bulltrackers-module 1.0.1102 → 1.0.1104

package/functions/computation-system-v3/framework/adapters/StorageManager.js

@@ -59,6 +59,9 @@ class StorageManager {
     async commitResults(dateStr, entry, results, depResultHashes = {}) {
         const storageConfig = entry.storage || {};
         const startTime = Date.now();
+
+        this.logger.log('INFO', `[StorageMgr] commitResults for ${entry.name}. Entities to commit: ${results ? Object.keys(results).length : 0}. Outbox Config Enabled: ${!!storageConfig.outbox?.enabled}`);
+
         const gcsTask = storageConfig.bigquery === false
             ? Promise.resolve(null)
             : this._stageToGCS(dateStr, entry, results, depResultHashes);
@@ -102,7 +105,7 @@ class StorageManager {
             const table = this.config.tables.results.table;
             const bucketName = this.config.storage.bucket;
             const prefix = this.config.storage.prefix;
-            
+
             // Normalize name to match Worker output exactly
             const compName = String(entry.name || 'unknown').toLowerCase();
             const ownerId = String(entry.ownerId || 'system');
@@ -127,7 +130,7 @@ class StorageManager {
             const nameHash = crypto.createHash('sha1').update(compName).digest('hex').slice(0, 8);
             const dateKey = dateStr.replace(/-/g, '');
             // Append a short unique ID to prevent concurrent run collisions
-            const runId = crypto.randomUUID().replace(/-/g, '').slice(0, 8); 
+            const runId = crypto.randomUUID().replace(/-/g, '').slice(0, 8);
             const tempTableId = `${table}_temp_${safeName}_${nameHash}_${dateKey}_${runId}`;
 
             this.logger.log('INFO', `[StorageMgr] Using deterministic temp table: ${tempTableId}`);
@@ -213,7 +216,7 @@ class StorageManager {
             }
         });
     }
-    
+
     async _computeTableHash(tempTableId) {
         const fullTemp = `\`${this.config.bigquery.projectId}.${this.config.bigquery.dataset}.${tempTableId}\``;
         const query = `SELECT CAST(BIT_XOR(FARM_FINGERPRINT(result_hash)) AS STRING) as table_checksum FROM ${fullTemp}`;
@@ -233,11 +236,11 @@ class StorageManager {
         const bucketName = this.config.storage.bucket;
         const prefix = this.config.storage.prefix;
         const ownerId = String(entry.ownerId || 'system');
-        
+
         // Normalize name
         const compName = String(entry.name || 'unknown').toLowerCase();
         const filename = `${prefix}/${dateStr}/${ownerId}/${compName}/${this.newUuid()}.json`;
-        
+
         const file = this.storage.bucket(bucketName).file(filename);
         const gcsUri = `gs://${bucketName}/${filename}`;
 
@@ -458,13 +461,13 @@ class StorageManager {
     async _cleanupGCSFiles(bucketName, filePrefix) {
         // NEW: Log the deletion target
         this.logger.log('INFO', `[StorageMgr] Cleaning up GCS files at gs://${bucketName}/${filePrefix}`);
-        
+
         const [files] = await this.storage.bucket(bucketName).getFiles({ prefix: filePrefix });
         const deletePromises = files.map(file => file.delete().catch(e => {
             this.logger.warn(`[StorageMgr] Failed to delete file ${file.name}: ${e.message}`);
         }));
         await Promise.all(deletePromises);
-        
+
         this.logger.log('INFO', `[StorageMgr] Successfully cleaned up ${files.length} file(s) from gs://${bucketName}/${filePrefix}`);
     }
 }

package/functions/computation-system-v3/framework/core/ContextBuilder.js

@@ -16,6 +16,13 @@ const buildWrappers = require('../wrappers/index');
 const MAX_LOG_LINE_BYTES = 4096;
 const ANSI_ESCAPE = /\x1b\[[0-9;]*m/g;
 const CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+const WRAPPER_DEPENDENCIES = Object.freeze({
+    performance: ['portfolio', 'math'],
+    risk: ['finance', 'math'],
+    behavioral: ['math', 'portfolio', 'rankings', 'trades', 'instruments'],
+    sectorAnalysis: ['math', 'portfolio', 'instruments'],
+    profileMetrics: ['math', 'portfolio', 'rankings', 'social']
+});
 
