claude-flow 3.49.0 → 3.51.0

package/v3/@claude-flow/cli/dist/src/commands/mods.js

@@ -0,0 +1,170 @@
+/**
+ * `ruflo mods` — opt into running ruflo as a Claude Code mod (ADR-404,
+ * Claude Code function hooks, early access).
+ *
+ * install/uninstall edit settings files and record what they added;
+ * status/doctor report what can be known from outside a session; sync-policy
+ * rewrites the policy projection the mod's tool check reads. Classic hooks
+ * are never removed: they stay the default and the fallback.
+ */
+import { output } from '../output.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { directoryMarketplace, MARKETPLACE_NAME } from '../mods/install.js';
+import { probeMods } from '../mods/probe.js';
+import { applyMods, removeMods } from '../mods/apply.js';
+/**
+ * `--source local` / `--marketplace-path <dir>`: a ruflo checkout as a
+ * directory marketplace (dogfooding). It must be a ruflo marketplace.
+ */
+function localMarketplace(dir) {
+    const catalog = join(resolve(dir), '.claude-plugin', 'marketplace.json');
+    if (!existsSync(catalog))
+        return `${dir} has no .claude-plugin/marketplace.json`;
+    try {
+        if (JSON.parse(readFileSync(catalog, 'utf8')).name !== MARKETPLACE_NAME)
+            return `${catalog} is not the ${MARKETPLACE_NAME} marketplace`;
+    }
+    catch {
+        return `${catalog} is not JSON`;
+    }
+    return directoryMarketplace(dir);
+}
+function projectRoot(ctx) {
+    return ctx.flags.projectRoot ?? ctx.flags['project-root'] ?? ctx.cwd ?? process.cwd();
+}
+function printFindings(findings) {
+    for (const f of findings) {
+        const mark = f.status === 'pass' ? output.success('✓') : f.status === 'warn' ? output.warning('!') : output.error('✗');
+        output.writeln(`${mark} ${f.name}: ${f.message}`);
+        if (f.fix && f.status !== 'pass')
+            output.writeln(output.dim(`    fix: ${f.fix}`));
+    }
+}
+const rootOption = { name: 'project-root', description: 'Project root (default: current directory)', type: 'string' };
+const installSub = {
+    name: 'install',
+    description: 'Enable the ruflo mod plugins (ruflo-mods, ruflo-swarm, ruflo-console) for this project; classic hooks stay as fallback',
+    options: [
+        rootOption,
+        { name: 'scope', description: 'local (.claude/settings.local.json, default) | project (.claude/settings.json)', type: 'string', default: 'local' },
+        { name: 'dry-run', description: 'Show the settings that would be written and the claude commands that would run', type: 'boolean', default: false },
+        { name: 'plugin-install', description: 'Refresh the ruflo marketplace and run `claude plugin install` (--no-plugin-install to only write settings)', type: 'boolean', default: true },
+        { name: 'strict', description: 'Exit 1 when a required plugin could not be made loadable', type: 'boolean', default: false },
+        { name: 'source', description: 'github (ruvnet/ruflo, default) | local (a ruflo checkout as a directory marketplace: plugins load live from it)', type: 'string', default: 'github' },
+        { name: 'marketplace-path', description: 'With --source local: the ruflo checkout (default: the project root)', type: 'string' },
+    ],
+    action: async (ctx) => {
+        const scope = ctx.flags.scope ?? 'local';
+        if (scope !== 'local' && scope !== 'project') {
+            output.printError(`--scope must be local or project, got ${scope}`);
+            return { success: false, exitCode: 1 };
+        }
+        const source = ctx.flags.source ?? 'github';
+        const path = (ctx.flags.marketplacePath ?? ctx.flags['marketplace-path']);
+        if (source !== 'github' && source !== 'local') {
+            output.printError(`--source must be github or local, got ${source}`);
+            return { success: false, exitCode: 1 };
+        }
+        let marketplace;
+        if (source === 'local' || path) {
+            const local = localMarketplace(path ?? projectRoot(ctx));
+            if (typeof local === 'string') {
+                output.printError(`--source local: ${local}`);
+                return { success: false, exitCode: 1 };
+            }
+            marketplace = local;
+        }
+        const result = await applyMods(projectRoot(ctx), {
+            scope: scope,
+            marketplace,
+            dryRun: ctx.flags.dryRun === true || ctx.flags['dry-run'] === true,
+            pluginInstall: ctx.flags.pluginInstall !== false && ctx.flags['plugin-install'] !== false,
+        });
+        if (result.install.dryRun)
+            return { success: true, data: result };
