clinkx 0.3.0 → 1.1.0

package/clinkx-workflows/dist/plan-review/discovery.d.ts

@@ -0,0 +1,45 @@
+export declare const PLAN_REVIEW_DISCOVERY_SCHEMA_VERSION: "council-plan-review-discovery-v1";
+export declare const PLAN_REVIEW_INTERCHANGE_SCHEMA_VERSION: "clinkx-plan-review-interchange-v1";
+/**
+ * A configured provider this server can dispatch a plan-review seat to.
+ *
+ * Availability only. D8 is retracted: plan-review seats run adapter-default, so
+ * there is no read-only eligibility to project — admission admits any
+ * configured provider, and publishing an `eligible` bit here would advertise a
+ * gate the runtime does not apply.
+ */
+export interface PlanReviewProviderDiscovery {
+    readonly cli_name: string;
+}
+export interface CouncilPlanReviewDiscovery {
+    readonly schema_version: typeof PLAN_REVIEW_DISCOVERY_SCHEMA_VERSION;
+    readonly interchange_schema_version: typeof PLAN_REVIEW_INTERCHANGE_SCHEMA_VERSION;
+    readonly input_schema_version: "council-plan-review-input-v1";
+    readonly result_schema_version: "council-plan-review-result-v1";
+    readonly execution_contract_schema_version: "execution-contract-v1";
+    readonly binding_schema_version: "clinkx-binding-v1";
+    readonly digest_profile: "checkpoint-text-v1";
+    readonly rubric_digest: string;
+    /**
+     * Positive declaration, matching the execution contract's own top-level
+     * field: reviewers are told not to mutate, and nothing enforces it. Published
+     * at discovery time so a consumer learns plan review is trusted-input-only
+     * BEFORE it submits a run.
+     */
+    readonly mutation_enforcement: "prompt-only";
+    readonly providers: readonly PlanReviewProviderDiscovery[];
+}
+/**
+ * Build the public, read-only discovery projection. The generic workflow
+ * catalog remains authoritative for names/descriptions/variables; this object
+ * is attached only to the plan-review-receipts entry.
+ *
+ * `configuredCliNames` is the host's full adapter inventory, which may include
+ * custom adapters outside plan review's closed v1 set. Providers are the
+ * INTERSECTION of that inventory with `PLAN_REVIEW_V1_CLI_NAMES`: a name must
+ * be both configured here AND bindable as a seat `cli_name`. Advertising a
+ * configured-but-non-v1 adapter would promise a seat that `CliNameSchema`
+ * rejects at contract parse; advertising an unconfigured v1 name would promise
+ * a provider this server cannot dispatch to.
+ */
+export declare function buildCouncilPlanReviewDiscovery(configuredCliNames: readonly string[]): CouncilPlanReviewDiscovery;

package/clinkx-workflows/dist/plan-review/discovery.js

@@ -0,0 +1,36 @@
+import { PLAN_REVIEW_V1_CLI_NAMES } from "./contract.js";
+import { PACKAGED_PLAN_REVIEW_RUBRIC_DIGEST } from "./rubric.js";
+export const PLAN_REVIEW_DISCOVERY_SCHEMA_VERSION = "council-plan-review-discovery-v1";
+export const PLAN_REVIEW_INTERCHANGE_SCHEMA_VERSION = "clinkx-plan-review-interchange-v1";
+/**
+ * Build the public, read-only discovery projection. The generic workflow
+ * catalog remains authoritative for names/descriptions/variables; this object
+ * is attached only to the plan-review-receipts entry.
+ *
+ * `configuredCliNames` is the host's full adapter inventory, which may include
+ * custom adapters outside plan review's closed v1 set. Providers are the
+ * INTERSECTION of that inventory with `PLAN_REVIEW_V1_CLI_NAMES`: a name must
+ * be both configured here AND bindable as a seat `cli_name`. Advertising a
+ * configured-but-non-v1 adapter would promise a seat that `CliNameSchema`
+ * rejects at contract parse; advertising an unconfigured v1 name would promise
+ * a provider this server cannot dispatch to.