 /**
  * Sanitize a log message: strip ANSI escapes and non-printable control chars, ensure valid UTF-8, cap length.
@@ -70,18 +77,31 @@ function buildLib(config) {
     const allowed = getAllowedLibModules(effectiveConfig);
     if (!allowed || allowed.length === 0) return Object.freeze({});
 
-    const out = {};
-    for (const m of allowed) {
+    const internalModules = new Set(allowed);
+    for (const moduleName of allowed) {
+        const dependencies = WRAPPER_DEPENDENCIES[moduleName];
+        if (!dependencies) continue;
+        dependencies.forEach((dependency) => internalModules.add(dependency));
+    }
+
+    const internalLibs = {};
+    for (const m of internalModules) {
         if (Object.prototype.hasOwnProperty.call(libFactories, m)) {
             try {
-                out[m] = libFactories[m]();
+                internalLibs[m] = libFactories[m]();
             } catch (err) {
                 throw new Error(`Failed to instantiate library '${m}': ${err.message}`);
             }
         }
     }
 
-    const wrappers = buildWrappers(out);
+    const wrappers = buildWrappers(internalLibs);
+    const out = {};
+    for (const m of allowed) {
+        if (Object.prototype.hasOwnProperty.call(internalLibs, m)) {
+            out[m] = internalLibs[m];
+        }
+    }
     Object.assign(out, wrappers);
 
     return deepFreeze(out);

package/functions/computation-system-v3/framework/core/ExecutionPipeline.js

@@ -248,6 +248,11 @@ class ExecutionPipeline {
                 }
                 return;
             }
+
+            else if (execResult.status === 'completed' && execResult.result === undefined) {
+                this.logger.log(`[Batch] ${entry.name} Entity ${entityId} skipped (computation returned undefined)`);
+            }
+
             if (execResult.status === 'error') {
                 const error = execResult.error?.message || String(execResult.error);
                 this.logger.error(`[Batch] Entity ${entityId} failed: ${error}`);
@@ -261,6 +266,8 @@ class ExecutionPipeline {
             }
         })));
 
+        this.logger.log(`[Batch] ${entry.name} batch ${batchNum ?? 'N/A'} completed. Entities OUT (with data): ${successCount} / ${entityIds.length}`);
+
         if (!dryRun && heavyEntities.length > 0 && this.stateRepo.logHeavyEntities) {
             await this.stateRepo.logHeavyEntities(entry.name, heavyEntities, entry.ownerId || ownerId);
         }

package/functions/computation-system-v3/framework/core/Manifest.js

@@ -137,6 +137,9 @@ class Manifest {
                 path: cfg?.firestore?.path || null,
                 merge: cfg?.firestore?.merge || false,
                 includeMetadata: cfg?.firestore?.includeMetadata !== false
+            },
+            outbox: {
+                enabled: cfg?.outbox?.enabled === true
             }
         };
     }
@@ -290,6 +293,9 @@ class Manifest {
                     path: null,
                     merge: false,
                     includeMetadata: false
+                },
+                outbox: {
+                    enabled: false
                 }
             };
         }

package/functions/computation-system-v3/framework/tests/unit/SkillsPhase.test.js

@@ -226,6 +226,18 @@ describe('Skills Phase 1 — Manifest', () => {
         const m2 = Manifest.build([base2]);
         assert.notStrictEqual(m1[0].hash, m2[0].hash, 'Hash should differ when lib subset differs');
     });
+
+    it('preserves outbox storage config in manifest entries', () => {
+        const recipe = validRecipe({
+            storage: {
+                bigquery: true,
+                firestore: { enabled: true, path: 'owners/{ownerId}/alerts/{date}/TestComp/{entityId}' },
+                outbox: { enabled: true }
+            }
+        });
+        const manifest = Manifest.build([recipe]);
+        assert.strictEqual(manifest[0].storage.outbox.enabled, true);
+    });
 });
 
