baselineos 0.2.0-beta.1

package/dist/core/orchestrator.js

@@ -0,0 +1,1297 @@
+import { EventEmitter } from 'eventemitter3';
+import { randomUUID } from 'crypto';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { trace, metrics, SpanKind, SpanStatusCode } from '@opentelemetry/api';
+import '@opentelemetry/sdk-node';
+import '@opentelemetry/exporter-trace-otlp-http';
+import '@opentelemetry/resources';
+import '@opentelemetry/semantic-conventions';
+import { z } from 'zod';
+import { Queue, Worker } from 'bullmq';
+
+// src/core/orchestrator.ts
+var tracer = new Proxy({}, {
+  get(_target, prop) {
+    return trace.getTracer("baselineos", "0.2.0-beta.1")[prop];
+  }
+});
+async function withSpan(name, attributes, fn) {
+  return tracer.startActiveSpan(name, { kind: SpanKind.INTERNAL, attributes }, async (span) => {
+    try {
+      const result = await fn(span);
+      span.setStatus({ code: SpanStatusCode.OK });
+      return result;
+    } catch (err) {
+      span.recordException(err);
+      span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
+      throw err;
+    } finally {
+      span.end();
+    }
+  });
+}
+var TaskInputSchema = z.object({
+  title: z.string().min(1),
+  description: z.string().min(1),
+  priority: z.enum(["critical", "high", "medium", "low"]).default("medium"),
+  requiredCapabilities: z.array(z.string()).default([]),
+  acceptanceCriteria: z.array(z.object({
+    description: z.string(),
+    type: z.enum(["automated", "agent-review", "human-review"]).default("automated"),
+    weight: z.number().min(0).max(1).default(1)
+  })).default([]),
+  context: z.record(z.unknown()).default({})
+});
+var PiiBlockedError = class extends Error {
+  constructor(types) {
+    super(`PII detected in prompt \u2014 blocked: ${types.join(", ")}`);
+    this.types = types;
+    this.name = "PiiBlockedError";
+  }
+};
+var PRIORITY_MAP = {
+  critical: 1,
+  high: 2,
+  medium: 5,
+  low: 10
+};
+var TaskQueue = class {
+  queue;
+  worker;
+  queueName;
+  /**
+   * @param executor  Called by the worker when a job is dequeued.
+   *                  Receives the taskId. Should call Orchestrator.dispatchExecution().
+   * @param config    Queue configuration.
+   */
+  constructor(executor, config = {}) {
+    this.queueName = config.queueName ?? "baseline-tasks";
+    const redisUrl = config.redisUrl ?? process.env["BASELINE_REDIS_URL"] ?? "redis://localhost:6379";
+    const connection = this.parseRedisUrl(redisUrl);
+    const attempts = config.attempts ?? 3;
+    const backoffDelay = config.backoffDelay ?? 2e3;
+    this.queue = new Queue(this.queueName, {
+      connection,
+      defaultJobOptions: {
+        attempts,
+        backoff: { type: "exponential", delay: backoffDelay },
+        removeOnComplete: { count: 500 },
+        removeOnFail: { count: 200 }
+      }
+    });
+    this.worker = new Worker(
+      this.queueName,
+      async (job) => {
+        await executor(job.data.taskId);
+      },
+      {
+        connection,
+        concurrency: config.concurrency ?? 5
+      }
+    );
+    this.worker.on("failed", (job, err) => {
+      console.warn(`[TaskQueue] Job ${job?.id ?? "?"} (task ${job?.data.taskId ?? "?"}) failed: ${err.message}`);
+    });
+  }
+  /**
+   * Enqueue a task for execution.
+   * Uses taskId as jobId — duplicate enqueues are silently ignored.
+   */
+  async enqueue(taskId, priority) {
+    await this.queue.add(
+      "execute",
+      { taskId },
+      {
+        jobId: taskId,
+        priority: PRIORITY_MAP[priority]
+      }
+    );
+  }
+  /**
+   * Queue statistics — useful for health checks and dashboards.
+   */
+  async getStats() {
+    const [waiting, active, completed, failed, delayed] = await Promise.all([
+      this.queue.getWaitingCount(),
+      this.queue.getActiveCount(),
+      this.queue.getCompletedCount(),
+      this.queue.getFailedCount(),
+      this.queue.getDelayedCount()
+    ]);
+    return { waiting, active, completed, failed, delayed };
+  }
+  /** Gracefully close queue and worker connections. */
+  async close() {
+    await this.worker.close();
+    await this.queue.close();
+  }
+  // ─── Internal ──────────────────────────────────────────────────────────────
+  parseRedisUrl(url) {
+    try {
+      const u = new URL(url);
+      const config = {
+        host: u.hostname || "localhost",
+        port: u.port ? parseInt(u.port, 10) : 6379,
+        username: u.username || void 0,
+        password: u.password || void 0
+      };
+      if (u.pathname && u.pathname !== "/") {
+        config["db"] = parseInt(u.pathname.slice(1), 10);
+      }
+      return config;
+    } catch {
+      return { host: "localhost", port: 6379 };
+    }
+  }
+};
+
+// src/core/orchestrator.ts
+var DEFAULT_CONFIG = {
+  maxAutonomousComplexity: "complex",
+  selfVerificationRequired: true,
+  supervisorReviewThreshold: 0.7,
+  qualityReviewSampleRate: 0.1,
