chainlesschain 0.81.0 → 0.143.0

package/src/lib/dlp-engine.js

@@ -691,3 +691,108 @@ export function getHighestUnresolvedSeverity() {
 }
 
 export { _v2PolicyMeta, _v2IncidentMeta, _builtinPolicyTemplates };
+
+
+// ===== V2 Surface: DLP Engine governance overlay (CLI v0.135.0) =====
+export const DLP_POLICY_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", SUSPENDED: "suspended", RETIRED: "retired",
+});
+export const DLP_SCAN_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", SCANNING: "scanning", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _dlpPolTrans = new Map([
+  [DLP_POLICY_MATURITY_V2.PENDING, new Set([DLP_POLICY_MATURITY_V2.ACTIVE, DLP_POLICY_MATURITY_V2.RETIRED])],
+  [DLP_POLICY_MATURITY_V2.ACTIVE, new Set([DLP_POLICY_MATURITY_V2.SUSPENDED, DLP_POLICY_MATURITY_V2.RETIRED])],
+  [DLP_POLICY_MATURITY_V2.SUSPENDED, new Set([DLP_POLICY_MATURITY_V2.ACTIVE, DLP_POLICY_MATURITY_V2.RETIRED])],
+  [DLP_POLICY_MATURITY_V2.RETIRED, new Set()],
+]);
+const _dlpPolTerminal = new Set([DLP_POLICY_MATURITY_V2.RETIRED]);
+const _dlpScanTrans = new Map([
+  [DLP_SCAN_LIFECYCLE_V2.QUEUED, new Set([DLP_SCAN_LIFECYCLE_V2.SCANNING, DLP_SCAN_LIFECYCLE_V2.CANCELLED])],
+  [DLP_SCAN_LIFECYCLE_V2.SCANNING, new Set([DLP_SCAN_LIFECYCLE_V2.COMPLETED, DLP_SCAN_LIFECYCLE_V2.FAILED, DLP_SCAN_LIFECYCLE_V2.CANCELLED])],
+  [DLP_SCAN_LIFECYCLE_V2.COMPLETED, new Set()],
+  [DLP_SCAN_LIFECYCLE_V2.FAILED, new Set()],
+  [DLP_SCAN_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _dlpPols = new Map();
+const _dlpScans = new Map();
+let _dlpMaxActivePerOwner = 16;
+let _dlpMaxPendingPerPol = 20;
+let _dlpPolIdleMs = 12 * 60 * 60 * 1000;
+let _dlpScanStuckMs = 5 * 60 * 1000;
+
+function _dlpPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveDlpPoliciesPerOwnerV2(n) { _dlpMaxActivePerOwner = _dlpPos(n, "maxActiveDlpPoliciesPerOwner"); }
+export function getMaxActiveDlpPoliciesPerOwnerV2() { return _dlpMaxActivePerOwner; }
+export function setMaxPendingDlpScansPerPolicyV2(n) { _dlpMaxPendingPerPol = _dlpPos(n, "maxPendingDlpScansPerPolicy"); }
+export function getMaxPendingDlpScansPerPolicyV2() { return _dlpMaxPendingPerPol; }
+export function setDlpPolicyIdleMsV2(n) { _dlpPolIdleMs = _dlpPos(n, "dlpPolicyIdleMs"); }
+export function getDlpPolicyIdleMsV2() { return _dlpPolIdleMs; }
+export function setDlpScanStuckMsV2(n) { _dlpScanStuckMs = _dlpPos(n, "dlpScanStuckMs"); }
+export function getDlpScanStuckMsV2() { return _dlpScanStuckMs; }
+
+export function _resetStateDlpEngineV2() {
+  _dlpPols.clear(); _dlpScans.clear();
+  _dlpMaxActivePerOwner = 16; _dlpMaxPendingPerPol = 20;
+  _dlpPolIdleMs = 12 * 60 * 60 * 1000; _dlpScanStuckMs = 5 * 60 * 1000;
+}
+
+export function registerDlpPolicyV2({ id, owner, classification, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_dlpPols.has(id)) throw new Error(`dlp policy ${id} already registered`);
+  const now = Date.now();
+  const p = { id, owner, classification: classification || "internal", status: DLP_POLICY_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, retiredAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _dlpPols.set(id, p);
+  return { ...p, metadata: { ...p.metadata } };
+}
+function _dlpCheckP(from, to) { const a = _dlpPolTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid dlp policy transition ${from} → ${to}`); }
+function _dlpCountActive(owner) { let n = 0; for (const p of _dlpPols.values()) if (p.owner === owner && p.status === DLP_POLICY_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateDlpPolicyV2(id) {
+  const p = _dlpPols.get(id); if (!p) throw new Error(`dlp policy ${id} not found`);
+  _dlpCheckP(p.status, DLP_POLICY_MATURITY_V2.ACTIVE);
+  const recovery = p.status === DLP_POLICY_MATURITY_V2.SUSPENDED;
+  if (!recovery) { const a = _dlpCountActive(p.owner); if (a >= _dlpMaxActivePerOwner) throw new Error(`max active dlp policies per owner (${_dlpMaxActivePerOwner}) reached for ${p.owner}`); }
+  const now = Date.now(); p.status = DLP_POLICY_MATURITY_V2.ACTIVE; p.updatedAt = now; p.lastTouchedAt = now; if (!p.activatedAt) p.activatedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function suspendDlpPolicyV2(id) { const p = _dlpPols.get(id); if (!p) throw new Error(`dlp policy ${id} not found`); _dlpCheckP(p.status, DLP_POLICY_MATURITY_V2.SUSPENDED); p.status = DLP_POLICY_MATURITY_V2.SUSPENDED; p.updatedAt = Date.now(); return { ...p, metadata: { ...p.metadata } }; }
+export function retireDlpPolicyV2(id) { const p = _dlpPols.get(id); if (!p) throw new Error(`dlp policy ${id} not found`); _dlpCheckP(p.status, DLP_POLICY_MATURITY_V2.RETIRED); const now = Date.now(); p.status = DLP_POLICY_MATURITY_V2.RETIRED; p.updatedAt = now; if (!p.retiredAt) p.retiredAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function touchDlpPolicyV2(id) { const p = _dlpPols.get(id); if (!p) throw new Error(`dlp policy ${id} not found`); if (_dlpPolTerminal.has(p.status)) throw new Error(`cannot touch terminal dlp policy ${id}`); const now = Date.now(); p.lastTouchedAt = now; p.updatedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function getDlpPolicyV2(id) { const p = _dlpPols.get(id); if (!p) return null; return { ...p, metadata: { ...p.metadata } }; }
+export function listDlpPoliciesV2() { return [..._dlpPols.values()].map((p) => ({ ...p, metadata: { ...p.metadata } })); }
+
+function _dlpCountPending(pid) { let n = 0; for (const s of _dlpScans.values()) if (s.policyId === pid && (s.status === DLP_SCAN_LIFECYCLE_V2.QUEUED || s.status === DLP_SCAN_LIFECYCLE_V2.SCANNING)) n++; return n; }
+
+export function createDlpScanV2({ id, policyId, target, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!policyId || typeof policyId !== "string") throw new Error("policyId is required");
+  if (_dlpScans.has(id)) throw new Error(`dlp scan ${id} already exists`);
+  if (!_dlpPols.has(policyId)) throw new Error(`dlp policy ${policyId} not found`);
+  const pending = _dlpCountPending(policyId);
+  if (pending >= _dlpMaxPendingPerPol) throw new Error(`max pending dlp scans per policy (${_dlpMaxPendingPerPol}) reached for ${policyId}`);
+  const now = Date.now();
