chainlesschain 0.166.17 → 0.166.18

package/src/lib/evolution/agent-evolution-ingress.js

@@ -0,0 +1,300 @@
+import crypto from "node:crypto";
+import evolutionRun from "@chainlesschain/session-core/evolution-run";
+
+import { EvolutionEvidenceArtifactAdapter } from "./evolution-evidence-artifact-adapter.js";
+import { EvolutionRunLedgerAdapter } from "./evolution-run-ledger-adapter.js";
+import { captureEvolutionRunWikiMaintenanceProducer } from "./evolution-run-wiki-maintenance-source.js";
+import { WIKI_MAINTENANCE_TRIGGER_KIND } from "./wiki-maintenance-trigger-ledger-adapter.js";
+
+const { EVOLUTION_RUN_EVENT_SCHEMA, EVENT_TYPES } = evolutionRun;
+
+export const AGENT_EVOLUTION_INGRESS_SCHEMA =
+  "chainlesschain.agent-evolution-ingress/v1";
+export const AGENT_EVOLUTION_INGRESS_FAILED_CODE =
+  "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+
+const INGRESSES = new WeakSet();
+const CORE_EVENT_KINDS = new Map([
+  ["tool-executing", "tool-requested"],
+  ["tool-result", "tool-completed"],
+  ["tool-error", "tool-failed"],
+  ["response-complete", "response-completed"],
+  ["run-ended", "goal-ended"],
+]);
+
+function requiredString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${label} is required`);
+  }
+  return value;
+}
+
+function canonical(value) {
+  if (value === null || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Agent evolution evidence must be finite JSON");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") return JSON.stringify(value);
+  if (!value || typeof value !== "object") {
+    throw new TypeError("Agent evolution evidence must be JSON-compatible");
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonical).join(",")}]`;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError("Agent evolution evidence must use plain objects");
+  }
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function clone(value) {
+  return JSON.parse(canonical(value));
+}
+
+function digest(value) {
+  return `sha256:${crypto.createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+
+function timestamp(value, label) {
+  const date = new Date(value);
+  if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) {
+    throw new TypeError(`${label} must be a canonical timestamp`);
+  }
+  return value;
+}
+
+function normalizeId(value, label) {
+  const result = requiredString(value, label);
+  if (Buffer.byteLength(result, "utf8") > 256) {
+    throw new TypeError(`${label} is too long`);
+  }
+  return result;
+}
+
+function guardIngress(operation) {
+  return Promise.resolve(operation).catch((cause) => {
+    if (cause?.code === AGENT_EVOLUTION_INGRESS_FAILED_CODE) throw cause;
+    const error = new Error(
+      `Agent evolution ingress failed: ${cause?.message || String(cause)}`,
+      { cause },
+    );
+    error.code = AGENT_EVOLUTION_INGRESS_FAILED_CODE;
+    throw error;
+  });
+}
+
+export function createAgentEvolutionIngress({
+  evidenceAdapter,
+  runAdapter,
+  sourceEnvelopeAuthority,
+  wikiMaintenanceProducer = null,
+  completionTriggerKind = WIKI_MAINTENANCE_TRIGGER_KIND.SESSION_END,
+  now = () => new Date(),
+  idGenerator = () => crypto.randomUUID(),
+} = {}) {
+  if (!(evidenceAdapter instanceof EvolutionEvidenceArtifactAdapter)) {
+    throw new TypeError("an EvolutionEvidenceArtifactAdapter is required");
+  }
+  if (!(runAdapter instanceof EvolutionRunLedgerAdapter)) {
+    throw new TypeError("an EvolutionRunLedgerAdapter is required");
+  }
+  if (typeof sourceEnvelopeAuthority?.issue !== "function") {
+    throw new TypeError("sourceEnvelopeAuthority.issue is required");
+  }
+  if (typeof now !== "function" || typeof idGenerator !== "function") {
+    throw new TypeError("ingress clock and idGenerator must be functions");
+  }
+  const maintenanceProducer =
+    wikiMaintenanceProducer === null
+      ? null
+      : captureEvolutionRunWikiMaintenanceProducer(wikiMaintenanceProducer);
