agentic-workflow-manager 9.11.12 → 9.12.1

package/dist/src/core/model-policy/native-codex.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeCodexRolloutSelection = void 0;
+exports.isNativeCodexChildObservation = isNativeCodexChildObservation;
+exports.normalizeCodexChildThreadObservation = normalizeCodexChildThreadObservation;
+exports.normalizeCodexModelCatalog = normalizeCodexModelCatalog;
+exports.queryCodexChildThreadObservation = queryCodexChildThreadObservation;
+exports.queryCodexModelCatalog = queryCodexModelCatalog;
+const child_process_1 = require("child_process");
+const native_codex_rollout_1 = require("./native-codex-rollout");
+var native_codex_rollout_2 = require("./native-codex-rollout");
+Object.defineProperty(exports, "normalizeCodexRolloutSelection", { enumerable: true, get: function () { return native_codex_rollout_2.normalizeCodexRolloutSelection; } });
+const nativeChildObservations = new WeakMap();
+function isNativeCodexChildObservation(value) {
+    return !!value && typeof value === 'object' && nativeChildObservations.get(value) === JSON.stringify(value);
+}
+function record(value, name) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${name} must be an object`);
+    return value;
+}
+function boundedText(value, name) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 128 || /[\u0000-\u001f\u007f-\u009f]/.test(value))
+        throw new Error(`${name} is invalid`);
+    return value;
+}
+/** Only call on a result obtained from native `thread/read` with includeTurns.
+ * A child with a completed turn proves native child execution and exposes its
+ * persisted configuration, but not the accepted per-turn or backend model. */
+function normalizeCodexChildThreadObservation(value, expectedParentThreadId) {
+    const parent = boundedText(expectedParentThreadId, 'expected parent thread id');
+    const response = record(value, 'Codex thread/read response');
+    const thread = record(response.thread, 'Codex child thread');
+    const childThreadId = boundedText(thread.id, 'Codex child thread id');
+    const parentThreadId = boundedText(thread.parentThreadId, 'Codex parent thread id');
+    if (parentThreadId !== parent || childThreadId === parent)
+        throw new Error('Codex child parent thread mismatch');
+    const model = boundedText(thread.model, 'Codex child configured model');
+    const effort = boundedText(thread.reasoningEffort, 'Codex child configured effort');
+    if (!Array.isArray(thread.turns) || thread.turns.length === 0 || thread.turns.length > 256)
+        throw new Error('Codex child turns are invalid');
+    const completed = thread.turns.find((raw) => {
+        const turn = record(raw, 'Codex child turn');
+        boundedText(turn.id, 'Codex child turn id');
+        if (!Array.isArray(turn.items) || turn.items.length > 4096)
+            throw new Error('Codex child turn items are invalid');
+        if (typeof turn.status !== 'string')
+            throw new Error('Codex child turn status is invalid');
+        return turn.status === 'completed';
+    });
+    if (!completed)
+        throw new Error('Codex child has no completed turn');
+    return { provenance: 'codex-app-server-thread-read', parentThreadId, childThreadId, turnId: completed.id,
+        nativeDispatchVerified: true, configuredSelection: { selector: { kind: 'model', id: model }, effort: { kind: 'explicit', value: effort } },
+        acceptedSelectionVerified: false, actualModelVerified: false, tokenUsage: 'unknown' };
+}
+/** Normalize only the provider's catalog. This cannot attest dispatch or actual backend identity. */
+function normalizeCodexModelCatalog(value) {
+    const response = record(value, 'Codex model/list response');
+    if (!Array.isArray(response.data) || response.data.length > 256)
+        throw new Error('Codex model catalog is invalid');
+    const selections = [];
+    const modelIds = new Set();
+    const selectionKeys = new Set();
+    for (const [index, raw] of response.data.entries()) {
+        const model = record(raw, `Codex model[${index}]`);
+        const catalogId = boundedText(model.id, `Codex model[${index}].id`);
+        const slug = boundedText(model.model, `Codex model[${index}].model`);
+        if (modelIds.has(catalogId))
+            throw new Error(`Codex catalog contains duplicate model id ${catalogId}`);
+        modelIds.add(catalogId);
+        if (typeof model.hidden !== 'boolean')
