
+    return {
+        target: Object.create(prototype === null ? null : Object.prototype),
+        entries,
+    };
+}
+function clone(value, freeze) {
+    const counters = { containers: 0, edges: 0, stringUnits: 0 };
+    const memo = new Map();
+    const active = new Set();
+    const stack = [];
+    const make = (candidate, depth) => {
+        if (primitive(candidate)) {
+            if (typeof candidate === 'string') {
+                counters.stringUnits += candidate.length;
+                if (counters.stringUnits > MAX_STRING_UNITS)
+                    reject();
+            }
+            return candidate;
+        }
+        if (typeof candidate !== 'object' || candidate === null)
+            reject();
+        if (depth > MAX_DEPTH)
+            reject();
+        const source = candidate;
+        const existing = memo.get(source);
+        if (existing) {
+            if (active.has(source))
+                reject();
+            return existing;
+        }
+        counters.containers += 1;
+        if (counters.containers > MAX_CONTAINERS)
+            reject();
+        const inspected = inspect(source, counters);
+        memo.set(source, inspected.target);
+        active.add(source);
+        stack.push({ source, target: inspected.target, entries: inspected.entries, index: 0 });
+        return inspected.target;
+    };
+    const root = make(value, 0);
+    while (stack.length > 0) {
+        const frame = stack[stack.length - 1];
+        if (frame.index >= frame.entries.length) {
+            active.delete(frame.source);
+            stack.pop();
+            continue;
+        }
+        const entry = frame.entries[frame.index++];
+        const child = make(entry.value, stack.length);
+        Object.defineProperty(frame.target, entry.key, {
+            value: child,
+            enumerable: true,
+            configurable: true,
+            writable: true,
+        });
+    }
+    if (freeze && typeof root === 'object' && root !== null) {
+        const pending = [root];
+        const seen = new Set();
+        while (pending.length > 0) {
+            const current = pending.pop();
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            for (const key of Object.keys(current)) {
+                const child = current[key];
+                if (typeof child === 'object' && child !== null)
+                    pending.push(child);
+            }
+            Object.freeze(current);
+        }
+    }
+    return root;
+}
+function captureGovernedValue(value) {
+    return clone(value, false);
+}
+function copyGovernedValue(value, frozen = false) {
+    return clone(value, frozen);
+}

package/dist/runtime/execution/plan-admission-error.d.ts

@@ -0,0 +1,22 @@
+/** Structured admission evidence. Legacy Error.message is not safe wire data. */
+export type PlanAdmissionIssueCode = 'UNSUPPORTED_PLAN_VERSION' | 'EMPTY_PLAN' | 'DUPLICATE_STEP_ID' | 'UNKNOWN_CAPABILITY' | 'CAPABILITY_VERSION_MISMATCH' | 'REQUIRED_INPUT_MISSING' | 'INPUT_TYPE_MISMATCH' | 'UNSUPPORTED_INPUT_SCHEMA' | 'INVALID_RESULT_REFERENCE' | 'RESULT_REFERENCE_NOT_EARLIER';
+export interface PlanAdmissionIssue {
+    readonly code: PlanAdmissionIssueCode;
+    readonly message: string;
+    readonly stepIndex?: number;
+    readonly field?: string;
+}
+export interface PlanAdmissionError extends Error {
+    readonly code: 'PLAN_ADMISSION_REJECTED';
+    readonly issues: readonly PlanAdmissionIssue[];
+}
+export type AdmissionOwner = object;
+/** Local issuance only; current-call certainty requires the direct executePlan boundary. */
+export declare function isPlanAdmissionError(value: unknown): value is PlanAdmissionError;
+export declare function issuePlanAdmissionError(owner: AdmissionOwner, message: string, issues: readonly {
+    code: PlanAdmissionIssueCode;
+    stepIndex?: number;
+    field?: string;
+}[]): PlanAdmissionError;
+/** Prevent a genuine diagnostic from another submission becoming this call's evidence. */
+export declare function containForeignAdmissionError(owner: AdmissionOwner, error: unknown): unknown;