+  defaultTrustScore: 70,
+  defaultMaxAttempts: 3,
+  maxTokensPerTask: 1e5,
+  maxConcurrentAgents: 10,
+  trustGrowthRate: 0.02,
+  trustDecayRate: 0.05,
+  trustMinimum: 30
+};
+var COMPLEXITY_ORDER = ["trivial", "simple", "moderate", "complex", "epic"];
+function complexityToNumber(c) {
+  return COMPLEXITY_ORDER.indexOf(c);
+}
+var Orchestrator = class extends EventEmitter {
+  config;
+  tasks;
+  agents;
+  disabledWorkflows;
+  checkpoints;
+  reviews;
+  plans;
+  workflows;
+  auditByTask;
+  auditGlobal;
+  taskQueue;
+  auditLog;
+  constructor(config = {}) {
+    super();
+    this.config = { ...DEFAULT_CONFIG, ...config };
+    this.tasks = /* @__PURE__ */ new Map();
+    this.agents = /* @__PURE__ */ new Map();
+    this.checkpoints = /* @__PURE__ */ new Map();
+    this.reviews = /* @__PURE__ */ new Map();
+    this.plans = /* @__PURE__ */ new Map();
+    this.workflows = /* @__PURE__ */ new Map();
+    this.auditByTask = /* @__PURE__ */ new Map();
+    this.auditGlobal = [];
+    this.disabledWorkflows = new Set(this.config.disabledWorkflows ?? []);
+    if (this.config.taskQueueConfig) {
+      this.taskQueue = new TaskQueue(
+        async (taskId) => {
+          await this.dispatchExecution(taskId);
+        },
+        this.config.taskQueueConfig
+      );
+    }
+    if (this.config.auditLog) {
+      this.auditLog = this.config.auditLog;
+    }
+    if (Array.isArray(this.config.workflows)) {
+      for (const workflow of this.config.workflows) {
+        this.registerWorkflow(workflow);
+      }
+    }
+    this.attachAuditListeners();
+  }
+  // ─── Task Management ─────────────────────────────────────────────────────────
+  async createTask(input) {
+    const validated = TaskInputSchema.parse(input);
+    const task = {
+      id: randomUUID(),
+      title: validated.title,
+      description: validated.description,
+      status: "pending",
+      priority: validated.priority,
+      complexity: this.assessComplexity(validated),
+      subtasks: [],
+      dependencies: [],
+      requiredCapabilities: validated.requiredCapabilities,
+      attempts: 0,
+      maxAttempts: this.config.defaultMaxAttempts,
+      acceptanceCriteria: validated.acceptanceCriteria.map((ac, i) => ({
+        id: `ac-${i}`,
+        description: ac.description,
+        type: ac.type,
+        weight: ac.weight
+      })),
+      verificationResults: [],
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      context: validated.context,
+      artifacts: []
+    };
+    this.tasks.set(task.id, task);
+    this.emit("task:created", { type: "task:created", task });
+    if (this.requiresHumanApproval(task)) {
+      task.status = "blocked";
+      task.needsHumanReview = true;
+      return task;
+    }
+    if (this.shouldDecompose(task)) {
+      await this.decomposeTask(task);
+    }
+    return task;
+  }
+  async executeTask(taskId) {
+    const task = this.tasks.get(taskId);
+    if (!task) {
+      throw new Error(`Task not found: ${taskId}`);
+    }
+    if (task.status === "blocked" && task.needsHumanReview) {
+      throw new Error(`Task ${taskId} requires human approval before execution`);
+    }
+    if (this.config.policyGate) {
+      const bestAgent = this.selectBestAgent(task);
+      const agentId = bestAgent?.id ?? "system";
+      const trustScore = bestAgent?.trustScore ?? this.config.defaultTrustScore;
+      const gateResult = await this.config.policyGate.preExecution(task, agentId, trustScore);
+      if (gateResult.blocked) {
+        task.status = "blocked";
+        task.needsHumanReview = true;
+        task.updatedAt = Date.now();
+        const violation = gateResult.evaluations.find((e) => !e.allowed);
+        const reason = violation?.reason ?? "Policy gate denied execution";
+        const policy = violation?.policy ?? "unknown";
+        if (gateResult.approvalToken) {
+          task.context = {
+            ...task.context,
+            approvalToken: gateResult.approvalToken,
+            approvalTokenExpires: gateResult.approvalTokenExpires
+          };
+        }
+        this.emit("task:blocked", { type: "task:blocked", task, reason, policy });
+        this.emit("escalation", { type: "escalation", task, reason, escalatedTo: "human" });
+        metrics.getMeter("baselineos").createCounter("baseline_escalation_total").add(1, {
+          reason: reason ?? "unknown",
+          agent_id: task.assignedAgent ?? "unknown"
+        });
+        return task;
+      }
+    }
+    if (this.taskQueue) {
+      await this.taskQueue.enqueue(taskId, task.priority);
+      return task;
+    }
+    return this.dispatchExecution(taskId);
+  }
+  /**
+   * Core execution body — called by the BullMQ worker (or directly when no queue).
+   * Runs the full supervision loop: execute → self-verify → review → correct.
+   * Not intended to be called externally; exposed for the queue worker closure.
