entroly-wasm 1.0.78 → 1.0.80

package/js/work_graph_store.js

@@ -0,0 +1,364 @@
+'use strict';
+
+// Persistence mechanics only. Work-state semantics remain in shared Rust.
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { WorkGraph } = require('./work_graph');
+const { enrichWorktreeContentDigests } = require('./work_graph_content_digest');
+const { discoverRepositoryIdentity, discoverRepositoryObservation } = require('./work_graph_repo');
+
+const DEFAULT_LOCK_TIMEOUT_MS = 5000;
+const DEFAULT_STALE_LOCK_MS = 120000;
+const DEFAULT_LOCK_SETTLE_MS = 1000;
+const DEFAULT_MAX_STATE_BYTES = 64 * 1024 * 1024;
+
+class WorkGraphStoreError extends Error {
+  constructor(message) { super(message); this.name = 'WorkGraphStoreError'; }
+}
+class WorkGraphLockTimeout extends WorkGraphStoreError {
+  constructor(message) { super(message); this.name = 'WorkGraphLockTimeout'; }
+}
+class WorkGraphStateError extends WorkGraphStoreError {
+  constructor(message) { super(message); this.name = 'WorkGraphStateError'; }
+}
+
+function finiteNonnegative(value, name) {
+  const number = Number(value);
+  if (!Number.isFinite(number) || number < 0) {
+    throw new WorkGraphStateError(`${name} must be a finite non-negative number`);
+  }
+  return number;
+}
+
+function positiveSafeInteger(value, name) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < 1) {
+    throw new WorkGraphStateError(`${name} must be a positive safe integer`);
+  }
+  return number;
+}
+
+function defaultStoreRoot() {
+  const base = process.env.ENTROLY_DIR
+    ? path.resolve(process.env.ENTROLY_DIR)
+    : path.join(os.homedir(), '.entroly');
+  return path.join(base, 'work-graphs');
+}
+
+function repoKey(repoId) {
+  if (!repoId) throw new WorkGraphStateError('repo_id must not be empty');
+  return crypto.createHash('sha256').update(String(repoId), 'utf8').digest('hex').slice(0, 32);
+}
+
+function secureDirectory(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(dir);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new WorkGraphStateError(`unsafe Work Graph directory: ${dir}`);
+  }
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700);
+}
+
+function sleepMs(ms) {
+  const wait = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(wait, 0, 0, Math.max(0, ms));
+}
+
+function fsyncDirectory(dir) {
+  if (process.platform === 'win32') return;
+  let fd;
+  try {
+    fd = fs.openSync(dir, fs.constants.O_RDONLY);
+    fs.fsyncSync(fd);
+  } catch (_) {
+    // File fsync + atomic rename remain the primary durability guarantee.