+  const s = { id, policyId, target: target || "", status: DLP_SCAN_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _dlpScans.set(id, s);
+  return { ...s, metadata: { ...s.metadata } };
+}
+function _dlpCheckS(from, to) { const a = _dlpScanTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid dlp scan transition ${from} → ${to}`); }
+export function startDlpScanV2(id) { const s = _dlpScans.get(id); if (!s) throw new Error(`dlp scan ${id} not found`); _dlpCheckS(s.status, DLP_SCAN_LIFECYCLE_V2.SCANNING); const now = Date.now(); s.status = DLP_SCAN_LIFECYCLE_V2.SCANNING; s.updatedAt = now; if (!s.startedAt) s.startedAt = now; return { ...s, metadata: { ...s.metadata } }; }
+export function completeDlpScanV2(id) { const s = _dlpScans.get(id); if (!s) throw new Error(`dlp scan ${id} not found`); _dlpCheckS(s.status, DLP_SCAN_LIFECYCLE_V2.COMPLETED); const now = Date.now(); s.status = DLP_SCAN_LIFECYCLE_V2.COMPLETED; s.updatedAt = now; if (!s.settledAt) s.settledAt = now; return { ...s, metadata: { ...s.metadata } }; }
+export function failDlpScanV2(id, reason) { const s = _dlpScans.get(id); if (!s) throw new Error(`dlp scan ${id} not found`); _dlpCheckS(s.status, DLP_SCAN_LIFECYCLE_V2.FAILED); const now = Date.now(); s.status = DLP_SCAN_LIFECYCLE_V2.FAILED; s.updatedAt = now; if (!s.settledAt) s.settledAt = now; if (reason) s.metadata.failReason = String(reason); return { ...s, metadata: { ...s.metadata } }; }
+export function cancelDlpScanV2(id, reason) { const s = _dlpScans.get(id); if (!s) throw new Error(`dlp scan ${id} not found`); _dlpCheckS(s.status, DLP_SCAN_LIFECYCLE_V2.CANCELLED); const now = Date.now(); s.status = DLP_SCAN_LIFECYCLE_V2.CANCELLED; s.updatedAt = now; if (!s.settledAt) s.settledAt = now; if (reason) s.metadata.cancelReason = String(reason); return { ...s, metadata: { ...s.metadata } }; }
+export function getDlpScanV2(id) { const s = _dlpScans.get(id); if (!s) return null; return { ...s, metadata: { ...s.metadata } }; }
+export function listDlpScansV2() { return [..._dlpScans.values()].map((s) => ({ ...s, metadata: { ...s.metadata } })); }
+
+export function autoSuspendIdleDlpPoliciesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const p of _dlpPols.values()) if (p.status === DLP_POLICY_MATURITY_V2.ACTIVE && (t - p.lastTouchedAt) >= _dlpPolIdleMs) { p.status = DLP_POLICY_MATURITY_V2.SUSPENDED; p.updatedAt = t; flipped.push(p.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckDlpScansV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const s of _dlpScans.values()) if (s.status === DLP_SCAN_LIFECYCLE_V2.SCANNING && s.startedAt != null && (t - s.startedAt) >= _dlpScanStuckMs) { s.status = DLP_SCAN_LIFECYCLE_V2.FAILED; s.updatedAt = t; if (!s.settledAt) s.settledAt = t; s.metadata.failReason = "auto-fail-stuck"; flipped.push(s.id); } return { flipped, count: flipped.length }; }
+
+export function getDlpEngineStatsV2() {
+  const policiesByStatus = {}; for (const s of Object.values(DLP_POLICY_MATURITY_V2)) policiesByStatus[s] = 0; for (const p of _dlpPols.values()) policiesByStatus[p.status]++;
+  const scansByStatus = {}; for (const s of Object.values(DLP_SCAN_LIFECYCLE_V2)) scansByStatus[s] = 0; for (const sc of _dlpScans.values()) scansByStatus[sc.status]++;
+  return { totalPoliciesV2: _dlpPols.size, totalScansV2: _dlpScans.size, maxActiveDlpPoliciesPerOwner: _dlpMaxActivePerOwner, maxPendingDlpScansPerPolicy: _dlpMaxPendingPerPol, dlpPolicyIdleMs: _dlpPolIdleMs, dlpScanStuckMs: _dlpScanStuckMs, policiesByStatus, scansByStatus };
+}

package/src/lib/evolution-system.js

@@ -959,3 +959,108 @@ export function _resetV2State() {
   _v2Config.predictionHorizonMs = 86400000;
   _v2Config.growthLogRetentionDays = 365;
 }
+
+
+// ===== V2 Surface: Evolution System governance overlay (CLI v0.137.0) =====
+export const EVO_GOAL_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", PAUSED: "paused", ARCHIVED: "archived",
+});
+export const EVO_CYCLE_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _evoGoalTrans = new Map([
+  [EVO_GOAL_MATURITY_V2.PENDING, new Set([EVO_GOAL_MATURITY_V2.ACTIVE, EVO_GOAL_MATURITY_V2.ARCHIVED])],
+  [EVO_GOAL_MATURITY_V2.ACTIVE, new Set([EVO_GOAL_MATURITY_V2.PAUSED, EVO_GOAL_MATURITY_V2.ARCHIVED])],
+  [EVO_GOAL_MATURITY_V2.PAUSED, new Set([EVO_GOAL_MATURITY_V2.ACTIVE, EVO_GOAL_MATURITY_V2.ARCHIVED])],
+  [EVO_GOAL_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _evoGoalTerminal = new Set([EVO_GOAL_MATURITY_V2.ARCHIVED]);
+const _evoCycleTrans = new Map([
+  [EVO_CYCLE_LIFECYCLE_V2.QUEUED, new Set([EVO_CYCLE_LIFECYCLE_V2.RUNNING, EVO_CYCLE_LIFECYCLE_V2.CANCELLED])],
+  [EVO_CYCLE_LIFECYCLE_V2.RUNNING, new Set([EVO_CYCLE_LIFECYCLE_V2.COMPLETED, EVO_CYCLE_LIFECYCLE_V2.FAILED, EVO_CYCLE_LIFECYCLE_V2.CANCELLED])],
+  [EVO_CYCLE_LIFECYCLE_V2.COMPLETED, new Set()],
+  [EVO_CYCLE_LIFECYCLE_V2.FAILED, new Set()],
+  [EVO_CYCLE_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _evoGoals = new Map();
+const _evoCycles = new Map();
+let _evoMaxActivePerOwner = 6;
+let _evoMaxPendingPerGoal = 12;
+let _evoGoalIdleMs = 14 * 24 * 60 * 60 * 1000;
+let _evoCycleStuckMs = 10 * 60 * 1000;
+
+function _evoPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveEvoGoalsPerOwnerV2(n) { _evoMaxActivePerOwner = _evoPos(n, "maxActiveEvoGoalsPerOwner"); }
+export function getMaxActiveEvoGoalsPerOwnerV2() { return _evoMaxActivePerOwner; }
+export function setMaxPendingEvoCyclesPerGoalV2(n) { _evoMaxPendingPerGoal = _evoPos(n, "maxPendingEvoCyclesPerGoal"); }
+export function getMaxPendingEvoCyclesPerGoalV2() { return _evoMaxPendingPerGoal; }
+export function setEvoGoalIdleMsV2(n) { _evoGoalIdleMs = _evoPos(n, "evoGoalIdleMs"); }
+export function getEvoGoalIdleMsV2() { return _evoGoalIdleMs; }
+export function setEvoCycleStuckMsV2(n) { _evoCycleStuckMs = _evoPos(n, "evoCycleStuckMs"); }
+export function getEvoCycleStuckMsV2() { return _evoCycleStuckMs; }
+
+export function _resetStateEvolutionSystemV2() {
+  _evoGoals.clear(); _evoCycles.clear();
+  _evoMaxActivePerOwner = 6; _evoMaxPendingPerGoal = 12;
+  _evoGoalIdleMs = 14 * 24 * 60 * 60 * 1000; _evoCycleStuckMs = 10 * 60 * 1000;
+}
+