+        if (result.resolvable)
+            output.writeln('Restart Claude Code, then run /ruflo in a session to open the console (/ruflo mods shows what the mod owns). Check with: ruflo mods doctor');
+        const data = { ...result.install, resolvable: result.resolvable };
+        return result.resolvable || ctx.flags.strict !== true ? { success: true, data } : { success: false, exitCode: 1, data };
+    },
+};
+const uninstallSub = {
+    name: 'uninstall',
+    description: 'Remove what `ruflo mods install` added, and claude plugin uninstall what it installed (classic hooks take every event back)',
+    options: [rootOption, { name: 'dry-run', description: 'Show what would be removed', type: 'boolean', default: false }],
+    action: async (ctx) => {
+        const result = await removeMods(projectRoot(ctx), { dryRun: ctx.flags.dryRun === true || ctx.flags['dry-run'] === true });
+        if (!result.removed) {
+            output.printWarning('No install record (.claude-flow/mods/install.json): nothing ruflo added to remove.');
+            return { success: true, data: result };
+        }
+        output.printSuccess(`${result.dryRun ? 'Would remove' : 'Removed'} what ruflo mods added from ${result.settingsFiles.join(', ')}`);
+        if (result.uninstalled.length)
+            output.writeln(`claude plugin uninstall: ${result.uninstalled.join(', ')}`);
+        return { success: result.failed.length === 0, exitCode: result.failed.length ? 1 : 0, data: result };
+    },
+};
+function findingsCommand(name, description) {
+    return {
+        name,
+        description,
+        options: [rootOption, { name: 'json', description: 'Output as JSON', type: 'boolean', default: false }],
+        action: async (ctx) => {
+            const findings = probeMods({ projectRoot: projectRoot(ctx) });
+            if (ctx.flags.json)
+                output.printJson(findings);
+            else
+                printFindings(findings);
+            const failed = findings.some((f) => f.status === 'fail');
+            // status reports (exit 0); doctor gates on a failure (warnings are expected while early access is off).
+            return name === 'doctor' && failed ? { success: false, exitCode: 1, data: findings } : { success: true, data: findings };
+        },
+    };
+}
+async function syncPolicy(root, quiet) {
+    try {
+        const { loadPolicyState } = await import('../services/policy-runtime.js');
+        const { syncPolicyProjection } = await import('../mods/policy-projection.js');
+        const result = syncPolicyProjection(root, loadPolicyState(root));
+        if (!quiet || result.action !== 'unchanged')
+            output.writeln(`policy projection: ${result.action} (${result.path})`);
+        return true;
+    }
+    catch (error) {
+        output.printWarning(`policy projection not synced: ${error.message}`);
+        return false;
+    }
+}
+const syncPolicySub = {
+    name: 'sync-policy',
+    description: 'Rewrite the Claude Code policy projection from .claude-flow/policy/state.json',
+    options: [rootOption],
+    action: async (ctx) => {
+        const ok = await syncPolicy(projectRoot(ctx), false);
+        return { success: ok, exitCode: ok ? 0 : 1 };
+    },
+};
+const statusSub = findingsCommand('status', 'Show whether the mod is enabled, can load, and what it owns');
+export const modsCommand = {
+    name: 'mods',
+    description: 'Run ruflo as a Claude Code mod (function hooks, early access, ADR-404)',
+    subcommands: [
+        installSub,
+        uninstallSub,
+        statusSub,
+        findingsCommand('doctor', 'Check the mod path; exits 1 only on a failure'),
+        syncPolicySub,
+    ],
+    examples: [
+        { command: 'ruflo mods install', description: 'Enable the mod plugins for this checkout (settings.local.json) and install them with claude' },
+        { command: 'ruflo mods install --scope project', description: 'Same, in the committed settings.json (what ruflo init does)' },
+        { command: 'ruflo mods install --no-plugin-install', description: 'Only write settings; run no claude command' },
+        { command: 'ruflo mods install --source local', description: 'Dogfood: load the mods live from this ruflo checkout (directory marketplace)' },
+        { command: 'ruflo mods doctor', description: 'Marketplace fresh? Plugins loadable? Function hooks on? Refused by policy?' },
+        { command: 'ruflo mods uninstall', description: 'Remove only what install added' },
+    ],
+    action: statusSub.action,
+};
+export default modsCommand;
+//# sourceMappingURL=mods.js.map

