crewly 1.5.17 → 1.5.19

package/dist/backend/backend/src/services/fission/fission-guard.service.js

@@ -0,0 +1,372 @@
+/**
+ * FissionGuardService — Task fission prevention
+ *
+ * Prevents agents from creating unbounded sub-tasks by enforcing
+ * 6 guardrails:
+ *   1. maxDepth — parentWorkItemId chain depth limit
+ *   2. maxTasks — per-Mission task count limit
+ *   3. Rate limit — per-agent creation rate within a sliding window
+ *   4. Branching factor — max children per WorkItem
+ *   5. Task TTL — time-to-live enforcement
+ *   6. Budget gate — cost threshold requiring approval
+ *
+ * @module services/fission/fission-guard.service
+ */
+import { v4 as uuidv4 } from 'uuid';
+import { LoggerService } from '../core/logger.service.js';
+import { DEFAULT_FISSION_CONFIG, createAllowedResult, createBlockedResult, } from './fission-guard.types.js';
+// ---------------------------------------------------------------------------
+// FissionGuardService
+// ---------------------------------------------------------------------------
+export class FissionGuardService {
+    static instance = null;
+    config;
+    dataProvider;
+    budgetChecker;
+    logger;
+    /** Per-agent creation timestamps for rate limiting */
+    creationRecords = new Map();
+    /** Violation audit trail (newest first) */
+    violations = [];
+    /**
+     * Creates a new FissionGuardService.
+     *
+     * @param dataProvider - Provides WorkItem relationship data
+     * @param budgetChecker - Optional budget checking interface
+     * @param config - Optional configuration override
+     */
+    constructor(dataProvider, budgetChecker, config) {
+        this.dataProvider = dataProvider;
+        this.budgetChecker = budgetChecker ?? null;
+        this.config = { ...DEFAULT_FISSION_CONFIG, ...config };
+        this.logger = LoggerService.getInstance().createComponentLogger('FissionGuard');
+    }
+    /**
+     * Get or create the singleton instance.
+     * Must be initialized with init() before first use.
+     *
+     * @returns The singleton FissionGuardService
+     */
+    static getInstance() {
+        if (!FissionGuardService.instance) {
+            throw new Error('FissionGuardService not initialized — call init() first');
+        }
+        return FissionGuardService.instance;
+    }
+    /**
+     * Initialize the singleton with dependencies.
+     *
+     * @param dataProvider - Provides WorkItem relationship data
+     * @param budgetChecker - Optional budget checking interface
+     * @param config - Optional configuration override
+     * @returns The initialized singleton
+     */
+    static init(dataProvider, budgetChecker, config) {
+        FissionGuardService.instance = new FissionGuardService(dataProvider, budgetChecker, config);
+        return FissionGuardService.instance;
+    }
+    /** Reset singleton (for testing). */
+    static resetInstance() {
+        FissionGuardService.instance = null;
+    }
+    // -------------------------------------------------------------------------
+    // Core Guard Check
+    // -------------------------------------------------------------------------
+    /**
+     * Check whether an agent is allowed to create a sub-task under the given parent.
+     * Evaluates all 6 guardrails in order. Returns on the first violation.