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+class WorkGraphStore {
+  constructor(repoId, options = {}) {
+    this.repoId = String(repoId || '');
+    this.root = options.root ? path.resolve(String(options.root)) : defaultStoreRoot();
+    this.repoDir = path.join(this.root, repoKey(this.repoId));
+    this.statePath = path.join(this.repoDir, 'state.json');
+    this.lockPath = path.join(this.repoDir, '.lock');
+    this.lockTimeoutMs = finiteNonnegative(
+      options.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS, 'lockTimeoutMs',
+    );
+    this.staleLockMs = Math.max(1000, finiteNonnegative(
+      options.staleLockMs ?? DEFAULT_STALE_LOCK_MS, 'staleLockMs',
+    ));
+    this.maxStateBytes = Math.max(1024, positiveSafeInteger(
+      options.maxStateBytes ?? DEFAULT_MAX_STATE_BYTES, 'maxStateBytes',
+    ));
+    secureDirectory(this.root);
+    secureDirectory(this.repoDir);
+  }
+
+  static forRepository(repoPath = '.', options = {}) {
+    const identity = discoverRepositoryIdentity(repoPath);
+    return new WorkGraphStore(identity.repo_id, options);
+  }
+
+  readLockToken() {
+    try {
+      const stat = fs.lstatSync(this.lockPath);
+      if (stat.isSymbolicLink() || !stat.isFile()) {
+        throw new WorkGraphStateError(`unsafe Work Graph lock path: ${this.lockPath}`);
+      }
+      return fs.readFileSync(this.lockPath, 'utf8').split('\n', 1)[0];
+    } catch (error) {
+      if (error instanceof WorkGraphStateError) throw error;
+      return '';
+    }
+  }
+
+  filesystemNowMs() {
+    const probe = path.join(this.repoDir, `.clock-${crypto.randomUUID().replace(/-/g, '')}`);
+    let fd;
+    try {
+      fd = fs.openSync(probe, 'wx', 0o600);
+      fs.closeSync(fd);
+      fd = undefined;
+      return fs.statSync(probe).mtimeMs;
+    } catch (error) {
+      throw new WorkGraphStoreError(`cannot sample Work Graph filesystem clock: ${error.message}`);
+    } finally {
+      if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) {} }
+      try { fs.unlinkSync(probe); } catch (_) {}
+    }
+  }
+
+  lockIsStale() {
+    let stat;
+    try { stat = fs.lstatSync(this.lockPath); }
+    catch (_) { return false; }
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new WorkGraphStateError(`unsafe Work Graph lock path: ${this.lockPath}`);
+    }
+    const first = stat.mtimeMs;
+    if (this.filesystemNowMs() - first < this.staleLockMs) return false;
+    sleepMs(DEFAULT_LOCK_SETTLE_MS);
+    let second;
+    try { second = fs.statSync(this.lockPath).mtimeMs; }
+    catch (_) { return false; }
+    return second === first && this.filesystemNowMs() - second >= this.staleLockMs;
+  }
+
+  breakStaleLock() {
+    if (!this.lockIsStale()) return false;
+    try { fs.unlinkSync(this.lockPath); return true; }
+    catch (error) { return error && error.code === 'ENOENT'; }
+  }
+
+  tryAcquireLock(token) {
+    let fd;
+    try {
+      fd = fs.openSync(this.lockPath, 'wx', 0o600);
+      fs.writeFileSync(fd, `${token}\n${(Date.now() / 1000).toFixed(6)}\n`, 'utf8');
+      fs.fsyncSync(fd);
+      fs.closeSync(fd);
+      return true;
+    } catch (error) {
+      if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) {} }
+      if (error && error.code === 'EEXIST') return false;
+      throw new WorkGraphStoreError(`cannot acquire Work Graph lock: ${error.message}`);
+    }
+  }
+
+  acquireLock() {
+    const started = process.hrtime.bigint();
+    const timeoutNs = BigInt(Math.trunc(this.lockTimeoutMs * 1e6));
+    const token = `${os.hostname()}:${process.pid}:${crypto.randomUUID().replace(/-/g, '')}`;
+    let delay = 1;
+    for (;;) {