 describe('Skills Phase 1 — ContextBuilder', () => {
@@ -319,6 +331,47 @@ describe('Skills Phase 1 — ContextBuilder', () => {
         assert.strictEqual(Object.isFrozen(ctx.lib), true);
         assert.strictEqual(Object.isFrozen(ctx.lib.math), true);
     });
+
+    it('wrapper modules can use internal dependencies without exposing them directly', () => {
+        const builder = new ContextBuilder({}, null);
+        const ctx = builder.build({
+            computationName: 'BehavioralTest',
+            date: '2024-01-31',
+            data: {},
+            config: { skills: ['lib', 'bigquery'], lib: ['behavioral', 'dataHelpers'] }
+        });
+
+        assert.ok(ctx.lib.behavioral);
+        assert.strictEqual(ctx.lib.portfolio, undefined);
+        assert.strictEqual(ctx.lib.rankings, undefined);
+
+        const result = ctx.lib.behavioral.DetectAnomaly({
+            portfolios: [{
+                user_id: 'pi-1',
+                date: '2024-01-31',
+                portfolio_data: { Positions: [] }
+            }],
+            rankingsData: [{
+                pi_id: 'pi-1',
+                date: '2024-01-31',
+                rankings_data: {}
+            }],
+            tradeHistory: [],
+            tickerMappings: [],
+            sectorMappings: [],
+            piMasterList: [],
+            entityId: 'pi-1',
+            date: '2024-01-31',
+            getEntityRows: (rows, entityId) => {
+                const arr = Array.isArray(rows) ? rows : Object.values(rows || {}).flat();
+                return arr.filter((row) => String(row.user_id ?? row.pi_id ?? row.cid) === String(entityId));
+            },
+            toDateStr: (value) => String(value).slice(0, 10)
+        });
+
+        assert.ok(result);
+        assert.notStrictEqual(result.outcome, 'Cannot read properties of undefined');
+    });
 });
 
 describe('Phase 1 — Worker tier routing', () => {

package/functions/computation-system-v4/computations/SystemHealth_Smoke_Alerter.js

@@ -1,66 +1,66 @@
-'use strict';
-/**
- * @fileoverview System health smoke alerter
- */
-
-const DEV_CID = '29312236';
-
-exports.config = {
-  name: 'SystemHealth_Smoke_Alerter',
-  type: 'global',
-  category: 'alerter',
-  dependencies: [],
-  schedule: '0 9 * * *', 
-
-  requires: {},
-
-  storage: {
-    bigquery: false,
-    firestore: {
-      enabled: true,
-      path: 'owners/system/alert_notifications/{date}/SystemHealth_Smoke_Alerter',
-      merge: false
-    },
-    // FIX 1: Explicitly enable outbox storage
-    outbox: {
-      enabled: true
-    }
-  },
-
-  alert: {
-    id: 'system_health_smoke',
-    frontendName: 'System Health (Smoke)',
-    description: 'Proves the alert listener and notification pipeline are working',
-    messageTemplate: 'System is online and working fine.',
-    severity: 'low'
-  }
-};
-
-exports.process = (ctx) => {
-  const date = ctx.date || new Date().toISOString().slice(0, 10);
-  
-  const notification = {
-      userCid: DEV_CID,
-      piCid: 0,
-      alertTypeId: exports.config.alert.id,
-      alertTypeName: exports.config.alert.frontendName,
-      message: exports.config.alert.messageTemplate,
-      computationName: exports.config.name,
-      computationDate: date,
-      severity: exports.config.alert.severity,
-      watchlistId: 'system_smoke',
-      watchlistName: 'System Smoke'
-  };
-
-  return {
-    // We keep the notification at the root for standard Firestore paths
-    results: [notification], 
-    
-    // FIX 2: Provide the exact `_outbox` envelope the StorageManager expects
-    _outbox: {
-      fcmPayloads: [notification], // Route default to FCM
-      emailPayloads: [],
-      smsPayloads: []
-    }
-  };
+'use strict';
+/**
+ * @fileoverview System health smoke alerter
+ */
+
+const DEV_CID = '29312236';
+
+exports.config = {
+  name: 'SystemHealth_Smoke_Alerter',
+  type: 'global',
+  category: 'alerter',
+  dependencies: [],
+  schedule: '0 9 * * *', 
+
+  requires: {},
+
+  storage: {
+    bigquery: false,
+    firestore: {
+      enabled: true,
+      path: 'owners/system/alert_notifications/{date}/SystemHealth_Smoke_Alerter',
+      merge: false
+    },
+    // FIX 1: Explicitly enable outbox storage
+    outbox: {
+      enabled: true
+    }
+  },
+
+  alert: {
+    id: 'system_health_smoke',
+    frontendName: 'System Health (Smoke)',
+    description: 'Proves the alert listener and notification pipeline are working',
+    messageTemplate: 'System is online and working fine.',
+    severity: 'low'
+  }
+};
+
+exports.process = (ctx) => {
+  const date = ctx.date || new Date().toISOString().slice(0, 10);
+  
+  const notification = {
+      userCid: DEV_CID,
+      piCid: 0,
+      alertTypeId: exports.config.alert.id,
+      alertTypeName: exports.config.alert.frontendName,
+      message: exports.config.alert.messageTemplate,
+      computationName: exports.config.name,
+      computationDate: date,
+      severity: exports.config.alert.severity,
+      watchlistId: 'system_smoke',
+      watchlistName: 'System Smoke'
+  };
+
+  return {
+    // We keep the notification at the root for standard Firestore paths
+    results: [notification], 
+    
+    // FIX 2: Provide the exact `_outbox` envelope the StorageManager expects
+    _outbox: {
+      fcmPayloads: [notification], // Route default to FCM
+      emailPayloads: [],
+      smsPayloads: []
+    }
+  };
 };

