create-agdf 0.20.2 → 0.31.0

package/runtime/core/lib/control-inspect/authoring-inputs.js

@@ -0,0 +1,195 @@
+import { MATERIAL_LIMITS } from '../control-state/material-limits.js';
+import { AUTHORING_TEXT_HANDOFF } from '../control-state/authoring-text-handoff.js';
+import { approvalSummaryAuthoringFormat } from '../control-state/run-presentation-render.js';
+import { resolveArtifactPresentationLanguages } from '../resources/context.js';
+import { runDocumentPath } from '../control-state/run-identity.js';
+import { preparedCommandCall } from '../control-state/prepared-control-calls.js';
+import { inspectArtefactRecordingMode } from '../control-state/run-artefact-recording.js';
+import { readFileSync, statSync } from '../control-read/fs.js';
+import { captureControlScope } from '../control-read/snapshot.js';
+import { readRunState } from '../control-evaluation/run-state.js';
+import { runSealState, artefactFileDigest, canonicalRunText } from '../control-state/run-seal.js';
+import { containedRegularFile, hasSymlinkComponent } from '../control-state/contained-file.js';
+import { operationContract } from '../control-state/run-command-contract.js';
+import { resolveArtefactTemplatePath } from '../resources/artefact-templates.js';
+import { digest, resolveControlCommandTarget } from '../control-state/approval-command-contract.js';
+import { inspectDefinitionSources } from '../control-evaluation/definition-sources.js';
+import { prdDefinitionEligible } from '../skill-dispatch/prd-definition.js';
+import { evaluateGateCheck } from '../control-evaluation/gate-check.js';
+import { inspectPlannedEntry, inspectPlannedSelection } from '../control-state/planned-entry.js';
+import { assertPlannedNotTransferred } from '../control-state/planned-origin-reader.js';
+import { parseControlState } from '../control-state/run-state-parser.js';
+import { CLOSEOUT_AUTHORING_SCOPE, isCompletedStructuredCloseout } from './selection.js';
+
+const templateId = gate => ({ UR: 'UR', PRD: 'PRD', SD: 'SD', TP: 'TP', QA: 'QA_REPORT', OR: 'OR',
+  'Brownfield Review': 'BROWNFIELD_REVIEW', 'Brownfield Analysis': 'BROWNFIELD_REVIEW', 'Mode/Slice Decision': 'BROWNFIELD_REVIEW',
+  'UX Intent Definition': 'UX_INTENT_DEFINITION', 'Verified Change Execution': 'VERIFIED_CHANGE' })[gate];
+
+// One contained source projection plus the existing version-bound template owner.
+// Its paged text is input, never a presentation, edit permission or review attestation.
+export function inspectAuthoringInputs(root, input, { gitObservation } = {}) {
+  const unavailable = reason => ({ available: false, reason, authorizes: false });
+  try {
+    const scopedCloseout = input.authoring_scope === CLOSEOUT_AUTHORING_SCOPE;
+    const observeGit = () => ({ head: gitObservation.gitValue(root, ['rev-parse', 'HEAD']),
+      tracked: gitObservation.gitPathList(root, ['diff', 'HEAD', '--name-only']),
+      untracked: gitObservation.gitPathList(root, ['ls-files', '--others', '--exclude-standard']) });
+    let git;
+    const currentGit = () => git ??= observeGit();
+    const observedGit = !input.planning && gitObservation ? { gitValue: () => currentGit().head,
+      gitPathList: (_root, args) => args[0] === 'diff' ? currentGit().tracked : currentGit().untracked } : undefined;
+    const captured = captureControlScope(root, () => {
+      const languages = resolveArtifactPresentationLanguages(root, input.presentation_language);
+      if (input.planning) {
+        inspectPlannedSelection(root, input.planning, { presentationLanguage: input.presentation_language });
+        const creating = input.planning.expected_digest === null;
+        const entry = creating ? null : inspectPlannedEntry(root, input.planning.plan_id, { presentationLanguage: input.presentation_language });
+        if (!creating) assertPlannedNotTransferred(root, input.planning.plan_id);
+        const kind = creating ? 'planned_ur.create' : 'planned_ur.replace';
+        return { languages, gate: null, authoring_owner: 'UR', mode: 'planning', recording: { mode: creating ? 'create_planned' : 'replace_planned', kind },
+          next_operation: { type: 'author_planned_ur', skill_id: 'ur-definition', kind }, status: 'draft', blocking_reason: null,
+          sources: entry ? [{ type: 'UR', path: entry.path, status: 'draft', digest: entry.digest, content: entry.content }] : [] };
+      }
+      const state = readRunState(root, { runId: input.run_id, ignoreRunIdEnv: true });
+      if (state.resolution_error || state.meta?.revision_id !== input.expected_revision_id || runSealState(root, state.content).status !== 'valid') throw Error('authoring_binding_stale_or_invalid');
+      const evaluated = evaluateGateCheck(root, { runId: input.run_id, ignoreRunIdEnv: true, presentationLanguage: input.presentation_language }, observedGit);
+      const mode = state.mode_slice_decision?.decision;
+      if (scopedCloseout && !isCompletedStructuredCloseout(evaluated, mode)) throw Error('authoring_closeout_unavailable');
+      const protectedSources = parseControlState(state.content, { closeoutArtefacts: ['Planned UR Snapshot', 'Planned UR Origin'] }).artefacts;
+      const rows = [...new Map([...state.artefacts, ...protectedSources])].filter(([, r]) => r.path).map(([type, row]) => ({ type, ...row }));
+      if (rows.length > 32) throw Error('authoring_source_limit');
+      const selected = scopedCloseout ? rows.filter(row => row.type === 'OR' || row.type === 'QA') : rows;
+      if (scopedCloseout && selected.length !== 2) throw Error('authoring_closeout_unavailable');
+      const sources = selected.map(row => {
+        const path = row.path.replace(/^`|`$/gu, '');
+        if (!path.startsWith(`${runDocumentPath(input.run_id, '')}/`) || hasSymlinkComponent(root, path)) throw Error('authoring_source_unavailable');
+        const file = containedRegularFile(root, path);
+        if (file.status !== 'valid' || statSync(file.path).size > 131072) throw Error('authoring_source_unavailable');
+        const content = new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(file.path));
+        return { type: row.type, path, status: row.status, digest: artefactFileDigest(root, path), content };
+      });
+      if (scopedCloseout) return { languages, gate: evaluated.current_gate, mode, status: evaluated.status,