package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js

@@ -530,7 +530,19 @@ export function generateHookHandler() {
         '  });',
         '}',
         '',
+        // ADR-404: same handshake as the shipped hook-handler.cjs, so a helper
+        // regenerated by the refresh fallback still hands route/post-edit to the mod.
+        '// ADR-404: the ruflo mod names the events it runs in-process in',
+        '// RUFLO_MODS_OWNS; only side-effect events hand over, guards always run.',
+        "const MOD_OWNABLE_EVENTS = new Set(['route', 'post-edit']);",
+        'function ownedByMod(cmd, env) {',
+        '  env = env || process.env;',
+        '  if (!MOD_OWNABLE_EVENTS.has(cmd)) return false;',
+        "  return String(env.RUFLO_MODS_OWNS || '').split(',').some(function (owned) { return owned.trim() === cmd; });",
+        '}',
+        '',
         'async function main() {',
+        '  if (ownedByMod(command)) return;',
         '  let stdinData = "";',
         '  try { stdinData = await readStdin(); } catch (e) { /* ignore */ }',
         '  let hookInput = {};',

package/v3/@claude-flow/cli/dist/src/mcp-client.js

@@ -72,6 +72,7 @@ import { businessPodTools } from './mcp-tools/business-pod-tools.js';
 // for ops-pod synthetic-endpoint benches). Default-rejects private addresses
 // + auth headers; opt-in via CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE / _AUTH=1.
 import { httpFetchTools } from './mcp-tools/http-fetch-tools.js';
+import { missionTools } from './mcp-tools/mission-tools.js';
 // #1916: coverage-aware routing tools — defined in ruvector/coverage-tools.ts
 // but were never registered, so the `ruflo hooks coverage-*` CLI subcommands
 // failed with `Tool not found: hooks_coverage-route`.
@@ -180,6 +181,8 @@ registerTools([
     ...businessPodTools,
     // ADR-164 Phase 4 §5.1.8 — http_fetch (1 tool, secure-by-default HTTP probe)
     ...httpFetchTools,
+    // ADR-406 — mission semantic operations (create/plan/get/events/request_action)
+    ...missionTools,
 ]);
 // The capability brain consumes the completed live registry. This is injected
 // after registration to keep guidance honest and avoid a registry import cycle.

package/v3/@claude-flow/cli/dist/src/mcp-tools/capability-brain.js

@@ -314,7 +314,7 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'tasks-workflows-sessions',
         name: 'Tasks, Workflows, Sessions & Progress',
-        prefixes: ['task_', 'workflow_', 'session_', 'progress_'],
+        prefixes: ['task_', 'workflow_', 'session_', 'progress_', 'mission_'],
         description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         taskSignals: ['task', 'workflow', 'session', 'handoff', 'progress'],
         commands: ['task create', 'task status', 'workflow run'],

package/v3/@claude-flow/cli/dist/src/mcp-tools/index.d.ts

@@ -38,4 +38,5 @@ export { xFederationJoinTools } from './x-federation-join.js';
 export { xFederationChannelTools } from './x-federation-channels.js';
 export { businessPodTools } from './business-pod-tools.js';
 export { httpFetchTools } from './http-fetch-tools.js';
+export { missionTools, createMissionTools } from './mission-tools.js';
 //# sourceMappingURL=index.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/index.js