package/functions/computation-system-v4/config/bulltrackers.config.ts

@@ -1,4 +1,4 @@
-import type { KernelConfig } from '../types/shared';
+import type { KernelConfig } from '../core/types/shared';
 
 export const kernelConfig: KernelConfig = {
   project: {

package/functions/computation-system-v4/core/README.md

@@ -0,0 +1,252 @@
+# Core Overview
+
+This directory contains the production runtime for the v4 computation system: the kernel, official system plugins, shared sandbox helpers, and the public type contracts they implement.
+
+This README gives a file-by-file purpose map for `core/`, excluding the implementation-heavy files under:
+
+- `plugins/context/libs/*`
+- `plugins/context/wrappers/*`
+
+Those two directories are intentionally omitted from the detailed breakdown below.
+
+## Directory Shape
+
+- `kernel/`: the orchestration layer that wires hooks, plugins, and execution flow together.
+- `plugins/`: trusted system plugins and shared runtime helpers.
+- `types/`: the TypeScript contracts for the kernel and plugin capability system.
+
+## `kernel/`
+
+### [`kernel/index.ts`](./kernel/index.ts)
+Barrel export for the kernel package. Re-exports the main kernel classes so callers can import the orchestration surface from one place.
+
+### [`kernel/Kernel.ts`](./kernel/Kernel.ts)
+The main runtime orchestrator. It boots the plugin set, resolves capabilities, coordinates lifecycle hooks, builds execution context, and drives a computation run through planning, execution, and finalization.
+
+### [`kernel/HookRegistry.ts`](./kernel/HookRegistry.ts)
+Owns lifecycle hook registration and dispatch. System plugins use it to tap into kernel stages without directly coupling to each other.
+
+### [`kernel/PluginRegistry.ts`](./kernel/PluginRegistry.ts)
+Registers plugins, indexes them by capability, and resolves capability lookups at runtime. This is the trust-aware directory the kernel uses to find official system services.
+
+### [`kernel/ContextAccumulator.ts`](./kernel/ContextAccumulator.ts)
+Builds and merges the evolving runtime context for a computation run. It is responsible for collecting stage outputs into a consistent context object without leaking plugin-local details into unrelated stages.
+
+### [`kernel/utils/AstValidator.ts`](./kernel/utils/AstValidator.ts)
+Shared AST policy checker used by kernel-adjacent validation paths. It provides a lightweight static guardrail around unsafe language constructs before execution is attempted.
+
+## `plugins/`
+
+### [`plugins/index.ts`](./plugins/index.ts)
+Barrel export for the official system plugin set.
+
+### Billing
+
+#### [`plugins/billing/DefaultBillingPlugin.ts`](./plugins/billing/DefaultBillingPlugin.ts)
+Trusted billing plugin. Applies billing-related lifecycle behavior and keeps charging logic in system-owned code rather than user-owned code.
+
+### Context
+
+#### [`plugins/context/DefaultContextPlugin.ts`](./plugins/context/DefaultContextPlugin.ts)
+Builds the `ctx` object exposed to computations. It injects system libraries, resolves verified user libraries, enforces alias isolation rules, applies dependency ordering, and prevents user code from shadowing trusted built-ins.
+
+#### [`plugins/context/UserLibrarySource.ts`](./plugins/context/UserLibrarySource.ts)
+Loads and interprets verified user library artifacts. It extracts the library manifest/factory metadata through the isolated metadata worker, validates contracts, and turns uploaded code into a runtime-ready user library definition.
+
+### Data
+
+#### [`plugins/data/BigQueryDataAdapterPlugin.ts`](./plugins/data/BigQueryDataAdapterPlugin.ts)
+Primary data-access plugin for BigQuery-backed computations. It turns manifest/config requirements into actual query execution against the configured warehouse backend.