+  if (
+    ![
+      WIKI_MAINTENANCE_TRIGGER_KIND.SESSION_END,
+      WIKI_MAINTENANCE_TRIGGER_KIND.GOAL_END,
+    ].includes(completionTriggerKind)
+  ) {
+    throw new TypeError(
+      "Agent completion trigger kind must be session-end or goal-end",
+    );
+  }
+  const issueSourceEnvelope = sourceEnvelopeAuthority.issue.bind(
+    sourceEnvelopeAuthority,
+  );
+  const descriptor = runAdapter.descriptor;
+  let tail = Promise.resolve();
+
+  const serialize = (operation) => {
+    const pending = tail.then(operation, operation);
+    tail = pending.catch(() => undefined);
+    return pending;
+  };
+
+  const currentTimestamp = () => {
+    const value = now();
+    const iso = value instanceof Date ? value.toISOString() : value;
+    return timestamp(iso, "ingress timestamp");
+  };
+
+  const appendStarted = () => {
+    const loaded = runAdapter.load();
+    if (loaded.events.length > 0) return loaded.projection;
+    const occurredAt = currentTimestamp();
+    return runAdapter.appendEvent({
+      schema: EVOLUTION_RUN_EVENT_SCHEMA,
+      tenantId: descriptor.tenantId,
+      runId: descriptor.runId,
+      eventId: `${descriptor.runId}:started`,
+      sequence: 1,
+      type: EVENT_TYPES.RUN_STARTED,
+      subjectId: descriptor.runId,
+      payloadDigest: digest({ occurredAt, runtime: "agent" }),
+      artifactRef: null,
+      keyRef: null,
+      data: { occurredAt, runtime: "agent" },
+    }).projection;
+  };
+
+  const ingest = (kind, evidence, options = {}) =>
+    guardIngress(
+      serialize(async () => {
+        const projection = appendStarted();
+        if (projection.status === "completed") {
+          throw new Error(
+            "completed EvolutionRun cannot accept Agent evidence",
+          );
+        }
+        const eventId = normalizeId(
+          options.eventId ?? `agent:${idGenerator()}`,
+          "Agent evidence eventId",
+        );
+        const occurredAt = timestamp(
+          options.occurredAt ?? currentTimestamp(),
+          "Agent evidence occurredAt",
+        );
+        const payload = clone(evidence);
+        const sourceEnvelope = await issueSourceEnvelope(
+          Object.freeze({
+            schema: AGENT_EVOLUTION_INGRESS_SCHEMA,
+            tenantId: descriptor.tenantId,
+            runId: descriptor.runId,
+            eventId,
+            kind,
+            occurredAt,
+            evidence: payload,
+          }),
+        );
+        const persisted = await evidenceAdapter.projectAndPersist({
+          sourceEnvelope,
+          payload,
+        });
+        if (
+          persisted?.tenantId !== descriptor.tenantId ||
+          persisted.evidenceId == null ||
+          persisted.manifest?.type !== "evidence" ||
+          typeof persisted.manifest.ref?.ref !== "string"
+        ) {
+          throw new Error(
+            "Agent evidence persistence returned an unbound result",
+          );
+        }
+        const current = runAdapter.load();
+        return runAdapter.appendEvent({
+          schema: EVOLUTION_RUN_EVENT_SCHEMA,
+          tenantId: descriptor.tenantId,
+          runId: descriptor.runId,
+          eventId,
+          sequence: current.events.length + 1,
+          type: EVENT_TYPES.RAW_EVENT_REFERENCED,
+          subjectId: persisted.evidenceId,
+          payloadDigest: persisted.manifest.digest,
+          artifactRef: persisted.manifest.ref.ref,
+          keyRef: null,
+          data: {
+            evidenceKind: kind,
+            occurredAt,
+            derivationManifestDigest: persisted.manifest.digest,
+          },
+        });
+      }),
+    );
+
+  const ingress = Object.freeze({
+    schema: AGENT_EVOLUTION_INGRESS_SCHEMA,
+    tenantId: descriptor.tenantId,
+    runId: descriptor.runId,
+    start: () => guardIngress(serialize(() => appendStarted())),
+    ingestUserPrompt: (input, options) =>
