@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/server/native-artifacts.d.ts

@@ -20,7 +20,6 @@ export declare const NATIVE_SAVE_DASHBOARD_SEMANTIC_CONSTRAINTS: {
         readonly positionalRows: "Positional scalar rows in [x, ...series] order. Each row must contain exactly one x cell plus one cell per series entry.";
     };
 };
-/** The exact public MCP shape advertised to native clients and accepted by the host. */
 export declare const NATIVE_SAVE_DASHBOARD_INPUT_SCHEMA: {
     readonly type: "object";
     readonly additionalProperties: false;
@@ -90,7 +89,7 @@ export declare const NATIVE_SAVE_DASHBOARD_INPUT_SCHEMA: {
         };
         readonly answer_selection: {
             readonly const: "latest";
-            readonly description: "Resolve the newest verified answer retained by this native session when its opaque answer_ref is no longer available in the conversation.";
+            readonly description: "Resolve the newest answer retained by this native session when its opaque answer_ref is no longer available in the conversation.";
         };
         readonly envelope: {
             readonly type: "object";
@@ -98,7 +97,8 @@ export declare const NATIVE_SAVE_DASHBOARD_INPUT_SCHEMA: {
             readonly required: readonly ["blocks", "verified"];
             readonly properties: {
                 readonly verified: {
-                    readonly const: true;
+                    readonly type: "boolean";
+                    readonly description: "Ignored: the host records verified only for an answer it produced from a grounded component run; anything submitted here is stored as unverified.";
                 };
                 readonly summary: {
                     readonly anyOf: readonly [{
@@ -349,7 +349,8 @@ export declare const NATIVE_PERSIST_ANSWER_INPUT_SCHEMA: {
             readonly required: readonly ["blocks", "verified"];
             readonly properties: {
                 readonly verified: {
-                    readonly const: true;
+                    readonly type: "boolean";
+                    readonly description: "Ignored: the host records verified only for an answer it produced from a grounded component run; anything submitted here is stored as unverified.";
                 };
                 readonly blocks: {
                     readonly type: "array";
@@ -580,7 +581,7 @@ export declare const NATIVE_SAVE_DASHBOARD_CONTRACT: {
             };
             readonly answer_selection: {
                 readonly const: "latest";
-                readonly description: "Resolve the newest verified answer retained by this native session when its opaque answer_ref is no longer available in the conversation.";
+                readonly description: "Resolve the newest answer retained by this native session when its opaque answer_ref is no longer available in the conversation.";
             };
             readonly envelope: {
                 readonly type: "object";
@@ -588,7 +589,8 @@ export declare const NATIVE_SAVE_DASHBOARD_CONTRACT: {
                 readonly required: readonly ["blocks", "verified"];
                 readonly properties: {
                     readonly verified: {
-                        readonly const: true;
+                        readonly type: "boolean";
+                        readonly description: "Ignored: the host records verified only for an answer it produced from a grounded component run; anything submitted here is stored as unverified.";
                     };
                     readonly summary: {
                         readonly anyOf: readonly [{
@@ -848,7 +850,8 @@ export declare const NATIVE_PERSIST_ANSWER_CONTRACT: {
                 readonly required: readonly ["blocks", "verified"];
                 readonly properties: {
                     readonly verified: {
-                        readonly const: true;
+                        readonly type: "boolean";
+                        readonly description: "Ignored: the host records verified only for an answer it produced from a grounded component run; anything submitted here is stored as unverified.";
                     };
                     readonly blocks: {
                         readonly type: "array";
@@ -970,6 +973,7 @@ export interface NativeArtifactServiceOptions {
         readonly idempotencyKey: string;
         readonly envelopeJson: string;
         readonly digest: string;
+        readonly grounded: boolean;
     }) => {
         readonly row: NativeStructuredAnswerRow;
         readonly created: boolean;
@@ -1000,5 +1004,17 @@ export declare class NativeArtifactService {
      * a later follow-up can only reference this stored result, never recompute.
      */
     persistAnswer(credential: string | undefined, input: unknown): PersistedStructuredAnswer;
+    /**
+     * Host-only entry for a grounded component root (never exposed over MCP).
+     * The caller must already have checked the component's verified provenance.
+     */
+    persistGroundedAnswer(credential: string | undefined, input: unknown): PersistedStructuredAnswer;
+    private persistStructured;
     save(credential: string | undefined, input: unknown): SavedNativeArtifact;
+    /**
+     * Host-only entry for a grounded component render root (never exposed over
+     * MCP). The caller must already have checked verified provenance.
+     */
+    saveGrounded(credential: string | undefined, input: unknown): SavedNativeArtifact;
+    private saveArtifact;
 }