+ */
+export function buildCouncilPlanReviewDiscovery(configuredCliNames) {
+    const v1CliNames = new Set(PLAN_REVIEW_V1_CLI_NAMES);
+    return {
+        schema_version: PLAN_REVIEW_DISCOVERY_SCHEMA_VERSION,
+        interchange_schema_version: PLAN_REVIEW_INTERCHANGE_SCHEMA_VERSION,
+        input_schema_version: "council-plan-review-input-v1",
+        result_schema_version: "council-plan-review-result-v1",
+        execution_contract_schema_version: "execution-contract-v1",
+        binding_schema_version: "clinkx-binding-v1",
+        digest_profile: "checkpoint-text-v1",
+        rubric_digest: PACKAGED_PLAN_REVIEW_RUBRIC_DIGEST,
+        mutation_enforcement: "prompt-only",
+        providers: [...new Set(configuredCliNames)]
+            .filter((cliName) => v1CliNames.has(cliName))
+            .sort()
+            .map((cliName) => ({ cli_name: cliName })),
+    };
+}
+//# sourceMappingURL=discovery.js.map

package/clinkx-workflows/dist/plan-review/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/plan-review/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,CAAC,MAAM,oCAAoC,GAC/C,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,sCAAsC,GACjD,mCAA4C,CAAC;AAiC/C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,kBAAqC;IAErC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;IAC7D,OAAO;QACL,cAAc,EAAE,oCAAoC;QACpD,0BAA0B,EAAE,sCAAsC;QAClE,oBAAoB,EAAE,8BAA8B;QACpD,qBAAqB,EAAE,+BAA+B;QACtD,iCAAiC,EAAE,uBAAuB;QAC1D,sBAAsB,EAAE,mBAAmB;QAC3C,cAAc,EAAE,oBAAoB;QACpC,aAAa,EAAE,kCAAkC;QACjD,oBAAoB,EAAE,aAAa;QACnC,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aAC5C,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/clinkx-workflows/dist/plan-review/execution-contract.d.ts

@@ -0,0 +1,298 @@
+import { z } from "zod";
+import { type CouncilPlanReviewResult } from "./contract.js";
+/**
+ * Strict normalized Phase-0 model. It is data-only: runtime admission,
+ * capability probing, snapshots, state, and subprocess enforcement land later.
+ */
+export declare const CouncilPlanReviewExecutionContractSchema: z.ZodEffects<z.ZodObject<{
+    schema_version: z.ZodLiteral<"execution-contract-v1">;
+    workspace_schema: z.ZodLiteral<"plan-workspace-v1">;
+    digest_profile: z.ZodLiteral<"checkpoint-text-v1">;
+    bindings: z.ZodObject<{
+        repository_id: z.ZodString;
+        review_id: z.ZodString;
+        iteration: z.ZodString;
+        plan_id: z.ZodString;
+        revision: z.ZodString;
+        plan_digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    }, {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    }>;
+    seats: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        seat_id: z.ZodString;
+        internal_call_id: z.ZodString;
+        cross_review_call_id: z.ZodString;
+        reviewer: z.ZodString;
+        cli_name: z.ZodEnum<["codex", "claude", "glm", "agy", "grok"]>;
+        stance: z.ZodEnum<["strict", "pragmatic", "adversarial"]>;
+    }, "strict", z.ZodTypeAny, {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }, {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }>, {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }, {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }>, "many">;
+    rubric: z.ZodObject<{
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        digest: string;
+    }, {
+        digest: string;
+    }>;
+    threshold: z.ZodEffects<z.ZodString, string, string>;
+    designated_editor: z.ZodString;
+    chairman_seat: z.ZodString;
+    /**
+     * D8 is RETRACTED: reviewers run adapter-default, so non-mutation is a
+     * PROMPT INSTRUCTION and nothing more. This field says exactly that and
+     * publishes no containment claim the runtime cannot back.