+      if (this.tryAcquireLock(token)) return token;
+      if (this.breakStaleLock()) continue;
+      if (process.hrtime.bigint() - started >= timeoutNs) {
+        throw new WorkGraphLockTimeout(`timed out acquiring Work Graph lock for ${this.repoId}`);
+      }
+      const jitter = 0.5 + crypto.randomInt(0, 65536) / 65535;
+      sleepMs(Math.max(1, Math.floor(delay * jitter)));
+      delay = Math.min(delay * 2, 50);
+    }
+  }
+
+  releaseLock(token) {
+    if (this.readLockToken() !== token) return;
+    try { fs.unlinkSync(this.lockPath); } catch (_) {}
+  }
+
+  withLock(fn) {
+    const token = this.acquireLock();
+    try { return fn(); }
+    finally { this.releaseLock(token); }
+  }
+
+  loadUnlocked() {
+    if (!fs.existsSync(this.statePath)) return new WorkGraph(this.repoId);
+    const stat = fs.lstatSync(this.statePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new WorkGraphStateError(`unsafe Work Graph state: ${this.statePath}`);
+    }
+    if (stat.size > this.maxStateBytes) {
+      throw new WorkGraphStateError(`Work Graph state is ${stat.size} bytes; limit is ${this.maxStateBytes}`);
+    }
+    let graph;
+    try { graph = WorkGraph.fromJSON(fs.readFileSync(this.statePath, 'utf8')); }
+    catch (error) { throw new WorkGraphStateError(`cannot load Work Graph state: ${error.message}`); }
+    if (graph.repoId !== this.repoId) {
+      throw new WorkGraphStateError(
+        `stored Work Graph repo mismatch: expected ${this.repoId}, got ${graph.repoId}`,
+      );
+    }
+    return graph;
+  }
+
+  saveUnlocked(graph) {
+    if (graph.repoId !== this.repoId) {
+      throw new WorkGraphStateError(
+        `cannot persist foreign Work Graph: expected ${this.repoId}, got ${graph.repoId}`,
+      );
+    }
+    const payload = Buffer.from(graph.exportJSON(false), 'utf8');
+    if (payload.length > this.maxStateBytes) {
+      throw new WorkGraphStateError(`Work Graph state is ${payload.length} bytes; limit is ${this.maxStateBytes}`);
+    }
+    secureDirectory(this.repoDir);
+    const temp = path.join(this.repoDir, `.state-${process.pid}-${crypto.randomUUID().replace(/-/g, '')}.tmp`);
+    let fd;
+    try {
+      fd = fs.openSync(temp, 'wx', 0o600);
+      fs.writeFileSync(fd, payload);
+      fs.fsyncSync(fd);
+      fs.closeSync(fd);
+      fd = undefined;
+      fs.renameSync(temp, this.statePath);
+      if (process.platform !== 'win32') fs.chmodSync(this.statePath, 0o600);
+      fsyncDirectory(this.repoDir);
+    } finally {
+      if (fd !== undefined) { try { fs.closeSync(fd); } catch (_) {} }
+      try { fs.unlinkSync(temp); } catch (_) {}
+    }
+  }
+
+  load() { return this.withLock(() => this.loadUnlocked()); }
+
+  save(graph) {
+    return this.withLock(() => {
+      const current = this.loadUnlocked();
+      current.merge(graph);
+      this.saveUnlocked(current);
+      return current;
+    });
+  }
+
+  submitObservation(observation) {
+    if (!observation || observation.repo_id !== this.repoId) {
+      throw new WorkGraphStateError(
+        `repository identity changed: expected ${this.repoId}, got ${observation && observation.repo_id}`,
+      );
+    }
+    return this.withLock(() => {
+      const graph = this.loadUnlocked();
+      graph.observeRepository(observation);
+      this.saveUnlocked(graph);
+      return graph;
+    });
+  }
+
+  mutate(operation) {
+    return this.withLock(() => {
+      const graph = this.loadUnlocked();
+      const result = operation(graph);
+      this.saveUnlocked(graph);
+      return { graph, result };
+    });
+  }
+
+  updateRepository(repoPath = '.', options = {}) {
+    const observation = discoverRepositoryObservation(repoPath, options);
