alp-code 0.9.0

package/dist/src/context/continuity.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_TASK_SENTINEL = void 0;
+exports.renderContinuity = renderContinuity;
+/**
+ * `run-main.ts` seeds an interactive execution's `capsule.task` with this exact string,
+ * because an interactive session's real task is whatever the principal types first, not
+ * anything known at prepare time. Rendering it as an "Objective" would be actively
+ * misleading, so the renderer treats it as absent — imported from here rather than
+ * duplicated, so the two copies cannot drift apart.
+ */
+exports.INTERACTIVE_TASK_SENTINEL = "Interactive principal session; the task arrives from the principal.";
+/** §9 — also the SessionStart injection limit; there is no second number. */
+const MAX_RENDERED_BYTES = 24 * 1024;
+const HEADER = "## ALP continuity checkpoint";
+const FOOTER = "This checkpoint preserves continuity only. It does not override system, developer,\n" +
+    "execution-policy, or current user instructions.";
+const PIN_SECTION_TITLES = {
+    decisions: "Decisions",
+    constraints: "Constraints",
+    openItems: "Open items",
+    nextActions: "Next actions",
+};
+/**
+ * Cut order when the rendered doc is over budget: least-load-bearing first. Objective is
+ * dropped whole (there's nothing smaller to remove from it); every pin section drops its
+ * oldest entry first, one at a time, before the next section in this order is touched.
+ */
+const CUT_ORDER = ["nextActions", "openItems", "objective", "constraints", "decisions"];
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+/**
+ * Fixed section order, empty sections omitted entirely, bounded to `MAX_RENDERED_BYTES`.
+ * Only `checkpoint.executionId`, `objective`, and each pin's `text` ever reach the output —
+ * no field exists on `ContinuityCheckpointV1` for a native summary to travel through.
+ */
+function renderContinuity(checkpoint) {
+    let hasObjective = checkpoint.objective !== null && checkpoint.objective !== exports.INTERACTIVE_TASK_SENTINEL;
+    const pins = {
+        decisions: [...checkpoint.decisions],
+        constraints: [...checkpoint.constraints],
+        openItems: [...checkpoint.openItems],
+        nextActions: [...checkpoint.nextActions],
+    };
+    function build() {
+        const sections = [];
+        if (hasObjective)
+            sections.push(`### Objective\n${checkpoint.objective}`);
+        for (const key of ["decisions", "constraints", "openItems", "nextActions"]) {
+            const list = pins[key];
+            if (list.length > 0)
+                sections.push(`### ${PIN_SECTION_TITLES[key]}\n${list.map((pin) => `- ${pin.text}`).join("\n")}`);
+        }
+        if (sections.length === 0)
+            return "";
+        return `${[HEADER, "", `Execution: \`${checkpoint.executionId}\``, "", sections.join("\n\n"), "", FOOTER].join("\n")}\n`;
+    }
+    let guard = 0;
+    while (byteLength(build()) > MAX_RENDERED_BYTES && guard++ < 10_000) {
+        const cut = CUT_ORDER.find((key) => (key === "objective" ? hasObjective : pins[key].length > 0));
+        if (cut === undefined)
+            break;
+        if (cut === "objective")
+            hasObjective = false;
+        else
+            pins[cut].shift();
+    }
+    return build();
+}

package/dist/src/context/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/delegation/backend-registry.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackendRegistry = void 0;
+const types_1 = require("./types");
+const REQUIRED_METHODS = [
+    "healthCheck",
+    "spawn",
+    "status",
+    "wait",
+    "cancel",
+    "cleanup",
+];
+class BackendRegistry {
+    backends = new Map();
+    register(backend) {
+        if (!backend.name.trim())
+            throw new types_1.DelegationError("INVALID_REQUEST", "backend name cannot be empty");
+        if (this.backends.has(backend.name)) {
+            throw new types_1.DelegationError("INVALID_REQUEST", `backend \`${backend.name}\` is already registered`);
+        }
+        for (const method of REQUIRED_METHODS) {
+            if (typeof backend[method] !== "function") {
+                throw new types_1.DelegationError("INVALID_REQUEST", `backend \`${backend.name}\` is missing ${method}()`);
+            }
+        }
+        this.backends.set(backend.name, backend);
+        return this;
+    }
+    resolve(name) {
+        const backend = this.backends.get(name);
+        if (!backend) {