package/dist-server/server/native-artifacts.js

@@ -53,6 +53,7 @@ const POSITIONAL_ROWS_SCHEMA = {
     items: { type: "array", items: SCALAR_SCHEMA },
 };
 /** The exact public MCP shape advertised to native clients and accepted by the host. */
+const VERIFIED_FIELD_SCHEMA = { type: "boolean", description: "Ignored: the host records verified only for an answer it produced from a grounded component run; anything submitted here is stored as unverified." };
 export const NATIVE_SAVE_DASHBOARD_INPUT_SCHEMA = {
     type: "object",
     additionalProperties: false,
@@ -67,11 +68,11 @@ export const NATIVE_SAVE_DASHBOARD_INPUT_SCHEMA = {
         name: { ...SAFE_TEXT_SCHEMA, minLength: 1, maxLength: MAX_NAME_LENGTH, pattern: "\\S" },
         idempotency_key: { ...SAFE_TEXT_SCHEMA, minLength: 8, maxLength: MAX_IDEMPOTENCY_KEY_LENGTH, pattern: "^[A-Za-z0-9][A-Za-z0-9._:-]+$" },
         answer_ref: { ...SAFE_TEXT_SCHEMA, pattern: "^answer-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$", description: "Opaque reference returned by persist_answer for this native session." },
-        answer_selection: { const: "latest", description: "Resolve the newest verified answer retained by this native session when its opaque answer_ref is no longer available in the conversation." },
+        answer_selection: { const: "latest", description: "Resolve the newest answer retained by this native session when its opaque answer_ref is no longer available in the conversation." },
         envelope: {
             type: "object", additionalProperties: false, required: ["blocks", "verified"],
             properties: {
-                verified: { const: true }, summary: NULLABLE_SAFE_TEXT_SCHEMA, estimate: { type: ["boolean", "null"] },
+                verified: VERIFIED_FIELD_SCHEMA, summary: NULLABLE_SAFE_TEXT_SCHEMA, estimate: { type: ["boolean", "null"] },
                 blocks: {
                     type: "array", minItems: 1,
                     items: { oneOf: [
@@ -97,7 +98,7 @@ const NATIVE_STRUCTURED_ANSWER_ENVELOPE_SCHEMA = {
     additionalProperties: false,
     required: ["blocks", "verified"],
     properties: {
-        verified: { const: true },
+        verified: VERIFIED_FIELD_SCHEMA,
         blocks: {
             type: "array",
             minItems: 1,
@@ -211,8 +212,8 @@ function validBlock(block) {
 function validateDashboardEnvelope(envelope) {
     if (!isRecord(envelope) || !Object.hasOwn(envelope, "blocks") || !Object.hasOwn(envelope, "verified") || !Object.keys(envelope).every((key) => ["blocks", "summary", "verified", "estimate"].includes(key)))
         throw new NativeArtifactError("invalid dashboard render envelope: expected blocks and verified with optional summary or estimate");
-    if (envelope.verified !== true)
-        throw new NativeArtifactError("invalid dashboard render envelope: verified must be true");
+    if (typeof envelope.verified !== "boolean")
+        throw new NativeArtifactError("invalid dashboard render envelope: verified must be a boolean");
     if (!Array.isArray(envelope.blocks) || envelope.blocks.length === 0)
         throw new NativeArtifactError("invalid dashboard render envelope: blocks must be a non-empty array");
     const invalidBlock = envelope.blocks.findIndex((block) => !validBlock(block));
@@ -275,6 +276,14 @@ function validatePersistedStructuredAnswer(value) {
     }
     return { version: "1", idempotency_key: value.idempotency_key, envelope: value.envelope };
 }
+/**
+ * The stored `verified` flag is host provenance, never the caller's claim: the
+ * persisted envelope carries exactly the flag the host recorded, so its own
+ * badge cannot disagree with the artifact row.
+ */
+function withHostVerified(envelope, verified) {
+    return { ...envelope, verified };
+}
 function structuredAnswerDigest(envelopeJson) {
     return `sha256:${createHash("sha256").update(envelopeJson).digest("hex")}`;
 }
@@ -377,11 +386,21 @@ export class NativeArtifactService {
      * a later follow-up can only reference this stored result, never recompute.
      */
     persistAnswer(credential, input) {
+        return this.persistStructured(credential, input, false);
+    }
+    /**
+     * Host-only entry for a grounded component root (never exposed over MCP).
+     * The caller must already have checked the component's verified provenance.
+     */
+    persistGroundedAnswer(credential, input) {
+        return this.persistStructured(credential, input, true);
+    }
+    persistStructured(credential, input, grounded) {
         const session = this.authorize(credential);
         if (session.purpose !== "analysis")
             throw new NativeArtifactError("structured answer persistence is unavailable for this native session", 409);
         const payload = validatePersistedStructuredAnswer(input);
-        const envelopeJson = JSON.stringify(payload.envelope);
+        const envelopeJson = JSON.stringify(withHostVerified(payload.envelope, grounded));
         const digest = structuredAnswerDigest(envelopeJson);
         const existing = this.options.store.getNativeStructuredAnswerByIdempotency(session.id, payload.idempotency_key);