+      ingest("user-prompt", { input: clone(input) }, options),
+    ingestAgentEvent: (event, options) => {
+      const baseKind = CORE_EVENT_KINDS.get(event?.type);
+      if (!baseKind) {
+        return Promise.resolve(Object.freeze({ ignored: true }));
+      }
+      const kind =
+        event.type === "tool-result" &&
+        Boolean(event.error || event.result?.error || event.result?.isError)
+          ? "tool-failed"
+          : baseKind;
+      return ingest(kind, { event: clone(event) }, options);
+    },
+    complete: (options = {}) =>
+      guardIngress(
+        serialize(async () => {
+          const loaded = runAdapter.load();
+          let projection;
+          if (loaded.projection?.status === "completed") {
+            projection = loaded.projection;
+          } else {
+            if (loaded.events.length === 0) appendStarted();
+            const current = runAdapter.load();
+            const occurredAt = timestamp(
+              options.occurredAt ?? currentTimestamp(),
+              "Agent completion occurredAt",
+            );
+            projection = runAdapter.appendEvent({
+              schema: EVOLUTION_RUN_EVENT_SCHEMA,
+              tenantId: descriptor.tenantId,
+              runId: descriptor.runId,
+              eventId: `${descriptor.runId}:completed`,
+              sequence: current.events.length + 1,
+              type: EVENT_TYPES.RUN_COMPLETED,
+              subjectId: descriptor.runId,
+              payloadDigest: digest({ occurredAt, status: "completed" }),
+              artifactRef: null,
+              keyRef: null,
+              data: { occurredAt, status: "completed" },
+            }).projection;
+          }
+          if (maintenanceProducer !== null) {
+            await maintenanceProducer.enqueueCompletedRun({
+              kind: completionTriggerKind,
+              runId: descriptor.runId,
+            });
+          }
+          return projection;
+        }),
+      ),
+  });
+  INGRESSES.add(ingress);
+  return ingress;
+}
+
+export function captureAgentEvolutionIngress(value, options = {}) {
+  if (!INGRESSES.has(value)) {
+    throw new TypeError("a branded Agent evolution ingress is required");
+  }
+  if (options.tenantId != null && value.tenantId !== options.tenantId) {
+    throw new TypeError("Agent evolution ingress belongs to another tenant");
+  }
+  return value;
+}

package/src/lib/evolution/agent-evolution-runtime-composition-brand.js

@@ -0,0 +1,22 @@
+export const AGENT_EVOLUTION_RUNTIME_COMPOSITION_SCHEMA =
+  "chainlesschain.agent-evolution-runtime-composition/v1";
+
+const COMPOSITIONS = new WeakSet();
+
+export function sealAgentEvolutionRuntimeComposition(fields) {
+  const composition = Object.freeze({
+    schema: AGENT_EVOLUTION_RUNTIME_COMPOSITION_SCHEMA,
+    ...fields,
+  });
+  COMPOSITIONS.add(composition);
+  return composition;
+}
+
+export function captureAgentEvolutionRuntimeComposition(value) {
+  if (!COMPOSITIONS.has(value)) {
+    throw new TypeError(
+      "a branded Agent evolution runtime composition is required",
+    );
+  }
+  return value;
+}

package/src/lib/evolution/agent-evolution-runtime-composition.js

@@ -0,0 +1,369 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { types as utilTypes } from "node:util";
+
+import { ArtifactStore } from "../artifact-store.js";
+import {
+  ArtifactStoreEncryptedRawStore,
+  EvolutionEvidenceArtifactAdapter,
+} from "./evolution-evidence-artifact-adapter.js";
+import {
+  EvolutionEvidenceBundleVerifier,
+  EvolutionEvidenceProjector,
+} from "./evolution-evidence-projector.js";
+import { EvolutionArtifactPorts } from "./evolution-artifact-ports.js";
+import {
+  captureEvolutionLedgerFileBackend,
+  createEvolutionLedgerFileBackend,
+} from "./evolution-ledger-file-backend.js";
+import { EvolutionRunLedgerAdapter } from "./evolution-run-ledger-adapter.js";
+import {