+export function registerEvoGoalV2({ id, owner, objective, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_evoGoals.has(id)) throw new Error(`evo goal ${id} already registered`);
+  const now = Date.now();
+  const g = { id, owner, objective: objective || "", status: EVO_GOAL_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, archivedAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _evoGoals.set(id, g);
+  return { ...g, metadata: { ...g.metadata } };
+}
+function _evoCheckG(from, to) { const a = _evoGoalTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid evo goal transition ${from} → ${to}`); }
+function _evoCountActive(owner) { let n = 0; for (const g of _evoGoals.values()) if (g.owner === owner && g.status === EVO_GOAL_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateEvoGoalV2(id) {
+  const g = _evoGoals.get(id); if (!g) throw new Error(`evo goal ${id} not found`);
+  _evoCheckG(g.status, EVO_GOAL_MATURITY_V2.ACTIVE);
+  const recovery = g.status === EVO_GOAL_MATURITY_V2.PAUSED;
+  if (!recovery) { const a = _evoCountActive(g.owner); if (a >= _evoMaxActivePerOwner) throw new Error(`max active evo goals per owner (${_evoMaxActivePerOwner}) reached for ${g.owner}`); }
+  const now = Date.now(); g.status = EVO_GOAL_MATURITY_V2.ACTIVE; g.updatedAt = now; g.lastTouchedAt = now; if (!g.activatedAt) g.activatedAt = now;
+  return { ...g, metadata: { ...g.metadata } };
+}
+export function pauseEvoGoalV2(id) { const g = _evoGoals.get(id); if (!g) throw new Error(`evo goal ${id} not found`); _evoCheckG(g.status, EVO_GOAL_MATURITY_V2.PAUSED); g.status = EVO_GOAL_MATURITY_V2.PAUSED; g.updatedAt = Date.now(); return { ...g, metadata: { ...g.metadata } }; }
+export function archiveEvoGoalV2(id) { const g = _evoGoals.get(id); if (!g) throw new Error(`evo goal ${id} not found`); _evoCheckG(g.status, EVO_GOAL_MATURITY_V2.ARCHIVED); const now = Date.now(); g.status = EVO_GOAL_MATURITY_V2.ARCHIVED; g.updatedAt = now; if (!g.archivedAt) g.archivedAt = now; return { ...g, metadata: { ...g.metadata } }; }
+export function touchEvoGoalV2(id) { const g = _evoGoals.get(id); if (!g) throw new Error(`evo goal ${id} not found`); if (_evoGoalTerminal.has(g.status)) throw new Error(`cannot touch terminal evo goal ${id}`); const now = Date.now(); g.lastTouchedAt = now; g.updatedAt = now; return { ...g, metadata: { ...g.metadata } }; }
+export function getEvoGoalV2(id) { const g = _evoGoals.get(id); if (!g) return null; return { ...g, metadata: { ...g.metadata } }; }
+export function listEvoGoalsV2() { return [..._evoGoals.values()].map((g) => ({ ...g, metadata: { ...g.metadata } })); }
+
+function _evoCountPending(gid) { let n = 0; for (const c of _evoCycles.values()) if (c.goalId === gid && (c.status === EVO_CYCLE_LIFECYCLE_V2.QUEUED || c.status === EVO_CYCLE_LIFECYCLE_V2.RUNNING)) n++; return n; }
+
+export function createEvoCycleV2({ id, goalId, generation, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!goalId || typeof goalId !== "string") throw new Error("goalId is required");
+  if (_evoCycles.has(id)) throw new Error(`evo cycle ${id} already exists`);
+  if (!_evoGoals.has(goalId)) throw new Error(`evo goal ${goalId} not found`);
+  const pending = _evoCountPending(goalId);
+  if (pending >= _evoMaxPendingPerGoal) throw new Error(`max pending evo cycles per goal (${_evoMaxPendingPerGoal}) reached for ${goalId}`);
+  const now = Date.now();
+  const c = { id, goalId, generation: generation ?? 0, status: EVO_CYCLE_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _evoCycles.set(id, c);
+  return { ...c, metadata: { ...c.metadata } };
+}
+function _evoCheckC(from, to) { const a = _evoCycleTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid evo cycle transition ${from} → ${to}`); }
+export function startEvoCycleV2(id) { const c = _evoCycles.get(id); if (!c) throw new Error(`evo cycle ${id} not found`); _evoCheckC(c.status, EVO_CYCLE_LIFECYCLE_V2.RUNNING); const now = Date.now(); c.status = EVO_CYCLE_LIFECYCLE_V2.RUNNING; c.updatedAt = now; if (!c.startedAt) c.startedAt = now; return { ...c, metadata: { ...c.metadata } }; }
+export function completeEvoCycleV2(id) { const c = _evoCycles.get(id); if (!c) throw new Error(`evo cycle ${id} not found`); _evoCheckC(c.status, EVO_CYCLE_LIFECYCLE_V2.COMPLETED); const now = Date.now(); c.status = EVO_CYCLE_LIFECYCLE_V2.COMPLETED; c.updatedAt = now; if (!c.settledAt) c.settledAt = now; return { ...c, metadata: { ...c.metadata } }; }
+export function failEvoCycleV2(id, reason) { const c = _evoCycles.get(id); if (!c) throw new Error(`evo cycle ${id} not found`); _evoCheckC(c.status, EVO_CYCLE_LIFECYCLE_V2.FAILED); const now = Date.now(); c.status = EVO_CYCLE_LIFECYCLE_V2.FAILED; c.updatedAt = now; if (!c.settledAt) c.settledAt = now; if (reason) c.metadata.failReason = String(reason); return { ...c, metadata: { ...c.metadata } }; }
+export function cancelEvoCycleV2(id, reason) { const c = _evoCycles.get(id); if (!c) throw new Error(`evo cycle ${id} not found`); _evoCheckC(c.status, EVO_CYCLE_LIFECYCLE_V2.CANCELLED); const now = Date.now(); c.status = EVO_CYCLE_LIFECYCLE_V2.CANCELLED; c.updatedAt = now; if (!c.settledAt) c.settledAt = now; if (reason) c.metadata.cancelReason = String(reason); return { ...c, metadata: { ...c.metadata } }; }
+export function getEvoCycleV2(id) { const c = _evoCycles.get(id); if (!c) return null; return { ...c, metadata: { ...c.metadata } }; }
+export function listEvoCyclesV2() { return [..._evoCycles.values()].map((c) => ({ ...c, metadata: { ...c.metadata } })); }
+
+export function autoPauseIdleEvoGoalsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const g of _evoGoals.values()) if (g.status === EVO_GOAL_MATURITY_V2.ACTIVE && (t - g.lastTouchedAt) >= _evoGoalIdleMs) { g.status = EVO_GOAL_MATURITY_V2.PAUSED; g.updatedAt = t; flipped.push(g.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckEvoCyclesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const c of _evoCycles.values()) if (c.status === EVO_CYCLE_LIFECYCLE_V2.RUNNING && c.startedAt != null && (t - c.startedAt) >= _evoCycleStuckMs) { c.status = EVO_CYCLE_LIFECYCLE_V2.FAILED; c.updatedAt = t; if (!c.settledAt) c.settledAt = t; c.metadata.failReason = "auto-fail-stuck"; flipped.push(c.id); } return { flipped, count: flipped.length }; }