         if (existing) {
@@ -392,7 +411,7 @@ export class NativeArtifactService {
         }
         try {
             const persisted = (this.options.persistStructuredAnswer ?? ((params) => this.options.store.createNativeStructuredAnswer(params)))({
-                id: newId("answer"), nativeSessionId: session.id, idempotencyKey: payload.idempotency_key, envelopeJson, digest,
+                id: newId("answer"), nativeSessionId: session.id, idempotencyKey: payload.idempotency_key, envelopeJson, digest, grounded,
             });
             if (persisted.row.digest !== digest || persisted.row.envelopeJson !== envelopeJson) {
                 throw new NativeArtifactError("structured answer idempotency key is already bound to a different answer", 409);
@@ -409,6 +428,16 @@ export class NativeArtifactService {
         }
     }
     save(credential, input) {
+        return this.saveArtifact(credential, input, false);
+    }
+    /**
+     * Host-only entry for a grounded component render root (never exposed over
+     * MCP). The caller must already have checked verified provenance.
+     */
+    saveGrounded(credential, input) {
+        return this.saveArtifact(credential, input, true);
+    }
+    saveArtifact(credential, input, grounded) {
         const context = credential === undefined ? undefined : this.credentials.get(credential);
         if (!context)
             throw new NativeArtifactError("GenBI MCP bearer credential is invalid. Restart this native session to refresh its GenBI MCP connection.", 401);
@@ -419,7 +448,6 @@ export class NativeArtifactService {
             throw new NativeArtifactError("GenBI MCP session binding is stale. Start a new native session.", 409);
         }
         const payload = validateInput(input);
-        const referenceSave = "answer_ref" in payload || "answer_selection" in payload;
         const source = "answer_ref" in payload
             ? this.options.store.getNativeStructuredAnswer(payload.answer_ref)
             : "answer_selection" in payload
@@ -431,13 +459,16 @@ export class NativeArtifactService {
             throw new NativeArtifactError("no persisted answer is available for this native session", 404);
         if (source)
             validateStoredStructuredAnswer(source, session.id);
-        const contents = referenceSave ? source.envelopeJson : JSON.stringify(payload.envelope);
-        const digest = referenceSave ? source.digest : structuredAnswerDigest(contents);
+        // A reference save inherits the retained answer's provenance; an envelope
+        // save is verified only through the host-only grounded entry.
+        const verified = source ? source.grounded : grounded;
+        const contents = JSON.stringify(withHostVerified(source ? JSON.parse(source.envelopeJson) : "envelope" in payload ? payload.envelope : undefined, verified));
+        const digest = structuredAnswerDigest(contents);
         const sameSaveRequest = (artifact) => artifact !== undefined &&
             artifact.name === payload.name.trim() &&
             artifact.projectIdentity === binding.identity && artifact.bindingGeneration === binding.generation && artifact.projectRevision === binding.revision &&
             artifact.nativeVendor === session.vendor && artifact.nativeAgent === session.agent &&
-            artifact.contentDigest === digest && artifact.sourceAnswerId === (source?.id ?? null);
+            artifact.contentDigest === digest && artifact.sourceAnswerId === (source?.id ?? null) && artifact.verified === verified;
         const existing = this.options.store.getNativeArtifactByIdempotency(session.id, payload.idempotency_key);
         if (existing) {
             if (!sameSaveRequest(existing))
@@ -450,7 +481,7 @@ export class NativeArtifactService {
         try {
             const safeTarget = assertSafeContainedTarget(this.options.artifactsRoot, target);
             (this.options.writeAtomic ?? writeContainedAtomically)(safeTarget, contents);
-            const inserted = this.options.store.createNativeArtifact({ id, sessionId: session.id, nativeSessionId: session.id, name: payload.name.trim(), location, projectIdentity: binding.identity, bindingGeneration: binding.generation, projectRevision: binding.revision, vendor: session.vendor, agent: session.agent, digest, idempotencyKey: payload.idempotency_key, ...(source ? { sourceAnswerId: source.id } : {}) });
+            const inserted = this.options.store.createNativeArtifact({ id, sessionId: session.id, nativeSessionId: session.id, name: payload.name.trim(), location, projectIdentity: binding.identity, bindingGeneration: binding.generation, projectRevision: binding.revision, vendor: session.vendor, agent: session.agent, digest, idempotencyKey: payload.idempotency_key, verified, ...(source ? { sourceAnswerId: source.id } : {}) });
             if (!inserted.created && !sameSaveRequest(inserted.row)) {
                 rmSync(target, { force: true });
                 throw new NativeArtifactError("artifact idempotency key is already bound to a different save request", 409);