+     *
+     * @param parent - The parent WorkItem the sub-task would be created under
+     * @param agentId - The agent attempting the creation
+     * @param missionId - Optional Mission ID for per-mission limits
+     * @returns GuardResult indicating whether the creation is allowed
+     */
+    async canCreateSubTask(parent, agentId, missionId) {
+        // 1. Max depth
+        const depthResult = await this.checkMaxDepth(parent);
+        if (!depthResult.allowed) {
+            this.recordViolation('max_depth', agentId, parent.id, missionId, depthResult.reason, await this.resolveDepth(parent), this.config.maxDepth);
+            return depthResult;
+        }
+        // 2. Max tasks per mission
+        if (missionId) {
+            const tasksResult = await this.checkMaxTasks(missionId);
+            if (!tasksResult.allowed) {
+                const count = await this.dataProvider.countMissionWorkItems(missionId);
+                this.recordViolation('max_tasks', agentId, parent.id, missionId, tasksResult.reason, count, this.config.maxTasksPerMission);
+                return tasksResult;
+            }
+        }
+        // 3. Rate limit
+        const rateResult = this.checkRateLimit(agentId);
+        if (!rateResult.allowed) {
+            const record = this.creationRecords.get(agentId);
+            const count = record ? this.getRecentCount(record) : 0;
+            this.recordViolation('rate_limit', agentId, parent.id, missionId, rateResult.reason, count, this.config.rateLimitMaxCreations);
+            return rateResult;
+        }
+        // 4. Branching factor
+        const branchResult = await this.checkBranchingFactor(parent.id);
+        if (!branchResult.allowed) {
+            const children = await this.dataProvider.countChildWorkItems(parent.id);
+            this.recordViolation('branching_factor', agentId, parent.id, missionId, branchResult.reason, children, this.config.maxBranchingFactor);
+            return branchResult;
+        }
+        // 5. TTL check on parent
+        const ttlResult = this.checkTTL(parent);
+        if (!ttlResult.allowed) {
+            const ageMs = Date.now() - new Date(parent.createdAt).getTime();
+            this.recordViolation('ttl_exceeded', agentId, parent.id, missionId, ttlResult.reason, ageMs, this.config.maxTtlMs);
+            return ttlResult;
+        }
+        // 6. Budget gate
+        if (this.config.budgetGateEnabled && this.budgetChecker) {
+            const budgetResult = await this.checkBudget(agentId);
+            if (!budgetResult.allowed) {
+                this.recordViolation('budget_exceeded', agentId, parent.id, missionId, budgetResult.reason, 0, this.config.budgetThresholdUsd);
+                return budgetResult;
+            }
+        }
+        // All checks passed — record the creation for rate limiting
+        this.recordCreation(agentId);
+        return createAllowedResult();
+    }
+    // -------------------------------------------------------------------------
+    // Individual Guardrails
+    // -------------------------------------------------------------------------
+    /**
+     * Guardrail 1: Check parent chain depth.
+     * Walks parentWorkItemId links to determine depth.
+     *
+     * @param parent - The parent WorkItem
+     * @returns GuardResult
+     */
+    async checkMaxDepth(parent) {
+        const depth = await this.resolveDepth(parent);
+        // The child would be at depth + 1
+        if (depth + 1 > this.config.maxDepth) {
+            return createBlockedResult('max_depth', `Sub-task would be at depth ${depth + 1}, exceeding max depth of ${this.config.maxDepth}`);
+        }
+        return createAllowedResult();
+    }
+    /**
+     * Guardrail 2: Check total tasks for a Mission.
+     *
+     * @param missionId - The Mission to check
+     * @returns GuardResult
+     */
+    async checkMaxTasks(missionId) {
+        const count = await this.dataProvider.countMissionWorkItems(missionId);
+        // Hard limit is absolute — cannot be overridden by config
+        if (count >= this.config.hardMaxTasksPerMission) {
+            return createBlockedResult('max_tasks', `Mission ${missionId} has ${count} tasks, at hard limit of ${this.config.hardMaxTasksPerMission}`);
+        }
+        if (count >= this.config.maxTasksPerMission) {
+            return createBlockedResult('max_tasks', `Mission ${missionId} has ${count} tasks, at limit of ${this.config.maxTasksPerMission}`);
+        }
+        return createAllowedResult();
+    }
+    /**
+     * Guardrail 3: Check agent creation rate within sliding window.