+        blocking_reason: evaluated.blocking_reason, next_operation: evaluated.next_operation, sources };
+      // Match dispatch's initial UX prerequisite route as well as source reassessment.
+      // Reuse its eligibility and contained-source facts; inspection grants no repair permission.
+      const prdEligible = prdDefinitionEligible(evaluated, { ...input, skill_id: 'prd-definition' });
+      const uxRequired = prdEligible && inspectDefinitionSources(root, state, input.run_id, 'PRD', ['UR', 'Brownfield Review']).issue?.repairable;
+      const nextOperation = uxRequired ? { type: 'reassess_source_analysis', skill_id: 'ux-intent-definition', analysis: 'UX Intent Definition' } : evaluated.next_operation;
+      return { languages, gate: evaluated.current_gate, authoring_owner: nextOperation?.type === 'record_closeout' ? 'OR'
+        : nextOperation?.analysis ?? nextOperation?.internal_step ?? nextOperation?.gate ?? evaluated.current_gate,
+        recording: inspectArtefactRecordingMode(state, evaluated.current_gate), mode, next_operation: nextOperation, status: evaluated.status,
+        blocking_reason: evaluated.blocking_reason, sources };
+    });
+    const data = captured.data, ids = scopedCloseout ? [] : [data.gate === 'OR' && data.mode === 'verified_change' ? 'VERIFIED_CHANGE' : templateId(data.authoring_owner),
+      ...(['Brownfield Review', 'Mode/Slice Decision'].includes(data.gate) ? ['VERIFIED_CHANGE'] : [])].filter(Boolean);
+    const templates = ids.map(id => {
+      const path = resolveArtefactTemplatePath(id);
+      if (statSync(path).size > 131072) throw Error('authoring_template_limit');
+      const content = new TextDecoder('utf-8', { fatal: true }).decode(readFileSync(path));
+      return { role: 'template', type: id, digest: digest(canonicalRunText(content)), content, source: 'version_matched_plugin' };
+    });
+    const sources = data.sources.map(s => ({ role: 'source', ...s }));
+    const currentDraft = sources.find(source => source.type === data.authoring_owner);
+    // The source being corrected must not move behind unrelated, growing sources.
+    // Keep the legacy template-first view; bundles put the current source first.
+    const documents = input.bundle && currentDraft
+      ? [currentDraft, ...templates, ...sources.filter(source => source !== currentDraft)]
+      : [...templates, ...sources];
+    if (documents.length > 32) throw Error('authoring_source_limit');
+    const manifest = digest(JSON.stringify({ target_id: resolveControlCommandTarget(root).target_id, run_id: input.run_id,
+      ...(input.planning ? { planning: input.planning } : {}),
+      ...(scopedCloseout ? { authoring_scope: input.authoring_scope } : {}),
+      revision_id: input.expected_revision_id, languages: data.languages, ...(input.bundle ? { bundle: 2 } : {}), gate: data.gate, authoring_owner: data.authoring_owner, recording: data.recording, documents: documents.map(({ content, ...r }) => r) })).slice(7);
+    const chunks = [];
+    for (const document of documents) {
+      const { content, ...metadata } = document, bytes = Buffer.from(content);
+      if (input.bundle && !bytes.length) chunks.push({ ...metadata, content: '', byte_start: 0, byte_end: 0, total_bytes: 0 });
+      for (let start = 0; start < bytes.length;) {
+        let end = Math.min(start + 16384, bytes.length);
+        while (end < bytes.length && (bytes[end] & 0xc0) === 0x80) end--;
+        let chunk;
+        for (;;) {
+          chunk = { ...metadata, content: bytes.subarray(start, end).toString('utf8'), byte_start: start, byte_end: end, total_bytes: bytes.length };
+          if (!input.bundle || Buffer.byteLength(JSON.stringify([chunk])) <= 48128) break;
+          end = start + Math.floor((end - start) / 2);
+          while (end > start && (bytes[end] & 0xc0) === 0x80) end--;
+          if (end <= start) throw Error('authoring_metadata_limit');
+        }
+        chunks.push(chunk);
+        start = end;
+      }
+    }
+    const pages = [];
+    if (input.bundle) {
+      for (const chunk of chunks) {
+        const last = pages.at(-1);
+        if (!last || Buffer.byteLength(JSON.stringify([...last, chunk])) > 48128) pages.push([chunk]);
+        else last.push(chunk);
+      }
+    }
+    const selection = input.bundle ? pages : chunks;
+    const prefix = `${manifest}:`;
+    if (input.cursor !== undefined && (!input.cursor.startsWith(prefix) || !/^(0|[1-9][0-9]*)$/u.test(input.cursor.slice(prefix.length)))) throw Error('authoring_cursor_stale_or_invalid');
+    const index = input.cursor === undefined ? 0 : Number(input.cursor.slice(prefix.length));
+    if (!Number.isSafeInteger(index) || index < 0 || index >= Math.max(selection.length, 1)) throw Error('authoring_cursor_stale_or_invalid');
+    if (git && JSON.stringify(observeGit()) !== JSON.stringify(git)) throw Error('authoring_binding_stale_or_invalid');
+    captured.view.revalidate();
+    const grouped = new Map();
+    for (const part of pages[index] ?? []) {
+      const key = JSON.stringify([part.role, part.type, part.path, part.digest]);
+      const prior = grouped.get(key);
+      if (prior) {
+        if (prior.byte_end !== part.byte_start) throw Error('authoring_fragment_order_invalid');
+        prior.content += part.content; prior.byte_end = part.byte_end;
+      } else grouped.set(key, { ...part });
+    }
+    const documentRows = [...grouped.values()].map(row => ({ ...row, complete: row.byte_start === 0 && row.byte_end === row.total_bytes }));
+    const documentPage = { documents: documentRows.filter(row => row.complete), fragments: documentRows.filter(row => !row.complete) };
+    if (input.bundle && Buffer.byteLength(JSON.stringify(documentPage)) > 49152) throw Error('authoring_page_limit');
+    const pageCall = page => ({ tool: 'agdf_inspect', arguments: { operation: 'authoring-inputs',
+      ...Object.fromEntries(['presentation_language', 'working_directory', 'primary_target', 'target_source', 'target_id',
+        'run_id', 'expected_revision_id', 'planning', 'bundle', 'authoring_scope'].filter(key => input[key] !== undefined).map(key => [key, input[key]])),
+      cursor: `${prefix}${page}` } });
+    const nextPage = index + 1 < selection.length ? pageCall(index + 1) : null;