@@ -43,4 +43,6 @@ export { xFederationChannelTools } from './x-federation-channels.js';
 export { businessPodTools } from './business-pod-tools.js';
 // ADR-164 Phase 4 §5.1.8 — http_fetch (secure-by-default HTTP probe)
 export { httpFetchTools } from './http-fetch-tools.js';
+// ADR-406 — mission semantic operations
+export { missionTools, createMissionTools } from './mission-tools.js';
 //# sourceMappingURL=index.js.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/mission-tools.d.ts

@@ -0,0 +1,22 @@
+/**
+ * ADR-406 §19.7 — MCP adapter for the mission semantic operations.
+ *
+ * A thin transport: input goes to the same `MissionService` (and the same zod
+ * schemas) the CLI uses, unchanged. Policy authorization of the tool call
+ * itself happens in `mcp-client.ts` before any handler runs; nothing here
+ * accepts an approval, principal or permission flag from input.
+ */
+import type { MCPTool } from './types.js';
+import { type MissionResult } from '../missions/service.js';
+/** The operations an adapter needs; London-school tests substitute it. */
+export interface MissionPort {
+    create(raw: unknown): Promise<MissionResult<unknown>>;
+    plan(raw: unknown): Promise<MissionResult<unknown>>;
+    get(raw: unknown): Promise<MissionResult<unknown>>;
+    events(raw: unknown): Promise<MissionResult<unknown>>;
+    requestAction(raw: unknown): Promise<MissionResult<unknown>>;
+}
+export type MissionPortFactory = (projectRoot: string) => MissionPort;
+export declare function createMissionTools(factory?: MissionPortFactory): MCPTool[];
+export declare const missionTools: MCPTool[];
+//# sourceMappingURL=mission-tools.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/mission-tools.js