+
+#### [`plugins/data/MaterializedViewManager.ts`](./plugins/data/MaterializedViewManager.ts)
+Support utility for data-layer materialized view workflows. It encapsulates the view management logic used by the data plugin so the main adapter stays focused on execution flow.
+
+### Dispatch
+
+#### [`plugins/dispatch/DefaultDispatchPlugin.ts`](./plugins/dispatch/DefaultDispatchPlugin.ts)
+Standard dispatch plugin for non-Python computations. It is responsible for selecting and invoking the appropriate execution route once a computation has been planned and prepared.
+
+#### [`plugins/dispatch/PythonDispatchPlugin.ts`](./plugins/dispatch/PythonDispatchPlugin.ts)
+Dispatch plugin for Python-oriented computations. It handles the trusted bridge between the v4 orchestration model and Python execution flows.
+
+### Logging
+
+#### [`plugins/logging/GcpExecutionLogSinkPlugin.ts`](./plugins/logging/GcpExecutionLogSinkPlugin.ts)
+System log sink for pushing execution telemetry and structured logs into Google Cloud logging infrastructure.
+
+### Manifest
+
+#### [`plugins/manifest/DefaultManifestPlugin.ts`](./plugins/manifest/DefaultManifestPlugin.ts)
+The central manifest-resolution plugin. It parses computation definitions, validates configuration shape, applies verification-aware policy checks, merges library/plugin requirements, and produces the canonical runtime manifest used by the kernel.
+
+#### [`plugins/manifest/ContractRegistry.ts`](./plugins/manifest/ContractRegistry.ts)
+Registry for callable contracts discovered from built-in libraries, wrappers, and verified user libraries. It gives manifest resolution a single place to look up what a call requires from the data layer.
+
+#### [`plugins/manifest/ConfigResolver.ts`](./plugins/manifest/ConfigResolver.ts)
+Normalizes and merges config-driven requirements into the manifest. It contains the defensive merge rules for `requires`, including field unioning, `mandatory` promotion, and lookback widening.
+
+#### [`plugins/manifest/BundleValidator.ts`](./plugins/manifest/BundleValidator.ts)
+Validates uploaded/bundled source artifacts before they are admitted into the verification pipeline. This is part of the “safe to inspect” gate before deeper semantic checks.
+
+#### [`plugins/manifest/AstValidator.ts`](./plugins/manifest/AstValidator.ts)
+Manifest-specific AST safety validator used during computation/plugin/library verification. It focuses on policy enforcement for uploaded code rather than kernel internals.
+
+#### [`plugins/manifest/NpmPolicy.ts`](./plugins/manifest/NpmPolicy.ts)
+Enforces package/import policy for JavaScript and TypeScript bundles. It is where allowed and disallowed npm dependency rules are expressed.
+
+#### [`plugins/manifest/NpmBundleWorker.ts`](./plugins/manifest/NpmBundleWorker.ts)
+Worker-side helper used for npm bundle inspection/processing during verification. It keeps heavier bundle handling out of the main verification flow.
+
+#### [`plugins/manifest/ManifestHasher.ts`](./plugins/manifest/ManifestHasher.ts)
+Computes stable hashes for manifests and related execution inputs. These hashes are used to pin verified artifacts and detect when re-verification is required.
+
+#### [`plugins/manifest/PythonPolicy.ts`](./plugins/manifest/PythonPolicy.ts)
+Python-specific verification policy module. It applies the equivalent package/import rules for Python computations.
+
+#### [`plugins/manifest/RecipeExtractor.ts`](./plugins/manifest/RecipeExtractor.ts)
+Extracts canonical “recipe” metadata from computation definitions so downstream planning and verification work from a normalized shape.
+
+#### [`plugins/manifest/ScheduleValidator.ts`](./plugins/manifest/ScheduleValidator.ts)