+
+export function getEvolutionSystemGovStatsV2() {
+  const goalsByStatus = {}; for (const s of Object.values(EVO_GOAL_MATURITY_V2)) goalsByStatus[s] = 0; for (const g of _evoGoals.values()) goalsByStatus[g.status]++;
+  const cyclesByStatus = {}; for (const s of Object.values(EVO_CYCLE_LIFECYCLE_V2)) cyclesByStatus[s] = 0; for (const c of _evoCycles.values()) cyclesByStatus[c.status]++;
+  return { totalGoalsV2: _evoGoals.size, totalCyclesV2: _evoCycles.size, maxActiveEvoGoalsPerOwner: _evoMaxActivePerOwner, maxPendingEvoCyclesPerGoal: _evoMaxPendingPerGoal, evoGoalIdleMs: _evoGoalIdleMs, evoCycleStuckMs: _evoCycleStuckMs, goalsByStatus, cyclesByStatus };
+}

package/src/lib/evomap-manager.js

@@ -225,3 +225,108 @@ export class EvoMapManager {
     };
   }
 }
+
+
+// ===== V2 Surface: EvoMap Manager governance overlay (CLI v0.135.0) =====
+export const EVOMAP_MAP_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", STALE: "stale", ARCHIVED: "archived",
+});
+export const EVOMAP_EVOLUTION_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", COMPLETED: "completed", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _emMapTrans = new Map([
+  [EVOMAP_MAP_MATURITY_V2.PENDING, new Set([EVOMAP_MAP_MATURITY_V2.ACTIVE, EVOMAP_MAP_MATURITY_V2.ARCHIVED])],
+  [EVOMAP_MAP_MATURITY_V2.ACTIVE, new Set([EVOMAP_MAP_MATURITY_V2.STALE, EVOMAP_MAP_MATURITY_V2.ARCHIVED])],
+  [EVOMAP_MAP_MATURITY_V2.STALE, new Set([EVOMAP_MAP_MATURITY_V2.ACTIVE, EVOMAP_MAP_MATURITY_V2.ARCHIVED])],
+  [EVOMAP_MAP_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _emMapTerminal = new Set([EVOMAP_MAP_MATURITY_V2.ARCHIVED]);
+const _emEvoTrans = new Map([
+  [EVOMAP_EVOLUTION_LIFECYCLE_V2.QUEUED, new Set([EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING, EVOMAP_EVOLUTION_LIFECYCLE_V2.CANCELLED])],
+  [EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING, new Set([EVOMAP_EVOLUTION_LIFECYCLE_V2.COMPLETED, EVOMAP_EVOLUTION_LIFECYCLE_V2.FAILED, EVOMAP_EVOLUTION_LIFECYCLE_V2.CANCELLED])],
+  [EVOMAP_EVOLUTION_LIFECYCLE_V2.COMPLETED, new Set()],
+  [EVOMAP_EVOLUTION_LIFECYCLE_V2.FAILED, new Set()],
+  [EVOMAP_EVOLUTION_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _emMaps = new Map();
+const _emEvos = new Map();
+let _emMaxActivePerOwner = 10;
+let _emMaxPendingPerMap = 15;
+let _emMapIdleMs = 7 * 24 * 60 * 60 * 1000;
+let _emEvoStuckMs = 5 * 60 * 1000;
+
+function _emPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveEvoMapsPerOwnerV2(n) { _emMaxActivePerOwner = _emPos(n, "maxActiveEvoMapsPerOwner"); }
+export function getMaxActiveEvoMapsPerOwnerV2() { return _emMaxActivePerOwner; }
+export function setMaxPendingEvoEvolutionsPerMapV2(n) { _emMaxPendingPerMap = _emPos(n, "maxPendingEvoEvolutionsPerMap"); }
+export function getMaxPendingEvoEvolutionsPerMapV2() { return _emMaxPendingPerMap; }
+export function setEvoMapIdleMsV2(n) { _emMapIdleMs = _emPos(n, "evoMapIdleMs"); }
+export function getEvoMapIdleMsV2() { return _emMapIdleMs; }
+export function setEvoEvolutionStuckMsV2(n) { _emEvoStuckMs = _emPos(n, "evoEvolutionStuckMs"); }
+export function getEvoEvolutionStuckMsV2() { return _emEvoStuckMs; }
+
+export function _resetStateEvoMapManagerV2() {
+  _emMaps.clear(); _emEvos.clear();
+  _emMaxActivePerOwner = 10; _emMaxPendingPerMap = 15;
+  _emMapIdleMs = 7 * 24 * 60 * 60 * 1000; _emEvoStuckMs = 5 * 60 * 1000;
+}
+
+export function registerEvoMapV2({ id, owner, name, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_emMaps.has(id)) throw new Error(`evomap ${id} already registered`);
+  const now = Date.now();
+  const m = { id, owner, name: name || id, status: EVOMAP_MAP_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, archivedAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _emMaps.set(id, m);
+  return { ...m, metadata: { ...m.metadata } };
+}
+function _emCheckM(from, to) { const a = _emMapTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid evomap transition ${from} → ${to}`); }
+function _emCountActive(owner) { let n = 0; for (const m of _emMaps.values()) if (m.owner === owner && m.status === EVOMAP_MAP_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateEvoMapV2(id) {
+  const m = _emMaps.get(id); if (!m) throw new Error(`evomap ${id} not found`);
+  _emCheckM(m.status, EVOMAP_MAP_MATURITY_V2.ACTIVE);
+  const recovery = m.status === EVOMAP_MAP_MATURITY_V2.STALE;
+  if (!recovery) { const a = _emCountActive(m.owner); if (a >= _emMaxActivePerOwner) throw new Error(`max active evomaps per owner (${_emMaxActivePerOwner}) reached for ${m.owner}`); }
+  const now = Date.now(); m.status = EVOMAP_MAP_MATURITY_V2.ACTIVE; m.updatedAt = now; m.lastTouchedAt = now; if (!m.activatedAt) m.activatedAt = now;
+  return { ...m, metadata: { ...m.metadata } };
+}
+export function staleEvoMapV2(id) { const m = _emMaps.get(id); if (!m) throw new Error(`evomap ${id} not found`); _emCheckM(m.status, EVOMAP_MAP_MATURITY_V2.STALE); m.status = EVOMAP_MAP_MATURITY_V2.STALE; m.updatedAt = Date.now(); return { ...m, metadata: { ...m.metadata } }; }
+export function archiveEvoMapV2(id) { const m = _emMaps.get(id); if (!m) throw new Error(`evomap ${id} not found`); _emCheckM(m.status, EVOMAP_MAP_MATURITY_V2.ARCHIVED); const now = Date.now(); m.status = EVOMAP_MAP_MATURITY_V2.ARCHIVED; m.updatedAt = now; if (!m.archivedAt) m.archivedAt = now; return { ...m, metadata: { ...m.metadata } }; }
+export function touchEvoMapV2(id) { const m = _emMaps.get(id); if (!m) throw new Error(`evomap ${id} not found`); if (_emMapTerminal.has(m.status)) throw new Error(`cannot touch terminal evomap ${id}`); const now = Date.now(); m.lastTouchedAt = now; m.updatedAt = now; return { ...m, metadata: { ...m.metadata } }; }
+export function getEvoMapV2(id) { const m = _emMaps.get(id); if (!m) return null; return { ...m, metadata: { ...m.metadata } }; }
+export function listEvoMapsV2() { return [..._emMaps.values()].map((m) => ({ ...m, metadata: { ...m.metadata } })); }
+