+            throw new types_1.DelegationError("BACKEND_UNAVAILABLE", `backend \`${name}\` is not registered (available: ${this.names().join(", ") || "none"})`);
+        }
+        return backend;
+    }
+    names() {
+        return Object.freeze([...this.backends.keys()]);
+    }
+}
+exports.BackendRegistry = BackendRegistry;

package/dist/src/delegation/delegation-service.js

@@ -0,0 +1,300 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationService = exports.FileDelegationExecutionStore = exports.InMemoryDelegationExecutionStore = void 0;
+const modes_1 = require("../agents/modes");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const types_1 = require("./types");
+function defaultIds() {
+    return {
+        request: () => `req_${(0, node_crypto_1.randomUUID)().replaceAll("-", "").slice(0, 20)}`,
+        execution: () => `exec_${(0, node_crypto_1.randomUUID)().replaceAll("-", "").slice(0, 20)}`,
+    };
+}
+function normalizeRequest(input, ids) {
+    for (const [name, value] of [
+        ["parentRole", input?.parentRole],
+        ["targetRole", input?.targetRole],
+        ["task", input?.task],
+        ["workspace", input?.workspace],
+    ]) {
+        if (typeof value !== "string" || !value.trim()) {
+            throw new types_1.DelegationError("INVALID_REQUEST", `delegation request requires ${name}`);
+        }
+    }
+    const timeoutMs = input.executionOptions?.timeoutMs ?? null;
+    if (timeoutMs !== null && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+        throw new types_1.DelegationError("INVALID_REQUEST", "timeoutMs must be positive");
+    }
+    return Object.freeze({
+        requestId: input.requestId?.trim() || ids.request(),
+        parentRole: input.parentRole.trim(),
+        parentExecutionId: input.parentExecutionId?.trim() || null,
+        targetRole: input.targetRole.trim(),
+        task: input.task.trim(),
+        workspace: input.workspace,
+        workspaceMode: input.workspaceMode ?? "read-only",
+        metadata: Object.freeze({ ...(input.metadata ?? {}) }),
+        executionOptions: Object.freeze({
+            background: Boolean(input.executionOptions?.background),
+            interactive: Boolean(input.executionOptions?.interactive),
+            timeoutMs,
+        }),
+    });
+}
+async function removeTemporaryFiles(spec) {
+    await Promise.all(spec.temporaryFiles.map((file) => (0, promises_1.rm)(file, { force: true })));
+}
+class InMemoryDelegationExecutionStore {
+    records = new Map();
+    put(record) {
+        if (this.records.has(record.executionId))
+            throw new Error(`duplicate execution \`${record.executionId}\``);
+        this.records.set(record.executionId, Object.freeze({ ...record }));
+    }
+    get(executionId) {
+        return this.records.get(executionId) ?? null;
+    }
+    update(executionId, patch) {
+        const current = this.records.get(executionId);
+        if (!current)
+            throw new types_1.DelegationError("EXECUTION_NOT_FOUND", `execution \`${executionId}\` does not exist`);
+        this.records.set(executionId, Object.freeze({ ...current, ...patch }));
+    }
+    list() {
+        return Object.freeze([...this.records.values()]);
+    }
+}
+exports.InMemoryDelegationExecutionStore = InMemoryDelegationExecutionStore;
+class FileDelegationExecutionStore {
+    file;
+    constructor(options) {
+        this.file = options.file;
+    }
+    put(record) {
+        const records = this.read();
+        if (records.some((entry) => entry.executionId === record.executionId)) {
+            throw new Error(`duplicate execution \`${record.executionId}\``);
+        }
+        records.push(Object.freeze({ ...record }));
+        this.write(records);
+    }
+    get(executionId) {
+        return this.read().find((record) => record.executionId === executionId) ?? null;
+    }
+    update(executionId, patch) {
+        const records = this.read();
+        const index = records.findIndex((record) => record.executionId === executionId);
+        if (index < 0)
+            throw new types_1.DelegationError("EXECUTION_NOT_FOUND", `execution \`${executionId}\` does not exist`);
+        records[index] = Object.freeze({ ...records[index], ...patch });
+        this.write(records);
+    }
+    list() {
+        return Object.freeze(this.read());
+    }
+    read() {
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)(this.file, "utf8"));