package/dist/runtime/execution/plan-admission-error.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPlanAdmissionError = isPlanAdmissionError;
+exports.issuePlanAdmissionError = issuePlanAdmissionError;
+exports.containForeignAdmissionError = containForeignAdmissionError;
+const messages = {
+    UNSUPPORTED_PLAN_VERSION: 'The plan version is not supported.',
+    EMPTY_PLAN: 'The plan contains no steps.',
+    DUPLICATE_STEP_ID: 'A step identifier is repeated.',
+    UNKNOWN_CAPABILITY: 'The requested capability is not registered.',
+    CAPABILITY_VERSION_MISMATCH: 'The requested capability version does not match.',
+    REQUIRED_INPUT_MISSING: 'A required input field is missing.',
+    INPUT_TYPE_MISMATCH: 'An input field has an incompatible type.',
+    UNSUPPORTED_INPUT_SCHEMA: 'An input field cannot be validated with the declared schema.',
+    INVALID_RESULT_REFERENCE: 'A result reference was not accepted by the admission parser.',
+    RESULT_REFERENCE_NOT_EARLIER: 'A result reference must target an earlier declared step.',
+};
+const issued = new WeakMap();
+/** Local issuance only; current-call certainty requires the direct executePlan boundary. */
+function isPlanAdmissionError(value) {
+    return typeof value === 'object' && value !== null && issued.has(value);
+}
+function issuePlanAdmissionError(owner, message, issues) {
+    const details = Object.freeze(issues.map(issue => Object.freeze({
+        code: issue.code,
+        message: messages[issue.code],
+        ...(issue.stepIndex === undefined ? {} : { stepIndex: issue.stepIndex }),
+        ...(issue.field === undefined ? {} : { field: issue.field }),
+    })));
+    const error = new Error(message);
+    Object.defineProperties(error, {
+        code: { value: 'PLAN_ADMISSION_REJECTED', writable: false, configurable: false, enumerable: false },
+        issues: { value: details, writable: false, configurable: false, enumerable: false },
+    });
+    issued.set(error, { owner, message });
+    return error;
+}
+/** Prevent a genuine diagnostic from another submission becoming this call's evidence. */
+function containForeignAdmissionError(owner, error) {
+    if (!isPlanAdmissionError(error))
+        return error;
+    const record = issued.get(error);
+    return record.owner === owner ? error : new Error(record.message, { cause: error });
+}

package/dist/runtime/execution/plan-validator.d.ts

@@ -1,5 +1,8 @@
+import type { PlanAdmissionIssueCode } from './plan-admission-error.js';
 import { ExecutionStep } from '../planner/planner.js';
 export interface PlanValidationError {
+    code: PlanAdmissionIssueCode;
+    stepIndex?: number;
     stepId: string;
     capability: string;
     field?: string;

package/dist/runtime/execution/plan-validator.js

@@ -23,6 +23,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'REQUIRED_INPUT_MISSING',
                 message: `Required input '${field}' is missing for capability '${step.capability}'`,
             });
             continue;
@@ -36,6 +37,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'UNSUPPORTED_INPUT_SCHEMA',
                 message: `Unsupported schema type '${definition.type}' for capability '${step.capability}'`,
             });
         }
@@ -44,6 +46,7 @@ function validateInput(step, capability, allowReferences) {
                 stepId: step.id,
                 capability: step.capability,
                 field,
+                code: 'INPUT_TYPE_MISMATCH',
                 message: `Input '${field}' must be of type '${definition.type}' for capability '${step.capability}'`,
             });
         }
@@ -68,6 +71,7 @@ function validateStepInput(step, input) {
             errors: [{
                     stepId: step.id,
                     capability: step.capability,
+                    code: 'UNKNOWN_CAPABILITY',
                     message: `Unknown capability: ${step.capability}`,
                 }],
         };
@@ -78,11 +82,13 @@ function validateStepInput(step, input) {
 function validatePlan(steps) {
     const errors = [];
     const seenStepIds = new Set();
-    for (const step of steps) {
+    for (const [stepIndex, step] of steps.entries()) {
+        const firstIssue = errors.length;
         if (seenStepIds.has(step.id)) {
             errors.push({
                 stepId: step.id,
                 capability: step.capability,
+                code: 'DUPLICATE_STEP_ID',
                 message: `Duplicate step ID: ${step.id}`,
             });
         }
@@ -91,8 +97,11 @@ function validatePlan(steps) {
             errors.push({
                 stepId: step.id,
                 capability: step.capability,
+                code: 'UNKNOWN_CAPABILITY',
                 message: `Unknown capability: ${step.capability}`,
             });
+            for (let i = firstIssue; i < errors.length; i++)
+                errors[i].stepIndex = stepIndex;
             seenStepIds.add(step.id);
             continue;
         }
@@ -100,6 +109,7 @@ function validatePlan(steps) {
             errors.push({
                 stepId: step.id,
                 capability: step.capability,
+                code: 'CAPABILITY_VERSION_MISMATCH',
                 message: `Capability version mismatch for '${step.capability}': requested ${step.capabilityVersion}, registered ${capability.version}`,
             });
         }
@@ -111,6 +121,7 @@ function validatePlan(steps) {
                     errors.push({
                         stepId: step.id,
                         capability: step.capability,
+                        code: 'RESULT_REFERENCE_NOT_EARLIER',
                         message: `Result reference must target an earlier step: ${reference}`,
                     });
                 }
@@ -119,10 +130,13 @@ function validatePlan(steps) {
                 errors.push({
                     stepId: step.id,
                     capability: step.capability,
+                    code: 'INVALID_RESULT_REFERENCE',
                     message: error instanceof Error ? error.message : 'Invalid result reference',
                 });
             }
         }
+        for (let i = firstIssue; i < errors.length; i++)
+            errors[i].stepIndex = stepIndex;
         seenStepIds.add(step.id);
     }
     return { valid: errors.length === 0, errors };