+    if (scopedCloseout) return { available: true, ...data.languages, run_id: input.run_id, revision_id: input.expected_revision_id,
+      gate: data.gate, mode: data.mode, status: data.status, blocking_reason: data.blocking_reason, next_operation: data.next_operation,
+      authoring_scope: input.authoring_scope, manifest_digest: `sha256:${manifest}`,
+      document_manifest: documents.map(({ content, ...metadata }) => metadata), format: 'document_bundle_v2',
+      ...documentPage, page_bytes_limit: 49152, page_index: index, page_count: Math.max(selection.length, 1),
+      complete: !nextPage, next_cursor: nextPage?.arguments.cursor ?? null, next_calls: nextPage ? [nextPage] : [], authorizes: false };
+    const draftRow = currentDraft && documentRows.find(row => row.role === 'source' && row.type === currentDraft.type && row.path === currentDraft.path && row.digest === currentDraft.digest);
+    const draftPage = input.bundle && currentDraft ? pages.findIndex(page => page.some(row => row.role === 'source'
+      && row.type === currentDraft.type && row.path === currentDraft.path && row.digest === currentDraft.digest && row.byte_start === 0)) : -1;
+    const registeredUr = data.authoring_owner === 'UR' && data.sources.some(source => source.type === 'UR' && source.path);
+    const formats = input.planning ? operationContract('agdf_record', data.recording.kind)
+      : registeredUr ? operationContract('agdf_revise', 'ur_draft.replace', { gate: 'UR' }) : data.authoring_owner === 'OR' ? operationContract('agdf_closeout', 'closeout.record')
+      : operationContract('agdf_record', ['PRD', 'SD', 'TP', 'QA'].includes(data.authoring_owner) ? 'artefact.record' : 'step.record', { gate: data.authoring_owner });
+    const summaryFormat = approvalSummaryAuthoringFormat(data.authoring_owner, currentDraft?.content ?? '', data.languages);
+    return { available: true, ...data.languages, run_id: input.run_id, revision_id: input.expected_revision_id, gate: data.gate, mode: data.mode,
+      ...(input.planning ? { planning: input.planning, canonical_skill: 'ur-definition' } : {}),
+      authoring_owner: data.authoring_owner, recording: data.recording,
+      ...(summaryFormat ? { approval_summary_format: summaryFormat } : {}),
+      ...(!input.planning && index === 0 ? { material_call: preparedCommandCall('agdf_record', 'material.stage',
+        { ...input, target_id: resolveControlCommandTarget(root).target_id }, { gate: data.authoring_owner }) } : {}),
+      status: data.status, blocking_reason: data.blocking_reason, next_operation: data.next_operation,
+      manifest_digest: `sha256:${manifest}`, ...(input.bundle ? { document_manifest: documents.map(({ content, ...r }) => r) } : { documents: documents.map(({ content, ...r }) => r) }),
+      ...(input.bundle ? { format: 'document_bundle_v2', ...documentPage, page_bytes_limit: 49152,
+        page_index: index, page_count: Math.max(selection.length, 1),
+        first_page_call: pageCall(0),
+        current_draft: currentDraft ? { type: currentDraft.type, path: currentDraft.path, status: currentDraft.status, digest: currentDraft.digest,
+          content_state: draftRow?.complete ? 'complete' : draftRow ? 'fragment' : 'not_on_page',
+          ...(draftPage >= 0 && (!draftRow || draftRow.byte_start > 0) ? { read_call: pageCall(draftPage) } : {}),
+          instruction: 'Metadata only, never document text or edit permission. Use the matching complete report.documents row. For a fragment, join matching report.fragments by byte offsets across next_calls before editing. If not_on_page or earlier fragment bytes were not retained, copy read_call.arguments unchanged to read its first page.' } : null }
+        : { chunk: chunks[index] ?? null }), complete: index + 1 >= selection.length,
+      next_cursor: index + 1 < selection.length ? `${prefix}${index + 1}` : null,
+      next_calls: nextPage ? [{ ...nextPage, instruction: 'Copy arguments unchanged to read the next page of this manifest. Retain earlier bytes; repeat until complete before editing a fragmented source. No JavaScript cloning or source/path discovery is needed.' }] : [],
+      // The writer contract is identical on every page of one manifest; later pages only name it.
+      formats: index === 0 ? input.bundle ? (({ schema, result_schema, ...authoring }) => authoring)(formats) : formats : { schema_version: formats.schema_version, available: formats.available, group: formats.group, kind: formats.kind,
+        omitted: 'identical to the first page of this manifest' },
+      material_transport: { tool: 'agdf_record', kind: input.planning ? 'planned_material.stage' : 'material.stage', limits: { request_bytes: 65536, inline_file_bytes: MATERIAL_LIMITS.inline, part_bytes: MATERIAL_LIMITS.part, source_bytes: MATERIAL_LIMITS.file },
+        instructions: (input.bundle
+          ? 'MCP access: response.structuredContent.report (or JSON.parse(response.content[0].text).report). Read complete report.documents[].content; report.document_manifest and current_draft are metadata only. The registered current draft is prioritized; inspect current_draft.content_state before looking for its complete document. Join report.fragments by identity and byte offsets across all next_calls pages before editing. Absent content is an error, never the string undefined. Copy call.arguments unchanged and supply only authored content in the named fields; no JavaScript helper is required. Preserve bundle:true. '
+          : 'MCP access: response.structuredContent.report (or JSON.parse(response.content[0].text).report). This legacy view puts text in report.chunk.content; report.documents is metadata only. Follow every next_cursor with this exact binding, or request bundle:true for fewer round trips. ')
+          + 'The included formats and bound forms replace a second operation-contract read. Retain unchanged sources for this manifest. Prefer material_call: put takes exact UTF-8 <=48 KiB per file within the 64 KiB JSON request bound and seals once. Use returned recording_calls, adding only required author/review inputs. Larger files use multipart; each action has its own UUID. Follow next_calls exactly. No file/path discovery or shell hashing. ' + AUTHORING_TEXT_HANDOFF }, authorizes: false };
+  } catch (e) { return unavailable(e.code ?? e.message); }
+}