+            if (parsed.version !== 1 || !Array.isArray(parsed.executions))
+                throw new Error("invalid delegation execution store");
+            return parsed.executions.map((record) => Object.freeze({ ...record }));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+    }
+    write(records) {
+        const directory = (0, node_path_1.dirname)(this.file);
+        (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+        (0, node_fs_1.chmodSync)(directory, 0o700);
+        const temporary = (0, node_path_1.join)(directory, `.${(0, node_crypto_1.randomUUID)()}.executions.tmp`);
+        try {
+            (0, node_fs_1.writeFileSync)(temporary, `${JSON.stringify({ version: 1, executions: records }, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            (0, node_fs_1.renameSync)(temporary, this.file);
+            (0, node_fs_1.chmodSync)(this.file, 0o600);
+        }
+        finally {
+            (0, node_fs_1.rmSync)(temporary, { force: true });
+        }
+    }
+}
+exports.FileDelegationExecutionStore = FileDelegationExecutionStore;
+class DelegationService {
+    config;
+    registry;
+    policy;
+    memory;
+    executionService;
+    runtimeAdapters;
+    backend;
+    executionStore;
+    ids;
+    now;
+    constructor(options) {
+        this.registry = options.registry;
+        this.policy = options.policy;
+        this.memory = options.memory;
+        this.executionService = options.executionService;
+        this.runtimeAdapters = options.runtimeAdapters;
+        this.backend = options.backend;
+        this.executionStore = options.executionStore;
+        this.config = options.config;
+        this.ids = options.ids ?? defaultIds();
+        this.now = options.now ?? (() => new Date());
+    }
+    async prepare(input) {
+        const request = normalizeRequest(input, this.ids);
+        const executionId = this.ids.execution();
+        // ExecutionService owns the deny-first ordering and is deliberately invoked before
+        // runtime lookup, backend health, launch translation, or execution tracking.
+        const execution = await this.executionService.prepare({
+            executionId,
+            parent: request.parentRole,
+            target: request.targetRole,
+            task: request.task,
+            workspace: request.workspace,
+            workspaceMode: request.workspaceMode,
+            ...(this.config.mode === undefined ? {} : { mode: this.config.mode }),
+            memoryQueries: [],
+            characterBudget: 0,
+            invariantContext: "ALP execution policy is authoritative and fails closed.",
+            policyContext: "Use only the tools and workspace granted by the immutable execution snapshot.",
+        });
+        void this.policy;
+        void this.memory;
+        const definition = this.registry.get(request.targetRole);
+        const mode = this.config.mode ?? modes_1.DEFAULT_MODE;
+        // Nấc ghim một model cho vai đích, và model quyết định CLI — không còn ai chọn runtime
+        // rồi mới tra model, nên một nấc có thể phóng hai CLI khác nhau cho hai vai khác nhau.
+        const runtime = (0, modes_1.runtimeForMode)(definition, mode);
+        const adapter = this.runtimeAdapters.get(runtime);
+        if (!adapter) {
+            throw new types_1.DelegationError("RUNTIME_UNAVAILABLE", `runtime \`${runtime}\` is not registered`);
+        }
+        const launchSpec = await adapter.prepare({
+            execution,
+            model: (0, modes_1.modelForMode)(definition, mode),
+            reasoningEffort: (0, modes_1.reasoningEffortForMode)(definition, mode),
+            interactive: request.executionOptions.interactive,
+        });
+        return Object.freeze({ request, executionId, execution, runtime, launchSpec, backend: this.backend });
+    }
+    async delegate(input) {
+        const prepared = await this.prepare(input);
+        const { request, executionId, execution, runtime, launchSpec, backend } = prepared;
+        // Preconditions, after authorization and before the execution record exists. The backend
+        // registry used to health-check as part of picking a backend; with one backend there is
+        // nothing to pick, but the question it answered still needs asking — otherwise a machine
+        // with no runtime installed fails inside `spawn` as a bare ENOENT, and the execution is
+        // recorded as `failed` for a reason that names a path instead of the missing CLI.