+            throw new Error(`Codex model[${index}].hidden is invalid`);
+        if (!Array.isArray(model.supportedReasoningEfforts) || model.supportedReasoningEfforts.length > 20)
+            throw new Error(`Codex model[${index}] supported efforts are invalid`);
+        if (model.hidden)
+            continue;
+        for (const [effortIndex, rawEffort] of model.supportedReasoningEfforts.entries()) {
+            const option = record(rawEffort, `Codex model[${index}] effort[${effortIndex}]`);
+            const effort = boundedText(option.reasoningEffort, `Codex model[${index}] effort[${effortIndex}]`);
+            boundedText(option.description, `Codex model[${index}] effort description`);
+            const key = `${slug}\0${effort}`;
+            if (selectionKeys.has(key))
+                throw new Error(`Codex catalog contains duplicate selection ${slug}/${effort}`);
+            selectionKeys.add(key);
+            selections.push({ selector: { kind: 'model', id: slug }, effort: { kind: 'explicit', value: effort } });
+        }
+    }
+    return { provenance: 'native-catalog', selections, nativeDispatchVerified: false, actualModelVerified: false };
+}
+/** Explicit, read-only native observation of an existing child. It never starts
+ * a thread or turn, and only returns the bounded normalized fields. */
+function queryCodexChildThreadObservation(input) {
+    if (!input || typeof input !== 'object' || typeof input.command !== 'string' || input.command.length === 0 || input.command.length > 4096
+        || !Array.isArray(input.args) || input.args.length > 16 || input.args.some(arg => typeof arg !== 'string' || arg.length > 65536)
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000)
+        throw new Error('Codex child thread query is invalid');
+    const parentThreadId = boundedText(input.parentThreadId, 'parent thread id');
+    const childThreadId = boundedText(input.childThreadId, 'child thread id');
+    if (parentThreadId === childThreadId)
+        throw new Error('Codex child and parent thread ids must differ');
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(input.command, input.args, { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+        let settled = false;
+        let buffer = '';
+        let expectedId = 1;
+        const finish = (error, observed) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill();
+            if (error)
+                reject(error);
+            else {
+                nativeChildObservations.set(observed, JSON.stringify(observed));
+                resolve(observed);
+            }
+        };
+        const send = (request) => { if (!settled)
+            child.stdin.write(`${JSON.stringify(request)}\n`); };
+        const timer = setTimeout(() => finish(new Error('Codex child thread query timed out')), input.timeoutMs);
+        child.on('error', () => finish(new Error('Codex app-server could not be started')));
+        child.stdin.on('error', () => finish(new Error('Codex app-server input failed')));
+        child.on('exit', () => finish(new Error('Codex app-server exited before thread/read response')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            if (settled)
+                return;
+            buffer += chunk;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Codex thread/read response exceeds 2 MiB'));
+            for (;;) {
+                const end = buffer.indexOf('\n');
+                if (end < 0 || settled)
+                    break;
+                const line = buffer.slice(0, end).trim();
+                buffer = buffer.slice(end + 1);
+                if (!line)
+                    continue;
+                let message;
+                try {
+                    message = record(JSON.parse(line), 'Codex protocol response');
+                }
+                catch {
+                    return finish(new Error('Codex protocol returned invalid JSON'));
+                }
+                if (message.id === undefined)
+                    continue;
+                if (message.id !== expectedId)
+                    return finish(new Error('Codex protocol response id mismatch'));
+                if (message.error !== undefined)
+                    return finish(new Error('Codex app-server rejected thread/read request'));
+                if (expectedId === 1) {
+                    try {
+                        record(message.result, 'Codex initialize result');
+                    }