package/runtime/core/lib/control-inspect/cockpit-archive.js

@@ -0,0 +1,53 @@
+// Cockpit reads only this current archive format. Old control parsers stay offline.
+import { createHash } from 'node:crypto';
+import { join, posix } from 'node:path';
+import { existsSync, readFileSync } from '../control-read/fs.js';
+import { fail, READ_LIMITS } from '../control-read/snapshot.js';
+export const ARCHIVE_INDEX = '.agdf/control/archive/INDEX.json';
+export const ARCHIVE_SCHEMA = 'cockpit-archive/1';
+const hash = bytes => 'sha256:' + createHash('sha256').update(bytes).digest('hex');
+const safe = path => typeof path === 'string' && path.length < 4096 && !/[\\\u0000-\u001f:]/u.test(path)
+  && !path.startsWith('/') && path.split('/').every(p => p && p !== '.' && p !== '..');
+const plain = value => value && typeof value === 'object' && !Array.isArray(value);
+const text = value => typeof value === 'string' && value.length <= 8192;
+export function readCockpitArchive(root) {
+  if (!existsSync(join(root, ARCHIVE_INDEX))) return null;
+  const bytes = readFileSync(join(root, ARCHIVE_INDEX));
+  let index; try { index = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)); } catch { fail('archive_invalid'); }
+  validateCockpitArchive(index);
+  return { ...index, digest: hash(bytes) };
+}
+export function validateCockpitArchive(index) {
+  if (!plain(index) || index.schema !== ARCHIVE_SCHEMA || index.authorizes !== false || !/^sha256:[a-f0-9]{64}$/u.test(index.source_digest)
+    || !Array.isArray(index.entries) || index.entries.length > 4096) fail('archive_invalid');
+  if (Buffer.byteLength(JSON.stringify(index)) > READ_LIMITS.file) fail('resource_limit');
+  const keys = new Set(), paths = new Set(); let files = 0;
+  for (const run of index.entries) {
+    if (!plain(run) || !text(run.id) || keys.has(run.id) || !text(run.title) || !['run', 'artefacts', 'project'].includes(run.entry_kind) || ![run.recorded_lifecycle, run.recorded_gate, run.source_control_version].every(v => v === null || text(v))
+      || !Array.isArray(run.recorded_approvals) || run.recorded_approvals.length > 64 || !run.recorded_approvals.every(a => plain(a) && ['gate', 'status', 'evidence'].every(k => text(a[k])))
+      || !Array.isArray(run.documents) || run.documents.length > READ_LIMITS.files) fail('archive_invalid');
+    keys.add(run.id);
+    for (const doc of run.documents) {
+      if (!plain(doc) || !safe(doc.path) || !doc.path.startsWith('.agdf/control/archive/source/') || (!text(doc.original_path) || !doc.original_path.startsWith('.agdf/control/'))
+        || paths.has(doc.path) || !/^sha256:[a-f0-9]{64}$/u.test(doc.digest) || !Number.isSafeInteger(doc.bytes) || doc.bytes < 0) fail('archive_invalid');
+      paths.add(doc.path); if (++files > READ_LIMITS.files) fail('resource_limit');
+    }
+  }
+  return index;
+}
+export function archiveRows(index) {
+  return index ? index.entries.map(run => ({ kind: 'archive', identity: `archive/${run.id}`, section: 'archive', key: run.id,
+    original_key: run.id, title: run.title, stored_status: `Archiviert · damaliger Stand: ${run.recorded_lifecycle ?? 'Unbekannt'}`,
+    scope: 'Altbestandsarchiv · nur lesen', priority: null, stored_next_step: 'Archiv ansehen',
+    source_links: ARCHIVE_INDEX, current_spec: null, source: { path: ARCHIVE_INDEX, digest: index.digest },
+    coverage: 'archived', actions: ['read_archive'], handoff_ready: false, selectable: true, authorizes: false })) : [];
+}
+export function readArchiveDocument(root, doc) {
+  const bytes = readFileSync(join(root, doc.path));
+  if (bytes.length !== doc.bytes || hash(bytes) !== doc.digest) fail('source_changed');
+  if (bytes.length > READ_LIMITS.preview || !['md', 'json', 'txt', 'log', 'patch'].includes(posix.extname(doc.path).slice(1).toLowerCase()))
+    return { available: false, reason: 'document_unsupported', path: doc.original_path, digest: doc.digest, bytes: doc.bytes };
+  let content; try { content = new TextDecoder('utf-8', { fatal: true }).decode(bytes); if (content.includes('\0')) throw Error(); }
+  catch { return { available: false, reason: 'document_unsupported', path: doc.original_path, digest: doc.digest, bytes: doc.bytes }; }
+  return { available: true, path: doc.original_path, digest: doc.digest, bytes: doc.bytes, content };
+}