+  captureAgentEvolutionIngress,
+  createAgentEvolutionIngress,
+} from "./agent-evolution-ingress.js";
+import { sealAgentEvolutionRuntimeComposition } from "./agent-evolution-runtime-composition-brand.js";
+
+export {
+  AGENT_EVOLUTION_RUNTIME_COMPOSITION_SCHEMA,
+  captureAgentEvolutionRuntimeComposition,
+} from "./agent-evolution-runtime-composition-brand.js";
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
+const AUTHORITY_KEYS = new Set([
+  "artifact",
+  "attestationSigner",
+  "attestationVerifier",
+  "keyedCommitter",
+  "ledger",
+  "rawEncryptor",
+  "sourceEnvelope",
+  "sourceVerifier",
+  "storagePolicy",
+  "witness",
+]);
+const ARTIFACT_AUTHORITY_KEYS = new Set([
+  "currentAuthorityResolver",
+  "envelopeSigner",
+  "envelopeVerifier",
+]);
+
+function exactRecord(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value) ||
+    Reflect.ownKeys(value).length !== keys.size ||
+    Reflect.ownKeys(value).some(
+      (key) => typeof key !== "string" || !keys.has(key),
+    )
+  ) {
+    throw new TypeError(`${label} must contain exactly the required ports`);
+  }
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(`${label}.${String(key)} must be a data property`);
+    }
+  }
+  return value;
+}
+
+function identifier(value, label) {
+  if (typeof value !== "string" || !SAFE_ID.test(value)) {
+    throw new TypeError(`${label} is invalid`);
+  }
+  return value;
+}
+
+function capture(owner, method, label) {
+  if (
+    !owner ||
+    typeof owner !== "object" ||
+    utilTypes.isProxy(owner) ||
+    typeof owner[method] !== "function"
+  ) {
+    throw new TypeError(`${label}.${method} port is required`);
+  }
+  const operation = owner[method];
+  return Object.freeze((...args) => Reflect.apply(operation, owner, args));
+}
+
+function captureAuthority(authority, method, label) {
+  return Object.freeze({ [method]: capture(authority, method, label) });
+}
+
+function normalizeClock(clock) {
+  if (typeof clock !== "function" || utilTypes.isProxy(clock)) {
+    throw new TypeError("clock must be a non-proxy function");
+  }
+  return Object.freeze(() => {
+    const milliseconds = Number(clock());
+    if (!Number.isFinite(milliseconds)) {
+      throw new TypeError("clock must return epoch milliseconds");
+    }
+    return milliseconds;
+  });
+}
+
+function layout(stateRootDir, tenantId, runId) {
+  if (typeof stateRootDir !== "string" || stateRootDir.trim() === "") {
+    throw new TypeError("stateRootDir is required");
+  }
+  const rootDir = path.resolve(stateRootDir);
+  const scope = path.join(
+    rootDir,
+    encodeURIComponent(tenantId),
+    encodeURIComponent(runId),
+  );
+  const result = Object.freeze({
+    rootDir,
+    artifactDir: path.join(scope, "artifacts"),
+    rawDir: path.join(scope, "raw"),
+    ledgerRootDir: path.join(scope, "ledger-events"),
+    ledgerAuthorityRootDir: path.join(scope, "ledger-authority"),
+    witnessFilePath: path.join(scope, "witness", "checkpoint.json"),
+  });
+  fs.mkdirSync(path.dirname(result.witnessFilePath), {
+    recursive: true,
+    mode: 0o700,
+  });
+  return result;
+}
+
+function defaultWitnessId(tenantId, runId) {
+  return `agent-evolution-${crypto
+    .createHash("sha256")
+    .update(`${tenantId}\0${runId}`, "utf8")
+    .digest("hex")}`;
+}
+
+function assertIndependentSigningAuthorities(ledger, witness) {
+  if (
+    !ledger?.trust ||
+    !witness?.trust ||
+    ledger === witness ||
+    ledger.signer === witness.signer ||
+    ledger.verifier === witness.verifier ||
+    ledger.trust === witness.trust ||
+    ledger.trust.keyId === witness.trust.keyId ||
+    ledger.trust.trustPolicyDigest === witness.trust.trustPolicyDigest
+  ) {
+    throw new TypeError(
+      "ledger and witness production authorities must be independent",
+    );
+  }
+}
+
+/**
+ * Production composition root for the CLI Agent evolution ingress.