+                    catch {
+                        return finish(new Error('Codex protocol initialize response is invalid'));
+                    }
+                    send({ method: 'initialized' });
+                    expectedId = 2;
+                    send({ id: expectedId, method: 'thread/read', params: { threadId: childThreadId, includeTurns: true } });
+                    continue;
+                }
+                try {
+                    const result = normalizeCodexChildThreadObservation(message.result, parentThreadId);
+                    if (result.childThreadId !== childThreadId)
+                        throw new Error('Codex child thread id mismatch');
+                    if (input.codexHome === undefined) {
+                        finish(undefined, result);
+                        continue;
+                    }
+                    const response = record(message.result, 'Codex thread/read result');
+                    const thread = record(response.thread, 'Codex child thread');
+                    if (typeof thread.path !== 'string')
+                        throw new Error('Codex child rollout path is unavailable');
+                    const turn = (0, native_codex_rollout_1.readCodexRolloutSelection)({ codexHome: input.codexHome, file: thread.path,
+                        expected: { parentThreadId, childThreadId, turnId: result.turnId } });
+                    if (turn.configuredSelection.selector.id !== result.configuredSelection.selector.id
+                        || turn.configuredSelection.effort.kind !== result.configuredSelection.effort.kind
+                        || (turn.configuredSelection.effort.kind === 'explicit' && result.configuredSelection.effort.kind === 'explicit'
+                            && turn.configuredSelection.effort.value !== result.configuredSelection.effort.value))
+                        throw new Error('Codex child selection changed after the observed turn');
+                    finish(undefined, { ...result, configuredSelection: turn.configuredSelection, acceptedSelectionVerified: true, childRuntimeVersion: turn.cliVersion, observedAt: turn.observedAt });
+                }
+                catch (error) {
+                    finish(error);
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'awm', title: 'AWM native observation', version: '1.0.0' } } });
+    });
+}
+/** Explicit no-inference App Server discovery. Never invoked by doctor/preflight. */
+function queryCodexModelCatalog(input) {
+    if (!input || typeof input !== 'object'
+        || typeof input.command !== 'string' || input.command.length === 0 || input.command.length > 4096
+        || !Array.isArray(input.args) || input.args.length > 16
+        || input.args.some(arg => typeof arg !== 'string' || arg.length > 65536)
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000) {
+        throw new Error('Codex catalog query is invalid');
+    }
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(input.command, input.args, { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+        let settled = false;
+        let buffer = '';
+        let nextRequestId = 2;
+        let pendingRequestId = 1;
+        let pages = 0;
+        const models = [];
+        const finish = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.kill();
+            if (error)
+                reject(error);
+            else
+                resolve(result);
+        };
+        const send = (message) => {
+            if (settled)
+                return;
+            child.stdin.write(`${JSON.stringify(message)}\n`);
+        };
+        const timer = setTimeout(() => finish(new Error('Codex catalog query timed out')), input.timeoutMs);
+        child.on('error', () => finish(new Error('Codex app-server could not be started')));
+        child.stdin.on('error', () => finish(new Error('Codex app-server input failed')));
+        child.on('exit', () => finish(new Error('Codex app-server exited before catalog response')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            if (settled)
+                return;
+            buffer += chunk;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Codex protocol response exceeds 2 MiB'));
+            for (;;) {
+                const end = buffer.indexOf('\n');
+                if (end < 0 || settled)
+                    break;
+                const line = buffer.slice(0, end).trim();
+                buffer = buffer.slice(end + 1);