+        const health = await backend.healthCheck();
+        if (!health.ok) {
+            await removeTemporaryFiles(launchSpec).catch(() => undefined);
+            throw new types_1.DelegationError("BACKEND_UNAVAILABLE", health.message);
+        }
+        this.executionStore.put({
+            executionId,
+            requestId: request.requestId,
+            parentExecutionId: request.parentExecutionId,
+            parentRole: request.parentRole,
+            targetRole: request.targetRole,
+            workspace: execution.policy.workspace,
+            runtime,
+            backend: backend.name,
+            createdAt: this.now().toISOString(),
+            status: "queued",
+            executionStateFile: execution.artifacts.stateFile,
+        });
+        try {
+            const spawned = await backend.spawn({
+                executionId,
+                launchSpec,
+                lifecycle: {
+                    requestId: request.requestId,
+                    parentExecutionId: request.parentExecutionId,
+                    background: request.executionOptions.background,
+                    interactive: request.executionOptions.interactive,
+                    timeoutMs: request.executionOptions.timeoutMs,
+                },
+            });
+            this.executionStore.update(executionId, { status: spawned.status });
+            return this.result(this.executionStore.get(executionId), spawned);
+        }
+        catch (error) {
+            this.executionStore.update(executionId, {
+                status: "failed",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            await removeTemporaryFiles(launchSpec).catch(() => undefined);
+            throw error;
+        }
+    }
+    async status(executionId) {
+        const record = this.record(executionId);
+        const value = await this.backend.status(executionId);
+        const result = this.result(record, value);
+        this.executionStore.update(executionId, { status: result.status });
+        return result;
+    }
+    async wait(executionId, options = {}) {
+        const record = this.record(executionId);
+        const value = await this.backend.wait(executionId, options);
+        const result = this.result(record, value);
+        this.executionStore.update(executionId, { status: result.status });
+        return result;
+    }
+    async cancel(executionId) {
+        const record = this.record(executionId);
+        const value = await this.backend.cancel(executionId);
+        this.executionStore.update(executionId, { status: value.status });
+        return this.result(this.record(executionId), value);
+    }
+    async cleanup(executionId) {
+        const record = this.record(executionId);
+        await this.backend.cleanup(executionId);
+        return this.result(record, { executionId, status: record.status });
+    }
+    listExecutions() {
+        return this.executionStore.list();
+    }
+    record(executionId) {
+        const record = this.executionStore.get(executionId);
+        if (!record)
+            throw new types_1.DelegationError("EXECUTION_NOT_FOUND", `execution \`${executionId}\` does not exist`);
+        return record;
+    }
+    result(record, value) {
+        let status = value.status;
+        let output = value.output;
+        if (["completed", "failed", "cancelled"].includes(value.status) && record.executionStateFile) {
+            try {
+                const state = JSON.parse((0, node_fs_1.readFileSync)(record.executionStateFile, "utf8"));
+                if (["completed", "failed", "cancelled"].includes(String(state.status))) {
+                    status = state.status;
+                }
+                // Roles answer in prose, so the common case is already a string. Wrapping it in
+                // JSON would hand the caller an escaped blob instead of the report.