package/dist-server/server/native-component-context.d.ts

@@ -0,0 +1,19 @@
+import { type CodexSessionTools } from "./runtime-host/codex-direct-tools.js";
+import { type NativeComponentRuntimeOptions } from "./native-component-runtime.js";
+import type { NativeComponentPreparation } from "./native-components.js";
+export interface NativeComponentContextOptions extends Omit<NativeComponentRuntimeOptions, "contexts" | "wren"> {
+    /** All executables and the provider are resolved by the certified server provisioner. */
+    readonly contextLoaderBinary: string;
+    /** Explicit host-only credential environment supplied by the provisioner. */
+    readonly wrenEnvironment?: Readonly<NodeJS.ProcessEnv>;
+    readonly wrenBinary: string;
+    readonly project: string;
+    readonly signal: AbortSignal;
+}
+/** Capture file-only context before host admission; never opens a vendor or Wren process. */
+export declare function prepareCapturedNativeComponentHost(irDocument: string, scope: Readonly<Record<string, unknown>>, options: NativeComponentContextOptions): Promise<NativeComponentPreparation | undefined>;
+/** Direct-session variant shares the same captured project/credential provenance. */
+export declare function prepareCapturedCodexDirectTools(irDocument: string, scope: Readonly<Record<string, unknown>>, options: NativeComponentContextOptions & {
+    readonly producerBinary: string;
+    readonly expiresAt: number;
+}): Promise<CodexSessionTools>;

package/dist-server/server/native-component-context.js

@@ -0,0 +1,76 @@
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { generatePreparedContext } from "../harness/compile/context-loader.js";
+import { hashDirectory } from "../harness/compile/fingerprint.js";
+import { captureWrenAccessIdentity } from "../harness/components/wren-access.js";
+import { prepareCodexDirectTools } from "./runtime-host/codex-direct-tools.js";
+import { prepareNativeComponentHost } from "./native-component-preparation.js";
+import { createNativeComponentRuntimeBindings } from "./native-component-runtime.js";
+/** Capture file-only context before host admission; never opens a vendor or Wren process. */
+export async function prepareCapturedNativeComponentHost(irDocument, scope, options) {
+    const capturedScope = structuredClone(scope);
+    const bindings = await captureBindings(irDocument, options);
+    return prepareNativeComponentHost(irDocument, capturedScope, bindings);
+}
+/** Direct-session variant shares the same captured project/credential provenance. */
+export async function prepareCapturedCodexDirectTools(irDocument, scope, options) {
+    if (options.vendor.vendor !== "codex" || options.identity.vendor !== "codex")
+        throw new Error("Direct session requires Codex");
+    const capturedScope = structuredClone(scope);
+    const accountEmail = options.vendor.accountEmail;
+    const bindings = await captureBindings(irDocument, options);
+    return prepareCodexDirectTools({ irDocument, scope: capturedScope, bindings, producerBinary: options.producerBinary,
+        accountEmail, expiresAt: options.expiresAt, signal: options.signal });
+}
+async function captureBindings(irDocument, options) {
+    const identity = structuredClone(options.identity);
+    const project = path.resolve(options.project);
+    const signal = options.signal;
+    const currentIdentity = options.currentIdentity.bind(options);
+    const assertBinding = options.assertCurrent.bind(options);
+    const assertVendor = options.vendor.assertCurrent.bind(options.vendor);
+    const check = () => {
+        signal.throwIfAborted();
+        assertBinding();
+        assertVendor();
+        if (!isDeepStrictEqual(currentIdentity(), identity))
+            throw new Error("Native component context binding expired");
+    };
+    check();
+    const ir = z.object({ warble_ir_version: z.literal("0.9"), components: z.array(z.object({
+            id: z.string(), context_binding: z.record(z.string(), z.unknown()).optional(),
+        }).passthrough()) }).passthrough().parse(JSON.parse(irDocument));
+    if (new Set(ir.components.map((component) => component.id)).size !== ir.components.length)
+        throw new Error("Duplicate component identity");
+    const fingerprint = await hashDirectory(project);
+    const accessIdentity = await captureWrenAccessIdentity(project, options.wrenEnvironment);
+    check();
+    const scratch = await mkdtemp(path.join(os.tmpdir(), "genbi-native-context-"));
+    try {
+        const snapshotPath = path.join(scratch, "context.json");
+        await generatePreparedContext(options.contextLoaderBinary, project, snapshotPath, signal);
+        const snapshot = z.object({ context_version: z.literal(2), parseable: z.literal(true) }).passthrough()
+            .parse(JSON.parse(await readFile(snapshotPath, "utf8")));
+        await accessIdentity.assertCurrent();
+        if (fingerprint !== await hashDirectory(project))
+            throw new Error("Native component project changed during context capture");
+        check();
+        const contexts = Object.fromEntries(ir.components.flatMap((component) => {
+            const binding = component.context_binding;
+            // Other, unreachable components cannot contribute a project or context grant.
+            // Preparation below requires a captured context for every reachable component.
+            if (!binding || typeof binding.project !== "string" || path.resolve(binding.project) !== project)
+                return [];
+            return [[component.id, { binding, snapshot }]];
+        }));
+        const bindings = createNativeComponentRuntimeBindings({ ...options, identity, contexts, currentIdentity, assertCurrent: check,
+            wren: { executable: options.wrenBinary, project, fingerprint, identity: accessIdentity } });
+        return bindings;
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}