+     *
+     * @param agentId - The agent to check
+     * @returns GuardResult
+     */
+    checkRateLimit(agentId) {
+        const record = this.creationRecords.get(agentId);
+        if (!record)
+            return createAllowedResult();
+        const recentCount = this.getRecentCount(record);
+        if (recentCount >= this.config.rateLimitMaxCreations) {
+            return createBlockedResult('rate_limit', `Agent ${agentId} created ${recentCount} sub-tasks in the last ${this.config.rateLimitWindowMs / 60_000} minutes, limit is ${this.config.rateLimitMaxCreations}`);
+        }
+        return createAllowedResult();
+    }
+    /**
+     * Guardrail 4: Check children count for a parent WorkItem.
+     *
+     * @param parentWorkItemId - The parent WorkItem ID
+     * @returns GuardResult
+     */
+    async checkBranchingFactor(parentWorkItemId) {
+        const children = await this.dataProvider.countChildWorkItems(parentWorkItemId);
+        if (children >= this.config.maxBranchingFactor) {
+            return createBlockedResult('branching_factor', `WorkItem ${parentWorkItemId} already has ${children} children, limit is ${this.config.maxBranchingFactor}`);
+        }
+        return createAllowedResult();
+    }
+    /**
+     * Guardrail 5: Check if parent WorkItem has exceeded its TTL.
+     * If the parent is already past max TTL, creating children is pointless.
+     *
+     * @param parent - The parent WorkItem
+     * @returns GuardResult
+     */
+    checkTTL(parent) {
+        const ageMs = Date.now() - new Date(parent.createdAt).getTime();
+        if (ageMs > this.config.maxTtlMs) {
+            return createBlockedResult('ttl_exceeded', `Parent WorkItem ${parent.id} age is ${Math.round(ageMs / 3_600_000)}h, exceeding max TTL of ${Math.round(this.config.maxTtlMs / 3_600_000)}h`);
+        }
+        return createAllowedResult();
+    }
+    /**
+     * Guardrail 6: Check agent budget.
+     * Uses the injected BudgetChecker to verify the agent hasn't exceeded spend.
+     *
+     * @param agentId - The agent to check
+     * @returns GuardResult
+     */
+    async checkBudget(agentId) {
+        if (!this.budgetChecker)
+            return createAllowedResult();
+        try {
+            const withinBudget = await this.budgetChecker.isWithinBudget(agentId);
+            if (!withinBudget) {
+                return createBlockedResult('budget_exceeded', `Agent ${agentId} has exceeded budget threshold of $${this.config.budgetThresholdUsd} — approval required`);
+            }
+        }
+        catch (err) {
+            // Budget check failure is non-fatal — allow the creation but log warning
+            this.logger.warn('Budget check failed, allowing creation', {
+                agentId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        return createAllowedResult();
+    }
+    // -------------------------------------------------------------------------
+    // Violation History
+    // -------------------------------------------------------------------------
+    /**
+     * Returns recent violations for auditing.
+     *
+     * @param limit - Maximum number of violations to return
+     * @returns Array of FissionViolation (newest first)
+     */
+    getViolations(limit = 50) {
+        return this.violations.slice(0, Math.min(limit, this.config.maxViolationHistory));
+    }
+    /**
+     * Returns violations filtered by type.
+     *
+     * @param type - Violation type to filter by
+     * @returns Array of matching violations
+     */
+    getViolationsByType(type) {
+        return this.violations.filter(v => v.violationType === type);
+    }
+    // -------------------------------------------------------------------------
+    // Configuration
+    // -------------------------------------------------------------------------
+    /**
+     * Returns the current configuration.
+     *
+     * @returns A copy of the current FissionGuardConfig
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Updates configuration at runtime.
+     *
+     * @param updates - Partial configuration to merge
+     */
+    updateConfig(updates) {
+        // Enforce hard limit cannot be increased beyond absolute max
+        if (updates.maxTasksPerMission !== undefined) {
+            updates.maxTasksPerMission = Math.min(updates.maxTasksPerMission, this.config.hardMaxTasksPerMission);
+        }
+        this.config = { ...this.config, ...updates };
+        this.logger.info('FissionGuardConfig updated', { config: this.config });
+    }
+    // -------------------------------------------------------------------------
+    // Private Helpers
+    // -------------------------------------------------------------------------
+    /**
+     * Resolves the depth of a WorkItem by walking the parentWorkItemId chain.