+function _emCountPending(mid) { let n = 0; for (const e of _emEvos.values()) if (e.mapId === mid && (e.status === EVOMAP_EVOLUTION_LIFECYCLE_V2.QUEUED || e.status === EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING)) n++; return n; }
+
+export function createEvoEvolutionV2({ id, mapId, strategy, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!mapId || typeof mapId !== "string") throw new Error("mapId is required");
+  if (_emEvos.has(id)) throw new Error(`evo evolution ${id} already exists`);
+  if (!_emMaps.has(mapId)) throw new Error(`evomap ${mapId} not found`);
+  const pending = _emCountPending(mapId);
+  if (pending >= _emMaxPendingPerMap) throw new Error(`max pending evo evolutions per map (${_emMaxPendingPerMap}) reached for ${mapId}`);
+  const now = Date.now();
+  const e = { id, mapId, strategy: strategy || "default", status: EVOMAP_EVOLUTION_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _emEvos.set(id, e);
+  return { ...e, metadata: { ...e.metadata } };
+}
+function _emCheckE(from, to) { const a = _emEvoTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid evo evolution transition ${from} → ${to}`); }
+export function startEvoEvolutionV2(id) { const e = _emEvos.get(id); if (!e) throw new Error(`evo evolution ${id} not found`); _emCheckE(e.status, EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING); const now = Date.now(); e.status = EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING; e.updatedAt = now; if (!e.startedAt) e.startedAt = now; return { ...e, metadata: { ...e.metadata } }; }
+export function completeEvoEvolutionV2(id) { const e = _emEvos.get(id); if (!e) throw new Error(`evo evolution ${id} not found`); _emCheckE(e.status, EVOMAP_EVOLUTION_LIFECYCLE_V2.COMPLETED); const now = Date.now(); e.status = EVOMAP_EVOLUTION_LIFECYCLE_V2.COMPLETED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; return { ...e, metadata: { ...e.metadata } }; }
+export function failEvoEvolutionV2(id, reason) { const e = _emEvos.get(id); if (!e) throw new Error(`evo evolution ${id} not found`); _emCheckE(e.status, EVOMAP_EVOLUTION_LIFECYCLE_V2.FAILED); const now = Date.now(); e.status = EVOMAP_EVOLUTION_LIFECYCLE_V2.FAILED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; if (reason) e.metadata.failReason = String(reason); return { ...e, metadata: { ...e.metadata } }; }
+export function cancelEvoEvolutionV2(id, reason) { const e = _emEvos.get(id); if (!e) throw new Error(`evo evolution ${id} not found`); _emCheckE(e.status, EVOMAP_EVOLUTION_LIFECYCLE_V2.CANCELLED); const now = Date.now(); e.status = EVOMAP_EVOLUTION_LIFECYCLE_V2.CANCELLED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; if (reason) e.metadata.cancelReason = String(reason); return { ...e, metadata: { ...e.metadata } }; }
+export function getEvoEvolutionV2(id) { const e = _emEvos.get(id); if (!e) return null; return { ...e, metadata: { ...e.metadata } }; }
+export function listEvoEvolutionsV2() { return [..._emEvos.values()].map((e) => ({ ...e, metadata: { ...e.metadata } })); }
+
+export function autoStaleIdleEvoMapsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const m of _emMaps.values()) if (m.status === EVOMAP_MAP_MATURITY_V2.ACTIVE && (t - m.lastTouchedAt) >= _emMapIdleMs) { m.status = EVOMAP_MAP_MATURITY_V2.STALE; m.updatedAt = t; flipped.push(m.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckEvoEvolutionsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const e of _emEvos.values()) if (e.status === EVOMAP_EVOLUTION_LIFECYCLE_V2.RUNNING && e.startedAt != null && (t - e.startedAt) >= _emEvoStuckMs) { e.status = EVOMAP_EVOLUTION_LIFECYCLE_V2.FAILED; e.updatedAt = t; if (!e.settledAt) e.settledAt = t; e.metadata.failReason = "auto-fail-stuck"; flipped.push(e.id); } return { flipped, count: flipped.length }; }
+
+export function getEvoMapManagerStatsV2() {
+  const mapsByStatus = {}; for (const s of Object.values(EVOMAP_MAP_MATURITY_V2)) mapsByStatus[s] = 0; for (const m of _emMaps.values()) mapsByStatus[m.status]++;
+  const evosByStatus = {}; for (const s of Object.values(EVOMAP_EVOLUTION_LIFECYCLE_V2)) evosByStatus[s] = 0; for (const e of _emEvos.values()) evosByStatus[e.status]++;
+  return { totalMapsV2: _emMaps.size, totalEvolutionsV2: _emEvos.size, maxActiveEvoMapsPerOwner: _emMaxActivePerOwner, maxPendingEvoEvolutionsPerMap: _emMaxPendingPerMap, evoMapIdleMs: _emMapIdleMs, evoEvolutionStuckMs: _emEvoStuckMs, mapsByStatus, evosByStatus };
+}

package/src/lib/execution-backend.js

@@ -237,3 +237,108 @@ export function createBackend(config = {}) {
       return new LocalBackend(config.options || {});
   }
 }
+
+
+// ===== V2 Surface: Execution Backend governance overlay (CLI v0.133.0) =====
+export const EXECBE_BACKEND_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", DEGRADED: "degraded", RETIRED: "retired",
+});
+export const EXECBE_JOB_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", RUNNING: "running", SUCCEEDED: "succeeded", FAILED: "failed", CANCELLED: "cancelled",
+});
+
+const _ebBackendTrans = new Map([
+  [EXECBE_BACKEND_MATURITY_V2.PENDING, new Set([EXECBE_BACKEND_MATURITY_V2.ACTIVE, EXECBE_BACKEND_MATURITY_V2.RETIRED])],
+  [EXECBE_BACKEND_MATURITY_V2.ACTIVE, new Set([EXECBE_BACKEND_MATURITY_V2.DEGRADED, EXECBE_BACKEND_MATURITY_V2.RETIRED])],
+  [EXECBE_BACKEND_MATURITY_V2.DEGRADED, new Set([EXECBE_BACKEND_MATURITY_V2.ACTIVE, EXECBE_BACKEND_MATURITY_V2.RETIRED])],
+  [EXECBE_BACKEND_MATURITY_V2.RETIRED, new Set()],
+]);
+const _ebBackendTerminal = new Set([EXECBE_BACKEND_MATURITY_V2.RETIRED]);
+const _ebJobTrans = new Map([
+  [EXECBE_JOB_LIFECYCLE_V2.QUEUED, new Set([EXECBE_JOB_LIFECYCLE_V2.RUNNING, EXECBE_JOB_LIFECYCLE_V2.CANCELLED])],
+  [EXECBE_JOB_LIFECYCLE_V2.RUNNING, new Set([EXECBE_JOB_LIFECYCLE_V2.SUCCEEDED, EXECBE_JOB_LIFECYCLE_V2.FAILED, EXECBE_JOB_LIFECYCLE_V2.CANCELLED])],
+  [EXECBE_JOB_LIFECYCLE_V2.SUCCEEDED, new Set()],
+  [EXECBE_JOB_LIFECYCLE_V2.FAILED, new Set()],
+  [EXECBE_JOB_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+
+const _ebBackends = new Map();
+const _ebJobs = new Map();
+let _ebMaxActivePerOwner = 6;
+let _ebMaxPendingPerBackend = 20;
+let _ebBackendIdleMs = 12 * 60 * 60 * 1000;