package/dist-server/server/native-component-preparation.d.ts

@@ -0,0 +1,20 @@
+import { type ComponentBrokerOptions } from "../harness/components/broker.js";
+import type { NativeComponentIdentity, NativeComponentPreparation } from "./native-components.js";
+/** The certified provisioner supplies bindings; this module derives scope/closure authority. */
+export interface NativeComponentBindings {
+    readonly identity: NativeComponentIdentity;
+    readonly contexts: ComponentBrokerOptions["contexts"];
+    readonly verifierBinary: string;
+    readonly prepare: ComponentBrokerOptions["prepare"];
+    readonly step: ComponentBrokerOptions["step"];
+    readonly normalize: ComponentBrokerOptions["normalize"];
+    readonly persistRoot?: ComponentBrokerOptions["persistRoot"];
+    readonly onEvent?: ComponentBrokerOptions["onEvent"];
+    currentIdentity(): NativeComponentIdentity | undefined;
+    /** Includes exact executable/account/generation and context snapshot provenance. */
+    assertCurrent(): void;
+}
+/** Select only composed eligible roots; direct non-composed vendor entries retain their path. */
+export declare function prepareNativeComponentHost(irDocument: string, scope: Readonly<Record<string, unknown>>, bindings: NativeComponentBindings): NativeComponentPreparation | undefined;
+/** Direct Codex sessions pin one root even when it has no child components. */
+export declare function prepareDirectCodexComponentHost(irDocument: string, scope: Readonly<Record<string, unknown>>, bindings: NativeComponentBindings): NativeComponentPreparation;