package/dist/runtime/execution/result-reference.js

@@ -9,8 +9,15 @@ function isResultReference(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return false;
     }
-    const record = value;
-    return Object.keys(record).length === 1 && typeof record.$ref === 'string';
+    const keys = Reflect.ownKeys(value);
+    if (keys.length !== 1 || keys[0] !== '$ref') {
+        return false;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, '$ref');
+    return descriptor !== undefined
+        && descriptor.enumerable === true
+        && Object.hasOwn(descriptor, 'value')
+        && typeof descriptor.value === 'string';
 }
 function parseResultReference(reference) {
     if (!reference.startsWith(REFERENCE_PREFIX)) {

package/dist/runtime/jobs/job-manager.d.ts

@@ -1,3 +1,4 @@
+import { AdmissionOwner } from '../execution/plan-admission-error.js';
 import { ExecutionAuthorizer } from '../permissions/execution-authorizer.js';
 import { ExecutionPlan } from '../planner/planner.js';
 import { ExecutionCaller } from '../execution/execution-context.js';
@@ -5,12 +6,12 @@ import { Job, JobOutcome } from './job.js';
 import { JobStatus } from './job-status.js';
 import { JobListFilter } from './job-store.js';
 declare class JobManager {
-    executePlan(plan: ExecutionPlan, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer): Promise<Job>;
+    executePlan(plan: ExecutionPlan, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer, admissionOwner?: AdmissionOwner, enabledVersions?: ReadonlySet<string>): Promise<Job>;
     create(goal: string, planner?: string): Promise<Job>;
     get(id: string): Promise<Job | undefined>;
     list(filter?: JobListFilter): Promise<Job[]>;
     setStatus(id: string, status: JobStatus): Promise<Job>;
-    execute(id: string, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer): Promise<Job>;
+    execute(id: string, caller?: ExecutionCaller, authorizer?: ExecutionAuthorizer, semanticVersion?: '1.0' | '2.0'): Promise<Job>;
     review(id: string, outcome: JobOutcome, notes?: string): Promise<Job>;
     private addEvent;
 }