+                if (!line)
+                    continue;
+                let message;
+                try {
+                    message = record(JSON.parse(line), 'Codex protocol response');
+                }
+                catch {
+                    return finish(new Error('Codex protocol returned invalid JSON'));
+                }
+                if (message.id === undefined)
+                    continue; // asynchronous notification
+                if (message.id !== pendingRequestId)
+                    return finish(new Error('Codex protocol response id mismatch'));
+                if (message.error !== undefined)
+                    return finish(new Error('Codex app-server rejected catalog request'));
+                if (pendingRequestId === 1) {
+                    try {
+                        record(message.result, 'Codex initialize result');
+                    }
+                    catch {
+                        return finish(new Error('Codex protocol initialize response is invalid'));
+                    }
+                    send({ method: 'initialized' });
+                    pendingRequestId = nextRequestId++;
+                    send({ id: pendingRequestId, method: 'model/list', params: { includeHidden: false, limit: 100 } });
+                    continue;
+                }
+                let page;
+                try {
+                    page = record(message.result, 'Codex model/list result');
+                }
+                catch {
+                    return finish(new Error('Codex protocol model/list response is invalid'));
+                }
+                if (!Array.isArray(page.data))
+                    return finish(new Error('Codex protocol model/list data is invalid'));
+                models.push(...page.data);
+                pages += 1;
+                if (models.length > 256 || pages > 8)
+                    return finish(new Error('Codex model catalog exceeds discovery limit'));
+                if (page.nextCursor === null || page.nextCursor === undefined) {
+                    try {
+                        finish(undefined, normalizeCodexModelCatalog({ data: models }));
+                    }
+                    catch (error) {
+                        finish(error);
+                    }
+                    continue;
+                }
+                if (typeof page.nextCursor !== 'string' || page.nextCursor.length === 0 || page.nextCursor.length > 1024)
+                    return finish(new Error('Codex protocol cursor is invalid'));
+                pendingRequestId = nextRequestId++;
+                send({ id: pendingRequestId, method: 'model/list', params: { includeHidden: false, limit: 100, cursor: page.nextCursor } });
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'awm', title: 'AWM discovery', version: '1.0.0' } } });
+    });
+}

package/dist/src/core/model-policy/native-routing-observe.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.observeNativeRoutingChild = observeNativeRoutingChild;
+const crypto_1 = require("crypto");
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../paths");
+const capabilities_v2_1 = require("./capabilities-v2");
+const event_store_1 = require("./event-store");
+const local_event_scope_1 = require("./local-event-scope");
+const machine_key_1 = require("./machine-key");
+const capabilities_1 = require("./capabilities");
+const native_codex_1 = require("./native-codex");
+const native_routing_proof_1 = require("./native-routing-proof");
+const selection_policy_digest_1 = require("./selection-policy-digest");
+const store_1 = require("./store");
+function sameSelection(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+/** A bounded, read-mostly native observation for an already-dispatched child.
+ * Codex may refresh only its matching claim; Claude's Stop hook is the writer.
+ * No inference is started here. */
+async function observeNativeRoutingChild(input) {
+    if (!input || !input.attempt?.nativeEvidenceRequired || !input.attempt.reservedAt || input.attempt.state !== 'reserved'
+        || typeof input.nativeAgentId !== 'string' || input.nativeAgentId.length === 0 || input.nativeAgentId.length > 128
+        || typeof input.cwd !== 'string' || !path_1.default.isAbsolute(input.cwd) || !(input.now instanceof Date) || !Number.isFinite(input.now.getTime())
+        || !Array.isArray(input.consumedEventDigests) || input.consumedEventDigests.length > 4096