package/dist-server/server/native-component-preparation.js

@@ -0,0 +1,129 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { createComponentBroker } from "../harness/components/broker.js";
+import { HOST_FEATURES, planDigest } from "../harness/components/plan.js";
+const nodeSchema = z.object({ id: z.string().min(1), verb: z.string().min(1), entrypoint: z.boolean().optional(),
+    type: z.literal("analytical"), realization_kind: z.literal("skill"), trigger: z.object({ kind: z.literal("one_shot") }),
+    required_capabilities: z.array(z.string()), guardrails: z.array(z.record(z.string(), z.unknown())),
+    context_binding: z.record(z.string(), z.unknown()),
+    llm_calls: z.array(z.object({ tier: z.string().min(1), component_calls: z.array(z.object({ alias: z.string(), component: z.string() })).optional() }).passthrough()),
+}).passthrough();
+const irSchema = z.object({ warble_ir_version: z.literal("0.9"), components: z.array(z.record(z.string(), z.unknown())) }).passthrough();
+const supportedGuards = new Set(["read_only_execution", "row_limit", "statement_timeout", "deterministic_gate", "artifact_write", "additivity_guard", "drill_depth_limit"]);
+const execution = ["ordered_steps", "isolated_step_tools", "artifact_provenance", "per_step_tiers", "bounded_repair", "render_contract"];
+function freeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** Select only composed eligible roots; direct non-composed vendor entries retain their path. */
+export function prepareNativeComponentHost(irDocument, scope, bindings) {
+    return prepareHost(irDocument, scope, bindings, false);
+}
+/** Direct Codex sessions pin one root even when it has no child components. */
+export function prepareDirectCodexComponentHost(irDocument, scope, bindings) {
+    if (bindings.identity.vendor !== "codex")
+        throw new Error("Direct session requires Codex");
+    const prepared = prepareHost(irDocument, scope, bindings, true);
+    if (!prepared || Object.keys(prepared.hostRoots).length !== 1)
+        throw new Error("Direct session requires one entry");
+    return prepared;
+}
+function prepareHost(irDocument, scope, bindings, direct) {
+    bindings.assertCurrent();
+    const identity = freeze(structuredClone(bindings.identity));
+    const contexts = freeze(structuredClone(bindings.contexts));
+    const assertCurrent = bindings.assertCurrent.bind(bindings);
+    const currentIdentity = bindings.currentIdentity.bind(bindings);
+    const prepare = bindings.prepare, step = bindings.step, normalize = bindings.normalize;
+    const persistRoot = bindings.persistRoot, onEvent = bindings.onEvent, verifierBinary = bindings.verifierBinary;
+    const check = () => {
+        assertCurrent();
+        if (!isDeepStrictEqual(currentIdentity(), identity))
+            throw new Error("Native component binding expired");
+    };
+    check();
+    const ir = irSchema.parse(JSON.parse(irDocument));
+    const nodes = new Map(ir.components.map((node) => [z.string().min(1).parse(node.id), node]));
+    if (nodes.size !== ir.components.length)
+        throw new Error("Duplicate component identity");
+    const entry = z.union([
+        z.object({ kind: z.literal("scope"), prompt: z.string() }).strict(),
+        z.object({ kind: z.literal("agent").default("agent"), verb: z.string(), prompt: z.string() }).strict(),
+    ]).parse(scope.entry);
+    if (identity.vendor === "codex" && entry.kind !== "agent")
+        throw new Error("Codex requires a single pinned entry");
+    if (!isDeepStrictEqual(scope.binding, identity.binding))
+        throw new Error("Native component scope binding mismatch");
+    const eligible = [...nodes.values()].filter((node) => node.entrypoint !== false && (entry.kind === "scope" || node.verb === entry.verb));
+    if (entry.kind === "agent" && eligible.length !== 1)
+        throw new Error("Unknown or ambiguous pinned entry");
+    const roots = eligible.filter((node) => direct || z.array(z.object({ component_calls: z.array(z.unknown()).optional() }).passthrough()).parse(node.llm_calls)
+        .some((step) => (step.component_calls?.length ?? 0) > 0));
+    if (!roots.length)
+        return undefined;
+    const needed = new Set();
+    const hostRoots = Object.fromEntries(roots.map((root) => {
+        const visited = new Set();
+        const visiting = new Set();
+        const visit = (id, depth) => {
+            if (depth > 8 || visiting.has(id))
+                throw new Error("Invalid component invocation closure");
+            if (visited.has(id))
+                return;
+            const node = nodeSchema.parse(nodes.get(id));
+            visiting.add(id);
+            for (const guard of node.guardrails)
+                if (!supportedGuards.has(String(guard.name)))
+                    throw new Error("Unsupported native component guard");
+            for (const call of node.llm_calls)
+                for (const edge of call.component_calls ?? [])
+                    visit(edge.component, depth + 1);
+            visiting.delete(id);
+            visited.add(id);
+            needed.add(id);
+        };
+        visit(String(root.id), 0);
+        const components = Object.fromEntries([...visited].sort().map((id) => {
+            const node = nodeSchema.parse(nodes.get(id));
+            const context = contexts[id];
+            if (!context || !isDeepStrictEqual(context.binding, node.context_binding))
+                throw new Error("Missing or mismatched component context");
+            const capabilities = Object.fromEntries(node.required_capabilities.filter((capability) => !capability.startsWith("llm:")).map((capability) => {
+                if (capability === "sql_execution:read_only")
+                    return [capability, { tool: "query_read_only" }];
+                if (capability === "semantic_introspection")
+                    return [capability, { tool: "inspect_context" }];
+                if (["component_invocation", "artifact_write", "render_contract"].includes(capability))
+                    return [capability, {}];
+                throw new Error("Unsupported native component capability");
+            }));
+            return [id, { version: "2", tiers: [...new Set(node.llm_calls.map((call) => call.tier))], guardrails: node.guardrails, capabilities, execution }];
+        }));
+        return [String(root.id), { version: "2", protocol: "warble-component-host/1", execution: HOST_FEATURES, components }];
+    }));
+    freeze(hostRoots);
+    const selectedContexts = Object.fromEntries([...needed].sort().map((id) => [id, contexts[id]]));
+    const snapshots = Object.fromEntries(Object.entries(selectedContexts).map(([id, value]) => [id, value.snapshot]));
+    return freeze({
+        identity, hostRoots, contexts: freeze(snapshots), assertCurrent: check,
+        async host(root, plan, signal) {
+            check();
+            signal.throwIfAborted();
+            const descriptor = hostRoots[root];
+            if (!descriptor || plan.entries.length !== 1 || plan.entries[0] !== root || !isDeepStrictEqual(Object.keys(plan.components).sort(), Object.keys(descriptor.components).sort()))
+                throw new Error("Native component root mismatch");
+            const rootContexts = Object.fromEntries(Object.keys(plan.components).map((id) => [id, selectedContexts[id]]));
+            const brokerIdentity = { session: identity.session_id, vendor: identity.vendor, account: identity.auth_identity,
+                generation: identity.runtime_generation, project: identity.binding.project_identity, bindingRevision: identity.binding.revision,
+                contextDigest: planDigest(rootContexts), planDigest: plan.identity };
+            return createComponentBroker({ plan, contexts: rootContexts, verifierBinary,
+                identity: brokerIdentity, currentIdentity: () => { check(); return signal.aborted ? undefined : brokerIdentity; },
+                prepare, step, normalize, ...(persistRoot ? { persistRoot } : {}), ...(onEvent ? { onEvent } : {}),
+            });
+        },
+    });
+}