package/dist/runtime/jobs/job-manager.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jobManager = void 0;
+const plan_admission_error_js_1 = require("../execution/plan-admission-error.js");
 const node_crypto_1 = require("node:crypto");
 const registry_js_1 = require("../registry/registry.js");
 const execution_authorizer_js_1 = require("../permissions/execution-authorizer.js");
 const plan_validator_js_1 = require("../execution/plan-validator.js");
 const result_reference_js_1 = require("../execution/result-reference.js");
+const governed_value_js_1 = require("../execution/governed-value.js");
 const memory_event_bus_js_1 = require("../events/memory-event-bus.js");
 const job_store_js_1 = require("./job-store.js");
 const console_execution_logger_js_1 = require("../execution/console-execution-logger.js");
@@ -13,7 +15,11 @@ const console_log_sink_js_1 = require("../logging/console-log-sink.js");
 const composite_log_sink_js_1 = require("../logging/composite-log-sink.js");
 const sqlite_log_sink_js_1 = require("../logging/sqlite-log-sink.js");
 class JobManager {
-    async executePlan(plan, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer) {
+    async executePlan(plan, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer, admissionOwner = {}, enabledVersions = new Set(['1.0'])) {
+        const version = plan.version;
+        if ((version !== '1.0' && version !== '2.0') || !enabledVersions.has(version)) {
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, "Execution plan version is not supported; expected '1.0'.", [{ code: 'UNSUPPORTED_PLAN_VERSION' }]);
+        }
         // Own the structural envelope before admission; nested input remains shared.
         const capturedGoal = plan.goal;
         const idempotencyKey = plan.idempotencyKey;
@@ -33,13 +39,13 @@ class JobManager {
             };
         }
         if (!steps.length) {
-            throw new Error('Execution plan contains no steps');
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, 'Execution plan contains no steps', [{ code: 'EMPTY_PLAN' }]);
         }
         const validation = (0, plan_validator_js_1.validatePlan)(steps);
         if (!validation.valid) {
-            throw new Error(`Execution plan failed validation: ${validation.errors
+            throw (0, plan_admission_error_js_1.issuePlanAdmissionError)(admissionOwner, `Execution plan failed validation: ${validation.errors
                 .map((error) => error.message)
-                .join('; ')}`);
+                .join('; ')}`, validation.errors);
         }
         const goal = capturedGoal?.trim() ||
             'External execution plan';
@@ -53,7 +59,7 @@ class JobManager {
         job.updatedAt =
             new Date().toISOString();
         await job_store_js_1.jobStore.update(job);
-        return this.execute(job.id, caller, authorizer);
+        return this.execute(job.id, caller, authorizer, version);
     }
     async create(goal, planner) {
         if (!goal?.trim()) {
@@ -92,7 +98,7 @@ class JobManager {
         await job_store_js_1.jobStore.update(job);
         return job;
     }
-    async execute(id, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer) {
+    async execute(id, caller, authorizer = execution_authorizer_js_1.defaultExecutionAuthorizer, semanticVersion = '1.0') {
         const job = await job_store_js_1.jobStore.get(id);
         if (!job) {
             throw new Error(`Job not found: ${id}`);
@@ -112,24 +118,32 @@ class JobManager {
                 }
                 try {
                     const completedSteps = job.steps.slice(0, job.steps.indexOf(step));
+                    // ADR-0011 begins after the existing resolver. Reference traversal
+                    // may retain its legacy getter/Proxy behavior; capture governs only
+                    // the representation returned by that resolver.
                     const resolvedInput = (0, result_reference_js_1.resolveResultReferences)(step.input, completedSteps);
-                    const inputValidation = (0, plan_validator_js_1.validateStepInput)(step, resolvedInput);
+                    const governedInput = semanticVersion === '2.0'
+                        ? (0, governed_value_js_1.captureGovernedValue)(resolvedInput)
+                        : resolvedInput;
+                    const inputValidation = (0, plan_validator_js_1.validateStepInput)(step, governedInput);
                     if (!inputValidation.valid) {
                         throw new Error(inputValidation.errors
                             .map((validationError) => validationError.message)
                             .join('; '));
                     }
-                    const authorization = await authorizer.authorize({
-                        jobId: job.id,
-                        stepId: step.id,
-                        capability: {
-                            name: capability.name,
-                            version: capability.version,
-                            risk: capability.risk,
-                        },
-                        input: resolvedInput,
-                        caller,
-                    });
+                    const authorization = semanticVersion === '2.0'
+                        ? await authorizer.authorize(createGovernedAuthorizationContext(job.id, step.id, capability, (0, governed_value_js_1.copyGovernedValue)(governedInput, true), caller))
+                        : await authorizer.authorize({
+                            jobId: job.id,
+                            stepId: step.id,
+                            capability: {
+                                name: capability.name,
+                                version: capability.version,
+                                risk: capability.risk,
+                            },
+                            input: resolvedInput,
+                            caller,
+                        });
                     if (typeof authorization !== 'object' ||
                         authorization === null ||
                         Array.isArray(authorization) ||
@@ -158,6 +172,11 @@ class JobManager {
                         });
                         throw new AuthorizationDeniedError(message);
                     }
+                    // ADR-0011 requires the detached v2 entry value to exist before the
+                    // running/start transition. V1 retains its historical shared input.
+                    const capabilityInput = semanticVersion === '2.0'
+                        ? (0, governed_value_js_1.copyGovernedValue)(governedInput)
+                        : resolvedInput;
                     step.status = 'running';
                     step.startedAt = new Date().toISOString();
                     this.addEvent(job, 'capability.started', {
@@ -168,7 +187,7 @@ class JobManager {
                         new console_log_sink_js_1.ConsoleLogSink(),
                         new sqlite_log_sink_js_1.SQLiteLogSink(),
                     ]));
-                    const result = await capability.execute(resolvedInput, {
+                    const result = await capability.execute(capabilityInput, {
                         jobId: job.id,
                         stepId: step.id,
                         logger,
@@ -266,6 +285,25 @@ class JobManager {
         return event;
     }
 }
+function createGovernedAuthorizationContext(jobId, stepId, capability, input, caller) {
+    const context = {
+        jobId,
+        stepId,
+        capability: {
+            name: capability.name,
+            version: capability.version,
+            risk: capability.risk,
+        },
+        caller,
+    };
+    Object.defineProperty(context, 'input', {
+        value: input,
+        enumerable: true,
+        configurable: false,
+        writable: false,
+    });
+    return context;
+}
 class AuthorizationDeniedError extends Error {
 }
 exports.jobManager = new JobManager();