+     * Depth 0 = root (no parent), depth 1 = direct child, etc.
+     *
+     * @param item - The WorkItem to resolve depth for
+     * @returns The depth (0-based)
+     */
+    async resolveDepth(item) {
+        let depth = 0;
+        let currentParentId = item.parentWorkItemId;
+        // Safety limit to prevent infinite loops from circular references
+        const maxWalk = this.config.maxDepth + 10;
+        let walked = 0;
+        while (currentParentId && walked < maxWalk) {
+            depth++;
+            walked++;
+            const parent = await this.dataProvider.getWorkItemById(currentParentId);
+            if (!parent)
+                break;
+            currentParentId = parent.parentWorkItemId;
+        }
+        return depth;
+    }
+    /**
+     * Count recent creations within the rate limit window.
+     *
+     * @param record - The agent's creation record
+     * @returns Number of creations within the window
+     */
+    getRecentCount(record) {
+        const cutoff = Date.now() - this.config.rateLimitWindowMs;
+        return record.timestamps.filter(t => t > cutoff).length;
+    }
+    /**
+     * Record a successful creation for rate limiting.
+     *
+     * @param agentId - The agent that created a sub-task
+     */
+    recordCreation(agentId) {
+        let record = this.creationRecords.get(agentId);
+        if (!record) {
+            record = { agentId, timestamps: [] };
+            this.creationRecords.set(agentId, record);
+        }
+        record.timestamps.push(Date.now());
+        // Prune old timestamps outside the window
+        const cutoff = Date.now() - this.config.rateLimitWindowMs;
+        record.timestamps = record.timestamps.filter(t => t > cutoff);
+    }
+    /**
+     * Record a violation for auditing.
+     *
+     * @param violationType - Which guardrail was violated
+     * @param agentId - Agent that triggered the violation
+     * @param parentWorkItemId - The parent WorkItem ID
+     * @param missionId - Optional Mission ID
+     * @param reason - Human-readable reason
+     * @param currentValue - The value that exceeded the limit
+     * @param configuredLimit - The configured limit
+     */
+    recordViolation(violationType, agentId, parentWorkItemId, missionId, reason, currentValue, configuredLimit) {
+        const violation = {
+            id: uuidv4(),
+            violationType,
+            agentId,
+            parentWorkItemId,
+            missionId,
+            reason,
+            currentValue,
+            configuredLimit,
+            violatedAt: new Date().toISOString(),
+        };
+        this.violations.unshift(violation);
+        // Trim history
+        if (this.violations.length > this.config.maxViolationHistory) {
+            this.violations = this.violations.slice(0, this.config.maxViolationHistory);
+        }
+        this.logger.warn('Fission guard violation', {
+            violationType,
+            agentId,
+            parentWorkItemId,
+            missionId,
+            currentValue,
+            configuredLimit,
+        });
+    }
+}
+//# sourceMappingURL=fission-guard.service.js.map

package/dist/backend/backend/src/services/fission/fission-guard.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fission-guard.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/fission/fission-guard.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,aAAa,EAAwB,MAAM,2BAA2B,CAAC;AAShF,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AA4BlC,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAC,QAAQ,GAA+B,IAAI,CAAC;IAEnD,MAAM,CAAqB;IAC3B,YAAY,CAAsB;IAClC,aAAa,CAAuB;IAC3B,MAAM,CAAkB;IAEzC,sDAAsD;IAC9C,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;IAEtE,2CAA2C;IACnC,UAAU,GAAuB,EAAE,CAAC;IAE5C;;;;;;OAMG;IACH,YACE,YAAiC,EACjC,aAAoC,EACpC,MAAoC;QAEpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,sBAAsB,EAAE,GAAG,MAAM,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CACT,YAAiC,EACjC,aAAoC,EACpC,MAAoC;QAEpC,mBAAmB,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5F,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED,qCAAqC;IACrC,MAAM,CAAC,aAAa;QAClB,mBAAmB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtC,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAE5E;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAgB,EAChB,OAAe,EACf,SAAkB;QAElB,eAAe;QACf,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,MAAO,EAClF,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