@@ -0,0 +1,75 @@
+/**
+ * ADR-406 §19.7 — MCP adapter for the mission semantic operations.
+ *
+ * A thin transport: input goes to the same `MissionService` (and the same zod
+ * schemas) the CLI uses, unchanged. Policy authorization of the tool call
+ * itself happens in `mcp-client.ts` before any handler runs; nothing here
+ * accepts an approval, principal or permission flag from input.
+ */
+import { getProjectCwd } from './types.js';
+import { MissionService } from '../missions/service.js';
+const defaultFactory = (projectRoot) => new MissionService({ projectRoot, channel: 'mcp' });
+function rootOf(context) {
+    return typeof context?.projectRoot === 'string' ? context.projectRoot : getProjectCwd();
+}
+const MISSION_ID = { type: 'string', pattern: '^msn_[a-f0-9]{24}$', description: 'Mission id' };
+const REQUEST_ID = { type: 'string', maxLength: 128, description: 'Caller-chosen idempotency key; reuse only to retry the same request' };
+const EXPECTED_REVISION = { type: 'integer', minimum: 1, description: 'Mission revision the request was prepared against' };
+export function createMissionTools(factory = defaultFactory) {
+    const call = (op) => async (input, context) => factory(rootOf(context))[op](input);
+    return [
+        {
+            name: 'mission_create',
+            description: 'Create a draft mission (objective only), idempotent per requestId. Use when starting governed multi-step work that several clients (CLI, MCP, the Claude Code workbench) must observe and control through one durable record. task_create is wrong because a task has no plan revision, budget ceiling or acceptance evidence. Recording a mission executes nothing.',
+            category: 'mission',
+            inputSchema: { type: 'object', properties: { requestId: REQUEST_ID, objective: { type: 'string', maxLength: 2000 } }, required: ['requestId', 'objective'] },
+            handler: call('create'),
+        },
+        {
+            name: 'mission_plan',
+            description: 'Submit or revise a mission plan: acyclic task graph, acceptance criteria and budget ceiling in integer minor units. Use when a mission needs a reviewable plan before any authorization or admission. Editing plan state through memory_store is wrong because it bypasses revision checks: a stale expectedRevision here returns a conflict with the current revision, and a revision invalidates prior authorization.',
+            category: 'mission',
+            inputSchema: {
+                type: 'object',
+                properties: { requestId: REQUEST_ID, missionId: MISSION_ID, expectedRevision: EXPECTED_REVISION, plan: { type: 'object', description: '{ tasks[], acceptance[], budget{currency, ceilingMinor}, scope }' } },
+                required: ['requestId', 'missionId', 'expectedRevision', 'plan'],
+            },
+            handler: call('plan'),
+        },
+        {
+            name: 'mission_get',
+            description: 'Read one mission (record, plan, budget, tasks, evidence, executor observation) or list missions; read only. Use when you need the authoritative current state of a mission before acting on it. Inferring state from task_status or a UI badge is wrong because task status is recorded state; only evidence.verified counts as verified, and a disconnected executor is not a failure.',
+            category: 'mission',
+            inputSchema: { type: 'object', properties: { missionId: MISSION_ID } },
+            handler: call('get'),
+        },
+        {
+            name: 'mission_events',
+            description: 'Read mission events after a durable cursor (afterSequence). Use when resuming or reconnecting a client and you need exactly what changed since your last sequence. Re-reading mission_get in a loop is wrong because it loses the transition history; delivery here may repeat, so deduplicate by (missionId, seq), and gap=true means reload with mission_get before replaying.',
+            category: 'mission',
+            inputSchema: {
+                type: 'object',
+                properties: { missionId: MISSION_ID, afterSequence: { type: 'integer', minimum: 0 }, limit: { type: 'integer', minimum: 1, maximum: 500 } },
+                required: ['missionId'],
+            },
+            handler: call('events'),
+        },
+        {
+            name: 'mission_request_action',
+            description: 'Request a scoped mission control action: requestAuthorization, pause or cancel (admit and resume report executor-unavailable until a durable executor is admitted). Use when a person or agent wants a running or planned mission to change course. Calling task_cancel or killing a process is wrong because it skips the revision check and executor acknowledgement; a request is not authorization, the runtime decides.',
+            category: 'mission',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    requestId: REQUEST_ID, missionId: MISSION_ID, expectedRevision: EXPECTED_REVISION,
+                    action: { type: 'string', enum: ['requestAuthorization', 'pause', 'cancel', 'admit', 'resume'] },
+                    reason: { type: 'string', maxLength: 500 },
+                },
+                required: ['requestId', 'missionId', 'expectedRevision', 'action'],
+            },
+            handler: call('requestAction'),
+        },
+    ];
+}
+export const missionTools = createMissionTools();
+//# sourceMappingURL=mission-tools.js.map

package/v3/@claude-flow/cli/dist/src/missions/fold.d.ts

@@ -0,0 +1,19 @@
+/**
+ * ADR-406 §19.3 — fold a mission's append-only event log into a `MissionView`.
+ *
+ * Replay re-checks every control event against the transition table and every
+ * observation against its own rules, and verifies the hash chain, so state is
+ * a pure function of the log: snapshot + tail and full replay must agree.
+ */
+import { type ControlEventType, type MissionEvent, type ObservationEventType } from './schemas.js';
+import { type MissionView } from './transitions.js';
+export declare const GENESIS_HASH: string;
+export declare function isControlEvent(type: string): type is ControlEventType;
+/** Hash over every field except `hash` itself, chained through `prevHash`. */
+export declare function eventHash(event: Omit<MissionEvent, 'hash'>): string;
+/** Observation rules; throws `TransitionError`. Observations never change state. */
+export declare function checkObservation(view: MissionView, type: ObservationEventType, p: Record<string, unknown>): void;
+/** Apply one event; throws `TransitionError` for anything the rules refuse. */
+export declare function foldEvent(view: MissionView | null, event: MissionEvent): MissionView;
+export declare function replay(events: readonly MissionEvent[], from?: MissionView | null): MissionView | null;
+//# sourceMappingURL=fold.d.ts.map