+Validates scheduling-related manifest configuration such as trigger shape and supported schedule semantics.
+
+### Planner
+
+#### [`plugins/planner/DefaultPlannerPlugin.ts`](./plugins/planner/DefaultPlannerPlugin.ts)
+Trusted planning plugin that converts a manifest into an executable plan. It handles dependency-aware execution ordering before dispatch/runtime stages begin.
+
+### Pub/Sub
+
+#### [`plugins/pubsub/DefaultPubSubPlugin.ts`](./plugins/pubsub/DefaultPubSubPlugin.ts)
+System-owned Pub/Sub side-effect plugin. User plugins may emit publish intents, but this plugin remains the trusted component that validates and performs the actual publish.
+
+### Runtime
+
+#### [`plugins/runtime/WasmRuntimePlugin.ts`](./plugins/runtime/WasmRuntimePlugin.ts)
+Primary runtime plugin for isolated computation execution. It coordinates execution of bundled code inside the chosen runtime boundary and exposes the runtime capability to the rest of the kernel.
+
+#### [`plugins/runtime/wasm/WasmWorker.ts`](./plugins/runtime/wasm/WasmWorker.ts)
+Worker/controller class for the isolated runtime process. It encapsulates the communication boundary used to run computation code away from the main orchestrator thread.
+
+#### [`plugins/runtime/wasm/worker-entry.ts`](./plugins/runtime/wasm/worker-entry.ts)
+Worker entrypoint for the runtime sandbox. It bootstraps the isolated runtime environment and listens for execution requests from the host plugin.
+
+#### [`plugins/runtime/wasm/libBundler.ts`](./plugins/runtime/wasm/libBundler.ts)
+Helper for preparing bundled library/runtime payloads before they are sent into the sandboxed runtime worker.
+
+### Scheduler
+
+#### [`plugins/scheduler/CloudTasksSchedulerPlugin.ts`](./plugins/scheduler/CloudTasksSchedulerPlugin.ts)
+Scheduler integration for Google Cloud Tasks. It is the trusted queueing layer that turns validated execution plans into scheduled work items.
+
+### Shared
+
+#### [`plugins/shared/AlertSubscriptionMatcher.ts`](./plugins/shared/AlertSubscriptionMatcher.ts)
+Shared utility used by alert-oriented flows to match produced results against subscription rules and outbox routing needs.
+
+#### [`plugins/shared/UntrustedMetadataExtractor.ts`](./plugins/shared/UntrustedMetadataExtractor.ts)
+Host-side wrapper for extracting metadata from untrusted uploaded libraries/plugins without running that extraction in the main thread. It delegates to a dedicated worker and returns sanitized definition metadata to the caller.
+
+#### [`plugins/shared/untrusted-metadata-worker.js`](./plugins/shared/untrusted-metadata-worker.js)
+Worker implementation used by `UntrustedMetadataExtractor.ts`. It performs the isolated metadata extraction step for untrusted artifacts during verification and loading.
+
+### State
+
+#### [`plugins/state/FirestoreStatePlugin.ts`](./plugins/state/FirestoreStatePlugin.ts)
+State plugin backed by Firestore. It persists computation state, verification records, and owner-scoped metadata for computations, user plugins, and user libraries.
+
+### Storage
+
+#### [`plugins/storage/GcsStoragePlugin.ts`](./plugins/storage/GcsStoragePlugin.ts)
+Storage plugin backed by Google Cloud Storage. It stores and loads immutable, hash-addressed computation/plugin/library artifacts.
+
+### Telemetry
+
+#### [`plugins/telemetry/DefaultTelemetryPlugin.ts`](./plugins/telemetry/DefaultTelemetryPlugin.ts)
+Trusted telemetry plugin for recording stage-level execution events, metrics, and verification progress.
+
+#### [`plugins/telemetry/StageHarness.ts`](./plugins/telemetry/StageHarness.ts)
+Helper for wrapping runtime stages with consistent telemetry emission, timing, and error capture.
+
+### User Plugins
+