,2BAA2B;QAC3B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBACvE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,MAAO,EAClF,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACzC,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,MAAO,EAClF,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC5C,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,MAAO,EAC1F,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAChE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAO,EACnF,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,MAAO,EACzF,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACrC,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAE7B,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,MAAgB;QAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,kCAAkC;QAClC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,mBAAmB,CACxB,WAAW,EACX,8BAA8B,KAAK,GAAG,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEvE,0DAA0D;QAC1D,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAChD,OAAO,mBAAmB,CACxB,WAAW,EACX,WAAW,SAAS,QAAQ,KAAK,4BAA4B,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5C,OAAO,mBAAmB,CACxB,WAAW,EACX,WAAW,SAAS,QAAQ,KAAK,uBAAuB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CACzF,CAAC;QACJ,CAAC;QAED,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,mBAAmB,EAAE,CAAC;QAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;YACrD,OAAO,mBAAmB,CACxB,YAAY,EACZ,SAAS,OAAO,YAAY,WAAW,0BAA0B,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,MAAM,sBAAsB,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CACjK,CAAC;QACJ,CAAC;QAED,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,gBAAwB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC/E,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CACxB,kBAAkB,EAClB,YAAY,gBAAgB,gBAAgB,QAAQ,uBAAuB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,MAAgB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,mBAAmB,CACxB,cAAc,EACd,mBAAmB,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,2BAA2B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC/I,CAAC;QACJ,CAAC;QACD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,mBAAmB,EAAE,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,mBAAmB,CACxB,iBAAiB,EACjB,SAAS,OAAO,sCAAsC,IAAI,CAAC,MAAM,CAAC,kBAAkB,sBAAsB,CAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;gBACzD,OAAO;gBACP,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAE5E;;;;;OAKG;IACH,aAAa,CAAC,QAAgB,EAAE;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,IAA0B;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAE5E;;;;OAIG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,OAAoC;QAC/C,6DAA6D;QAC7D,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CACnC,OAAO,CAAC,kBAAkB,EAC1B,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACnC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAE5E;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAC,IAAc;QACvC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAE5C,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,OAAO,eAAe,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;YAC3C,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM;gBAAE,MAAM;YACnB,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC5C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,MAA2B;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,OAAe;QACpC,IAAI,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAEnC,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;OAUG;IACK,eAAe,CACrB,aAAmC,EACnC,OAAe,EACf,gBAAwB,EACxB,SAA6B,EAC7B,MAAc,EACd,YAAoB,EACpB,eAAuB;QAEvB,MAAM,SAAS,GAAqB;YAClC,EAAE,EAAE,MAAM,EAAE;YACZ,aAAa;YACb,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,MAAM;YACN,YAAY;YACZ,eAAe;YACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEnC,eAAe;QACf,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,aAAa;YACb,OAAO;YACP,gBAAgB;YAChB,SAAS;YACT,YAAY;YACZ,eAAe;SAChB,CAAC,CAAC;IACL,CAAC"}

package/dist/backend/backend/src/services/fission/fission-guard.types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Fission Guard Type Definitions
+ *
+ * Types for the FissionGuardService — prevents agents from creating
+ * unbounded sub-tasks. Implements 6 guardrails: maxDepth, maxTasks,
+ * rate limit, branching factor, TTL, and budget gate.
+ *
+ * @module services/fission/fission-guard.types
+ */
+/**
+ * Result of a fission guard check.
+ * Returned by canCreateSubTask() to indicate whether creation is allowed.
