deepline 0.3.128 → 0.3.129

package/dist/bundling-sources/shared_libs/play-runtime/integration-operation-reader-fence/job.ts

@@ -1,5 +1,6 @@
 import {
   INTEGRATION_OPERATION_CANONICAL_READER_CAPABILITY,
+  RUNTIME_RECEIPT_VALUE_REFERENCE_READER_CAPABILITY,
   type IntegrationOperationStorageMode,
   type ReaderFenceApplyOutcome,
   type ReaderFenceWriterMode,
@@ -52,6 +53,43 @@ export function createRuntimeGatewayReaderFenceJob(
       return { mode: fence.mode, source: 'fence', epoch: fence.epoch };
     },
 
+    async runtimeReceiptValueReferenceWriterMode(input) {
+      validateSchema(input.schema);
+      let fence: RuntimeGatewayReaderFence | null;
+      try {
+        fence = await ports.store.read({ schema: input.schema });
+      } catch {
+        return {
+          enabled: false,
+          source: 'fail_closed',
+          epoch: null,
+          failure: 'store_unavailable',
+        };
+      }
+      if (!fence) {
+        return { enabled: false, source: 'absent', epoch: null };
+      }
+      if (
+        !isValidRuntimeGatewayReaderFence(fence) ||
+        fence.schema !== input.schema
+      ) {
+        return {
+          enabled: false,
+          source: 'fail_closed',
+          epoch: null,
+          failure: 'invalid_record',
+        };
+      }
+      return {
+        enabled:
+          fence.mode === 'canonical_v1' &&
+          fence.canonicalReaderProof?.capability ===
+            RUNTIME_RECEIPT_VALUE_REFERENCE_READER_CAPABILITY,
+        source: 'fence',
+        epoch: fence.epoch,
+      };
+    },
+
     async apply(
       candidate: RuntimeGatewayReaderFenceCandidate,
     ): Promise<ReaderFenceApplyOutcome> {
@@ -102,7 +140,10 @@ export function validateRuntimeGatewayReaderFence(
       'Canonical reader fences require verified gateway reader proof.',
     );
   }
-  if (proof.capability !== INTEGRATION_OPERATION_CANONICAL_READER_CAPABILITY) {
+  if (
+    proof.capability !== INTEGRATION_OPERATION_CANONICAL_READER_CAPABILITY &&
+    proof.capability !== RUNTIME_RECEIPT_VALUE_REFERENCE_READER_CAPABILITY
+  ) {
     throw new Error(
       'Canonical reader fence has an unsupported gateway capability.',
     );

package/dist/bundling-sources/shared_libs/play-runtime/launch-source-policy.ts

@@ -33,9 +33,10 @@ export type PlayLaunchQueuePolicy = {
 };
 
 /**
- * CLI/API launches are user-visible requests. Give a short capacity window so
- * a temporary spike can clear, but never let an interactive run appear to
- * succeed and then start charging much later without an explicit retry.
+ * Retained for callers that need to describe the historical API capacity
+ * window in diagnostics. Accepted API launches no longer apply this deadline:
+ * the architecture contract is durable admission, and an accepted run must
+ * not silently disappear merely because a burst outlasted one worker fleet.
  */
 export const API_LAUNCH_CAPACITY_WAIT_SECONDS = 60;
 
@@ -75,15 +76,14 @@ export function resolvePlayLaunchQueuePolicy(
     case 'api':
       return {
         triggerSource: 'api',
-        // API/CLI callers need a bounded, user-visible outcome. A brief
-        // capacity window absorbs normal spikes; after that the run is
-        // terminalized with a typed queue-expired/capacity result rather than
-        // starting unexpectedly much later. The priority still lets manual
-        // work win the next slot within its organization without bypassing
-        // cross-org fairness.
+        // Once accepted, API/CLI work is a durable customer intent. The
+        // admission service still bounds request concurrency and active-run
+        // limits before enqueue; after enqueue, autoscaling/backpressure must
+        // drain the run rather than converting temporary capacity pressure
+        // into silent work loss.
         priority: 100,
-        maxDelaySeconds: API_LAUNCH_CAPACITY_WAIT_SECONDS,
-        sandboxCapacityMaxWaitSeconds: API_LAUNCH_CAPACITY_WAIT_SECONDS,
+        maxDelaySeconds: null,
+        sandboxCapacityMaxWaitSeconds: null,
       };
     case 'webhook':
       return {