package/dist-server/server/native-component-runtime.d.ts

@@ -0,0 +1,36 @@
+import { type WrenAccessIdentity } from "../harness/components/wren-access.js";
+import type { NativeComponentBindings } from "./native-component-preparation.js";
+import { type ClaudeComponentRuntime } from "./runtime-host/claude-component-step.js";
+import { type CodexComponentPolicy } from "./runtime-host/codex-component-step.js";
+import type { RpcTransport } from "./runtime-host/codex-rpc.js";
+/** Injected only after vendor certification. This factory does not confer certification. */
+export type NativeComponentVendor = {
+    readonly authIdentity: string;
+    readonly accountEmail: string;
+    readonly generation: string;
+    readonly models: Readonly<Record<string, string>>;
+    assertCurrent(): void;
+    assertLive?(): void;
+} & ({
+    readonly vendor: "claude";
+    open(model: string, signal: AbortSignal): Promise<ClaudeComponentRuntime>;
+} | {
+    readonly vendor: "codex";
+    open(model: string, signal: AbortSignal): Promise<{
+        readonly transport: RpcTransport;
+        readonly policy: CodexComponentPolicy;
+    }>;
+});
+export interface NativeComponentRuntimeOptions extends Pick<NativeComponentBindings, "identity" | "contexts" | "verifierBinary" | "currentIdentity" | "assertCurrent" | "persistRoot" | "onEvent"> {
+    readonly vendor: NativeComponentVendor;
+    /** Optional cheap scope guard; integrity remains mandatory at protected operations. */
+    assertLive?(): void;
+    readonly wren: {
+        readonly executable: string;
+        readonly project: string;
+        readonly fingerprint: string;
+        readonly identity: WrenAccessIdentity;
+    };
+}
+/** Bind governed steps to one approved account and captured tier map; no outer-session transport. */
+export declare function createNativeComponentRuntimeBindings(options: NativeComponentRuntimeOptions): NativeComponentBindings;