+     */
+    mutation_enforcement: z.ZodLiteral<"prompt-only">;
+    /**
+     * D2/D3/D6. These previously rode inside the D8 `read_only_policy` struct;
+     * they are independent decisions and outlive it. Each stays pinned to the
+     * only value the runtime implements — a `true` here would assert a
+     * deliberation the transport does not perform.
+     */
+    deliberation_policy: z.ZodObject<{
+        fallback_allowed: z.ZodLiteral<false>;
+        seat_substitution_allowed: z.ZodLiteral<false>;
+        deliberation_receipts_allowed: z.ZodLiteral<false>;
+        partial_transport_is_approval: z.ZodLiteral<false>;
+    }, "strict", z.ZodTypeAny, {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    }, {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    }>;
+    context_evidence_policy: z.ZodObject<{
+        immutable_snapshot_only: z.ZodLiteral<true>;
+        snapshot_digest: z.ZodString;
+        original_plan_context_allowed: z.ZodLiteral<false>;
+        plan_workspace_context_allowed: z.ZodLiteral<false>;
+    }, "strict", z.ZodTypeAny, {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    }, {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    schema_version: "execution-contract-v1";
+    workspace_schema: "plan-workspace-v1";
+    digest_profile: "checkpoint-text-v1";
+    threshold: string;
+    designated_editor: string;
+    chairman_seat: string;
+    seats: {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }[];
+    bindings: {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    };
+    rubric: {
+        digest: string;
+    };
+    mutation_enforcement: "prompt-only";
+    deliberation_policy: {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    };
+    context_evidence_policy: {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    };
+}, {
+    schema_version: "execution-contract-v1";
+    workspace_schema: "plan-workspace-v1";
+    digest_profile: "checkpoint-text-v1";
+    threshold: string;
+    designated_editor: string;
+    chairman_seat: string;
+    seats: {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }[];
+    bindings: {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    };
+    rubric: {
+        digest: string;
+    };
+    mutation_enforcement: "prompt-only";
+    deliberation_policy: {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    };
+    context_evidence_policy: {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    };
+}>, {
+    schema_version: "execution-contract-v1";
+    workspace_schema: "plan-workspace-v1";
+    digest_profile: "checkpoint-text-v1";
+    threshold: string;
+    designated_editor: string;
+    chairman_seat: string;
+    seats: {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }[];
+    bindings: {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    };
+    rubric: {
+        digest: string;
+    };
+    mutation_enforcement: "prompt-only";
+    deliberation_policy: {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    };
+    context_evidence_policy: {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    };
+}, {
+    schema_version: "execution-contract-v1";
+    workspace_schema: "plan-workspace-v1";
+    digest_profile: "checkpoint-text-v1";
+    threshold: string;
+    designated_editor: string;
+    chairman_seat: string;
+    seats: {
+        cli_name: "codex" | "claude" | "glm" | "agy" | "grok";
+        seat_id: string;
+        reviewer: string;
+        stance: "strict" | "pragmatic" | "adversarial";
+        internal_call_id: string;
+        cross_review_call_id: string;
+    }[];
+    bindings: {
+        review_id: string;
+        repository_id: string;
+        iteration: string;
+        plan_id: string;
+        revision: string;
+        plan_digest: string;
+    };
+    rubric: {
+        digest: string;
+    };
+    mutation_enforcement: "prompt-only";
+    deliberation_policy: {
+        fallback_allowed: false;
+        seat_substitution_allowed: false;
+        deliberation_receipts_allowed: false;