package/dist/bundling-sources/shared_libs/play-runtime/ledger-safe-payload.ts

@@ -1,6 +1,8 @@
+import { stringifyPostgresJson } from './postgres-json';
+import { boundRunLogLine } from './run-log-buffer';
 import { createSecretRedactionContext } from './secret-redaction';
 import {
-  assertRuntimeReceiptOutputWithinLimit,
+  assertSerializedRuntimeReceiptOutputWithinLimit,
   inspectConvexLedgerPayload,
   jsonByteLengthUpTo,
   LEDGER_TERMINAL_RESULT_MAX_BYTES,
@@ -57,21 +59,54 @@ export function sanitizeOpaqueLedgerPayload(value: unknown): unknown {
   return redactedIssue ? opaqueLedgerPayloadSummary(redactedIssue) : redacted;
 }
 
-/** Secret-redact a receipt payload without coupling its 10 MiB cell limit to the ledger. */
-export function sanitizeRuntimeReceiptPayload(value: unknown): unknown {
-  // Reject an obviously oversized source before doing redaction work, then
-  // validate the exact value that will be persisted. Redaction normally shrinks
-  // credential-shaped values but can expand short matched strings.
-  assertRuntimeReceiptOutputWithinLimit({
-    output: value,
-    path: 'runtime receipt output',
-  });
+/** A receipt payload redacted once, serialized once, and measured from that text. */
+export type SanitizedRuntimeReceiptPayload = {
+  /** The redacted value. Callers return or re-project this, never the source. */
+  value: unknown;
+  /**
+   * Canonical Postgres JSON text for `value`, byte-identical to what
+   * `stringifyPostgresJson(value ?? null)` produces. `jsonb` accepts this text
+   * directly, so the completion path never re-serializes the same output.
+   */
+  serialized: string;
+  /** UTF-8 byte length of `serialized`; the measured size the limit is enforced on. */
+  bytes: number;
+};
+
+/**
+ * Secret-redact a receipt payload without coupling its 10 MiB cell limit to the
+ * ledger, and serialize it exactly once.
+ *
+ * The limit is enforced on the redacted, serialized value that is actually
+ * persisted. Redaction normally shrinks credential-shaped values but can expand
+ * short matched strings, so measuring the source instead would be wrong in both
+ * directions.
+ *
+ * Redaction is identity-preserving: a payload carrying no credential comes back
+ * as the very object that was passed in, with no deep clone, and is serialized
+ * exactly once. Only a payload that actually redacts pays for a rebuilt value.
+ */
+export function sanitizeRuntimeReceiptPayloadForStorage(
+  value: unknown,
+): SanitizedRuntimeReceiptPayload {
   const redacted = ledgerIngressRedactor.redact(value);
-  assertRuntimeReceiptOutputWithinLimit({
-    output: redacted,
+  // `undefined` is not JSON. The receipt contract stores it as jsonb `null`,
+  // which is exactly what the previous `stringifyPostgresJson(output ?? null)`
+  // parameter produced.
+  const serialized = stringifyPostgresJson(redacted ?? null);
+  if (serialized === undefined) {
+    throw new TypeError('Runtime receipt output is not JSON-serializable.');
+  }
+  const bytes = assertSerializedRuntimeReceiptOutputWithinLimit({
+    serialized,
     path: 'runtime receipt output after secret redaction',
   });
-  return redacted;
+  return { value: redacted, serialized, bytes };
+}
+
+/** Secret-redact a receipt payload without coupling its 10 MiB cell limit to the ledger. */
+export function sanitizeRuntimeReceiptPayload(value: unknown): unknown {
+  return sanitizeRuntimeReceiptPayloadForStorage(value).value;
 }
 
 export function sanitizeLedgerLogLines(value: unknown): string[] {
@@ -80,9 +115,7 @@ export function sanitizeLedgerLogLines(value: unknown): string[] {
     .filter((line): line is string => typeof line === 'string')
     .slice(0, MAX_LEDGER_LOG_LINES_PER_EVENT)
     .map((line) =>
-      ledgerIngressRedactor
-        .redactString(line.trim())
-        .slice(0, MAX_LEDGER_LOG_LINE_LENGTH),
+      boundRunLogLine(ledgerIngressRedactor.redactString(line.trim())),
     )
     .filter(Boolean);
 }