+ *
+ * Every cryptographic, identity, policy, commitment and encryption operation
+ * is supplied by the host. This module deliberately contains no local key,
+ * permissive policy, environment fallback, or auto-enable path.
+ */
+export function createAgentEvolutionRuntimeComposition({
+  tenantId: tenantIdInput,
+  runId: runIdInput,
+  audience: audienceInput = "evolution-runtime",
+  stateRootDir,
+  authorities: authorityInput,
+  evidenceTtlMs,
+  witnessId: witnessIdInput,
+  clock: clockInput = Date.now,
+  evidenceIdGenerator,
+  ingressIdGenerator,
+  wikiMaintenanceProducer = null,
+  completionTriggerKind,
+  secure = true,
+  fsImpl,
+  lock,
+  random,
+  lockTimeoutMs,
+  witnessMaximumBytes,
+} = {}) {
+  const tenantId = identifier(tenantIdInput, "tenantId");
+  const runId = identifier(runIdInput, "runId");
+  const audience = identifier(audienceInput, "audience");
+  const witnessId = identifier(
+    witnessIdInput ?? defaultWitnessId(tenantId, runId),
+    "witnessId",
+  );
+  const authorities = exactRecord(
+    authorityInput,
+    AUTHORITY_KEYS,
+    "authorities",
+  );
+  const artifactAuthority = exactRecord(
+    authorities.artifact,
+    ARTIFACT_AUTHORITY_KEYS,
+    "authorities.artifact",
+  );
+  const clock = normalizeClock(clockInput);
+  if (
+    typeof evidenceIdGenerator !== "function" ||
+    utilTypes.isProxy(evidenceIdGenerator)
+  ) {
+    throw new TypeError("evidenceIdGenerator port is required");
+  }
+  if (
+    typeof ingressIdGenerator !== "function" ||
+    utilTypes.isProxy(ingressIdGenerator)
+  ) {
+    throw new TypeError("ingressIdGenerator port is required");
+  }
+  const ports = Object.freeze({
+    artifactEnvelopeSigner: captureAuthority(
+      artifactAuthority.envelopeSigner,
+      "sign",
+      "artifact envelope signer",
+    ),
+    artifactEnvelopeVerifier: captureAuthority(
+      artifactAuthority.envelopeVerifier,
+      "verify",
+      "artifact envelope verifier",
+    ),
+    artifactCurrentAuthorityResolver: captureAuthority(
+      artifactAuthority.currentAuthorityResolver,
+      "resolve",
+      "artifact current authority resolver",
+    ),
+    rawEncryptor: captureAuthority(
+      authorities.rawEncryptor,
+      "encrypt",
+      "Raw encryptor",
+    ),
+    sourceEnvelope: captureAuthority(
+      authorities.sourceEnvelope,
+      "issue",
+      "source envelope authority",
+    ),
+    sourceVerifier: captureAuthority(
+      authorities.sourceVerifier,
+      "verify",
+      "source verifier",
+    ),
+    keyedCommitter: captureAuthority(
+      authorities.keyedCommitter,
+      "commit",
+      "keyed committer",
+    ),
+    storagePolicy: captureAuthority(
+      authorities.storagePolicy,
+      "resolve",
+      "storage policy",
+    ),
+    attestationSigner: captureAuthority(
+      authorities.attestationSigner,
+      "sign",
+      "attestation signer",
+    ),
+    attestationVerifier: captureAuthority(
+      authorities.attestationVerifier,
+      "verify",
+      "attestation verifier",
+    ),
+  });
+  capture(authorities.ledger?.signer, "sign", "ledger signer");
+  capture(authorities.ledger?.verifier, "verify", "ledger verifier");
+  capture(authorities.witness?.signer, "sign", "witness signer");
+  capture(authorities.witness?.verifier, "verify", "witness verifier");