+    enrichWorktreeContentDigests(repoPath, observation);
+    return this.submitObservation(observation);
+  }
+
+  claimWork(repoPath, options = {}) {
+    const agentId = String(options.agentId || '').trim();
+    const taskTitle = String(options.taskTitle || '').trim();
+    if (!agentId || !taskTitle) {
+      throw new WorkGraphStateError('agentId and taskTitle must not be empty');
+    }
+    const nowMs = options.observedAtMs == null ? Date.now() : Number(options.observedAtMs);
+    if (!Number.isSafeInteger(nowMs)) {
+      throw new WorkGraphStateError('observedAtMs must be a JavaScript-safe integer');
+    }
+    const ttlMs = positiveSafeInteger(options.ttlMs ?? 900000, 'ttlMs');
+    const leaseId = String(options.leaseId || crypto.randomUUID().replace(/-/g, ''));
+    const taskId = String(options.taskId || '');
+    const sourceKind = String(options.sourceKind || 'agent_statement');
+    if (!['agent_statement', 'user_statement'].includes(sourceKind)) {
+      throw new WorkGraphStateError("sourceKind must be 'agent_statement' or 'user_statement'");
+    }
+    const observation = discoverRepositoryObservation(repoPath, {
+      agentId,
+      sessionId: String(options.sessionId || ''),
+      observedAtMs: nowMs,
+      taskHint: {
+        task_id: taskId,
+        title: taskTitle,
+        trust: 'observed',
+        explicit_status: 'in_progress',
+        remaining_work: [],
+        source_kind: sourceKind,
+        source_ref: `work-claim:${leaseId}`,
+      },
+    });
+    observation.leases = [{
+      lease_id: leaseId,
+      agent_id: agentId,
+      task_id: taskId,
+      scope_paths: [...new Set(options.scopePaths || [])].map(String).sort(),
+      scope_symbols: [...new Set(options.scopeSymbols || [])].map(String).sort(),
+      expires_at_ms: nowMs + ttlMs,
+      source_ref: `work-lease:${leaseId}`,
+    }];
+    enrichWorktreeContentDigests(repoPath, observation);
+    return { graph: this.submitObservation(observation), leaseId };
+  }
+
+  coordination(nowMs = Date.now()) { return this.load().coordination(nowMs); }
+  resume(workstreamId = null, maxEvidence = 128) {
+    return this.load().resume(workstreamId, maxEvidence);
+  }
+  recordContextReceipt(receipt, options = {}) {
+    return this.mutate((graph) => graph.recordContextReceipt(receipt, options));
+  }
+  recordMemory(memory, nowMs, supersededIds = []) {
+    return this.mutate((graph) => graph.recordMemory(memory, nowMs, supersededIds));
+  }
+  recordExecutionChain(route, outcome, verification, invalidatedCommitments = []) {
+    return this.mutate((graph) => graph.recordExecutionChain(
+      route, outcome, verification, invalidatedCommitments,
+    ));
+  }
+  continuationProof(handoff, manifest) {
+    return this.load().continuationProof(handoff, manifest);
+  }
+  reconstructedContinuationProof(workstreamId, toAgent, manifest) {
+    return this.load().reconstructedContinuationProof(workstreamId, toAgent, manifest);
+  }
+  handoff(workstreamId, fromAgent, toAgent, generatedAtMs = Date.now()) {
+    return this.load().handoff(workstreamId, fromAgent, toAgent, generatedAtMs);
+  }
+}
+
+module.exports = {
+  WorkGraphLockTimeout,
+  WorkGraphStateError,
+  WorkGraphStore,
+  WorkGraphStoreError,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "entroly-wasm",
-  "version": "1.0.78",
+  "version": "1.0.80",
   "description": "WebAssembly Context Assurance for AI agents: reduce avoidable token usage with local evidence selection, receipts, exact recovery, and verification.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -32,12 +32,27 @@
     "js/value_tracker.js",