package/dist/runtime/operator-runtime.d.ts

@@ -15,9 +15,11 @@ export interface ExecutePlanOptions {
 }
 export interface OperatorRuntimeOptions {
     readonly authorizer?: ExecutionAuthorizer;
+    readonly planVersions?: readonly string[];
 }
 export declare class OperatorRuntime {
     private readonly authorizer;
+    private readonly planVersions;
     constructor(options?: OperatorRuntimeOptions);
     use(module: CapabilityModule): void;
     executePlan(plan: ExecutionPlan, options?: ExecutePlanOptions): Promise<Job>;

package/dist/runtime/operator-runtime.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.operatorRuntime = exports.OperatorRuntime = void 0;
+const plan_admission_error_js_1 = require("./execution/plan-admission-error.js");
 const job_manager_js_1 = require("./jobs/job-manager.js");
 const job_memory_js_1 = require("./jobs/job-memory.js");
 const execution_authorizer_js_1 = require("./permissions/execution-authorizer.js");
@@ -23,10 +24,19 @@ function immutableCaller(caller) {
 }
 class OperatorRuntime {
     authorizer;
+    planVersions;
     constructor(options = {}) {
         this.authorizer =
             options.authorizer ??
                 execution_authorizer_js_1.defaultExecutionAuthorizer;
+        const versions = options.planVersions ?? ['1.0'];
+        if (!Array.isArray(versions) ||
+            versions.length === 0 ||
+            versions.some((version) => version !== '1.0' && version !== '2.0') ||
+            new Set(versions).size !== versions.length) {
+            throw new Error('planVersions must contain unique supported semantic versions');
+        }
+        this.planVersions = new Set(versions);
     }
     use(module) {
         const declared = new Set(module.manifest.capabilities);
@@ -38,7 +48,13 @@ class OperatorRuntime {
         }
     }
     async executePlan(plan, options = {}) {
-        return job_manager_js_1.jobManager.executePlan(plan, immutableCaller(options.caller), this.authorizer);
+        const admissionOwner = {};
+        try {
+            return await job_manager_js_1.jobManager.executePlan(plan, immutableCaller(options.caller), this.authorizer, admissionOwner, this.planVersions);
+        }
+        catch (error) {
+            throw (0, plan_admission_error_js_1.containForeignAdmissionError)(admissionOwner, error);
+        }
     }
     async run(goal, options = {}) {
         const router = planner_router_registry_js_1.plannerRouterRegistry.getDefault();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veil-runtime/core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "A governed, capability-driven execution runtime",
   "license": "Apache-2.0",
   "repository": {
@@ -63,7 +63,7 @@
     "better-sqlite3": "^13.0.3"
   },
   "devDependencies": {
-    "@babel/parser": "8.0.5",
+    "@babel/parser": "8.0.6",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.2.0",
     "fastify": "^5.11.3",