package/v3/@claude-flow/cli/dist/src/missions/fold.js

@@ -0,0 +1,238 @@
+/**
+ * ADR-406 §19.3 — fold a mission's append-only event log into a `MissionView`.
+ *
+ * Replay re-checks every control event against the transition table and every
+ * observation against its own rules, and verifies the hash chain, so state is
+ * a pure function of the log: snapshot + tail and full replay must agree.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../mods/command-registry/catalog.js';
+import { CONTROL_EVENTS, MISSION_EVENT_CONTRACT, MISSION_SCHEMA_VERSION, executorConnectionSchema, missionRecordSchema, } from './schemas.js';
+import { TransitionError, checkTransition, digestOf } from './transitions.js';
+import { TERMINAL_STATES } from './schemas.js';
+export const GENESIS_HASH = `sha256:${'0'.repeat(64)}`;
+const TASK_STATUSES = new Set(['pending', 'running', 'recorded-done', 'failed', 'unknown']);
+export function isControlEvent(type) {
+    return CONTROL_EVENTS.includes(type);
+}
+/** Hash over every field except `hash` itself, chained through `prevHash`. */
+export function eventHash(event) {
+    return `sha256:${createHash('sha256').update(canonicalJson(event)).digest('hex')}`;
+}
+/** Observation rules; throws `TransitionError`. Observations never change state. */
+export function checkObservation(view, type, p) {
+    if (TERMINAL_STATES.has(view.record.state))
+        throw new TransitionError('terminal', `mission is ${view.record.state}`);
+    if (type === 'executor.observed') {
+        if (typeof p.executorId !== 'string' || !p.executorId)
+            throw new TransitionError('invalid-observation', 'executorId required');
+        if (!executorConnectionSchema.safeParse(p.connection).success)
+            throw new TransitionError('invalid-observation', 'connection must be healthy|stale|disconnected|unknown');
+        if (typeof p.observedAt !== 'string')
+            throw new TransitionError('invalid-observation', 'observedAt (source time) required');
+        return;
+    }
+    if (type === 'task.observed') {
+        if (!view.planBody?.tasks.some((t) => t.id === p.taskId))
+            throw new TransitionError('invalid-observation', `unknown task ${String(p.taskId)}`);
+        if (!TASK_STATUSES.has(p.status))
+            throw new TransitionError('invalid-observation', 'invalid task status');
+        if (p.leaseEpoch !== view.lease.epoch)
+            throw new TransitionError('stale-epoch', `lease epoch ${String(p.leaseEpoch)} is not current (${view.lease.epoch})`);
+        return;
+    }
+    // evidence.recorded
+    if (!view.planBody?.acceptance.some((c) => c.id === p.criterionId))
+        throw new TransitionError('invalid-observation', `unknown criterion ${String(p.criterionId)}`);
+    if (typeof p.evidenceId !== 'string' || typeof p.producer !== 'string')
+        throw new TransitionError('invalid-observation', 'evidenceId and producer required');
+    if (typeof p.artifactDigest !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(p.artifactDigest))
+        throw new TransitionError('invalid-observation', 'artifactDigest required');
+    if (typeof p.verified !== 'boolean')
+        throw new TransitionError('invalid-observation', 'verified flag required');
+    if (view.evidence.some((e) => e.evidenceId === p.evidenceId))
+        throw new TransitionError('invalid-observation', `duplicate evidence ${String(p.evidenceId)}`);
+}
+function created(event) {
+    const p = event.payload;
+    const record = missionRecordSchema.parse({
+        schemaVersion: MISSION_SCHEMA_VERSION,
+        missionId: event.missionId,
+        tenantId: p.tenantId,
+        workspaceId: p.workspaceId,
+        ownerPrincipalId: p.ownerPrincipalId,
+        revision: 1,
+        objective: p.objective,
+        plan: { revision: 0, digest: 'none', taskGraphRef: 'none' },
+        policyRef: p.policyRef,
+        budgetRef: p.budgetRef,
+        executionMode: 'session-bound',
+        state: 'draft',
+        evidenceRefs: [],
+        acceptance: { revision: 0, criteriaDigest: 'none' },
+        lastEventSequence: event.seq,