+        || input.consumedEventDigests.some(item => typeof item !== 'string' || !/^[a-f0-9]{64}$/.test(item)))
+        throw new Error('native routing observation is invalid');
+    const key = (0, machine_key_1.readMachineKey)((0, paths_1.awmHome)());
+    if (!key)
+        throw new Error('native routing machine key is missing');
+    const envelope = input.attempt.envelope;
+    const local = await (0, local_event_scope_1.queryLocalEventScope)(input.cwd, envelope.runtime.target, envelope.runtime.kind);
+    if (local.state !== 'current' || JSON.stringify(local.scope.runtime) !== JSON.stringify(envelope.runtime))
+        throw new Error('native routing runtime or account scope drifted');
+    const policy = (0, store_1.readEffectivePolicy)(input.cwd);
+    if (policy.state !== 'approved' || policy.policy.contentDigest !== envelope.policyDigest)
+        throw new Error('native routing policy drifted');
+    const mapping = policy.policy.content.mappings.find(row => row.target === envelope.runtime.target && row.runtimeKind === envelope.runtime.kind);
+    if (!mapping)
+        throw new Error('native routing mapping is absent');
+    const receipt = (0, event_store_1.readStoredEventReceipt)((0, capabilities_1.validateRuntimeKey)(envelope.runtime));
+    if (receipt.state !== 'present')
+        throw new Error('native routing receipt is absent or invalid');
+    const currentness = (0, capabilities_v2_1.evaluateEventReceipt)(receipt.receipt, local.scope, envelope.resolved, (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, envelope.resolved), input.now);
+    if (currentness.state !== 'current')
+        throw new Error(`native routing receipt drifted: ${currentness.reason}`);
+    let observed;
+    let observedAt;
+    let eventDigest;
+    let source;
+    let actualModel;
+    if (envelope.runtime.target === 'codex') {
+        if (typeof input.parentThreadId !== 'string' || input.parentThreadId.length === 0 || input.parentThreadId.length > 128)
+            throw new Error('Codex parent thread identity is required');
+        const child = await (0, native_codex_1.queryCodexChildThreadObservation)({ command: 'codex', args: ['app-server', '--stdio'], timeoutMs: 10000,
+            parentThreadId: input.parentThreadId, childThreadId: input.nativeAgentId,
+            codexHome: path_1.default.resolve(process.env.CODEX_HOME ?? path_1.default.join(os_1.default.homedir(), '.codex')) });
+        if (!child.acceptedSelectionVerified || child.childRuntimeVersion !== envelope.runtime.version || !child.observedAt)
+            throw new Error('Codex child turn selection is not natively verified');
+        observed = child.configuredSelection;
+        observedAt = child.observedAt;
+        const codexObservedMs = Date.parse(observedAt);
+        if (!Number.isFinite(codexObservedMs) || codexObservedMs < Date.parse(input.attempt.reservedAt)
+            || codexObservedMs > input.now.getTime() + 60_000 || input.now.getTime() - codexObservedMs > 15 * 60_000)
+            throw new Error('Codex native child turn is stale or predates reservation');
+        eventDigest = (0, crypto_1.createHash)('sha256').update(JSON.stringify({ parent: child.parentThreadId, child: child.childThreadId,
+            turn: child.turnId, selection: observed, runtimeVersion: child.childRuntimeVersion,
+            accountScopeDigest: local.scope.runtime.accountScopeDigest })).digest('hex');
+        source = 'codex-turn-context';
+        if (input.consumedEventDigests.includes(eventDigest))
+            throw new Error('Codex native child turn was already consumed');
+        if (sameSelection(observed, envelope.resolved)) {
+            (0, event_store_1.publishCodexObservation)({ scope: local.scope, observation: child, expectedSelection: envelope.resolved,
+                mappingDigest: (0, selection_policy_digest_1.selectionPolicyDigest)(mapping, envelope.resolved), now: input.now });
+        }
+    }
+    else if (envelope.runtime.target === 'claude-code') {
+        const claim = receipt.receipt.claims.find(item => sameSelection(item.selection, envelope.resolved));
+        const agentDigest = (0, event_store_1.claudeAgentIdDigest)(input.nativeAgentId, key);
+        const event = claim?.nativeEvents?.find(item => item.nativeAgentIdDigest === agentDigest)
+            ?? (claim?.nativeAgentIdDigest === agentDigest ? { eventDigest: claim.eventDigest, observedAt: claim.observedAt } : undefined);