package/runtime/core/lib/control-inspect/cockpit-context.js

@@ -85,7 +85,8 @@ export function composeCockpitPacket(metadata, document, context, input) {
   const selected = input.graph_ids.map(id => registrations.get(id));
   if (selected.some(ref => ref.state !== 'available')) fail('resource_denied');
   if (context.references.some(ref => ref.state !== 'available' && !input.excluded_ids.includes(ref.resource_id))) fail('context_exclusion_required');
-  const packet = { ...metadata, context_id: randomUUID(), generation: input.generation,
+  // Context packets keep their independent published format when the reader envelope evolves.
+  const packet = { ...metadata, schema_version: '1', context_id: randomUUID(), generation: input.generation,
     prepared_at: new Date().toISOString(), artefact: document,
     graph_nodes: selected,
     included: [{ resource_id: document.resource.resource_id, path: document.resource.path }, ...selected.map(ref => ({ resource_id: ref.resource_id, node_id: ref.node_id, origin: ref.origin }))],

package/runtime/core/lib/control-inspect/cockpit-contract.js

@@ -1,24 +1,30 @@
+import { RUN_ID_PATTERN } from '../control-state/run-identity.js';
 // One wire-schema owner for the bounded cockpit connection. No filesystem selectors.
 import { COCKPIT_UI_URI } from '../mcp-resource-contract.js';
+import { READ_SESSION_CAPACITY } from '../control-read/cockpit-pool.js';
 export { COCKPIT_UI_URI, DECISION_UI_URI } from '../mcp-resource-contract.js';
 export const COCKPIT_MIME = 'text/html;profile=mcp-app';
 export const COCKPIT_LIMITS = Object.freeze({ html: 4 * 1024 ** 2, idle: 30 * 60_000, lifetime: 8 * 60 * 60_000,
-  sessions: 4, capture: 64 * 1024 ** 2, workerOldGeneration: 256 });
+  sessions: READ_SESSION_CAPACITY, capture: 64 * 1024 ** 2, workerOldGeneration: 256 });
 const id = { type: 'string', format: 'uuid' };
-const run = { type: 'string', pattern: '^[A-Za-z0-9_-]{1,128}$' };
+const run = { type: 'string', pattern: RUN_ID_PATTERN.source };
 function operation(name, fields = {}, optional = []) {
   const properties = { operation: { const: name }, session_id: id, ...fields };
   return { type: 'object', additionalProperties: false, properties, required: Object.keys(properties).filter(key => !optional.includes(key)) };
 }
 export const COCKPIT_READ_SCHEMA = Object.freeze({ oneOf: [
-  operation('snapshot', { run_id: run }, ['run_id']),
-  operation('backlog_titles', { snapshot_id: id, row_ids: { type: 'array', minItems: 1, maxItems: 12, uniqueItems: true, items: id } }),
+  operation('snapshot', { run_id: run, view: { type: 'string', enum: ['runs'] } }, ['run_id', 'view']),
+  operation('archive', { snapshot_id: id, row_id: id, resource_id: id }, ['resource_id']),
+  operation('planned', { snapshot_id: id, row_id: id }),
   operation('run', { snapshot_id: id, run_id: run }),
   operation('artifact_readiness', { snapshot_id: id, run_id: run, gate: { type: 'string', enum: ['UR', 'PRD', 'SD', 'TP'] }, expected_revision_id: id }),
   operation('document', { snapshot_id: id, run_id: run, resource_id: id }),
   operation('preview', { snapshot_id: id, run_id: run, resource_id: id }),
   operation('freshness', { snapshot_id: id }),
   operation('changes', { snapshot_id: id }),
+  operation('decision_display', { owner_epoch: id, nonce: id, surface_id: id,
+    document_digest: { type: 'string', pattern: '^sha256:[a-f0-9]{64}$' }, visible: { const: true } }),
+  operation('decision_state'),
   operation('context', { snapshot_id: id, run_id: run }),
   operation('prepare_context', { snapshot_id: id, run_id: run, revision_id: id, resource_id: id,
     graph_ids: { type: 'array', maxItems: 16, uniqueItems: true, items: id },
@@ -69,6 +75,7 @@ export function parseCockpitArguments(value, render = false) {
     if (typeof value.run_id !== 'string' || !new RegExp(run.pattern).test(value.run_id)) return reject();
     return { run_id: value.run_id };
   }
+  if (value.operation === 'snapshot' && Object.hasOwn(value, 'run_id') && Object.hasOwn(value, 'view')) return reject();
   const branch = COCKPIT_READ_SCHEMA.oneOf.find(row => row.properties.operation.const === value.operation);
   if (!branch || Object.keys(value).some(key => !Object.hasOwn(branch.properties, key)) || branch.required.some(key => !Object.hasOwn(value, key))) return reject();
   const valid = (item, rule) => {