+        createdAt: event.at,
+        updatedAt: event.at,
+    });
+    return {
+        record, planBody: null, budget: null, tasks: {}, evidence: [], executor: null,
+        lease: { executorId: null, epoch: 0 }, unresolvedOperations: [], blockedReason: null, lastHash: event.hash,
+    };
+}
+function withPlan(view, plan, event) {
+    const criteriaDigest = digestOf(plan.acceptance);
+    const prior = view.record.acceptance;
+    const estimated = plan.tasks.reduce((s, t) => s + t.estimatedCostMinor, 0);
+    const tasks = {};
+    for (const t of plan.tasks)
+        tasks[t.id] = { status: view.tasks[t.id]?.status ?? 'pending' };
+    return {
+        ...view,
+        planBody: plan,
+        tasks,
+        budget: {
+            currency: plan.budget.currency,
+            ceilingMinor: plan.budget.ceilingMinor,
+            estimatedMinor: estimated,
+            reservedMinor: view.budget?.reservedMinor ?? 0,
+            settledMinor: view.budget?.settledMinor ?? 0,
+            unresolvedMinor: view.budget?.unresolvedMinor ?? 0,
+        },
+        record: {
+            ...view.record,
+            plan: { revision: view.record.plan.revision + 1, digest: String(event.payload.digest), taskGraphRef: `event:${event.seq}` },
+            acceptance: { revision: criteriaDigest === prior.criteriaDigest ? prior.revision : prior.revision + 1, criteriaDigest },
+            executionMode: plan.tasks.some((t) => t.executor.mode === 'session-bound') ? 'session-bound' : 'durable-executor',
+            // §19.4: a new plan revision invalidates authorization for the old one.
+            authorizationRef: undefined,
+        },
+    };
+}
+function applyControl(view, event) {
+    const rule = checkTransition(view, event.type, event.payload);
+    if (event.revision !== view.record.revision + 1) {
+        throw new TransitionError('revision-mismatch', `control event ${event.seq} must advance revision to ${view.record.revision + 1}`);
+    }
+    if (event.expectedRevision !== view.record.revision) {
+        throw new TransitionError('revision-conflict', `expected ${String(event.expectedRevision)}, current ${view.record.revision}`);
+    }
+    let next = view;
+    const p = event.payload;
+    switch (event.type) {
+        case 'plan.validated':
+        case 'plan.revised':
+            next = withPlan(view, p.plan, event);
+            break;
+        case 'admission.accepted':
+        case 'resume.admitted':
+            next = {
+                ...view,
+                budget: view.budget && { ...view.budget, reservedMinor: view.budget.reservedMinor + Number(p.reservationMinor) },
+                // A new admission fences every executor holding an older epoch.
+                lease: { executorId: null, epoch: view.lease.epoch + 1 },
+                blockedReason: null,
+                record: { ...view.record, authorizationRef: String(p.authorizationRef) },
+            };
+            break;
+        case 'executor.acknowledged':
+            next = { ...view, lease: { executorId: String(p.executorId), epoch: view.lease.epoch } };
+            break;
+        case 'blocked':
+            next = { ...view, blockedReason: String(p.reason) };
+            break;
+        default:
+            break;
+    }
+    const record = { ...next.record };
+    if (record.authorizationRef === undefined)
+        delete record.authorizationRef;
+    return {
+        ...next,
+        record: { ...record, state: rule.to, revision: view.record.revision + 1, lastEventSequence: event.seq, updatedAt: event.at },
+        lastHash: event.hash,
+    };
+}
+function applyObservation(view, event) {
+    checkObservation(view, event.type, event.payload);
+    const p = event.payload;
+    let next = view;
+    if (event.type === 'executor.observed') {
+        next = {
+            ...view,
+            executor: {
+                executorId: String(p.executorId),
+                connection: String(p.connection),
+                observedAt: String(p.observedAt),