+        partial_transport_is_approval: false;
+    };
+    context_evidence_policy: {
+        immutable_snapshot_only: true;
+        snapshot_digest: string;
+        original_plan_context_allowed: false;
+        plan_workspace_context_allowed: false;
+    };
+}>;
+export type CouncilPlanReviewExecutionContract = z.infer<typeof CouncilPlanReviewExecutionContractSchema>;
+export interface ComputedCouncilPlanReviewExecutionContract {
+    readonly contract: CouncilPlanReviewExecutionContract;
+    readonly canonicalBytes: Buffer;
+    readonly digest: string;
+}
+export declare function computeCouncilPlanReviewExecutionContractDigest(input: unknown): ComputedCouncilPlanReviewExecutionContract;
+export type ExecutionContractResultBindingRejection = "digest_mismatch" | "binding_mismatch" | "roster_mismatch";
+export declare class ExecutionContractResultBindingError extends Error {
+    readonly code: ExecutionContractResultBindingRejection;
+    constructor(code: ExecutionContractResultBindingRejection, message: string);
+}
+export interface ValidatedCouncilPlanReviewExecutionResult {
+    readonly contract: CouncilPlanReviewExecutionContract;
+    readonly result: CouncilPlanReviewResult;
+    readonly execution_contract_digest: string;
+}
+/** Validate only the normalized contract/result relationship; performs no I/O. */
+export declare function validateCouncilPlanReviewExecutionContractResult(contractInput: unknown, resultInput: unknown): ValidatedCouncilPlanReviewExecutionResult;

package/clinkx-workflows/dist/plan-review/execution-contract.js

@@ -0,0 +1,194 @@
+import { z } from "zod";
+import { CliNameSchema, CouncilPlanReviewResultSchema, DigestSchema, PlanIdSchema, RepositoryIdSchema, ReviewIdSchema, } from "./contract.js";
+import { computeExecutionContractDigest, executionContractDecimal, } from "./digest.js";
+const PositiveDecimalIntegerSchema = z.string().regex(/^[1-9][0-9]*$/);
+const ScoreDecimalSchema = z
+    .string()
+    .regex(/^(?:0|[1-9][0-9]*)(?:\.[0-9]*[1-9])?$/)
+    .refine((value) => Number(value) >= 0 && Number(value) <= 10, {
+    message: "threshold must be between 0 and 10",
+});
+const InternalSeatCallIdSchema = z.string().regex(/^seat_[0-9]{3,}$/);
+const InternalCrossReviewCallIdSchema = z.string().regex(/^cross_[0-9]{3,}$/);
+const ExecutionContractSeatSchema = z
+    .object({
+    seat_id: ReviewIdSchema,
+    internal_call_id: InternalSeatCallIdSchema,
+    cross_review_call_id: InternalCrossReviewCallIdSchema,
+    reviewer: z.string().min(1),
+    cli_name: CliNameSchema,
+    stance: z.enum(["strict", "pragmatic", "adversarial"]),
+})
+    .strict()
+    .refine((seat) => seat.reviewer === seat.cli_name, {
+    message: "reviewer must equal cli_name",
+    path: ["reviewer"],
+});
+const ExecutionContractBindingsSchema = z
+    .object({
+    repository_id: RepositoryIdSchema,
+    review_id: ReviewIdSchema,
+    iteration: PositiveDecimalIntegerSchema,
+    plan_id: PlanIdSchema,
+    revision: PositiveDecimalIntegerSchema,
+    plan_digest: DigestSchema,
+})
+    .strict();
+const ExecutionContractRubricSchema = z
+    .object({ digest: DigestSchema })
+    .strict();
+/**
+ * Strict normalized Phase-0 model. It is data-only: runtime admission,
+ * capability probing, snapshots, state, and subprocess enforcement land later.
+ */
+export const CouncilPlanReviewExecutionContractSchema = z
+    .object({
+    schema_version: z.literal("execution-contract-v1"),
+    workspace_schema: z.literal("plan-workspace-v1"),
+    digest_profile: z.literal("checkpoint-text-v1"),
+    bindings: ExecutionContractBindingsSchema,
+    seats: z.array(ExecutionContractSeatSchema).min(1).max(10),
+    rubric: ExecutionContractRubricSchema,
+    threshold: ScoreDecimalSchema,
+    designated_editor: z.string().min(1),
+    chairman_seat: ReviewIdSchema,
+    /**
+     * D8 is RETRACTED: reviewers run adapter-default, so non-mutation is a
+     * PROMPT INSTRUCTION and nothing more. This field says exactly that and
+     * publishes no containment claim the runtime cannot back.