package/runtime/core/lib/control-inspect/cockpit-list.d.ts

@@ -1,17 +1,21 @@
-export const COCKPIT_BACKLOG_SECTIONS: readonly ['Active Backlog', 'Planned / Parking Lot', 'Completed / Superseded Pointers'];
-export interface ListEntry { section: string; key: string; title: string; stored_status: string; selectable: boolean }
+export const COCKPIT_WORK_SECTIONS: readonly ['active', 'planned', 'completed', 'archive'];
+export interface ListEntry { section: string; key: string; title: string; stored_status: string; selectable: boolean; identity: string; source: { path: string; digest: string | null } }
 export interface ListDiagnostic { code: string; section?: string; key?: string | null }
 export interface ListInventory<T extends ListEntry = ListEntry, D extends ListDiagnostic = ListDiagnostic> {
-  entries: T[]; diagnostics: D[]; counts: Record<string, number>; content_digest: string; source_path: string;
+  entries: T[]; diagnostics: D[]; counts: Record<string, number>; content_digest: string; source_path: string; layout?: string;
 }
 export interface CockpitListRow<T extends ListEntry = ListEntry> {
   entry: T; index: number; identity: string; selectable: boolean; displayTitle: string;
-  provenance: { path: string; digest: string; originalTitle: string };
+  provenance: { path: string; digest: string | null; originalTitle: string };
 }
 export interface CockpitList<T extends ListEntry = ListEntry, D extends ListDiagnostic = ListDiagnostic> {
   section: string; query: string; coverage: 'complete' | 'partial' | 'unavailable'; diagnostics: D[];
   sectionCount: number | null; matchCount: number | null; rows: CockpitListRow<T>[];
 }
-export function hasConsistentBacklogCounts(inventory: unknown): boolean;
-export function backlogRowKey(entry: ListEntry, index: number, digest: string): string;
+export function hasConsistentWorkCounts(inventory: unknown): boolean;
 export function projectCockpitList<T extends ListEntry, D extends ListDiagnostic>(inventory: ListInventory<T, D> | null, options?: { section?: string; query?: string }): CockpitList<T, D>;
+
+export interface RunListEntry { valid: boolean; lifecycle: string | null; run_id: string; title: string; attention: { label: string } }
+export function projectCockpitRuns<T extends RunListEntry>(inventory: { runs: T[]; state: string }, options?: { section?: string; query?: string }): {
+  rows: T[]; sectionCount: number; matchCount: number; coverage: 'complete' | 'partial' | 'unavailable';
+};

package/runtime/core/lib/control-inspect/cockpit-list.js

@@ -1,45 +1,36 @@
-// Pure internal Core policy shared by Node readers and browser list presentations.
-// Raw entries and opaque selectors remain in source order and are never modified here.
-export const COCKPIT_BACKLOG_SECTIONS = Object.freeze([
-  'Active Backlog', 'Planned / Parking Lot', 'Completed / Superseded Pointers',
-]);
-const unreadableLayout = /^(backlog_(section_missing|layout_missing|layout_unsupported)|AGDF_BACKLOG_LAYOUT_UNKNOWN)$/;
-
-export function hasConsistentBacklogCounts(inventory) {
-  if (!inventory || !Array.isArray(inventory.entries) || !inventory.counts || typeof inventory.counts !== 'object') return false;
-  const actual = new Map();
-  for (const row of inventory.entries) {
-    if (!row || !COCKPIT_BACKLOG_SECTIONS.includes(row.section)) return false;
-    actual.set(row.section, (actual.get(row.section) ?? 0) + 1);
-  }
-  return Object.entries(inventory.counts).every(([section, count]) => COCKPIT_BACKLOG_SECTIONS.includes(section)
-    && Number.isSafeInteger(count) && count >= 0 && count === (actual.get(section) ?? 0))
-    && [...actual.keys()].every(section => Object.hasOwn(inventory.counts, section));
+// Pure current-model list policy shared by Core and the browser.
+export const COCKPIT_WORK_SECTIONS = Object.freeze(['active', 'planned', 'completed', 'archive']);
+export function hasConsistentWorkCounts(inventory) {
+  if (!inventory || inventory.layout !== 'run-folders-v1' || !Array.isArray(inventory.entries)
+    || !inventory.counts || typeof inventory.counts !== 'object' || Object.keys(inventory.counts).length !== COCKPIT_WORK_SECTIONS.length) return false;
+  return COCKPIT_WORK_SECTIONS.every(section => Number.isSafeInteger(inventory.counts[section])
+    && inventory.counts[section] === inventory.entries.filter(row => row?.section === section).length)
+    && inventory.entries.every(row => row && COCKPIT_WORK_SECTIONS.includes(row.section));
 }
-
-export function backlogRowKey(entry, index, digest) {
-  return JSON.stringify([digest, index, entry.section, entry.key]);
+export function projectCockpitList(inventory, { section = 'active', query = '' } = {}) {
+  if (!COCKPIT_WORK_SECTIONS.includes(section)) throw Error('dto_invalid');
+  const normalized = query.trim().toLowerCase();
+  if (!inventory) return { section, query: normalized, coverage: 'unavailable', diagnostics: [], sectionCount: null, matchCount: 0, rows: [] };
+  if (!hasConsistentWorkCounts(inventory)) throw Error('dto_invalid');
+  const diagnostics = inventory.diagnostics.filter(row => !row.section || row.section === section);
+  if (diagnostics.some(row => row.code === 'work_section_unavailable')) return { section, query: normalized, coverage: 'unavailable', diagnostics, sectionCount: null, matchCount: null, rows: [] };
+  const selected = inventory.entries.map((entry, index) => ({ entry, index })).filter(row => row.entry.section === section);
+  const rows = selected.filter(({ entry }) => !normalized || [entry.title, entry.key, entry.stored_status]
+    .some(value => value.toLowerCase().includes(normalized))).map(({ entry, index }) => ({ entry, index,
+      identity: JSON.stringify([entry.identity, entry.source.digest]), selectable: entry.selectable, displayTitle: entry.title.replace(/^\[(framework[-_]maintenance|external[-_]delivery)\]\s*/i, '') || entry.title,
+      provenance: { path: entry.source.path, digest: entry.source.digest, originalTitle: entry.title } }));
+  return { section, query: normalized, coverage: diagnostics.length || selected.some(row => !row.entry.selectable) ? 'partial' : 'complete',
+    diagnostics, sectionCount: selected.length, matchCount: rows.length, rows };
 }
 