+  assertIndependentSigningAuthorities(authorities.ledger, authorities.witness);
+  const storage = layout(stateRootDir, tenantId, runId);
+  const artifactPorts = new EvolutionArtifactPorts({
+    tenantId,
+    audience,
+    artifactStore: new ArtifactStore({
+      dir: storage.artifactDir,
+      now: clock,
+    }),
+    envelopeSigner: ports.artifactEnvelopeSigner,
+    envelopeVerifier: ports.artifactEnvelopeVerifier,
+    currentAuthorityResolver: ports.artifactCurrentAuthorityResolver,
+    now: clock,
+  });
+  const rawStore = new ArtifactStoreEncryptedRawStore({
+    tenantId,
+    artifactStore: new ArtifactStore({
+      dir: storage.rawDir,
+      now: clock,
+    }),
+    encryptor: ports.rawEncryptor,
+  });
+  const projector = new EvolutionEvidenceProjector({
+    sourceVerifier: ports.sourceVerifier,
+    keyedCommitter: ports.keyedCommitter,
+    storagePolicy: ports.storagePolicy,
+    rawStore,
+    attestationSigner: ports.attestationSigner,
+    attestationVerifier: ports.attestationVerifier,
+    idGenerator: evidenceIdGenerator,
+    now: () => new Date(clock()),
+  });
+  const bundleVerifier = new EvolutionEvidenceBundleVerifier({
+    attestationVerifier: ports.attestationVerifier,
+    now: () => new Date(clock()),
+  });
+  const evidenceAdapter = new EvolutionEvidenceArtifactAdapter({
+    tenantId,
+    audience,
+    projector,
+    bundleVerifier,
+    artifactPorts,
+    ...(evidenceTtlMs === undefined ? {} : { ttlMs: evidenceTtlMs }),
+  });
+  const ledgerArtifactResolver =
+    artifactPorts.createEvolutionLedgerArtifactResolver({
+      purpose: "evolution-ledger",
+    });
+  const backend = createEvolutionLedgerFileBackend({
+    rootDir: storage.ledgerRootDir,
+    authorityRootDir: storage.ledgerAuthorityRootDir,
+    witnessFilePath: storage.witnessFilePath,
+    witnessId,
+    ledgerAuthority: authorities.ledger,
+    witnessAuthority: authorities.witness,
+    artifactResolver: ledgerArtifactResolver,
+    secure,
+    clock,
+    ...(fsImpl === undefined ? {} : { fsImpl }),
+    ...(lock === undefined ? {} : { lock }),
+    ...(random === undefined ? {} : { random }),
+    ...(lockTimeoutMs === undefined ? {} : { lockTimeoutMs }),
+    ...(witnessMaximumBytes === undefined ? {} : { witnessMaximumBytes }),
+  });
+  captureEvolutionLedgerFileBackend(backend);
+  const runAdapter = new EvolutionRunLedgerAdapter({
+    descriptor: {
+      tenantId,
+      artifactTenantId: tenantId,
+      runId,
+      audience,
+      purpose: "evolution-ledger",
+    },
+    artifactPorts,
+    ledger: backend.ledger,
+    ledgerArtifactResolver,
+    now: clock,
+  });
+  const evolutionIngress = createAgentEvolutionIngress({
+    evidenceAdapter,
+    runAdapter,
+    sourceEnvelopeAuthority: ports.sourceEnvelope,
+    wikiMaintenanceProducer,
+    ...(completionTriggerKind === undefined ? {} : { completionTriggerKind }),
+    now: () => new Date(clock()),
+    idGenerator: ingressIdGenerator,
+  });
+  captureAgentEvolutionIngress(evolutionIngress, { tenantId });
+
+  const composition = sealAgentEvolutionRuntimeComposition({
+    tenantId,
+    runId,
+    evolutionIngress,
+    loadRun: Object.freeze(() => runAdapter.load()),
+    ledgerDescriptor: backend.descriptor,
+    storage,
+  });
+  return composition;
+}