     "js/app_sdk.js",
     "js/context_receipts.js",
+    "js/continuity_contracts.js",
+    "js/continuity_contracts.d.ts",
     "js/agentskills_export.js",
     "js/gateways.js",
     "js/vault_observer.js",
     "js/distill.js",
     "js/federation.js",
-    "js/evolution_daemon.js"
+    "js/evolution_daemon.js",
+    "js/trust_engine.js",
+    "js/trust_engine.d.ts",
+    "js/work_graph.js",
+    "js/work_graph.d.ts",
+    "js/work_graph_repo.js",
+    "js/work_graph_repo.d.ts",
+    "js/work_graph_store.js",
+    "js/work_graph_store.d.ts",
+    "js/work_context_snapshot_store.js",
+    "js/work_context_snapshot_store.d.ts",
+    "js/work_graph_content_digest.js",
+    "js/work_graph_continuity.js",
+    "js/work_graph_continuity.d.ts"
   ],
   "scripts": {
     "build": "wasm-pack build --target nodejs --out-dir pkg",
@@ -48,7 +63,7 @@
     "health": "node js/cli.js health",
     "demo": "node js/cli.js demo",
     "autotune": "node js/cli.js autotune",
-    "test": "node test_wasm_e2e.js"
+    "test": "node test_wasm_e2e.js && node test_work_graph.js && node test_work_graph_repo.js && node test_work_graph_store.js && node test_work_graph_content_digest.js && node test_work_graph_continuity.js && node test_context_trust_delivery.js && node test_work_graph_performance.js && node test_work_graph_root_exports.js && node test_context_receipt_parity.js"
   },
   "keywords": [
     "entroly",

package/pkg/entroly_wasm.d.ts

@@ -1,6 +1,42 @@
 /* tslint:disable */
 /* eslint-disable */
 
+export class WasmCognitiveBus {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Full event shape: `id`, `source_agent`, `event_type`, `content`,
+     * `timestamp`, `emotional_tag`, `salience`, `is_spike`.
+     */
+    drainJSON(agent_id: string, limit?: number | null): string;
+    /**
+     * Hippocampus bridge shape: `content`, `source`, `salience`,
+     * `emotional_tag`, `event_type`. Deliberately narrower than `drainJSON`.
+     */
+    drainMemoryBridgeJSON(): string;
+    /**
+     * `memorySalienceThreshold` matches the PyO3 default of 50.0.
+     */
+    constructor(memory_salience_threshold?: number | null);
+    /**
+     * Returns the number of subscribers the event was routed to, exactly as
+     * the PyO3 `publish` does.
+     */
+    publish(source_agent: string, event_type: string, content: string, emotional_tag?: number | null, salience?: number | null): number;
+    queueDepth(agent_id: string): number;
+    setTaskContext(agent_id: string, task_text: string): void;
+    setTick(tick: number): void;
+    statsJSON(): string;
+    /**
+     * `eventTypesJSON` is a JSON array of event-type strings. Passing them as
+     * JSON rather than a `Box<[JsString]>` keeps one decoding path shared with
+     * every other binding here.
+     */
+    subscribe(agent_id: string, event_types_json: string): void;
+    tick(): void;
+    unsubscribe(agent_id: string): void;
+}
+
 export class WasmEntrolyEngine {
     free(): void;
     [Symbol.dispose](): void;
@@ -201,10 +237,129 @@ export class WasmEntrolyEngine {
     stats(): any;
 }
 
+export class WasmNkbeAllocator {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Returns false when the agent is unknown, matching PyO3.
+     */
+    addFragment(agent_name: string, fragment_id: string, relevance: number, token_cost: number): boolean;
+    /**
+     * `{agent_name: {budget, weight, utility}}`, as the engine builds it.
+     */
+    allocateJSON(): string;
+    /**
+     * Defaults mirror the PyO3 constructor exactly: 128000 / 0.1 / 1e-4 / 30 /
+     * 5 / 0.01. Divergent defaults would be a parity break that no test on
+     * either side would notice.