+#### [`plugins/userPlugins/UserPluginRuntimePlugin.ts`](./plugins/userPlugins/UserPluginRuntimePlugin.ts)
+Runs verified user plugins as isolated middleware, validates stage-specific outputs, and converts user-produced results into trusted intent envelopes that system plugins can safely consume.
+
+#### [`plugins/userPlugins/UserPluginSource.ts`](./plugins/userPlugins/UserPluginSource.ts)
+Loads verified user plugin source definitions. Like `UserLibrarySource.ts`, it uses the isolated metadata extraction path and turns uploaded code into a validated runtime definition.
+
+### Verification
+
+#### [`plugins/verification/DefaultVerificationPlugin.ts`](./plugins/verification/DefaultVerificationPlugin.ts)
+First-class verification plugin for computations, user plugins, and user libraries. It runs policy validation, dry-run checks, sandbox-oriented safety checks, artifact hashing, and redacted error reporting before an artifact can become executable.
+
+## `types/`
+
+### [`types/index.ts`](./types/index.ts)
+Barrel export for the v4 type surface.
+
+### [`types/shared.ts`](./types/shared.ts)
+Shared structural types used across manifests, execution context, verification records, and runtime payloads.
+
+### [`types/IPlugin.ts`](./types/IPlugin.ts)
+Base contract for all system plugins.
+
+### [`types/IHook.ts`](./types/IHook.ts)
+Core lifecycle hook contract used by the hook registry.
+
+### [`types/IHookContext.ts`](./types/IHookContext.ts)
+The canonical context shape passed through lifecycle stages.
+
+### [`types/IMiddleware.ts`](./types/IMiddleware.ts)
+Contract for middleware-style behaviors that run inside the broader plugin system.
+
+### [`types/IManifestPlugin.ts`](./types/IManifestPlugin.ts)
+Capability contract for plugins that resolve and validate computation manifests.
+
+### [`types/IPlannerPlugin.ts`](./types/IPlannerPlugin.ts)
+Capability contract for execution planning plugins.
+
+### [`types/IRuntimePlugin.ts`](./types/IRuntimePlugin.ts)
+Capability contract for runtime execution plugins.
+
+### [`types/IDispatchPlugin.ts`](./types/IDispatchPlugin.ts)
+Capability contract for dispatch-layer plugins.
+
+### [`types/IDataAdapterPlugin.ts`](./types/IDataAdapterPlugin.ts)
+Capability contract for data source adapter plugins.
+
+### [`types/IContextPlugin.ts`](./types/IContextPlugin.ts)
+Capability contract for plugins that construct the computation context.
+
+### [`types/IBillingPlugin.ts`](./types/IBillingPlugin.ts)
+Capability contract for billing enforcement plugins.
+
+### [`types/ISchedulerPlugin.ts`](./types/ISchedulerPlugin.ts)
+Capability contract for scheduler/queue integration plugins.
+
+### [`types/IStatePlugin.ts`](./types/IStatePlugin.ts)
+Capability contract for persistence/state plugins.
+
+### [`types/IStoragePlugin.ts`](./types/IStoragePlugin.ts)
+Capability contract for blob/object storage plugins.
+
+### [`types/ITelemetryPlugin.ts`](./types/ITelemetryPlugin.ts)
+Capability contract for telemetry and stage reporting plugins.
+
+### [`types/IVerificationPlugin.ts`](./types/IVerificationPlugin.ts)
+Capability contract for artifact verification services.
+
+### [`types/IUserPlugin.ts`](./types/IUserPlugin.ts)
+Type contract for verified user plugin artifacts and their runtime shape.
+
+### [`types/IUserLibrary.ts`](./types/IUserLibrary.ts)
+Type contract for verified user library artifacts, bindings, contracts, and runtime resolution.
+
+## Omitted Files
+
+The following implementation groups are intentionally not covered file-by-file in this README because you asked to exclude the lib/wrapper files:
+
+- `plugins/context/libs/*`
+- `plugins/context/wrappers/*`
+
+They are still part of the runtime context surface, but their internal implementation details are out of scope for this map.