+   */
+  async dispatchExecution(taskId) {
+    const task = this.tasks.get(taskId);
+    if (!task) throw new Error(`Task not found: ${taskId}`);
+    task.status = "executing";
+    task.attempts++;
+    this.setFinalApprovalGate(task, "pending");
+    this.emit("task:started", { type: "task:started", task });
+    if (this.config.personaEngine) {
+      const userId = task.context?.userId ?? "system";
+      const activePersona = this.config.personaEngine.getActivePersona(userId);
+      if (activePersona) {
+        task.context = { ...task.context, persona: { id: activePersona.id, name: activePersona.name } };
+      }
+      this.config.personaEngine.learnFromBehavior(userId, {
+        type: "task_execution",
+        context: { taskId: task.id, complexity: task.complexity, priority: task.priority },
+        timestamp: /* @__PURE__ */ new Date()
+      });
+    }
+    if (this.config.layerSweep) {
+      const bestAgent = this.selectBestAgent(task);
+      const sweepResult = this.config.layerSweep.sweep({
+        taskId: task.id,
+        title: task.title,
+        description: task.description,
+        complexity: task.complexity,
+        priority: task.priority,
+        agent: bestAgent ? { id: bestAgent.id, role: bestAgent.role, trustScore: bestAgent.trustScore } : void 0
+      });
+      task.context = { ...task.context, layerSweep: sweepResult };
+      if (!sweepResult.overallPassed) {
+        const failedLayers = sweepResult.layerResults.filter((r) => !r.passed).map((r) => `${r.layerId}: ${r.checks.filter((c) => !c.passed).map((c) => c.detail).join("; ")}`).join(" | ");
+        task.status = "blocked";
+        task.needsHumanReview = true;
+        task.updatedAt = Date.now();
+        this.emit("task:blocked", { type: "task:blocked", task, reason: `Layer sweep failed: ${failedLayers}`, policy: "layer-sweep" });
+        this.emit("escalation", { type: "escalation", task, reason: `Governance layers failed: ${failedLayers}`, escalatedTo: "human" });
+        return task;
+      }
+    }
+    await withSpan("task.execute", {
+      "task.id": task.id,
+      "task.priority": task.priority,
+      "task.complexity": task.complexity,
+      "task.attempt": task.attempts
+    }, async (span) => {
+      try {
+        await this.executeWithSupervision(task);
+        const finalApprovalGate = this.getFinalApprovalGate(task);
+        if (task.needsHumanReview || finalApprovalGate !== "approved") {
+          const reason = task.context.finalGateReason ?? "Final approval gate unresolved";
+          task.status = "blocked";
+          task.needsHumanReview = true;
+          this.setFinalApprovalGate(task, "blocked", reason);
+          span.setAttribute("task.outcome", "blocked");
+          this.emit("escalation", { type: "escalation", task, reason, escalatedTo: "human" });
+          metrics.getMeter("baselineos").createCounter("baseline_escalation_total").add(1, {
+            reason: reason ?? "unknown",
+            agent_id: task.assignedAgent ?? "unknown"
+          });
+        } else {
+          task.status = "completed";
+          task.completedAt = Date.now();
+          span.setAttribute("task.outcome", "completed");
+          this.emit("task:completed", { type: "task:completed", task });
+        }
+        if (task.assignedAgent) {
+          this.updateAgentTrust(task.assignedAgent, true);
+        }
+      } catch (error) {
+        task.status = "failed";
+        this.setFinalApprovalGate(task, "blocked", "Execution failed");
+        span.setAttribute("task.outcome", "failed");
+        this.emit("task:failed", { type: "task:failed", task, error });
+        if (task.assignedAgent) {
+          this.updateAgentTrust(task.assignedAgent, false);
+        }
+      }
+    });
+    task.updatedAt = Date.now();
+    return task;
+  }
+  /**
+   * Execute task with autonomous supervision loop.
+   * This is where the AMP/Ralph magic happens.
+   */
+  async executeWithSupervision(task, startTime = Date.now()) {
+    const budget = this.getWorkflowBudget(task);
+    await this.performExecution(task, budget);
+    if (this.config.selfVerificationRequired) {
+      const selfVerifyResult = await this.selfVerify(task);
+      if (!selfVerifyResult.passed) {
+        if (task.attempts < task.maxAttempts) {
+          task.status = "correcting";
+          this.emit("task:correction-needed", {
+            type: "task:correction-needed",
+            task,
+            feedback: selfVerifyResult.details
+          });
+          task.context = {
+            ...task.context,
+            correctionFeedback: selfVerifyResult.details,
+            previousAttempt: task.attempts
+          };
+          task.attempts += 1;
+          if (budget?.maxAttempts && task.attempts > budget.maxAttempts) {
+            task.needsHumanReview = true;
+            this.setFinalApprovalGate(task, "blocked", "Workflow budget max attempts exceeded");
+            return;
+          }
+          if (budget?.maxDurationMs && Date.now() - startTime > budget.maxDurationMs) {
+            task.needsHumanReview = true;
+            this.setFinalApprovalGate(task, "blocked", "Workflow budget max duration exceeded");
+            return;
+          }
+          return this.executeWithSupervision(task, startTime);
+        }
+        task.needsHumanReview = true;
+        this.setFinalApprovalGate(task, "blocked", "Self-verification failed and max attempts exhausted");
+        task.context = {
+          ...task.context,
+          escalationReason: "Self-verification failed and max attempts exhausted",
+          lastVerificationFailure: selfVerifyResult.details
+        };
+        return;
+      }
+    }
+    const shouldReview = this.shouldTriggerSupervisorReview(task);
+    if (shouldReview) {
+      task.status = "reviewing";
+      const supervisor = this.findSupervisor(task);
+      if (supervisor) {
+        this.emit("task:review-requested", {
+          type: "task:review-requested",
+          task,
+          reviewer: supervisor
+        });
+        const review = await this.conductReview(task, supervisor);
+        this.reviews.set(review.id, review);
+        this.emit("task:reviewed", { type: "task:reviewed", task, review });
+        if (review.overallAssessment === "needs-work") {
+          if (task.attempts < task.maxAttempts) {
+            task.status = "correcting";
+            task.context = {
+              ...task.context,
+              reviewFeedback: review.feedback,
+              requiredChanges: review.requiredChanges
+            };
+            this.emit("task:correction-needed", {