+     */
+    mutation_enforcement: z.literal("prompt-only"),
+    /**
+     * D2/D3/D6. These previously rode inside the D8 `read_only_policy` struct;
+     * they are independent decisions and outlive it. Each stays pinned to the
+     * only value the runtime implements — a `true` here would assert a
+     * deliberation the transport does not perform.
+     */
+    deliberation_policy: z
+        .object({
+        fallback_allowed: z.literal(false),
+        seat_substitution_allowed: z.literal(false),
+        deliberation_receipts_allowed: z.literal(false),
+        partial_transport_is_approval: z.literal(false),
+    })
+        .strict(),
+    context_evidence_policy: z
+        .object({
+        immutable_snapshot_only: z.literal(true),
+        snapshot_digest: DigestSchema,
+        original_plan_context_allowed: z.literal(false),
+        plan_workspace_context_allowed: z.literal(false),
+    })
+        .strict(),
+})
+    .strict()
+    .superRefine((contract, ctx) => {
+    const seatIds = new Set();
+    const internalCallIds = new Set();
+    for (const [index, seat] of contract.seats.entries()) {
+        if (seatIds.has(seat.seat_id)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `Duplicate seat_id: ${seat.seat_id}`,
+                path: ["seats", index, "seat_id"],
+            });
+        }
+        seatIds.add(seat.seat_id);
+        if (internalCallIds.has(seat.internal_call_id)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `Duplicate internal_call_id: ${seat.internal_call_id}`,
+                path: ["seats", index, "internal_call_id"],
+            });
+        }
+        internalCallIds.add(seat.internal_call_id);
+        if (internalCallIds.has(seat.cross_review_call_id)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `Duplicate internal call ID: ${seat.cross_review_call_id}`,
+                path: ["seats", index, "cross_review_call_id"],
+            });
+        }
+        internalCallIds.add(seat.cross_review_call_id);
+    }
+    if (!seatIds.has(contract.chairman_seat)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "chairman_seat must identify one execution-contract seat",
+            path: ["chairman_seat"],
+        });
+    }
+    if (contract.context_evidence_policy.snapshot_digest !==
+        contract.bindings.plan_digest) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "snapshot_digest must equal bindings.plan_digest",
+            path: ["context_evidence_policy", "snapshot_digest"],
+        });
+    }
+});
+function digestValue(contract) {
+    return {
+        ...contract,
+        bindings: {
+            ...contract.bindings,
+            iteration: executionContractDecimal(contract.bindings.iteration),
+            revision: executionContractDecimal(contract.bindings.revision),
+        },
+        threshold: executionContractDecimal(contract.threshold),
+    };
+}
+export function computeCouncilPlanReviewExecutionContractDigest(input) {
+    const contract = CouncilPlanReviewExecutionContractSchema.parse(input);
+    const computed = computeExecutionContractDigest(digestValue(contract));
+    return { contract, ...computed };
+}
+export class ExecutionContractResultBindingError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ExecutionContractResultBindingError";
+        this.code = code;
+    }
+}
+/** Validate only the normalized contract/result relationship; performs no I/O. */
+export function validateCouncilPlanReviewExecutionContractResult(contractInput, resultInput) {
+    const computed = computeCouncilPlanReviewExecutionContractDigest(contractInput);
+    const result = CouncilPlanReviewResultSchema.parse(resultInput);
+    if (result.execution_contract_digest !== computed.digest) {
+        throw new ExecutionContractResultBindingError("digest_mismatch", "result execution_contract_digest does not match the normalized contract");
+    }
+    const { contract } = computed;
+    const receiptIterationMismatch = result.seats.some((seat) => seat.execution_status === "completed" &&
+        String(seat.receipt_candidate.iteration) !== contract.bindings.iteration);
+    const bindingMismatch = result.bindings.repository_id !== contract.bindings.repository_id ||
+        result.bindings.review_id !== contract.bindings.review_id ||
+        result.bindings.plan_id !== contract.bindings.plan_id ||