+let _ebJobStuckMs = 10 * 60 * 1000;
+
+function _ebPos(n, lbl) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${lbl} must be positive integer`); return v; }
+
+export function setMaxActiveBackendsPerOwnerV2(n) { _ebMaxActivePerOwner = _ebPos(n, "maxActiveBackendsPerOwner"); }
+export function getMaxActiveBackendsPerOwnerV2() { return _ebMaxActivePerOwner; }
+export function setMaxPendingJobsPerBackendV2(n) { _ebMaxPendingPerBackend = _ebPos(n, "maxPendingJobsPerBackend"); }
+export function getMaxPendingJobsPerBackendV2() { return _ebMaxPendingPerBackend; }
+export function setBackendIdleMsV2(n) { _ebBackendIdleMs = _ebPos(n, "backendIdleMs"); }
+export function getBackendIdleMsV2() { return _ebBackendIdleMs; }
+export function setExecJobStuckMsV2(n) { _ebJobStuckMs = _ebPos(n, "execJobStuckMs"); }
+export function getExecJobStuckMsV2() { return _ebJobStuckMs; }
+
+export function _resetStateExecutionBackendV2() {
+  _ebBackends.clear(); _ebJobs.clear();
+  _ebMaxActivePerOwner = 6; _ebMaxPendingPerBackend = 20;
+  _ebBackendIdleMs = 12 * 60 * 60 * 1000; _ebJobStuckMs = 10 * 60 * 1000;
+}
+
+export function registerBackendV2({ id, owner, kind, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!owner || typeof owner !== "string") throw new Error("owner is required");
+  if (_ebBackends.has(id)) throw new Error(`backend ${id} already registered`);
+  const now = Date.now();
+  const b = { id, owner, kind: kind || "local", status: EXECBE_BACKEND_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, activatedAt: null, retiredAt: null, lastTouchedAt: now, metadata: { ...(metadata || {}) } };
+  _ebBackends.set(id, b);
+  return { ...b, metadata: { ...b.metadata } };
+}
+function _ebCheckB(from, to) { const allowed = _ebBackendTrans.get(from); if (!allowed || !allowed.has(to)) throw new Error(`invalid backend transition ${from} → ${to}`); }
+function _ebCountActive(owner) { let n = 0; for (const b of _ebBackends.values()) if (b.owner === owner && b.status === EXECBE_BACKEND_MATURITY_V2.ACTIVE) n++; return n; }
+
+export function activateBackendV2(id) {
+  const b = _ebBackends.get(id); if (!b) throw new Error(`backend ${id} not found`);
+  _ebCheckB(b.status, EXECBE_BACKEND_MATURITY_V2.ACTIVE);
+  const recovery = b.status === EXECBE_BACKEND_MATURITY_V2.DEGRADED;
+  if (!recovery) { const a = _ebCountActive(b.owner); if (a >= _ebMaxActivePerOwner) throw new Error(`max active backends per owner (${_ebMaxActivePerOwner}) reached for ${b.owner}`); }
+  const now = Date.now(); b.status = EXECBE_BACKEND_MATURITY_V2.ACTIVE; b.updatedAt = now; b.lastTouchedAt = now; if (!b.activatedAt) b.activatedAt = now;
+  return { ...b, metadata: { ...b.metadata } };
+}
+export function degradeBackendV2(id) { const b = _ebBackends.get(id); if (!b) throw new Error(`backend ${id} not found`); _ebCheckB(b.status, EXECBE_BACKEND_MATURITY_V2.DEGRADED); b.status = EXECBE_BACKEND_MATURITY_V2.DEGRADED; b.updatedAt = Date.now(); return { ...b, metadata: { ...b.metadata } }; }
+export function retireBackendV2(id) { const b = _ebBackends.get(id); if (!b) throw new Error(`backend ${id} not found`); _ebCheckB(b.status, EXECBE_BACKEND_MATURITY_V2.RETIRED); const now = Date.now(); b.status = EXECBE_BACKEND_MATURITY_V2.RETIRED; b.updatedAt = now; if (!b.retiredAt) b.retiredAt = now; return { ...b, metadata: { ...b.metadata } }; }
+export function touchBackendV2(id) { const b = _ebBackends.get(id); if (!b) throw new Error(`backend ${id} not found`); if (_ebBackendTerminal.has(b.status)) throw new Error(`cannot touch terminal backend ${id}`); const now = Date.now(); b.lastTouchedAt = now; b.updatedAt = now; return { ...b, metadata: { ...b.metadata } }; }
+export function getBackendV2(id) { const b = _ebBackends.get(id); if (!b) return null; return { ...b, metadata: { ...b.metadata } }; }
+export function listBackendsV2() { return [..._ebBackends.values()].map((b) => ({ ...b, metadata: { ...b.metadata } })); }
+
+function _ebCountPending(bid) { let n = 0; for (const j of _ebJobs.values()) if (j.backendId === bid && (j.status === EXECBE_JOB_LIFECYCLE_V2.QUEUED || j.status === EXECBE_JOB_LIFECYCLE_V2.RUNNING)) n++; return n; }
+
+export function createExecJobV2({ id, backendId, command, metadata } = {}) {
+  if (!id || typeof id !== "string") throw new Error("id is required");
+  if (!backendId || typeof backendId !== "string") throw new Error("backendId is required");
+  if (_ebJobs.has(id)) throw new Error(`exec job ${id} already exists`);
+  if (!_ebBackends.has(backendId)) throw new Error(`backend ${backendId} not found`);
+  const pending = _ebCountPending(backendId);
+  if (pending >= _ebMaxPendingPerBackend) throw new Error(`max pending jobs per backend (${_ebMaxPendingPerBackend}) reached for ${backendId}`);
+  const now = Date.now();
+  const j = { id, backendId, command: command || "", status: EXECBE_JOB_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _ebJobs.set(id, j);
+  return { ...j, metadata: { ...j.metadata } };
+}
+function _ebCheckJ(from, to) { const allowed = _ebJobTrans.get(from); if (!allowed || !allowed.has(to)) throw new Error(`invalid exec job transition ${from} → ${to}`); }
+export function startExecJobV2(id) { const j = _ebJobs.get(id); if (!j) throw new Error(`exec job ${id} not found`); _ebCheckJ(j.status, EXECBE_JOB_LIFECYCLE_V2.RUNNING); const now = Date.now(); j.status = EXECBE_JOB_LIFECYCLE_V2.RUNNING; j.updatedAt = now; if (!j.startedAt) j.startedAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function succeedExecJobV2(id) { const j = _ebJobs.get(id); if (!j) throw new Error(`exec job ${id} not found`); _ebCheckJ(j.status, EXECBE_JOB_LIFECYCLE_V2.SUCCEEDED); const now = Date.now(); j.status = EXECBE_JOB_LIFECYCLE_V2.SUCCEEDED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; return { ...j, metadata: { ...j.metadata } }; }