+              type: "task:correction-needed",
+              task,
+              feedback: review.feedback
+            });
+            task.attempts += 1;
+            if (budget?.maxAttempts && task.attempts > budget.maxAttempts) {
+              task.needsHumanReview = true;
+              this.setFinalApprovalGate(task, "blocked", "Workflow budget max attempts exceeded");
+              return;
+            }
+            if (budget?.maxDurationMs && Date.now() - startTime > budget.maxDurationMs) {
+              task.needsHumanReview = true;
+              this.setFinalApprovalGate(task, "blocked", "Workflow budget max duration exceeded");
+              return;
+            }
+            return this.executeWithSupervision(task, startTime);
+          }
+          task.needsHumanReview = true;
+          this.setFinalApprovalGate(task, "blocked", "Supervisor requested changes and max attempts exhausted");
+          task.context = {
+            ...task.context,
+            escalationReason: "Supervisor requested changes and max attempts exhausted",
+            lastReviewFeedback: review.feedback
+          };
+          return;
+        } else if (review.overallAssessment === "rejected") {
+          const qualityAgent = this.findQualityAgent(task);
+          if (qualityAgent) {
+            const qualityReview = await this.conductReview(task, qualityAgent);
+            if (qualityReview.overallAssessment !== "approved") {
+              task.needsHumanReview = true;
+              this.setFinalApprovalGate(task, "blocked", "Quality review failed after supervisor rejection");
+              this.emit("escalation", {
+                type: "escalation",
+                task,
+                reason: "Quality review failed after supervisor rejection",
+                escalatedTo: "human"
+              });
+            }
+          } else {
+            task.needsHumanReview = true;
+            this.setFinalApprovalGate(task, "blocked", "Quality agent unavailable after supervisor rejection");
+          }
+        }
+      }
+    }
+    if (Math.random() < this.config.qualityReviewSampleRate) {
+      const qualityAgent = this.findQualityAgent(task);
+      if (qualityAgent) {
+        const qualityReview = await this.conductReview(task, qualityAgent);
+        this.reviews.set(qualityReview.id, qualityReview);
+        this.emit("task:reviewed", { type: "task:reviewed", task, review: qualityReview });
+        if (qualityReview.overallAssessment !== "approved") {
+          task.needsHumanReview = true;
+          this.setFinalApprovalGate(task, "blocked", "Quality sampling review failed");
+          task.context = {
+            ...task.context,
+            escalationReason: "Quality sampling review failed",
+            qualityReviewFeedback: qualityReview.feedback
+          };
+          this.emit("escalation", {
+            type: "escalation",
+            task,
+            reason: "Quality sampling review failed",
+            escalatedTo: "human"
+          });
+          return;
+        }
+      }
+    }
+    this.setFinalApprovalGate(task, "approved");
+  }
+  async performExecution(task, budget) {
+    return withSpan("task.perform", {
+      "task.id": task.id,
+      "task.workflow_id": task.workflowId ?? ""
+    }, async () => {
+      return this._performExecution(task, budget);
+    });
+  }
+  async _performExecution(task, budget) {
+    if (this.config.piiDetector) {
+      try {
+        const safeDescription = this.config.piiDetector.processText(task.description, task.id);
+        const safeTitle = this.config.piiDetector.processText(task.title, task.id);
+        if (safeDescription !== task.description || safeTitle !== task.title) {
+          task.context = {
+            ...task.context,
+            originalDescription: task.description,
+            originalTitle: task.title,
+            piiRedacted: true
+          };
+          task.description = safeDescription;
+          task.title = safeTitle;
+        }
+      } catch (err) {
+        if (err instanceof PiiBlockedError) {
+          task.status = "failed";
+          task.context = { ...task.context, piiBlocked: true, piiTypes: err.types };
+          task.updatedAt = Date.now();
+          throw err;
+        }
+        throw err;
+      }
+    }
+    const checkpoint = {
+      id: randomUUID(),
+      taskId: task.id,
+      state: { ...task.context },
+      artifacts: [...task.artifacts],
+      decisions: [],
+      createdBy: task.assignedAgent || "orchestrator",
+      createdAt: Date.now(),
+      description: `Before attempt ${task.attempts}`,
+      recoverable: true
+    };
+    this.checkpoints.set(checkpoint.id, checkpoint);
+    task.currentCheckpoint = checkpoint.id;
+    this.emit("task:checkpoint", { type: "task:checkpoint", task, checkpoint });
+    this.persistCheckpoint(checkpoint);
+    const engine = this.config.engine;
+    const plan = task.workflowPlanId ? this.plans.get(task.workflowPlanId) : void 0;
+    const steps = plan?.steps ?? [];
+    const maxSteps = budget?.maxSteps;
+    if (steps.length > 0) {
+      let stepCount = 0;
+      for (const step of steps) {
+        if (maxSteps && stepCount >= maxSteps) {
+          task.needsHumanReview = true;
+          this.setFinalApprovalGate(task, "blocked", "Workflow budget max steps exceeded");
+          break;
+        }
+        step.status = "executing";
+        if (engine) {
+          const result = await engine.execute(task, step);
+          step.status = "completed";
+          step.result = {
+            success: result.compliance.passed,
+            output: result.output,
+            artifacts: result.artifacts,
+            tokensUsed: result.tokensUsed,
+            duration: result.duration
+          };
+          task.artifacts.push(...result.artifacts);
+          task.actualTokens = (task.actualTokens ?? 0) + result.tokensUsed;
+          task.context = {
+            ...task.context,
+            lastOutput: result.output,
+            lastModel: result.model,
+            compliancePassed: result.compliance.passed,
+            complianceScore: result.compliance.score
+          };
+          if (!result.compliance.passed) {
+            task.context = {
+              ...task.context,
+              complianceViolations: result.compliance.violations
+            };
+          }
+        } else {
+          await new Promise((resolve) => setTimeout(resolve, 150));
+          step.status = "completed";
+          step.result = {
+            success: true,