+ */
+export interface GuardResult {
+    /** Whether the sub-task creation is allowed */
+    allowed: boolean;
+    /** Human-readable reason when blocked */
+    reason?: string;
+    /** Which guardrail was violated (for programmatic handling) */
+    violationType?: FissionViolationType;
+}
+/**
+ * Types of fission violations.
+ */
+export type FissionViolationType = 'max_depth' | 'max_tasks' | 'rate_limit' | 'branching_factor' | 'ttl_exceeded' | 'budget_exceeded';
+/** All valid FissionViolationType values. */
+export declare const FISSION_VIOLATION_TYPES: readonly FissionViolationType[];
+/**
+ * A recorded fission guard violation.
+ * Stored for auditing — shows what was blocked and why.
+ */
+export interface FissionViolation {
+    /** UUID of the violation record */
+    id: string;
+    /** Which guardrail was triggered */
+    violationType: FissionViolationType;
+    /** Agent that attempted the creation */
+    agentId: string;
+    /** Parent WorkItem ID (the would-be parent) */
+    parentWorkItemId: string;
+    /** Mission ID if applicable */
+    missionId?: string;
+    /** Human-readable reason for the block */
+    reason: string;
+    /** Current value that exceeded the limit (e.g., depth=4) */
+    currentValue: number;
+    /** The configured limit that was exceeded (e.g., maxDepth=3) */
+    configuredLimit: number;
+    /** ISO8601 timestamp */
+    violatedAt: string;
+}
+/**
+ * Configuration for all fission guardrails.
+ * Each field controls one specific guardrail.
+ */
+export interface FissionGuardConfig {
+    /** Maximum depth of parentWorkItemId chain (default: 3) */
+    maxDepth: number;
+    /** Maximum tasks per Mission (default: 50, hard limit: 200) */
+    maxTasksPerMission: number;
+    /** Absolute hard limit on tasks per Mission — cannot be overridden */
+    hardMaxTasksPerMission: number;
+    /** Rate limit window in milliseconds (default: 600_000 = 10 minutes) */
+    rateLimitWindowMs: number;
+    /** Maximum sub-tasks an agent can create within the rate limit window */
+    rateLimitMaxCreations: number;
+    /** Maximum children per single WorkItem (default: 5) */
+    maxBranchingFactor: number;
+    /** Default TTL for new WorkItems in milliseconds (default: 86_400_000 = 24h) */
+    defaultTtlMs: number;
+    /** Maximum allowed TTL in milliseconds (default: 604_800_000 = 7 days) */
+    maxTtlMs: number;
+    /** Budget threshold in USD — exceeding triggers approval requirement */
+    budgetThresholdUsd: number;
+    /** Whether the budget gate is enabled */
+    budgetGateEnabled: boolean;
+    /** Maximum violation history entries retained */
+    maxViolationHistory: number;
+}
+/**
+ * Default fission guard configuration.
+ * Values match CEO requirements from the implementation checklist.
+ */
+export declare const DEFAULT_FISSION_CONFIG: Readonly<FissionGuardConfig>;
+/**
+ * Tracks an agent's recent sub-task creation timestamps
+ * for rate limiting.
+ */
+export interface AgentCreationRecord {
+    /** Agent ID */
+    agentId: string;
+    /** Timestamps (epoch ms) of recent sub-task creations */
+    timestamps: number[];
+}
+/**
+ * Checks whether a string is a valid FissionViolationType.
+ *
+ * @param value - The string to check
+ * @returns True if value is a valid FissionViolationType
+ */
+export declare function isValidViolationType(value: string): value is FissionViolationType;
+/**
+ * Validates that an unknown value conforms to GuardResult.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid GuardResult
+ */
+export declare function isGuardResult(value: unknown): value is GuardResult;
+/**
+ * Validates that an unknown value conforms to FissionViolation.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid FissionViolation
+ */
+export declare function isFissionViolation(value: unknown): value is FissionViolation;
+/**
+ * Validates that an unknown value conforms to FissionGuardConfig.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid FissionGuardConfig
+ */
+export declare function isValidFissionGuardConfig(value: unknown): value is FissionGuardConfig;
+/**
+ * Creates a GuardResult indicating the action is allowed.