+export function failExecJobV2(id, reason) { const j = _ebJobs.get(id); if (!j) throw new Error(`exec job ${id} not found`); _ebCheckJ(j.status, EXECBE_JOB_LIFECYCLE_V2.FAILED); const now = Date.now(); j.status = EXECBE_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.failReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function cancelExecJobV2(id, reason) { const j = _ebJobs.get(id); if (!j) throw new Error(`exec job ${id} not found`); _ebCheckJ(j.status, EXECBE_JOB_LIFECYCLE_V2.CANCELLED); const now = Date.now(); j.status = EXECBE_JOB_LIFECYCLE_V2.CANCELLED; j.updatedAt = now; if (!j.settledAt) j.settledAt = now; if (reason) j.metadata.cancelReason = String(reason); return { ...j, metadata: { ...j.metadata } }; }
+export function getExecJobV2(id) { const j = _ebJobs.get(id); if (!j) return null; return { ...j, metadata: { ...j.metadata } }; }
+export function listExecJobsV2() { return [..._ebJobs.values()].map((j) => ({ ...j, metadata: { ...j.metadata } })); }
+
+export function autoDegradeIdleBackendsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const b of _ebBackends.values()) if (b.status === EXECBE_BACKEND_MATURITY_V2.ACTIVE && (t - b.lastTouchedAt) >= _ebBackendIdleMs) { b.status = EXECBE_BACKEND_MATURITY_V2.DEGRADED; b.updatedAt = t; flipped.push(b.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckExecJobsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const j of _ebJobs.values()) if (j.status === EXECBE_JOB_LIFECYCLE_V2.RUNNING && j.startedAt != null && (t - j.startedAt) >= _ebJobStuckMs) { j.status = EXECBE_JOB_LIFECYCLE_V2.FAILED; j.updatedAt = t; if (!j.settledAt) j.settledAt = t; j.metadata.failReason = "auto-fail-stuck"; flipped.push(j.id); } return { flipped, count: flipped.length }; }
+
+export function getExecutionBackendStatsV2() {
+  const backendsByStatus = {}; for (const s of Object.values(EXECBE_BACKEND_MATURITY_V2)) backendsByStatus[s] = 0; for (const b of _ebBackends.values()) backendsByStatus[b.status]++;
+  const jobsByStatus = {}; for (const s of Object.values(EXECBE_JOB_LIFECYCLE_V2)) jobsByStatus[s] = 0; for (const j of _ebJobs.values()) jobsByStatus[j.status]++;
+  return { totalBackendsV2: _ebBackends.size, totalJobsV2: _ebJobs.size, maxActiveBackendsPerOwner: _ebMaxActivePerOwner, maxPendingJobsPerBackend: _ebMaxPendingPerBackend, backendIdleMs: _ebBackendIdleMs, execJobStuckMs: _ebJobStuckMs, backendsByStatus, jobsByStatus };
+}

package/src/lib/feature-flags.js

@@ -5,3 +5,88 @@ export {
   setFeature,
   getFlagInfo,
 } from "../harness/feature-flags.js";
+
+
+// =====================================================================
+// Feature Flags V2 governance overlay (in-memory, atop legacy flags)
+// =====================================================================
+export const FFLAG_PROFILE_MATURITY_V2 = Object.freeze({
+  PENDING: "pending", ACTIVE: "active", PAUSED: "paused", ARCHIVED: "archived",
+});
+export const FFLAG_EVAL_LIFECYCLE_V2 = Object.freeze({
+  QUEUED: "queued", EVALUATING: "evaluating", EVALUATED: "evaluated", FAILED: "failed", CANCELLED: "cancelled",
+});
+const _fflagPTrans = new Map([
+  [FFLAG_PROFILE_MATURITY_V2.PENDING, new Set([FFLAG_PROFILE_MATURITY_V2.ACTIVE, FFLAG_PROFILE_MATURITY_V2.ARCHIVED])],
+  [FFLAG_PROFILE_MATURITY_V2.ACTIVE, new Set([FFLAG_PROFILE_MATURITY_V2.PAUSED, FFLAG_PROFILE_MATURITY_V2.ARCHIVED])],
+  [FFLAG_PROFILE_MATURITY_V2.PAUSED, new Set([FFLAG_PROFILE_MATURITY_V2.ACTIVE, FFLAG_PROFILE_MATURITY_V2.ARCHIVED])],
+  [FFLAG_PROFILE_MATURITY_V2.ARCHIVED, new Set()],
+]);
+const _fflagPTerminal = new Set([FFLAG_PROFILE_MATURITY_V2.ARCHIVED]);
+const _fflagETrans = new Map([
+  [FFLAG_EVAL_LIFECYCLE_V2.QUEUED, new Set([FFLAG_EVAL_LIFECYCLE_V2.EVALUATING, FFLAG_EVAL_LIFECYCLE_V2.CANCELLED])],
+  [FFLAG_EVAL_LIFECYCLE_V2.EVALUATING, new Set([FFLAG_EVAL_LIFECYCLE_V2.EVALUATED, FFLAG_EVAL_LIFECYCLE_V2.FAILED, FFLAG_EVAL_LIFECYCLE_V2.CANCELLED])],
+  [FFLAG_EVAL_LIFECYCLE_V2.EVALUATED, new Set()],
+  [FFLAG_EVAL_LIFECYCLE_V2.FAILED, new Set()],
+  [FFLAG_EVAL_LIFECYCLE_V2.CANCELLED, new Set()],
+]);
+const _fflagPsV2 = new Map();
+const _fflagEsV2 = new Map();
+let _fflagMaxActive = 15, _fflagMaxPending = 30, _fflagIdleMs = 30 * 24 * 60 * 60 * 1000, _fflagStuckMs = 30 * 1000;
+function _fflagPos(n, label) { const v = Math.floor(Number(n)); if (!Number.isFinite(v) || v <= 0) throw new Error(`${label} must be positive integer`); return v; }
+function _fflagCheckP(from, to) { const a = _fflagPTrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid fflag profile transition ${from} → ${to}`); }
+function _fflagCheckE(from, to) { const a = _fflagETrans.get(from); if (!a || !a.has(to)) throw new Error(`invalid fflag eval transition ${from} → ${to}`); }
+function _fflagCountActive(owner) { let c = 0; for (const p of _fflagPsV2.values()) if (p.owner === owner && p.status === FFLAG_PROFILE_MATURITY_V2.ACTIVE) c++; return c; }
+function _fflagCountPending(profileId) { let c = 0; for (const e of _fflagEsV2.values()) if (e.profileId === profileId && (e.status === FFLAG_EVAL_LIFECYCLE_V2.QUEUED || e.status === FFLAG_EVAL_LIFECYCLE_V2.EVALUATING)) c++; return c; }
+export function setMaxActiveFflagProfilesPerOwnerV2(n) { _fflagMaxActive = _fflagPos(n, "maxActiveFflagProfilesPerOwner"); }
+export function getMaxActiveFflagProfilesPerOwnerV2() { return _fflagMaxActive; }
+export function setMaxPendingFflagEvalsPerProfileV2(n) { _fflagMaxPending = _fflagPos(n, "maxPendingFflagEvalsPerProfile"); }
+export function getMaxPendingFflagEvalsPerProfileV2() { return _fflagMaxPending; }
+export function setFflagProfileIdleMsV2(n) { _fflagIdleMs = _fflagPos(n, "fflagProfileIdleMs"); }
+export function getFflagProfileIdleMsV2() { return _fflagIdleMs; }
+export function setFflagEvalStuckMsV2(n) { _fflagStuckMs = _fflagPos(n, "fflagEvalStuckMs"); }
+export function getFflagEvalStuckMsV2() { return _fflagStuckMs; }
+export function _resetStateFeatureFlagsV2() { _fflagPsV2.clear(); _fflagEsV2.clear(); _fflagMaxActive = 15; _fflagMaxPending = 30; _fflagIdleMs = 30 * 24 * 60 * 60 * 1000; _fflagStuckMs = 30 * 1000; }
+export function registerFflagProfileV2({ id, owner, scope, metadata } = {}) {
+  if (!id || !owner) throw new Error("id and owner required");
+  if (_fflagPsV2.has(id)) throw new Error(`fflag profile ${id} already exists`);
+  const now = Date.now();