+     */
+    constructor(global_budget?: number | null, tau?: number | null, epsilon?: number | null, max_iter?: number | null, nash_iterations?: number | null, learning_rate?: number | null);
+    registerAgent(name: string, weight: number, min_budget: number): void;
+    reinforce(outcomes_json: string): boolean;
+    statsJSON(): string;
+}
+
+export class WasmTrustEngine {
+    free(): void;
+    [Symbol.dispose](): void;
+    assessClaimJSON(evidence: string, claim: string): string;
+    fileCriticality(path: string): string;
+    hasSafetySignal(content: string): boolean;
+    constructor(profile: string);
+}
+
+export class WasmWorkGraph {
+    free(): void;
+    [Symbol.dispose](): void;
+    applyEventJSON(json_text: string): string;
+    contextScopeJSON(workstream_id: string | null | undefined, max_evidence: number, pretty: boolean): string;
+    continuationProofJSON(handoff_json: string, manifest_json: string): string;
+    coordinationJSON(now_ms: number, pretty: boolean): string;
+    exportJSON(pretty: boolean): string;
+    static fromJSON(json_text: string): WasmWorkGraph;
+    handoffJSON(workstream_id: string, from_agent: string, to_agent: string, generated_at_ms: number, pretty: boolean): string;
+    mergeJSON(json_text: string): number;
+    constructor(repo_id: string);
+    observeRepositoryJSON(json_text: string): string;
+    reconstructedContinuationProofJSON(workstream_id: string, to_agent: string, manifest_json: string): string;
+    recordContextReceiptJSON(receipt_json: string, agent_id: string, session_id: string): string;
+    recordExecutionChainJSON(route_json: string, outcome_json: string, verification_json: string, invalidated_commitments_json?: string | null): string;
+    recordMemoryJSON(memory_json: string, now_ms: number, superseded_ids_json?: string | null): string;
+    resumeJSON(workstream_id: string | null | undefined, max_evidence: number, pretty: boolean): string;
+    snapshotJSON(pretty: boolean): string;
+    summaryJSON(): string;
+    unfinishedJSON(pretty: boolean): string;
+    static verifyHandoffIntegrityJSON(receipt_json: string): boolean;
+    verifyHandoffJSON(receipt_json: string): boolean;
+    readonly eventCount: number;
+    readonly graphCommitment: string;
+    readonly repoId: string;
+    readonly revision: bigint;
+}
+
 export function classify_learning_query(query: string): string;
 
 export function classify_query_transition(prev_hash: bigint, current_query: string, elapsed_s: number, time_window_s: number, rephrase_threshold: number, topic_change_threshold: number): any;
 
+/**
+ * Build a canonical receipt envelope and return it as canonical JSON.
+ *
+ * Reference lists arrive as JSON arrays rather than `Box<[JsString]>` so there
+ * is one decoding path shared with the other bindings here, and so an empty
+ * list is expressed the same way in both runtimes.
+ */
+export function contextReceiptBuildJSON(repository_id: string, repository_commitment: string, graph_commitment: string, work_scope_id: string, source_commitment?: string | null, selected_refs_json?: string | null, omitted_refs_json?: string | null, pinned_refs_json?: string | null, recoverable_refs_json?: string | null, recovery_handles_json?: string | null, evidence_ids_json?: string | null, budget_tokens?: number | null, selection_policy?: string | null, execution_id?: string | null, created_at_ms?: number | null): string;
+
+/**
+ * The commitment carried by a verified envelope.
+ */
+export function contextReceiptCommitment(receipt_json: string): string;
+
+/**
+ * Project a verified envelope into the Work Graph reference form, as JSON.
+ */
+export function contextReceiptGraphRefJSON(receipt_json: string, workstream_id: string, agent_id: string, session_id: string): string;
+
+/**
+ * Schema version this build implements.
+ */
+export function contextReceiptSchemaVersion(): number;
+
+/**
+ * Parse and verify an envelope, returning its canonical JSON.
+ *
+ * Fails closed on a commitment that does not recompute and on an unrecognised
+ * schema version — a caller cannot obtain an unverified envelope here.
+ */
+export function contextReceiptVerifyJSON(receipt_json: string): string;
+
+/**
+ * May this memory be injected, and why.