+                lastAckExecutionId: typeof p.lastAckExecutionId === 'string' ? p.lastAckExecutionId : view.executor?.lastAckExecutionId ?? null,
+            },
+        };
+    }
+    else if (event.type === 'task.observed') {
+        const id = String(p.taskId);
+        const status = p.status;
+        const op = `task:${id}`;
+        const unresolved = view.unresolvedOperations.filter((o) => o !== op);
+        next = {
+            ...view,
+            tasks: { ...view.tasks, [id]: { status, ...(typeof p.invocationId === 'string' ? { invocationId: p.invocationId } : {}) } },
+            // An unknown outcome stays unresolved until a later observation settles it.
+            unresolvedOperations: status === 'unknown' ? [...unresolved, op] : unresolved,
+        };
+    }
+    else {
+        next = {
+            ...view,
+            evidence: [...view.evidence, {
+                    evidenceId: String(p.evidenceId),
+                    criterionId: String(p.criterionId),
+                    taskId: typeof p.taskId === 'string' ? p.taskId : null,
+                    artifactDigest: String(p.artifactDigest),
+                    producer: String(p.producer),
+                    verified: p.verified === true,
+                    planRevision: view.record.plan.revision,
+                    criteriaDigest: view.record.acceptance.criteriaDigest,
+                    at: event.at,
+                }],
+            record: { ...view.record, evidenceRefs: [...view.record.evidenceRefs, String(p.evidenceId)] },
+        };
+    }
+    return {
+        ...next,
+        record: { ...next.record, lastEventSequence: event.seq, updatedAt: event.at },
+        lastHash: event.hash,
+    };
+}
+/** Apply one event; throws `TransitionError` for anything the rules refuse. */
+export function foldEvent(view, event) {
+    if (event.contract !== MISSION_EVENT_CONTRACT)
+        throw new TransitionError('bad-contract', `unknown event contract ${String(event.contract)}`);
+    const expectedPrev = view ? view.lastHash : GENESIS_HASH;
+    if (event.prevHash !== expectedPrev)
+        throw new TransitionError('chain-broken', `event ${event.seq} prevHash mismatch`);
+    const { hash, ...rest } = event;
+    if (eventHash(rest) !== hash)
+        throw new TransitionError('chain-broken', `event ${event.seq} hash mismatch`);
+    const expectedSeq = view ? view.record.lastEventSequence + 1 : 1;
+    if (event.seq !== expectedSeq)
+        throw new TransitionError('sequence-gap', `event ${event.seq}, expected ${expectedSeq}`);
+    if (!view) {
+        if (event.type !== 'mission.created')
+            throw new TransitionError('invalid-transition', 'first event must be mission.created');
+        return created(event);
+    }
+    if (event.type === 'mission.created')
+        throw new TransitionError('invalid-transition', 'mission already created');
+    if (isControlEvent(event.type))
+        return applyControl(view, event);
+    if (event.expectedRevision !== null || event.revision !== view.record.revision) {
+        throw new TransitionError('invalid-observation', 'observations carry no expected revision and do not change it');
+    }
+    return applyObservation(view, event);
+}
+export function replay(events, from = null) {
+    let view = from;
+    for (const e of events)
+        view = foldEvent(view, e);
+    return view;
+}
+//# sourceMappingURL=fold.js.map

package/v3/@claude-flow/cli/dist/src/missions/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * ADR-406 mission control runtime (M0 contract + storage, M1 observation).
+ */
+export * from './schemas.js';
+export * from './transitions.js';
+export * from './fold.js';
+export * from './store.js';
+export * from './observation.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/v3/@claude-flow/cli/dist/src/missions/index.js

@@ -0,0 +1,10 @@
+/**
+ * ADR-406 mission control runtime (M0 contract + storage, M1 observation).
+ */
+export * from './schemas.js';
+export * from './transitions.js';
+export * from './fold.js';
+export * from './store.js';
+export * from './observation.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map