+        String(result.bindings.revision) !== contract.bindings.revision ||
+        result.bindings.digest !== contract.bindings.plan_digest ||
+        String(result.bindings.threshold) !== contract.threshold ||
+        result.bindings.designated_editor !== contract.designated_editor ||
+        result.bindings.chairman_seat !== contract.chairman_seat ||
+        receiptIterationMismatch;
+    if (bindingMismatch) {
+        throw new ExecutionContractResultBindingError("binding_mismatch", "result bindings do not match the normalized contract");
+    }
+    const rosterMatches = result.seats.length === contract.seats.length &&
+        result.seats.every((resultSeat, index) => {
+            const contractSeat = contract.seats[index];
+            return (contractSeat !== undefined &&
+                resultSeat.seat_id === contractSeat.seat_id &&
+                resultSeat.internal_call_id === contractSeat.internal_call_id &&
+                resultSeat.reviewer === contractSeat.reviewer &&
+                resultSeat.cli_name === contractSeat.cli_name);
+        });
+    if (!rosterMatches) {
+        throw new ExecutionContractResultBindingError("roster_mismatch", "result seats must exactly match execution-contract order and identity");
+    }
+    return {
+        contract,
+        result,
+        execution_contract_digest: computed.digest,
+    };
+}
+//# sourceMappingURL=execution-contract.js.map

package/clinkx-workflows/dist/plan-review/execution-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-contract.js","sourceRoot":"","sources":["../../src/plan-review/execution-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,aAAa,EACb,6BAA6B,EAC7B,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AAErB,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AACvE,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,KAAK,CAAC,uCAAuC,CAAC;KAC9C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE;IAC5D,OAAO,EAAE,oCAAoC;CAC9C,CAAC,CAAC;AACL,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACtE,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAE9E,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,OAAO,EAAE,cAAc;IACvB,gBAAgB,EAAE,wBAAwB;IAC1C,oBAAoB,EAAE,+BAA+B;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;CACvD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE;IACjD,OAAO,EAAE,8BAA8B;IACvC,IAAI,EAAE,CAAC,UAAU,CAAC;CACnB,CAAC,CAAC;AAEL,MAAM,+BAA+B,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,4BAA4B;IACvC,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,4BAA4B;IACtC,WAAW,EAAE,YAAY;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;KAChC,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC/C,QAAQ,EAAE,+BAA+B;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,aAAa,EAAE,cAAc;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9C;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC;SACnB,MAAM,CAAC;QACN,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KAChD,CAAC;SACD,MAAM,EAAE;IACX,uBAAuB,EAAE,CAAC;SACvB,MAAM,CAAC;QACN,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,eAAe,EAAE,YAAY;QAC7B,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KACjD,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,sBAAsB,IAAI,CAAC,OAAO,EAAE;gBAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,+BAA+B,IAAI,CAAC,gBAAgB,EAAE;gBAC/D,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,+BAA+B,IAAI,CAAC,oBAAoB,EAAE;gBACnE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IACE,QAAQ,CAAC,uBAAuB,CAAC,eAAe;QAChD,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAC7B,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAML,SAAS,WAAW,CAClB,QAA4C;IAE5C,OAAO;QACL,GAAG,QAAQ;QACX,QAAQ,EAAE;YACR,GAAG,QAAQ,CAAC,QAAQ;YACpB,SAAS,EAAE,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAChE,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC/D;QACD,SAAS,EAAE,wBAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC;KAClB,CAAC;AAC1C,CAAC;AAQD,MAAM,UAAU,+CAA+C,CAC7D,KAAc;IAEd,MAAM,QAAQ,GAAG,wCAAwC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,8BAA8B,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;AACnC,CAAC;AAOD,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,IAAI,CAA0C;IAEvD,YAAY,IAA6C,EAAE,OAAe;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAQD,kFAAkF;AAClF,MAAM,UAAU,gDAAgD,CAC9D,aAAsB,EACtB,WAAoB;IAEpB,MAAM,QAAQ,GAAG,+CAA+C,CAAC,aAAa,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