package/dist-server/server/native-component-runtime.js

@@ -0,0 +1,92 @@
+import { isDeepStrictEqual } from "node:util";
+import { hashDirectory } from "../harness/compile/fingerprint.js";
+import { normalizeComponentEvidence } from "../harness/components/normalize.js";
+import { openWrenComponentAccess } from "../harness/components/wren-access.js";
+import { runClaudeComponentStep } from "./runtime-host/claude-component-step.js";
+import { runCodexComponentStep } from "./runtime-host/codex-component-step.js";
+/** Bind governed steps to one approved account and captured tier map; no outer-session transport. */
+export function createNativeComponentRuntimeBindings(options) {
+    const identity = structuredClone(options.identity);
+    const contexts = structuredClone(options.contexts);
+    const provider = options.vendor;
+    const vendor = provider.vendor;
+    const account = { authIdentity: provider.authIdentity, accountEmail: provider.accountEmail, generation: provider.generation };
+    const models = structuredClone(provider.models);
+    const assertBinding = options.assertCurrent.bind(options);
+    const currentIdentity = options.currentIdentity.bind(options);
+    const assertVendor = provider.assertCurrent.bind(provider);
+    const open = provider.open.bind(provider);
+    const wren = { ...options.wren };
+    const persistRoot = options.persistRoot;
+    const used = new WeakSet();
+    const assertBindingLive = options.assertLive?.bind(options) ?? assertBinding;
+    const assertVendorLive = provider.assertLive?.bind(provider) ?? assertVendor;
+    const checkIdentity = () => {
+        if (identity.vendor !== vendor || identity.auth_identity !== account.authIdentity || identity.runtime_generation !== account.generation
+            || !account.accountEmail || !isDeepStrictEqual(currentIdentity(), identity)
+            || provider.vendor !== vendor || provider.authIdentity !== account.authIdentity || provider.accountEmail !== account.accountEmail
+            || provider.generation !== account.generation || !isDeepStrictEqual(provider.models, models))
+            throw new Error("Native component runtime binding expired");
+    };
+    const check = () => { assertBinding(); assertVendor(); checkIdentity(); };
+    const checkLive = () => { assertBindingLive(); assertVendorLive(); checkIdentity(); };
+    check();
+    const checkAccess = async (signal) => {
+        signal.throwIfAborted();
+        check();
+        await wren.identity.assertCurrent();
+        if (await hashDirectory(wren.project) !== wren.fingerprint)
+            throw new Error("Native component project changed");
+        signal.throwIfAborted();
+        check();
+    };
+    return {
+        identity, contexts, verifierBinary: options.verifierBinary, currentIdentity, assertCurrent: check,
+        ...(persistRoot ? { persistRoot: async (...args) => { await checkAccess(args[2]); await persistRoot(...args); } } : {}), ...(options.onEvent ? { onEvent: options.onEvent } : {}),
+        async prepare(component, _identity, signal) {
+            await checkAccess(signal);
+            if (component.steps.some((step) => !models[step.tier]))
+                throw new Error("Missing native component tier binding");
+            if (component.steps.every((step) => step.tools.length === 0))
+                return {
+                    async query() { throw new Error("No component query grant"); }, async inspect() { throw new Error("No component context grant"); }, async close() { },
+                };
+            return openWrenComponentAccess({ ...wren, signal });
+        },
+        async step(run, component) {
+            await checkAccess(run.signal);
+            const model = models[run.tier];
+            if (!model || !component.steps.some((step) => step.tier === run.tier))
+                throw new Error("Missing native component step binding");
+            const resource = await open(model, run.signal);
+            const transport = "transport" in resource ? resource.transport : resource;
+            let closing;
+            const close = () => closing ??= transport.close();
+            try {
+                await checkAccess(run.signal);
+                if (used.has(transport))
+                    throw new Error("Native component step requires a fresh runtime");
+                used.add(transport);
+                if (vendor === "codex" && "transport" in resource) {
+                    if (resource.policy.accountEmail !== account.accountEmail || resource.policy.model !== model)
+                        throw new Error("Native component account or model mismatch");
+                    const originalCheck = resource.policy.assertCurrent.bind(resource.policy);
+                    const originalLive = resource.policy.assertLive?.bind(resource.policy) ?? originalCheck;
+                    return await runCodexComponentStep({ listen: resource.transport.listen.bind(resource.transport), write: resource.transport.write.bind(resource.transport), close }, { ...resource.policy, assertCurrent() { check(); originalCheck(); },
+                        assertLive() { checkLive(); originalLive(); } }, run);
+                }
+                if (vendor === "claude" && !("transport" in resource)) {
+                    if (resource.account.email !== account.accountEmail || resource.model !== model)
+                        throw new Error("Native component account or model mismatch");
+                    const originalCheck = resource.assertCurrent.bind(resource);
+                    return await runClaudeComponentStep({ ...resource, query: resource.query.bind(resource), close, assertCurrent() { check(); originalCheck(); } }, run);
+                }
+                throw new Error("Native component vendor mismatch");
+            }
+            finally {
+                await close();
+            }
+        },
+        async normalize(component, evidence, signal, context) { await checkAccess(signal); return normalizeComponentEvidence(component, evidence, context); },
+    };
+}