+ *
+ * @returns A GuardResult with allowed=true
+ */
+export declare function createAllowedResult(): GuardResult;
+/**
+ * Creates a GuardResult indicating the action is blocked.
+ *
+ * @param violationType - Which guardrail was violated
+ * @param reason - Human-readable explanation
+ * @returns A GuardResult with allowed=false
+ */
+export declare function createBlockedResult(violationType: FissionViolationType, reason: string): GuardResult;
+//# sourceMappingURL=fission-guard.types.d.ts.map

package/dist/backend/backend/src/services/fission/fission-guard.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fission-guard.types.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/fission/fission-guard.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,WAAW,GACX,YAAY,GACZ,kBAAkB,GAClB,cAAc,GACd,iBAAiB,CAAC;AAEtB,6CAA6C;AAC7C,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAOzD,CAAC;AAMX;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,aAAa,EAAE,oBAAoB,CAAC;IACpC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAYtD,CAAC;AAMX;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAUlE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAc5E;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAgBrF;AAMD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,MAAM,GACb,WAAW,CAEb"}

package/dist/backend/backend/src/services/fission/fission-guard.types.js

@@ -0,0 +1,133 @@
+/**
+ * Fission Guard Type Definitions
+ *
+ * Types for the FissionGuardService — prevents agents from creating
+ * unbounded sub-tasks. Implements 6 guardrails: maxDepth, maxTasks,
+ * rate limit, branching factor, TTL, and budget gate.
+ *
+ * @module services/fission/fission-guard.types
+ */
+/** All valid FissionViolationType values. */
+export const FISSION_VIOLATION_TYPES = [
+    'max_depth',
+    'max_tasks',
+    'rate_limit',
+    'branching_factor',
+    'ttl_exceeded',
+    'budget_exceeded',
+];
+/**
+ * Default fission guard configuration.
+ * Values match CEO requirements from the implementation checklist.
+ */
+export const DEFAULT_FISSION_CONFIG = {
+    maxDepth: 3,
+    maxTasksPerMission: 50,
+    hardMaxTasksPerMission: 200,
+    rateLimitWindowMs: 600_000, // 10 minutes
+    rateLimitMaxCreations: 5,
+    maxBranchingFactor: 5,
+    defaultTtlMs: 86_400_000, // 24 hours
+    maxTtlMs: 604_800_000, // 7 days
+    budgetThresholdUsd: 10.0,
+    budgetGateEnabled: true,
+    maxViolationHistory: 500,
+};
+// ---------------------------------------------------------------------------
+// Type Guards
+// ---------------------------------------------------------------------------
+/**
+ * Checks whether a string is a valid FissionViolationType.
+ *
+ * @param value - The string to check
+ * @returns True if value is a valid FissionViolationType
+ */
+export function isValidViolationType(value) {
+    return FISSION_VIOLATION_TYPES.includes(value);
+}
+/**
+ * Validates that an unknown value conforms to GuardResult.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid GuardResult
+ */
+export function isGuardResult(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const obj = value;
+    if (typeof obj.allowed !== 'boolean')
+        return false;
+    if (obj.reason !== undefined && typeof obj.reason !== 'string')
+        return false;
+    if (obj.violationType !== undefined) {
+        if (typeof obj.violationType !== 'string')
+            return false;
+        if (!isValidViolationType(obj.violationType))
+            return false;
+    }
+    return true;
+}
+/**
+ * Validates that an unknown value conforms to FissionViolation.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid FissionViolation
+ */
+export function isFissionViolation(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const obj = value;
+    return (typeof obj.id === 'string' &&
+        typeof obj.violationType === 'string' &&
+        isValidViolationType(obj.violationType) &&
+        typeof obj.agentId === 'string' &&
+        typeof obj.parentWorkItemId === 'string' &&
+        typeof obj.reason === 'string' &&
+        typeof obj.currentValue === 'number' &&
+        typeof obj.configuredLimit === 'number' &&
+        typeof obj.violatedAt === 'string');
+}
+/**
+ * Validates that an unknown value conforms to FissionGuardConfig.