+        if (!claim || claim.source !== 'claude-assistant-transcript' || claim.nativeAgentType !== envelope.nativeAgentType || !event)
+            throw new Error('Claude Stop hook does not match this routed native child');
+        observed = claim.selection;
+        observedAt = event.observedAt;
+        eventDigest = event.eventDigest;
+        source = 'claude-assistant-transcript';
+        if (claim.actualModel !== 'unverified')
+            actualModel = claim.actualModel.id;
+        if (input.consumedEventDigests.includes(eventDigest))
+            throw new Error('Claude native child event was already consumed');
+    }
+    else
+        throw new Error('native routing provider is unsupported');
+    const observedMs = Date.parse(observedAt);
+    if (!Number.isFinite(observedMs) || observedMs < Date.parse(input.attempt.reservedAt)
+        || observedMs > input.now.getTime() + 60_000 || input.now.getTime() - observedMs > 15 * 60_000)
+        throw new Error('native routing event is stale or predates reservation');
+    return (0, native_routing_proof_1.signNativeRoutingProof)({ attemptId: input.attempt.id, nativeAgentId: input.nativeAgentId, source,
+        eventDigest, observedAt, selection: observed, ...(actualModel === undefined ? {} : { actualModel }) }, key);
+}

package/dist/src/core/model-policy/native-routing-proof.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signNativeRoutingProof = signNativeRoutingProof;
+exports.verifyNativeRoutingProof = verifyNativeRoutingProof;
+const crypto_1 = require("crypto");
+const types_1 = require("../journal/types");
+const DOMAIN = 'AWM native routing attempt/v1\0';
+function validBody(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const row = value;
+    return Object.keys(row).length === (row.actualModel === undefined ? 6 : 7) && Object.keys(row).every(key => ['attemptId', 'nativeAgentId', 'source', 'eventDigest', 'observedAt', 'selection', 'actualModel'].includes(key))
+        && typeof row.attemptId === 'string' && row.attemptId.length > 0 && row.attemptId.length <= 128
+        && typeof row.nativeAgentId === 'string' && row.nativeAgentId.length > 0 && row.nativeAgentId.length <= 128
+        && (row.source === 'codex-turn-context' || row.source === 'claude-assistant-transcript')
+        && typeof row.eventDigest === 'string' && /^[a-f0-9]{64}$/.test(row.eventDigest)
+        && typeof row.observedAt === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(row.observedAt)
+        && Number.isFinite(Date.parse(row.observedAt)) && (0, types_1.isRoutingSelection)(row.selection)
+        && (row.actualModel === undefined || (row.source === 'claude-assistant-transcript' && typeof row.actualModel === 'string' && row.actualModel.length > 0 && row.actualModel.length <= 128));
+}
+function signature(body, key) {
+    if (!Buffer.isBuffer(key) || key.length !== 32)
+        throw new Error('native routing machine key is invalid');
+    return (0, crypto_1.createHmac)('sha256', key).update(DOMAIN).update(JSON.stringify(body)).digest('hex');
+}
+function signNativeRoutingProof(input, key) {
+    if (!validBody(input))
+        throw new Error('native routing proof body is invalid');
+    const body = { attemptId: input.attemptId, nativeAgentId: input.nativeAgentId, source: input.source,
+        eventDigest: input.eventDigest, observedAt: input.observedAt, selection: input.selection,
+        ...(input.actualModel === undefined ? {} : { actualModel: input.actualModel }) };
+    return { schema: 'native-routing-proof/v1', ...body, mac: signature(body, key) };
+}
+function verifyNativeRoutingProof(value, expected, key, now) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || !expected || typeof expected !== 'object'
+        || !(now instanceof Date) || !Number.isFinite(now.getTime()))
+        return false;
+    const row = value;
+    if (Object.keys(row).length !== (row.actualModel === undefined ? 8 : 9) || row.schema !== 'native-routing-proof/v1' || typeof row.mac !== 'string' || !/^[a-f0-9]{64}$/.test(row.mac))
+        return false;
+    const body = { attemptId: row.attemptId, nativeAgentId: row.nativeAgentId, source: row.source,
+        eventDigest: row.eventDigest, observedAt: row.observedAt, selection: row.selection,
+        ...(row.actualModel === undefined ? {} : { actualModel: row.actualModel }) };
+    if (!validBody(body) || body.attemptId !== expected.attemptId || body.nativeAgentId !== expected.nativeAgentId