+            output: { message: `Executed step: ${step.title}` },
+            artifacts: [],
+            tokensUsed: 0,
+            duration: 150
+          };
+        }
+        stepCount += 1;
+      }
+    } else {
+      if (engine) {
+        const result = await engine.execute(task);
+        task.artifacts.push(...result.artifacts);
+        task.actualTokens = (task.actualTokens ?? 0) + result.tokensUsed;
+        task.context = {
+          ...task.context,
+          lastOutput: result.output,
+          lastModel: result.model,
+          compliancePassed: result.compliance.passed,
+          complianceScore: result.compliance.score
+        };
+        if (!result.compliance.passed) {
+          task.context = {
+            ...task.context,
+            complianceViolations: result.compliance.violations
+          };
+        }
+      } else {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    }
+  }
+  // ─── Workflow Registry ─────────────────────────────────────────────────────
+  registerWorkflow(definition) {
+    if (!definition.id) throw new Error("Workflow must have an id");
+    this.workflows.set(definition.id, definition);
+  }
+  listWorkflows() {
+    return Array.from(this.workflows.values());
+  }
+  getWorkflow(id) {
+    return this.workflows.get(id);
+  }
+  /** Disable a workflow type (kill switch). Persists for the lifetime of this Orchestrator instance. */
+  disableWorkflow(workflowId) {
+    this.disabledWorkflows.add(workflowId);
+    this.config.bus?.broadcast("system", "system:workflow-disabled", { workflowId }, "high");
+  }
+  /** Re-enable a previously disabled workflow. */
+  enableWorkflow(workflowId) {
+    this.disabledWorkflows.delete(workflowId);
+    this.config.bus?.broadcast("system", "system:workflow-enabled", { workflowId }, "normal");
+  }
+  /** Returns the set of currently disabled workflow IDs. */
+  getDisabledWorkflows() {
+    return Array.from(this.disabledWorkflows);
+  }
+  async createTaskFromWorkflow(workflowId, input = {}) {
+    if (this.disabledWorkflows.has(workflowId)) {
+      throw new Error(`Workflow '${workflowId}' is disabled (kill switch active). Enable it via orchestrator.enableWorkflow('${workflowId}') before creating tasks.`);
+    }
+    const workflow = this.getWorkflow(workflowId);
+    if (!workflow) {
+      throw new Error(`Workflow not found: ${workflowId}`);
+    }
+    const task = await this.createTask({
+      title: input.title ?? workflow.name,
+      description: input.description ?? workflow.description ?? workflow.name,
+      priority: input.priority ?? "medium",
+      requiredCapabilities: input.requiredCapabilities ?? workflow.requiredCapabilities ?? [],
+      acceptanceCriteria: input.acceptanceCriteria ?? [],
+      context: {
+        ...input.context ?? {},
+        workflowId: workflow.id
+      }
+    });
+    task.workflowId = workflow.id;
+    const plan = this.createExecutionPlanForWorkflow(task, workflow);
+    task.workflowPlanId = plan.id;
+    this.plans.set(plan.id, plan);
+    if (workflow.budget?.maxAttempts) {
+      task.maxAttempts = workflow.budget.maxAttempts;
+    }
+    return task;
+  }
+  async executeWorkflow(workflowId, input = {}) {
+    const task = await this.createTaskFromWorkflow(workflowId, input);
+    return this.executeTask(task.id);
+  }
+  createExecutionPlanForWorkflow(task, workflow) {
+    const steps = workflow.steps.map((step) => ({
+      id: step.id,
+      title: step.title,
+      description: step.description,
+      action: step.action,
+      dependencies: [],
+      status: "pending",
+      verificationCriteria: step.verificationCriteria ?? []
+    }));
+    return {
+      id: `plan-${task.id}`,
+      taskId: task.id,
+      steps,
+      estimatedTokens: 0,
+      estimatedDuration: 0,
+      riskAssessment: [],
+      createdAt: Date.now()
+    };
+  }
+  getWorkflowBudget(task) {
+    if (task.workflowId) {
+      return this.workflows.get(task.workflowId)?.budget;
+    }
+    return void 0;
+  }
+  // ─── Checkpoint Persistence + Recovery ─────────────────────────────────────
+  persistCheckpoint(checkpoint) {
+    const base = this.config.checkpointsPath ?? ".baseline/checkpoints";
+    try {
+      if (!existsSync(base)) {
+        mkdirSync(base, { recursive: true });
+      }
+      const file = join(base, `${checkpoint.id}.json`);
+      writeFileSync(file, JSON.stringify(checkpoint, null, 2));
+    } catch (err) {
+      process.stderr.write(`[baseline:orchestrator] Checkpoint persist failed: ${err.message}
+`);
+    }
+  }
+  loadCheckpoint(checkpointId) {
+    const base = this.config.checkpointsPath ?? ".baseline/checkpoints";
+    const file = join(base, `${checkpointId}.json`);
+    if (!existsSync(file)) return null;
+    try {
+      const raw = JSON.parse(readFileSync(file, "utf-8"));
+      return raw;
+    } catch (err) {
+      process.stderr.write(`[baseline:orchestrator] Checkpoint load failed for ${checkpointId}: ${err.message}
+`);
+      return null;
+    }
+  }
+  recoverTaskFromCheckpoint(checkpointId) {
+    const checkpoint = this.loadCheckpoint(checkpointId);
+    if (!checkpoint) return null;
+    const existing = this.tasks.get(checkpoint.taskId);
+    if (existing) {
+      existing.context = { ...checkpoint.state };
+      existing.status = "pending";
+      existing.currentCheckpoint = checkpoint.id;
+      this.tasks.set(existing.id, existing);
+      return existing;
+    }
+    const recovered = {
+      id: checkpoint.taskId,
+      title: "Recovered Task",
+      description: checkpoint.description,
+      status: "pending",
+      priority: "medium",
+      complexity: "moderate",
+      subtasks: [],
+      dependencies: [],
+      requiredCapabilities: [],
+      attempts: 0,
+      maxAttempts: this.config.defaultMaxAttempts,
+      acceptanceCriteria: [],
+      verificationResults: [],
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      context: { ...checkpoint.state },
+      artifacts: checkpoint.artifacts ?? [],
+      currentCheckpoint: checkpoint.id
+    };
+    this.tasks.set(recovered.id, recovered);
+    return recovered;
+  }
+  async selfVerify(task) {
+    return withSpan("task.self_verify", { "task.id": task.id }, async () => {
+      return this._selfVerify(task);
+    });
+  }
+  async _selfVerify(task) {
+    const engine = this.config.engine;
+    const output = task.context.lastOutput ?? "";
+    let result;
+    if (engine && output) {
+      result = await engine.selfVerify(task, output);
+    } else {
+      result = {
+        criterionId: "self-verify",
+        passed: true,
+        confidence: 0.85,