,yBAAyB,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC9B,MAAM,wBAAwB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAChD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,gBAAgB,KAAK,WAAW;QACrC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAC3E,CAAC;IACF,MAAM,eAAe,GACnB,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,QAAQ,CAAC,aAAa;QACjE,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,QAAQ,CAAC,SAAS;QACzD,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,QAAQ,CAAC,OAAO;QACrD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QAC/D,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACxD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,SAAS;QACxD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;QAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QACxD,wBAAwB,CAAC;IAC3B,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,EAClB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GACjB,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;QAC7C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YACvC,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,CACL,YAAY,KAAK,SAAS;gBAC1B,UAAU,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO;gBAC3C,UAAU,CAAC,gBAAgB,KAAK,YAAY,CAAC,gBAAgB;gBAC7D,UAAU,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ;gBAC7C,UAAU,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,mCAAmC,CAC3C,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM;QACN,yBAAyB,EAAE,QAAQ,CAAC,MAAM;KAC3C,CAAC;AACJ,CAAC"}

package/clinkx-workflows/dist/plan-review/expander.d.ts

@@ -0,0 +1,48 @@
+import type { NormalizedWorkflowDefinition } from "../definition-normalizer.js";
+import { type CouncilPlanReviewExecutionContract } from "./execution-contract.js";
+import type { CanonicalPlanSnapshot } from "./snapshot.js";
+/**
+ * Delimits the inlined snapshot. Long and fixed on purpose: the plan is
+ * untrusted text that may itself contain markdown fences, and an actor must be
+ * able to tell where the bound revision ends and its instructions resume.
+ */
+export declare const PLAN_SNAPSHOT_BEGIN = "-----BEGIN PLAN SNAPSHOT-----";
+export declare const PLAN_SNAPSHOT_END = "-----END PLAN SNAPSHOT-----";
+/**
+ * The exact snapshot block appended to every actor's prompt.
+ *
+ * Exported because it is the only thing a PERSISTED prepared input can be
+ * checked against on resume (D9). A resumed retry replays its persisted prompt
+ * verbatim — the expander never runs again for it — so the resume seam must
+ * re-derive these exact bytes and require them to be present. Two renderings
+ * would let the check pass against text no actor was ever sent.
+ *
+ * The result is appended by the ENGINE, after `renderCallPrompt` — never
+ * concatenated into a call's `prompt` template. See
+ * `NormalizedCall.plan_review_snapshot_text`: the plan is untrusted text that
+ * may contain `{{...}}`, and the renderer would rewrite or reject it.
+ */
+export declare function renderPlanSnapshotBlock(planSnapshotText: string): string;
+/** Remove plan/seat/provider bindings before a peer artifact is cross-reviewed. */
+export declare function projectPlanReviewSemanticBody(value: unknown): unknown;
+/**
+ * Expand the isolated four-stage plan-review seed. Existing council expansion
+ * is intentionally not reused or mutated.
+ */
+export declare function expandCouncilPlanReview(definition: NormalizedWorkflowDefinition, contractInput: CouncilPlanReviewExecutionContract, 
+/**
+ * The verified canonical plan snapshot (A-6/D9), inlined into every actor's
+ * prompt. Inlining TEXT rather than naming a path is what keeps D9 true now
+ * that actors run adapter-default: a path is a mutable thing an actor could
+ * re-read (or re-write) after verification, whereas the prompt bytes are
+ * fixed at dispatch.
+ *
+ * This takes the verified `CanonicalPlanSnapshot` rather than a bare `string`
+ * ON PURPOSE. A bare string accepts a PATHNAME just as happily as plan text,
+ * and a pathname would inline the path — reintroducing exactly the mutable
+ * indirection D9 exists to remove — while every existing test still passed,
+ * because none asserted on the rendered prompt. The nominal type makes that
+ * mistake unrepresentable for a reader; `assertVerifiedSnapshot` below makes
+ * it fail for the test suite.
+ */
+planSnapshot?: CanonicalPlanSnapshot): NormalizedWorkflowDefinition;