-export function projectCockpitList(inventory, { section = COCKPIT_BACKLOG_SECTIONS[0], query = '' } = {}) {
-  if (!COCKPIT_BACKLOG_SECTIONS.includes(section)) throw Error('dto_invalid');
-  const normalizedQuery = query.trim().toLowerCase();
-  const unavailable = { section, query: normalizedQuery, coverage: 'unavailable', diagnostics: [], sectionCount: null, matchCount: null, rows: [] };
-  if (!inventory) return unavailable;
-  if (!hasConsistentBacklogCounts(inventory)) throw Error('dto_invalid');
-  const diagnostics = inventory.diagnostics.filter(d => !d.section || d.section === section);
-  if (!Object.hasOwn(inventory.counts, section) || diagnostics.some(d => unreadableLayout.test(d.code))) return { ...unavailable, diagnostics };
-  const rows = [];
-  let sectionCount = 0, nonselectable = false;
-  inventory.entries.forEach((entry, index) => {
-    if (entry.section !== section) return;
-    sectionCount++;
-    nonselectable ||= !entry.selectable;
-    if (normalizedQuery && ![entry.title, entry.key, entry.stored_status].some(field => field.toLowerCase().includes(normalizedQuery))) return;
-    rows.push({ entry, index, identity: backlogRowKey(entry, index, inventory.content_digest), selectable: entry.selectable,
-      displayTitle: entry.title.replace(/^\[(framework[-_]maintenance|external[-_]delivery)\]\s*/i, '') || entry.title,
-      provenance: { path: inventory.source_path, digest: inventory.content_digest, originalTitle: entry.title } });
-  });
-  return { section, query: normalizedQuery, coverage: diagnostics.length || nonselectable ? 'partial' : 'complete', diagnostics,
-    sectionCount, matchCount: rows.length, rows: rows.reverse() };
+// Presentation-only grouping/search over the shared inventory's already ordered entries.
+export function projectCockpitRuns(inventory, { section = 'active', query = '' } = {}) {
+  if (!['active', 'completed'].includes(section)) throw Error('dto_invalid');
+  const normalized = query.trim().toLowerCase();
+  const entries = inventory.runs.filter(run => section === 'active'
+    ? !run.valid || run.lifecycle === 'active' : run.valid && run.lifecycle !== 'active');
+  const rows = entries.filter(run => !normalized || [run.title, run.run_id, run.attention.label]
+    .some(value => value.toLowerCase().includes(normalized)));
+  return { rows, sectionCount: entries.length, matchCount: rows.length,
+    coverage: inventory.state === 'complete' ? 'complete' : inventory.state === 'absent' ? 'unavailable' : 'partial' };
 }

package/runtime/core/lib/control-inspect/cockpit-session.js

@@ -10,13 +10,13 @@ import { COCKPIT_LIMITS, parseCockpitArguments, parsePluginCockpitArguments } fr
 