+        || !(0, types_1.isRoutingSelection)(expected.selection)
+        || typeof expected.reservedAt !== 'string' || !Number.isFinite(Date.parse(expected.reservedAt)))
+        return false;
+    const observedMs = Date.parse(body.observedAt);
+    if (observedMs < Date.parse(expected.reservedAt) || observedMs > now.getTime() + 60_000 || now.getTime() - observedMs > 15 * 60_000)
+        return false;
+    return (0, crypto_1.timingSafeEqual)(Buffer.from(row.mac, 'hex'), Buffer.from(signature(body, key), 'hex'));
+}

package/dist/src/core/model-policy/native-runtime.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryRuntimeExecutable = queryRuntimeExecutable;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+function executablePath(command) {
+    if (typeof command !== 'string' || command.length === 0 || command.length > 4096 || /[\u0000-\u001f\u007f-\u009f]/.test(command))
+        throw new Error('runtime executable command is invalid');
+    const names = process.platform === 'win32' && path_1.default.extname(command) === '' ? [command, `${command}.exe`] : [command];
+    const candidates = path_1.default.isAbsolute(command) ? names : (process.env.PATH ?? '').split(path_1.default.delimiter).filter(Boolean).flatMap(dir => names.map(name => path_1.default.join(dir, name)));
+    for (const candidate of candidates) {
+        try {
+            fs_1.default.accessSync(candidate, fs_1.default.constants.X_OK);
+            const real = fs_1.default.realpathSync(candidate);
+            if (!fs_1.default.statSync(real).isFile())
+                continue;
+            return real;
+        }
+        catch { /* keep looking */ }
+    }
+    throw new Error('runtime executable is unavailable');
+}
+function versionOf(file, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(file, ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], shell: false });
+        let settled = false;
+        let output = '';
+        const finish = (error, version) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error) {
+                child.kill();
+                reject(error);
+            }
+            else
+                resolve(version);
+        };
+        const timer = setTimeout(() => finish(new Error('runtime version query timed out')), timeoutMs);
+        child.on('error', () => finish(new Error('runtime executable could not start')));
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { output += chunk; if (output.length > 4096)
+            finish(new Error('runtime version output exceeds limit')); });
+        child.on('exit', code => {
+            if (code !== 0)
+                return finish(new Error('runtime version command failed'));
+            const match = output.match(/\b(?:v)?(\d+\.\d+\.\d+)\b/);
+            if (!match)
+                return finish(new Error('runtime version is unavailable'));
+            finish(undefined, match[1]);
+        });
+    });
+}
+function hashFile(file) {
+    return new Promise((resolve, reject) => {
+        const before = fs_1.default.statSync(file);
+        if (!before.isFile() || before.size > 512 * 1024 * 1024)
+            return reject(new Error('runtime executable file is invalid or too large'));
+        const hash = (0, crypto_1.createHash)('sha256');
+        const stream = fs_1.default.createReadStream(file);
+        stream.on('data', chunk => hash.update(chunk));
+        stream.on('error', () => reject(new Error('runtime executable could not be read')));
+        stream.on('end', () => {
+            const after = fs_1.default.statSync(file);
+            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs)
+                return reject(new Error('runtime executable changed while hashing'));
+            resolve(hash.digest('hex'));
+        });
+    });
+}
+/** Fingerprint the executable reached by PATH and query only --version. */
+async function queryRuntimeExecutable(input) {
+    if (!input || typeof input !== 'object' || !Array.isArray(input.args) || input.args.length !== 1 || input.args[0] !== '--version'
+        || !Number.isInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 30000)
+        throw new Error('runtime version query is invalid');
+    const file = executablePath(input.command);
+    const version = await versionOf(file, input.timeoutMs);
+    const binaryDigest = await hashFile(file);
+    return { version, binaryDigest, inferenceDispatched: false };
+}