+        details: "Self-verification passed (mock)",
+        verifiedBy: task.assignedAgent || "orchestrator",
+        verifiedAt: Date.now()
+      };
+    }
+    task.verificationResults.push(result);
+    this.emit("task:verified", { type: "task:verified", task, result });
+    return result;
+  }
+  shouldTriggerSupervisorReview(task) {
+    const avgConfidence = task.verificationResults.length > 0 ? task.verificationResults.reduce((sum, r) => sum + r.confidence, 0) / task.verificationResults.length : 0.5;
+    if (avgConfidence < this.config.supervisorReviewThreshold) {
+      return true;
+    }
+    if (task.priority === "critical") {
+      return true;
+    }
+    return Math.random() < this.config.qualityReviewSampleRate;
+  }
+  async conductReview(task, reviewer) {
+    return withSpan("task.review", {
+      "task.id": task.id,
+      "reviewer.id": reviewer.id,
+      "reviewer.role": reviewer.role
+    }, async () => {
+      return this._conductReview(task, reviewer);
+    });
+  }
+  async _conductReview(task, reviewer) {
+    const engine = this.config.engine;
+    const output = task.context.lastOutput ?? "";
+    const reviewType = reviewer.role === "supervisor" ? "supervisor" : "quality";
+    if (engine && output) {
+      const review = await engine.conductReview(task, output, reviewType);
+      review.reviewerId = reviewer.id;
+      review.revieweeId = task.assignedAgent || "unknown";
+      return review;
+    }
+    return {
+      id: randomUUID(),
+      taskId: task.id,
+      reviewerId: reviewer.id,
+      revieweeId: task.assignedAgent || "unknown",
+      type: reviewType,
+      scope: "full",
+      findings: [],
+      overallAssessment: "approved",
+      confidence: 0.9,
+      feedback: "Review completed successfully (mock)",
+      suggestions: [],
+      requiredChanges: [],
+      createdAt: Date.now(),
+      completedAt: Date.now(),
+      timeSpent: 100
+    };
+  }
+  findSupervisor(_task) {
+    return Array.from(this.agents.values()).find(
+      (a) => a.role === "supervisor" && a.status === "idle"
+    );
+  }
+  findQualityAgent(_task) {
+    return Array.from(this.agents.values()).find(
+      (a) => a.role === "quality" && a.status === "idle"
+    );
+  }
+  getTask(taskId) {
+    return this.tasks.get(taskId);
+  }
+  /**
+   * Approve a blocked task, optionally recording who approved it.
+   * When BASELINE_APPROVAL_SECRET is set, approvalToken must match the
+   * HMAC token issued when the task was blocked (SIGNAL-017).
+   */
+  async approveTask(taskId, approvedBy = "human", approvalToken) {
+    const task = this.tasks.get(taskId);
+    if (!task) {
+      throw new Error(`Task not found: ${taskId}`);
+    }
+    if (task.status !== "blocked") {
+      throw new Error(`Task ${taskId} is not blocked (status: ${task.status})`);
+    }
+    const approvalSecret = process.env["BASELINE_APPROVAL_SECRET"];
+    if (approvalSecret) {
+      const storedToken = task.context.approvalToken;
+      const tokenExpires = task.context.approvalTokenExpires;
+      if (!approvalToken) {
+        throw new Error(`Approval token required \u2014 set BASELINE_APPROVAL_SECRET is active`);
+      }
+      if (!storedToken) {
+        throw new Error(`No approval token on file for task ${taskId}`);
+      }
+      if (tokenExpires && Date.now() > tokenExpires) {
+        throw new Error(`Approval token expired for task ${taskId}`);
+      }
+      const { timingSafeEqual } = await import('crypto');
+      const expected = Buffer.from(storedToken);
+      const received = Buffer.from(approvalToken);
+      if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
+        throw new Error(`Invalid approval token for task ${taskId}`);
+      }
+    }
+    task.needsHumanReview = false;
+    task.status = "pending";
+    task.updatedAt = Date.now();
+    task.context = {
+      ...task.context,
+      approvedBy,
+      approvedAt: Date.now(),
+      finalApprovalGate: void 0,
+      approvalToken: void 0,
+      // one-time use — invalidate after approval
+      approvalTokenExpires: void 0
+    };
+    this.emit("task:approved", { type: "task:approved", task, approvedBy });
+    return this.executeTask(taskId);
+  }
+  cancelTask(taskId, reason = "Cancelled by user") {
+    const task = this.tasks.get(taskId);
+    if (!task) return false;
+    if (task.status === "completed" || task.status === "failed") {
+      return false;
+    }
+    task.status = "failed";
+    task.updatedAt = Date.now();
+    task.context = {
+      ...task.context,
+      cancelled: true,
+      cancelReason: reason
+    };
+    this.emit("task:failed", { type: "task:failed", task, error: reason });
+    return true;
+  }
+  getAllTasks() {
+    return Array.from(this.tasks.values());
+  }
+  // ─── Agent Management ──────────────────────────────────────────────────────
+  registerAgent(agent) {
+    const fullAgent = {
+      ...agent,
+      createdAt: Date.now(),
+      lastActiveAt: Date.now()
+    };
+    this.agents.set(fullAgent.id, fullAgent);
+    return fullAgent;
+  }
+  getAllAgents() {
+    return Array.from(this.agents.values());
+  }
+  /**
+   * Select the best available agent for a task based on trust score and capability match.
+   * Agents are ranked by: (capability overlap × trust score). Suspended agents are excluded.
+   */
+  selectBestAgent(task) {
+    const candidates = Array.from(this.agents.values()).filter((a) => a.status !== "suspended" && a.status !== "offline").filter((a) => {
+      if (task.requiredCapabilities.length === 0) return true;
+      return task.requiredCapabilities.some((cap) => a.capabilities.includes(cap));
+    });
+    if (candidates.length === 0) return void 0;
+    const scored = candidates.map((agent) => {
+      const capOverlap = task.requiredCapabilities.length > 0 ? task.requiredCapabilities.filter((cap) => agent.capabilities.includes(cap)).length / task.requiredCapabilities.length : 1;
+      return { agent, score: capOverlap * agent.trustScore };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    return scored[0]?.agent;
+  }
+  /**
+   * Suspend an agent. Suspended agents are excluded from task selection.
+   */
+  suspendAgent(agentId, reason = "Trust score below minimum") {
+    const agent = this.agents.get(agentId);
+    if (!agent || agent.status === "suspended") return false;
+    agent.status = "suspended";
+    agent.lastActiveAt = Date.now();
+    this.emit("agent:suspended", {
+      type: "agent:suspended",
+      agent,
+      reason
+    });
+    return true;
+  }
+  /**
+   * Reinstate a suspended agent.