 // One connection owns bounded independent read views. Retiring workers still occupy slots.
 export function createCockpitSessionService(root, {
-  poolFactory = viewRoot => new ReadWorkerPool(viewRoot, { limits: { total: COCKPIT_LIMITS.capture },
-    maxOldGenerationSizeMb: COCKPIT_LIMITS.workerOldGeneration }), now = Date.now, pluginMode = false,
+  budget, poolFactory = viewRoot => new ReadWorkerPool(viewRoot, { limits: { total: COCKPIT_LIMITS.capture },
+    maxOldGenerationSizeMb: COCKPIT_LIMITS.workerOldGeneration, budget }), now = Date.now, pluginMode = false,
 } = {}) {
   const target = pluginMode ? null : { target_id: resolveControlCommandTarget(root).target_id, display_path: root };
   const sessions = new Map();
   let closed = false, renderGeneration = 0, publication = null;
-  const failure = (code, viewTarget = target) => ({ schema_version: '1', target: viewTarget, snapshot_id: null, observed_as_of: null,
+  const failure = (code, viewTarget = target) => ({ schema_version: '2', target: viewTarget, snapshot_id: null, observed_as_of: null,
     source_digest: null, state: 'blocked', code, retryable: code !== 'session_expired', data: null, authorizes: false });
   function losePublication(session) {
     if (publication?.session_id !== session.id) return;
@@ -153,7 +153,7 @@ export function createCockpitSessionService(root, {
           if (active(session.id) !== session || generation !== session.generation) return fail('session_expired');
           touch(session); return result;
         }
-        if (input.operation === 'backlog_titles' && input.row_ids.some(id => !session.rows.has(id))) return fail('resource_denied');
+        if (['planned', 'archive'].includes(input.operation) && !session.rows.has(input.row_id)) return fail('resource_denied');
         if (['document', 'prepare_context'].includes(input.operation)
           && session.documents.get(input.resource_id) !== `${input.snapshot_id}:${input.run_id}`) return fail('resource_denied');
         if (['context', 'artifact_readiness'].includes(input.operation) && input.run_id !== session.run_id) return fail('resource_denied');
@@ -171,14 +171,14 @@ export function createCockpitSessionService(root, {
           if (publication.phase !== 'prepared') return fail('context_superseded');
         }
         if (input.operation === 'artifact_readiness' && publication) return fail(publication.phase === 'uncertain' ? 'context_cleanup_uncertain' : 'busy');
-        const replacement = ['snapshot', 'backlog_titles', 'run', 'document', 'context', 'artifact_readiness'].includes(input.operation);
-        if (['backlog_titles', 'run', 'document', 'context', 'artifact_readiness'].includes(input.operation)) {
+        const replacement = ['snapshot', 'run', 'document', 'context', 'artifact_readiness'].includes(input.operation);
+        if (['run', 'document', 'context', 'artifact_readiness'].includes(input.operation)) {
           discardPacket(session); ++session.generation; session.documents.clear(); session.snapshot = null; session.draft = null;
         }
         generation = session.generation;
         if (replacement) session.rows.clear();
         const result = await session.pool.request({ operation: input.operation, snapshot: input.snapshot_id,
-          selector: ['run', 'context'].includes(input.operation) ? input.run_id : input.resource_id, input }, signal);
+          selector: ['planned', 'archive'].includes(input.operation) ? input.row_id : ['run', 'context'].includes(input.operation) ? input.run_id : input.resource_id, input }, signal);
         if (active(session.id) !== session || generation !== session.generation) return fail('session_expired');
         const response = { ...result, authorizes: false };
         if (Buffer.byteLength(JSON.stringify(response), 'utf8') > READ_LIMITS.response) throw new ControlReadError('resource_limit');
@@ -190,7 +190,7 @@ export function createCockpitSessionService(root, {
         }
         if (!['resource_denied', 'context_superseded', 'busy', 'context_cleanup_uncertain'].includes(result.code)) touch(session);
         if (replacement && result.snapshot_id) session.snapshot = result.snapshot_id;
-        if (replacement && result.data?.kind === 'backlog') for (const row of result.data.entries) session.rows.add(row.row_id);
+        if (replacement && result.data?.kind === 'work') for (const row of result.data.entries) session.rows.add(row.row_id);
         if (replacement) { session.run_id = result.data?.run?.run_id ?? null; session.draft = result.data?.run?.draft_check?.source ?? null; }
         if (replacement && result.data?.run?.resources) for (const resource of result.data.run.resources) {
           session.documents.set(resource.resource_id, `${result.snapshot_id}:${result.data.run.run_id}`);

package/runtime/core/lib/control-inspect/cockpit-work.js

@@ -0,0 +1,33 @@
+import { readCockpitArchive, archiveRows } from './cockpit-archive.js';
+import { readWorkInventory } from '../control-state/planned-inventory.js';
+import { digest, canonicalJson } from '../control-state/approval-command-contract.js';
+import { COCKPIT_WORK_SECTIONS as sections } from './cockpit-list.js';
+
+// Compatibility DTO for the existing list/session protocol. The explicit layout
+// discriminator changes policy: order and per-row source identity come from Core,
+// never a Markdown table, stored rank, or adapter-specific lifecycle database.
+export function projectCockpitWork(root) {
+  const inventory = readWorkInventory(root, { language: 'de' });
+  if (inventory.state === 'unavailable') return { state: 'error', code: 'work_inventory_unavailable', data: null };
+  const entries = inventory.entries.map(row => {
+    const planned = row.kind === 'planned';
+    const section = planned ? sections[1] : row.lifecycle === 'active' || row.lifecycle === null ? sections[0] : sections[2];
+    const key = planned ? row.plan_id : row.run_id;
+    return { kind: row.kind, identity: row.identity, section, key, original_key: key, title: row.title,
+      stored_status: planned ? ({ ready: 'Bereit zur Übergabe', draft: 'UR in Klärung', recovery_required: 'Wiederherstellung erforderlich', unconfirmed: 'Zuordnung ungeklärt', unavailable: 'Quelle nicht verfügbar' })[row.coverage]
+        : row.attention.label, scope: planned ? 'UR-Planung' : 'Run', priority: row.priority ?? null,
+      stored_next_step: planned ? row.actions.join(' · ') : row.next_action ?? '', source_links: row.source.path,
+      current_spec: null, source: row.source, coverage: row.coverage, actions: row.actions,
+      handoff_ready: planned ? row.handoff_ready : false, planning_origins: row.planning_origins ?? [],
+      selectable: planned ? row.source.digest !== null && row.coverage !== 'unavailable' : row.valid, authorizes: false };
+  });
+  let archive = null;
+  try { archive = readCockpitArchive(root); } catch (error) { inventory.findings.push({ code: error.code ?? 'archive_invalid', section: 'archive' }); inventory.state = 'partial'; }
+  entries.push(...archiveRows(archive));
+  return { state: inventory.state === 'partial' ? 'partial' : entries.length ? 'available' : 'empty',
+    code: inventory.state === 'partial' ? 'work_inventory_partial' : null,
+    data: { kind: 'work', layout: 'run-folders-v1', entries, diagnostics: inventory.findings,
+      source_path: '.agdf/control/', content_digest: digest(canonicalJson(inventory)).slice(7),
+      counts: Object.fromEntries(sections.map(section => [section, entries.filter(row => row.section === section).length])),
+      planning_references: inventory.planning_references, authorizes: false } };
+}