+ *
+ * No score parameter, by design — section 10's "do not let similarity score
+ * imply truth" is enforced by the signature in both runtimes alike.
+ */
+export function memoryRecordAdmissibility(record_json: string, now_ms: number, superseded_ids_json?: string | null): string;
+
+/**
+ * Build a memory record and return it as canonical JSON.
+ */
+export function memoryRecordBuildJSON(repository_id: string, content_reference: string, trust_state: string, task_id?: string | null, workstream_id?: string | null, source_agent?: string | null, source_session?: string | null, source_execution?: string | null, content_commitment?: string | null, evidence_ids_json?: string | null, created_at_ms?: number | null, observed_at_ms?: number | null, valid_until_ms?: number | null, supersedes_json?: string | null, contradicted_by_json?: string | null, recovery_handle?: string | null): string;
+
+/**
+ * Schema version this build implements for memory records.
+ */
+export function memoryRecordSchemaVersion(): number;
+
+/**
+ * Parse and check a memory record, returning its canonical JSON.
+ */
+export function memoryRecordVerifyJSON(record_json: string): string;
+
+export function modelExecutionOutcomeBuildJSON(input_json: string): string;
+
+export function modelExecutionOutcomeVerifyJSON(value_json: string): string;
+
 export function optimize_task_profiles(episodes_json: string): any;
 
 export function qccr_expand_query(query: string): string;
@@ -213,4 +368,57 @@ export function qccr_rank_files(sources: string[], texts: string[], query: strin
 
 export function qccr_select(fragments_json: string, token_budget: number, query: string, overrides_json: string, preferred_json: string): string;
 
+/**
+ * Build a recovery handle and return it as canonical JSON.
+ *
+ * Throws when a disposition promises recovery without the means to honour it.
+ */
+export function recoveryHandleBuildJSON(repository_id: string, receipt_id: string, disposition: string, source_ref?: string | null, source_commitment?: string | null, fragment_commitment?: string | null, byte_start?: number | null, byte_end?: number | null, version?: string | null, storage_locator?: string | null, observed_at_ms?: number | null): string;
+
+/**
+ * Schema version this build implements for recovery handles.
+ */
+export function recoveryHandleSchemaVersion(): number;
+
+/**
+ * Check recovered bytes against the handle's commitment.
+ *
+ * Returns `verified`, `commitment_mismatch` or `not_recoverable`.
+ */
+export function recoveryHandleVerifyBytes(handle_json: string, payload: Uint8Array): string;
+
+/**
+ * Parse and check a handle, returning its canonical JSON.
+ */
+export function recoveryHandleVerifyJSON(handle_json: string): string;
+
 export function reward_weighted_optimize(episodes_json: string, current_weights_json: string): any;
+
+export function routingDecisionBuildJSON(input_json: string): string;
+
+export function routingDecisionVerifyJSON(value_json: string): string;
+
+export function verificationRecordBuildJSON(input_json: string): string;
+
+export function verificationRecordFreshness(value_json: string, current_repository_commitment: string, now_ms: number, invalidated_commitments_json?: string | null): string;
+
+export function verificationRecordVerifyJSON(value_json: string): string;
+
+export function verifiedContextSnapshotVerifyBytes(payload: Uint8Array, expected_commitment: string): string;
+
+export function workContinuationProofBuildJSON(input_json: string): string;
+
+export function workContinuationProofState(value_json: string, repository_id: string, graph_revision: number, graph_commitment: string): string;
+
+export function workContinuationProofVerifyJSON(value_json: string): string;
+
+/**
+ * Canonical edge identity. See `workGraphNodeId`.
+ */
+export function workGraphEdgeId(from: string, kind: string, to: string): string;
+
+/**
+ * Canonical node identity, so Node addresses artifacts exactly as Python and
+ * the graph itself do. Same engine function behind all three.
+ */
+export function workGraphNodeId(kind: string, repo_id: string, key: string): string;