+   */
+  reinstateAgent(agentId) {
+    const agent = this.agents.get(agentId);
+    if (!agent || agent.status !== "suspended") return false;
+    agent.status = "idle";
+    agent.lastActiveAt = Date.now();
+    this.emit("agent:reinstated", {
+      type: "agent:reinstated",
+      agent
+    });
+    return true;
+  }
+  updateAgentTrust(agentId, success) {
+    const agent = this.agents.get(agentId);
+    if (!agent) return;
+    const previousTrust = agent.trustScore;
+    if (success) {
+      agent.trustScore += this.config.trustGrowthRate * (100 - agent.trustScore);
+      agent.tasksCompleted++;
+    } else {
+      agent.trustScore -= this.config.trustDecayRate * agent.trustScore;
+      agent.tasksFailed++;
+    }
+    agent.lastActiveAt = Date.now();
+    this.emit("agent:trust-updated", {
+      type: "agent:trust-updated",
+      agent,
+      previousTrust
+    });
+    if (agent.trustScore < this.config.trustMinimum && agent.status !== "suspended") {
+      this.suspendAgent(agentId, `Trust score ${agent.trustScore.toFixed(1)} below minimum ${this.config.trustMinimum}`);
+    }
+    if (this.config.onTrustUpdate) {
+      this.config.onTrustUpdate(agentId, agent.trustScore, success);
+    }
+  }
+  // ─── Task Decomposition ────────────────────────────────────────────────────
+  async decomposeTask(task) {
+    task.status = "planning";
+    const engine = this.config.engine;
+    let phases;
+    if (engine) {
+      const decomposition = await engine.decompose(task);
+      phases = decomposition.phases.length > 0 ? decomposition.phases : [
+        { title: "research", description: `Research: ${task.title}`, capabilities: task.requiredCapabilities },
+        { title: "implement", description: `Implement: ${task.title}`, capabilities: task.requiredCapabilities },
+        { title: "verify", description: `Verify: ${task.title}`, capabilities: task.requiredCapabilities }
+      ];
+    } else {
+      phases = ["research", "design", "implement", "verify", "document"].map((p) => ({
+        title: p,
+        description: `${p} phase for: ${task.description}`,
+        capabilities: task.requiredCapabilities
+      }));
+    }
+    for (let i = 0; i < phases.length; i++) {
+      const phase = phases[i];
+      const subtask = {
+        id: randomUUID(),
+        parentId: task.id,
+        title: `${phase.title}: ${task.title}`,
+        description: phase.description,
+        status: "pending",
+        priority: task.priority,
+        complexity: "simple",
+        subtasks: [],
+        dependencies: i > 0 ? [task.subtasks[i - 1].id] : [],
+        requiredCapabilities: phase.capabilities.length > 0 ? phase.capabilities : task.requiredCapabilities,
+        attempts: 0,
+        maxAttempts: this.config.defaultMaxAttempts,
+        acceptanceCriteria: [],
+        verificationResults: [],
+        createdAt: Date.now(),
+        updatedAt: Date.now(),
+        context: { ...task.context, phase: phase.title },
+        artifacts: []
+      };
+      task.subtasks.push(subtask);
+      this.tasks.set(subtask.id, subtask);
+    }
+    task.status = "pending";
+    this.emit("task:decomposed", { type: "task:decomposed", task, subtasks: task.subtasks });
+  }
+  // ─── Helper Methods ────────────────────────────────────────────────────────
+  assessComplexity(input) {
+    const descLength = input.description.length;
+    const capCount = input.requiredCapabilities.length;
+    const criteriaCount = input.acceptanceCriteria.length;
+    const score = descLength / 100 + capCount * 2 + criteriaCount * 1.5;
+    if (score < 5) return "trivial";
+    if (score < 15) return "simple";
+    if (score < 30) return "moderate";
+    if (score < 50) return "complex";
+    return "epic";
+  }
+  shouldDecompose(task) {
+    return task.complexity === "complex" || task.complexity === "epic";
+  }
+  requiresHumanApproval(task) {
+    const maxIndex = complexityToNumber(this.config.maxAutonomousComplexity);
+    const taskIndex = complexityToNumber(task.complexity);
+    return taskIndex > maxIndex;
+  }
+  // ─── Audit + Evidence ──────────────────────────────────────────────────────
+  attachAuditListeners() {
+    const events = [
+      "task:created",
+      "task:decomposed",
+      "task:assigned",
+      "task:started",
+      "task:checkpoint",
+      "task:verified",
+      "task:review-requested",
+      "task:reviewed",
+      "task:correction-needed",
+      "task:corrected",
+      "task:completed",
+      "task:failed",
+      "task:blocked",
+      "task:approved",
+      "agent:status-changed",
+      "agent:trust-updated",
+      "escalation"
+    ];
+    for (const type of events) {
+      this.on(type, (event) => {
+        this.recordAudit(event);
+        this.publishToBus(event);
+      });
+    }
+  }
+  publishToBus(event) {
+    const bus = this.config.bus;
+    if (!bus) return;
+    const category = event.type.startsWith("task:") ? "task" : event.type.startsWith("agent:") ? "agent" : "system";
+    const agentId = "agent" in event ? event.agent.id : "task" in event && event.task.assignedAgent ? event.task.assignedAgent : void 0;
+    bus.publish({
+      from: agentId ?? "system",
+      topic: event.type,
+      category,
+      payload: event,
+      priority: event.type === "escalation" || event.type === "task:failed" ? "high" : "normal"
+    });
+  }
+  recordAudit(event) {
+    const timestamp = Date.now();
+    this.auditGlobal.push({ timestamp, event });
+    const taskId = this.getEventTaskId(event);
+    if (taskId) {
+      const list = this.auditByTask.get(taskId) ?? [];