+                if (state.output !== undefined) {
+                    output = typeof state.output === "string" ? state.output : JSON.stringify(state.output);
+                }
+            }
+            catch { /* backend result remains authoritative when state is unavailable */ }
+        }
+        return Object.freeze({
+            executionId: record.executionId,
+            requestId: record.requestId,
+            status,
+            ...(output === undefined ? {} : { output }),
+            ...(value.exitCode === undefined ? {} : { exitCode: value.exitCode }),
+            ...(value.signal === undefined ? {} : { signal: value.signal }),
+            ...(value.error === undefined ? {} : { error: value.error }),
+            metadata: Object.freeze({ ...(value.metadata ?? {}), backend: record.backend, runtime: record.runtime }),
+        });
+    }
+}
+exports.DelegationService = DelegationService;

package/dist/src/delegation/types.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationError = void 0;
+class DelegationError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "DelegationError";
+        this.code = code;
+    }
+}
+exports.DelegationError = DelegationError;

package/dist/src/execution/execution-policy.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashAgentDefinition = hashAgentDefinition;
+exports.createExecutionPolicy = createExecutionPolicy;
+const node_crypto_1 = require("node:crypto");
+const capability_catalog_1 = require("../agents/capability-catalog");
+const modes_1 = require("../agents/modes");
+const types_1 = require("../agents/types");
+const types_2 = require("./types");
+function canonicalize(value) {
+    if (typeof value === "function")
+        return value.toString();
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, canonicalize(child)]));
+    }
+    return value;
+}
+function sha256(value) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(JSON.stringify(canonicalize(value)))
+        .digest("hex");
+}
+/**
+ * The declared budget with one entry per runtime, present or not. Normalised in one place so
+ * the hash cannot move just because a definition spelled the same budget with a key missing
+ * rather than set to nothing.
+ */
+function declaredAutoCompactTokens(definition) {
+    return Object.fromEntries(types_1.RUNTIME_IDS.map((runtime) => [runtime, definition.autoCompactTokens?.[runtime] ?? null]));
+}
+function hashAgentDefinition(definition) {
+    return sha256({
+        id: definition.id,
+        displayName: definition.displayName,
+        model: definition.model,
+        reasoningEffort: definition.reasoningEffort,
+        reportsTo: definition.reportsTo,
+        delegatesTo: definition.delegatesTo,
+        capabilities: definition.capabilities,
+        autoCompactTokens: declaredAutoCompactTokens(definition),
+        instructions: definition.instructions,
+        workflow: definition.workflow,
+        output: {
+            name: definition.output.name,
+            schema: definition.output.schema,
+            validate: definition.output.validate,
+        },
+    });
+}
+function createExecutionPolicy(input) {
+    const definitionHash = hashAgentDefinition(input.definition);
+    const catalog = input.catalog ?? capability_catalog_1.capabilityCatalog;
+    const capabilities = input.definition.capabilities;
+    // Names were checked against this catalog at registry load; a miss here would mean the
+    // catalog changed underneath a definition, and an execution is not the place to find out.
+    const resolve = (kind, names, entries) => names.map((name) => {
+        const entry = entries[name];
+        if (entry === undefined) {
+            throw new Error(`unknown ${kind} \`${name}\` granted to \`${input.definition.id}\``);
+        }
+        return { name, ...entry };
+    });
+    const snapshot = {
+        executionId: input.executionId,
+        role: input.definition.id,
+        workspace: input.workspace,
+        workspaceMode: input.workspaceMode,
+        // Trong snapshot chứ không trong `definitionHash`: nấc là lựa chọn lúc phóng, không phải
+        // một vai khác. Definition không đổi, execution thì có.
+        mode: input.mode ?? modes_1.DEFAULT_MODE,
+        workspaceAccess: input.definition.capabilities.workspace.readRoots.length > 0
+            ? "granted"
+            : "none",
+        allowedTools: [...capabilities.tools],
+        skills: [...capabilities.skills],
+        subagents: resolve("subagent", capabilities.subagents, catalog.subagents),
+        mcpServers: resolve("mcp server", capabilities.mcpServers, catalog.mcpServers),
+        autoCompactTokens: declaredAutoCompactTokens(input.definition),
+        memory: {
+            read: [...input.definition.capabilities.memory.read],
+            write: [...input.definition.capabilities.memory.write],
+        },
+        delegatesTo: [...input.definition.delegatesTo],
+        createdAt: input.createdAt,
+        definitionHash,
+    };
+    return (0, types_2.deepFreezeExecutionValue)({
+        ...snapshot,
+        policyHash: sha256(snapshot),
+    });
+}