+  const p = { id, owner, scope: scope || "*", status: FFLAG_PROFILE_MATURITY_V2.PENDING, createdAt: now, updatedAt: now, lastTouchedAt: now, activatedAt: null, archivedAt: null, metadata: { ...(metadata || {}) } };
+  _fflagPsV2.set(id, p); return { ...p, metadata: { ...p.metadata } };
+}
+export function activateFflagProfileV2(id) {
+  const p = _fflagPsV2.get(id); if (!p) throw new Error(`fflag profile ${id} not found`);
+  const isInitial = p.status === FFLAG_PROFILE_MATURITY_V2.PENDING;
+  _fflagCheckP(p.status, FFLAG_PROFILE_MATURITY_V2.ACTIVE);
+  if (isInitial && _fflagCountActive(p.owner) >= _fflagMaxActive) throw new Error(`max active fflag profiles for owner ${p.owner} reached`);
+  const now = Date.now(); p.status = FFLAG_PROFILE_MATURITY_V2.ACTIVE; p.updatedAt = now; p.lastTouchedAt = now;
+  if (!p.activatedAt) p.activatedAt = now;
+  return { ...p, metadata: { ...p.metadata } };
+}
+export function pauseFflagProfileV2(id) { const p = _fflagPsV2.get(id); if (!p) throw new Error(`fflag profile ${id} not found`); _fflagCheckP(p.status, FFLAG_PROFILE_MATURITY_V2.PAUSED); p.status = FFLAG_PROFILE_MATURITY_V2.PAUSED; p.updatedAt = Date.now(); return { ...p, metadata: { ...p.metadata } }; }
+export function archiveFflagProfileV2(id) { const p = _fflagPsV2.get(id); if (!p) throw new Error(`fflag profile ${id} not found`); _fflagCheckP(p.status, FFLAG_PROFILE_MATURITY_V2.ARCHIVED); const now = Date.now(); p.status = FFLAG_PROFILE_MATURITY_V2.ARCHIVED; p.updatedAt = now; if (!p.archivedAt) p.archivedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function touchFflagProfileV2(id) { const p = _fflagPsV2.get(id); if (!p) throw new Error(`fflag profile ${id} not found`); if (_fflagPTerminal.has(p.status)) throw new Error(`cannot touch terminal fflag profile ${id}`); const now = Date.now(); p.lastTouchedAt = now; p.updatedAt = now; return { ...p, metadata: { ...p.metadata } }; }
+export function getFflagProfileV2(id) { const p = _fflagPsV2.get(id); if (!p) return null; return { ...p, metadata: { ...p.metadata } }; }
+export function listFflagProfilesV2() { return [..._fflagPsV2.values()].map((p) => ({ ...p, metadata: { ...p.metadata } })); }
+export function createFflagEvalV2({ id, profileId, key, metadata } = {}) {
+  if (!id || !profileId) throw new Error("id and profileId required");
+  if (_fflagEsV2.has(id)) throw new Error(`fflag eval ${id} already exists`);
+  if (!_fflagPsV2.has(profileId)) throw new Error(`fflag profile ${profileId} not found`);
+  if (_fflagCountPending(profileId) >= _fflagMaxPending) throw new Error(`max pending fflag evals for profile ${profileId} reached`);
+  const now = Date.now();
+  const e = { id, profileId, key: key || "", status: FFLAG_EVAL_LIFECYCLE_V2.QUEUED, createdAt: now, updatedAt: now, startedAt: null, settledAt: null, metadata: { ...(metadata || {}) } };
+  _fflagEsV2.set(id, e); return { ...e, metadata: { ...e.metadata } };
+}
+export function evaluatingFflagEvalV2(id) { const e = _fflagEsV2.get(id); if (!e) throw new Error(`fflag eval ${id} not found`); _fflagCheckE(e.status, FFLAG_EVAL_LIFECYCLE_V2.EVALUATING); const now = Date.now(); e.status = FFLAG_EVAL_LIFECYCLE_V2.EVALUATING; e.updatedAt = now; if (!e.startedAt) e.startedAt = now; return { ...e, metadata: { ...e.metadata } }; }
+export function evaluateFflagEvalV2(id) { const e = _fflagEsV2.get(id); if (!e) throw new Error(`fflag eval ${id} not found`); _fflagCheckE(e.status, FFLAG_EVAL_LIFECYCLE_V2.EVALUATED); const now = Date.now(); e.status = FFLAG_EVAL_LIFECYCLE_V2.EVALUATED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; return { ...e, metadata: { ...e.metadata } }; }
+export function failFflagEvalV2(id, reason) { const e = _fflagEsV2.get(id); if (!e) throw new Error(`fflag eval ${id} not found`); _fflagCheckE(e.status, FFLAG_EVAL_LIFECYCLE_V2.FAILED); const now = Date.now(); e.status = FFLAG_EVAL_LIFECYCLE_V2.FAILED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; if (reason) e.metadata.failReason = String(reason); return { ...e, metadata: { ...e.metadata } }; }
+export function cancelFflagEvalV2(id, reason) { const e = _fflagEsV2.get(id); if (!e) throw new Error(`fflag eval ${id} not found`); _fflagCheckE(e.status, FFLAG_EVAL_LIFECYCLE_V2.CANCELLED); const now = Date.now(); e.status = FFLAG_EVAL_LIFECYCLE_V2.CANCELLED; e.updatedAt = now; if (!e.settledAt) e.settledAt = now; if (reason) e.metadata.cancelReason = String(reason); return { ...e, metadata: { ...e.metadata } }; }
+export function getFflagEvalV2(id) { const e = _fflagEsV2.get(id); if (!e) return null; return { ...e, metadata: { ...e.metadata } }; }
+export function listFflagEvalsV2() { return [..._fflagEsV2.values()].map((e) => ({ ...e, metadata: { ...e.metadata } })); }
+export function autoPauseIdleFflagProfilesV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const p of _fflagPsV2.values()) if (p.status === FFLAG_PROFILE_MATURITY_V2.ACTIVE && (t - p.lastTouchedAt) >= _fflagIdleMs) { p.status = FFLAG_PROFILE_MATURITY_V2.PAUSED; p.updatedAt = t; flipped.push(p.id); } return { flipped, count: flipped.length }; }
+export function autoFailStuckFflagEvalsV2({ now } = {}) { const t = now ?? Date.now(); const flipped = []; for (const e of _fflagEsV2.values()) if (e.status === FFLAG_EVAL_LIFECYCLE_V2.EVALUATING && e.startedAt != null && (t - e.startedAt) >= _fflagStuckMs) { e.status = FFLAG_EVAL_LIFECYCLE_V2.FAILED; e.updatedAt = t; if (!e.settledAt) e.settledAt = t; e.metadata.failReason = "auto-fail-stuck"; flipped.push(e.id); } return { flipped, count: flipped.length }; }
+export function getFeatureFlagsGovStatsV2() {
+  const profilesByStatus = {}; for (const v of Object.values(FFLAG_PROFILE_MATURITY_V2)) profilesByStatus[v] = 0; for (const p of _fflagPsV2.values()) profilesByStatus[p.status]++;
+  const evalsByStatus = {}; for (const v of Object.values(FFLAG_EVAL_LIFECYCLE_V2)) evalsByStatus[v] = 0; for (const e of _fflagEsV2.values()) evalsByStatus[e.status]++;
+  return { totalFflagProfilesV2: _fflagPsV2.size, totalFflagEvalsV2: _fflagEsV2.size, maxActiveFflagProfilesPerOwner: _fflagMaxActive, maxPendingFflagEvalsPerProfile: _fflagMaxPending, fflagProfileIdleMs: _fflagIdleMs, fflagEvalStuckMs: _fflagStuckMs, profilesByStatus, evalsByStatus };
+}