+ *
+ * @param value - Unknown value to validate
+ * @returns True if value is a valid FissionGuardConfig
+ */
+export function isValidFissionGuardConfig(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const obj = value;
+    return (typeof obj.maxDepth === 'number' && obj.maxDepth > 0 &&
+        typeof obj.maxTasksPerMission === 'number' && obj.maxTasksPerMission > 0 &&
+        typeof obj.hardMaxTasksPerMission === 'number' && obj.hardMaxTasksPerMission > 0 &&
+        typeof obj.rateLimitWindowMs === 'number' && obj.rateLimitWindowMs > 0 &&
+        typeof obj.rateLimitMaxCreations === 'number' && obj.rateLimitMaxCreations > 0 &&
+        typeof obj.maxBranchingFactor === 'number' && obj.maxBranchingFactor > 0 &&
+        typeof obj.defaultTtlMs === 'number' && obj.defaultTtlMs > 0 &&
+        typeof obj.maxTtlMs === 'number' && obj.maxTtlMs > 0 &&
+        typeof obj.budgetThresholdUsd === 'number' && obj.budgetThresholdUsd >= 0 &&
+        typeof obj.budgetGateEnabled === 'boolean' &&
+        typeof obj.maxViolationHistory === 'number' && obj.maxViolationHistory > 0);
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Creates a GuardResult indicating the action is allowed.
+ *
+ * @returns A GuardResult with allowed=true
+ */
+export function createAllowedResult() {
+    return { allowed: true };
+}
+/**
+ * Creates a GuardResult indicating the action is blocked.
+ *
+ * @param violationType - Which guardrail was violated
+ * @param reason - Human-readable explanation
+ * @returns A GuardResult with allowed=false
+ */
+export function createBlockedResult(violationType, reason) {
+    return { allowed: false, reason, violationType };
+}
+//# sourceMappingURL=fission-guard.types.js.map

package/dist/backend/backend/src/services/fission/fission-guard.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fission-guard.types.js","sourceRoot":"","sources":["../../../../../../backend/src/services/fission/fission-guard.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,WAAW;IACX,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,iBAAiB;CACT,CAAC;AAgEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC;IAClE,QAAQ,EAAE,CAAC;IACX,kBAAkB,EAAE,EAAE;IACtB,sBAAsB,EAAE,GAAG;IAC3B,iBAAiB,EAAE,OAAO,EAAQ,aAAa;IAC/C,qBAAqB,EAAE,CAAC;IACxB,kBAAkB,EAAE,CAAC;IACrB,YAAY,EAAE,UAAU,EAAU,WAAW;IAC7C,QAAQ,EAAE,WAAW,EAAa,SAAS;IAC3C,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;IACvB,mBAAmB,EAAE,GAAG;CAChB,CAAC;AAiBX,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;QACvC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ;QACxC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QACvC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;QACpD,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,GAAG,CAAC;QACxE,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,GAAG,CAAC,sBAAsB,GAAG,CAAC;QAChF,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,GAAG,CAAC;QACtE,OAAO,GAAG,CAAC,qBAAqB,KAAK,QAAQ,IAAI,GAAG,CAAC,qBAAqB,GAAG,CAAC;QAC9E,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,GAAG,CAAC;QACxE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC;QAC5D,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;QACpD,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,IAAI,CAAC;QACzE,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS;QAC1C,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ,IAAI,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAmC,EACnC,MAAc;IAEd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnD,CAAC"}