package/dist/src/execution/execution-service.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionService = void 0;
+const promises_1 = require("node:fs/promises");
+const checkpoint_1 = require("../context/checkpoint");
+const continuity_1 = require("../context/continuity");
+const adapter_files_1 = require("../runtime/adapter-files");
+const execution_policy_1 = require("./execution-policy");
+const identity_capsule_1 = require("./identity-capsule");
+const types_1 = require("./types");
+function requireAuthorization(kind, authorization) {
+    if (!authorization.allowed) {
+        throw new Error(`${kind} authorization failed (${authorization.code}): ${authorization.reason}`);
+    }
+}
+class ExecutionService {
+    registry;
+    policy;
+    memory;
+    workflowRunner;
+    store;
+    resolveWorkspace;
+    now;
+    constructor(options) {
+        this.registry = options.registry;
+        this.policy = options.policy;
+        this.memory = options.memory;
+        this.workflowRunner = options.workflowRunner;
+        this.store = options.store;
+        this.resolveWorkspace = options.resolveWorkspace ?? promises_1.realpath;
+        this.now = options.now ?? (() => new Date());
+    }
+    async prepare(input) {
+        let parent = input.parent;
+        if (parent !== "principal") {
+            parent = this.registry.get(parent).id;
+        }
+        const definition = this.registry.get(input.target);
+        if (parent === "principal") {
+            if (definition.reportsTo !== "principal") {
+                throw new Error(`delegation authorization failed: \`${definition.id}\` does not report to principal`);
+            }
+        }
+        else {
+            requireAuthorization("delegation", this.policy.authorize({
+                type: "delegation",
+                actor: parent,
+                target: definition.id,
+            }));
+        }
+        const workspace = await this.resolveWorkspace(input.workspace);
+        // A role that declares no workspace root (read-thread, compaction, titling) reads memory,
+        // not the tree: there is no path for policy to authorize, and asking about one could only
+        // ever come back WORKSPACE_NOT_GRANTED — which is why those three could not be launched
+        // at all. A *write* request is still asked, because that is a grant they genuinely lack;
+        // the deny it returns is the right answer rather than an artefact of the question.
+        const grantsWorkspace = definition.capabilities.workspace.readRoots.length > 0;
+        if (grantsWorkspace || input.workspaceMode === "workspace-write") {
+            requireAuthorization("workspace", this.policy.authorize({
+                type: "workspace",
+                actor: definition.id,
+                operation: input.workspaceMode === "workspace-write" ? "write" : "read",
+                path: workspace,
+                execution: {
+                    activeWorkspace: workspace,
+                    workspaceMode: input.workspaceMode,
+                    delegated: parent !== "principal",
+                },
+            }));
+        }
+        const memoryContext = await this.memory.buildContext({
+            actor: definition.id,
+            queries: input.memoryQueries,
+            characterBudget: input.characterBudget,
+            invariantContext: input.invariantContext,
+            policyContext: input.policyContext,
+        });
+        const workflowState = this.workflowRunner.initialize(definition.workflow);
+        const createdAt = this.now().toISOString();
+        const policy = (0, execution_policy_1.createExecutionPolicy)({
+            executionId: input.executionId,
+            definition,
+            workspace,
+            workspaceMode: input.workspaceMode,
+            ...(input.mode === undefined ? {} : { mode: input.mode }),
+            createdAt,
+        });
+        const capsule = (0, identity_capsule_1.createIdentityCapsule)({
+            definition,
+            policy,
+            task: input.task,
+            memoryContext,
+            workflowState,
+        });
+        const state = (0, types_1.deepFreezeExecutionValue)({
+            executionId: input.executionId,
+            status: "prepared",
+            workflow: { ...workflowState },
+            policyHash: policy.policyHash,
+            createdAt,
+        });
+        const artifacts = await this.store.create({ policy, state });
+        // §8.1: seed the checkpoint here, not lazily on first pin, so a fresh execution's
+        // continuity is never empty by omission — the objective alone is worth reinjecting.
+        const checkpoint = await (0, checkpoint_1.writeCheckpoint)(artifacts.checkpointFile, (0, checkpoint_1.seedCheckpoint)({
+            executionId: input.executionId,
+            policyHash: policy.policyHash,
+            objective: capsule.task,
+            now: () => createdAt,
+        }));
+        await (0, adapter_files_1.atomicRuntimeFile)(artifacts.continuityFile, (0, continuity_1.renderContinuity)(checkpoint));
+        return (0, types_1.deepFreezeExecutionValue)({ capsule, policy, state, artifacts });
+    }
+}
+exports.ExecutionService = ExecutionService;