+      list.push({ timestamp, event });
+      this.auditByTask.set(taskId, list);
+    }
+    this.auditLog?.append(event);
+  }
+  getEventTaskId(event) {
+    if ("task" in event) {
+      return event.task.id;
+    }
+    return void 0;
+  }
+  getAuditTrail(taskId) {
+    if (taskId) {
+      return this.auditByTask.get(taskId) ?? [];
+    }
+    return this.auditGlobal;
+  }
+  getEvidenceBundle(taskId) {
+    const task = this.tasks.get(taskId);
+    const workflow = task?.workflowId ? this.workflows.get(task.workflowId) : void 0;
+    const plan = task?.workflowPlanId ? this.plans.get(task.workflowPlanId) : void 0;
+    const checkpoints = Array.from(this.checkpoints.values()).filter((c) => c.taskId === taskId);
+    const reviews = this.getReviews(taskId);
+    const verificationResults = task?.verificationResults ?? [];
+    const artifacts = task?.artifacts ?? [];
+    const audit = this.getAuditTrail(taskId);
+    return {
+      task,
+      workflow,
+      plan,
+      checkpoints,
+      reviews,
+      verificationResults,
+      artifacts,
+      audit
+    };
+  }
+  // ─── Statistics ────────────────────────────────────────────────────────────
+  getStats() {
+    const tasksByStatus = {};
+    for (const task of this.tasks.values()) {
+      tasksByStatus[task.status] = (tasksByStatus[task.status] || 0) + 1;
+    }
+    const agentsByRole = {};
+    for (const agent of this.agents.values()) {
+      agentsByRole[agent.role] = (agentsByRole[agent.role] || 0) + 1;
+    }
+    return {
+      tasks: { total: this.tasks.size, byStatus: tasksByStatus },
+      agents: { total: this.agents.size, byRole: agentsByRole }
+    };
+  }
+  // ─── Review Access ─────────────────────────────────────────────────────────
+  getReviews(taskId) {
+    const reviews = Array.from(this.reviews.values());
+    if (taskId) {
+      return reviews.filter((r) => r.taskId === taskId);
+    }
+    return reviews;
+  }
+  setFinalApprovalGate(task, gate, reason) {
+    task.context = {
+      ...task.context,
+      finalApprovalGate: gate,
+      ...reason ? { finalGateReason: reason } : {}
+    };
+  }
+  getFinalApprovalGate(task) {
+    const gate = task.context.finalApprovalGate;
+    if (gate === "pending" || gate === "approved" || gate === "blocked") {
+      return gate;
+    }
+    return void 0;
+  }
+};
+/**
+ * BaselineOS OpenTelemetry — SIGNAL-012
+ *
+ * Distributed tracing for the multi-agent orchestration layer.
+ * Initializes the OTel Node SDK and exports a shared tracer.
+ *
+ * Spans emitted:
+ *   task.execute          root span per executeTask() call
+ *   task.policy.pre       OPA pre-execution gate
+ *   task.policy.post      OPA post-execution gate
+ *   task.perform          performExecution() step loop
+ *   task.self_verify      selfVerify() LLM call
+ *   task.review           conductReview() LLM call
+ *
+ * Trace context is propagated through AgentBus messages via the
+ * optional `traceContext` field (W3C traceparent format).
+ *
+ * Configuration:
+ *   OTEL_EXPORTER_OTLP_ENDPOINT  OTLP HTTP collector (default: http://localhost:4318)
+ *   OTEL_SERVICE_NAME            service name override (default: baselineos)
+ *   BASELINE_OTEL_DISABLED       set to '1' to disable entirely (e.g. in tests)
+ *
+ * @license Apache-2.0
+ */
+/**
+ * BaselineOS Core Types
+ * 
+ * @license Apache-2.0
+ */
+/**
+ * PII Detector — SIGNAL-015
+ *
+ * Scans prompt text for personally identifiable information before it
+ * reaches the LLM router. Supports two enforcement modes:
+ *
+ *   redact — replaces detected values with [REDACTED:TYPE] (default)
+ *   block  — throws PiiBlockedError, halting task execution
+ *
+ * Detected types:
+ *   email        — RFC 5321 address pattern
+ *   phone        — US/international format (10-digit minimum)
+ *   ssn          — US Social Security Number (NNN-NN-NNNN)
+ *   credit-card  — Visa, Mastercard, Amex, Discover
+ *   api-key      — OpenAI sk-, Anthropic sk-ant-, GitHub ghp_, AWS AKIA
+ *   ip-address   — IPv4 addresses
+ *
+ * Integration:
+ *   Called by Orchestrator._performExecution() before engine.execute().
+ *   Publishes 'governance:pii-detected' on the AgentBus when PII is found.
+ *   Sets pii.detected and pii.types on the active OTel span.
+ *
+ * @license Apache-2.0
+ */
+/**
+ * Task Queue — SIGNAL-018
+ *
+ * BullMQ-backed durable task queue. Provides:
+ *   - Priority-ordered execution (critical → high → medium → low)
+ *   - Automatic retry with exponential backoff on failure
+ *   - Concurrency limiting (configurable, default 5)
+ *   - Job deduplication by task ID
+ *   - Queue observability via Bull Dashboard / BullMQ Board
+ *
+ * The queue is optional. When not configured, Orchestrator falls back
+ * to direct in-process execution (existing behaviour).
+ *
+ * Configuration:
+ *   BASELINE_REDIS_URL  Redis connection URL (default: redis://localhost:6379)
+ *
+ * Self-hosted Redis:
+ *   docker compose -f docker/docker-compose.monitoring.yml up -d
+ *   → redis://localhost:6379
+ *
+ * @license Apache-2.0
+ */
+/**
+ * BaselineOS Orchestrator
+ * 
+ * Autonomous multi-agent task execution with self-supervision.
+ * Implements AMP/Ralph patterns for agent-to-agent oversight.
+ * 
+ * Key Innovation: Tasks are decomposed, verified, reviewed, and corrected
+ * by agents — not humans. Human intervention only when all autonomous
+ * options are exhausted (<5% of tasks).
+ * 
+ * @license Apache-2.0
+ */
+
+export { Orchestrator };
+//# sourceMappingURL=orchestrator.js.map
+//# sourceMappingURL=orchestrator.js.map