harnery 0.35.0 → 0.37.0

package/dist/core/events/v3/bootstrap.d.ts

@@ -17,6 +17,13 @@ export interface InitializeEventLedgerV3Result {
         state: "active";
     }>;
 }
+export interface RefreshIncompatibleEventLedgerV3Result {
+    state: "current" | "refreshed";
+    archived_epoch?: string;
+    control: Extract<EventV3ControlState, {
+        state: "active";
+    }>;
+}
 /**
  * Ensure programmatic Harnery entry points have the same universal V3
  * boundary as `harn init`. Only a genuinely absent control pair is created;
@@ -31,4 +38,36 @@ export declare function ensureEventLedgerV3(coordRoot: string, approvalRecordId?
  * pair is published. No historical ledger bytes are rewritten or deleted.
  */
 export declare function initializeEventLedgerV3(input: InitializeEventLedgerV3Input): InitializeEventLedgerV3Result;
+/**
+ * Replace only a runtime-incompatible epoch that the current code can name
+ * exactly. Corruption and ambiguous control failures remain closed for the
+ * explicit recovery command.
+ */
+export declare function refreshIncompatibleEventLedgerV3(coordRoot: string): RefreshIncompatibleEventLedgerV3Result;
+export interface RotateOversizedEventLedgerV3Result {
+    state: "rotated" | "not_oversized" | "not_active" | "disabled";
+    active_bytes: number;
+    threshold_bytes: number;
+    archived_epoch?: string;
+    control?: Extract<EventV3ControlState, {
+        state: "active";
+    }>;
+}
+/**
+ * Archive a valid oversized epoch intact and start a fresh one.
+ *
+ * Every canonical read validates the complete epoch, and hook producers are
+ * one-shot processes, so an unbounded active segment makes every hook's cold
+ * read scale with all history. Rotation bounds that cost: the replaced epoch
+ * (events, spool, producer states, manifests) moves whole into the V3
+ * archive, live sessions re-onboard into the new epoch on their next signal,
+ * and the writer's epoch fence keeps in-flight producers of the old epoch
+ * from ever committing into the new one. Only a currently valid, active
+ * ledger rotates; integrity failures stay closed for the explicit recovery
+ * command. The threshold comes from the isolated Event V3 config resolver
+ * unless the caller pins one; a non-positive threshold disables rotation.
+ */
+export declare function rotateOversizedEventLedgerV3(coordRoot: string, options?: {
+    thresholdBytes?: number;
+}): RotateOversizedEventLedgerV3Result;
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/core/events/v3/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/bootstrap.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,mBAAmB,EAGzB,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,gBAAgB,SAAiC,GAChD,OAAO,CAAC,mBAAmB,EAAE;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAenD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAkE/B"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/bootstrap.ts"],"names":[],"mappings":"AAoBA,OAAO,EAML,KAAK,mBAAmB,EAEzB,MAAM,cAAc,CAAC;AAQtB,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,sCAAsC;IACrD,KAAK,EAAE,SAAS,GAAG,WAAW,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC5D;AAOD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,gBAAgB,SAAiC,GAChD,OAAO,CAAC,mBAAmB,EAAE;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAenD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,GAChB,sCAAsC,CAgCxC;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,SAAS,GAAG,eAAe,GAAG,YAAY,GAAG,UAAU,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACxC,kCAAkC,CAqDpC"}

package/dist/core/events/v3/bootstrap.js

@@ -1,14 +1,23 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fsyncParentDirectory } from "../../workflow/durable-record.js";
+import { acquireNoClobberLease } from "../../workflow/workspaces/leases.js";
 import { canonicalJsonV3, sha256V3 } from "./canonical.js";
 import { ADAPTER_CAPABILITY_PROFILES_V3 } from "./capabilities.js";
-import { buildActivationManifestV3, buildCandidateGenesisManifestV3, EVENT_V3_ACTIVATION_MANIFEST, EVENT_V3_GENESIS_MANIFEST, readEventV3ControlState, repairEventV3ControlPair, } from "./control.js";
+import { buildActivationManifestV3, buildCandidateGenesisManifestV3, EVENT_V3_ACTIVATION_MANIFEST, EVENT_V3_GENESIS_MANIFEST, readEventV3ControlState, } from "./control.js";
+import { repairEventV3ControlPair } from "./control-writer.js";
 import { loadOrCreateFingerprintKeyStoreV3 } from "./fingerprint-keys.js";
 import { EVENT_V3_SCHEMA_DIGEST } from "./generated.js";
-import { liveEventV3BuildId, livePlatformV3 } from "./live-routing.js";
+import { resolveEventLedgerRotateActiveBytesV3 } from "./rotation-config.js";
+import { currentHarneryRuntimeBuild, liveEventV3BuildId, livePlatformV3 } from "./runtime-build.js";
+import { drainReadyEventsV3 } from "./writer.js";
+const BOOTSTRAP_LEASE_RETRIES = 12;
+const BOOTSTRAP_LEASE_RETRY_MS = 25;
+const BOOTSTRAP_LEASE_STALE_MS = 10_000;
+const bootstrapSleepCell = new Int32Array(new SharedArrayBuffer(4));
 /**
  * Ensure programmatic Harnery entry points have the same universal V3
  * boundary as `harn init`. Only a genuinely absent control pair is created;
@@ -37,6 +46,112 @@ export function ensureEventLedgerV3(coordRoot, approvalRecordId = "harnery-runti
  * pair is published. No historical ledger bytes are rewritten or deleted.
  */
 export function initializeEventLedgerV3(input) {
+    return withBootstrapLease(input.coordRoot, () => initializeEventLedgerV3Locked(input));
+}
+/**
+ * Replace only a runtime-incompatible epoch that the current code can name
+ * exactly. Corruption and ambiguous control failures remain closed for the
+ * explicit recovery command.
+ */
+export function refreshIncompatibleEventLedgerV3(coordRoot) {
+    const root = resolve(coordRoot);
+    return withBootstrapLease(root, () => {
+        const current = readEventV3ControlState(root);
+        if (current.state === "active" && runtimeCapabilityProfileCurrent(current)) {
+            return { state: "current", control: current };
+        }
+        const refreshable = (current.state === "invalid" && current.reason === "genesis_schema_digest_incompatible") ||
+            ((current.state === "candidate" || current.state === "active") &&
+                !runtimeCapabilityProfileCurrent(current));
+        if (!refreshable) {
+            const reason = "reason" in current ? `${current.state}:${current.reason}` : current.state;
+            throw new Error(`event_v3_runtime_refresh_refused:${reason}`);
+        }
+        const configPath = join(root, ".harnery", "config.jsonc");
+        const initialized = initializeEventLedgerV3Locked({
+            coordRoot: root,
+            harneryBuild: currentHarneryRuntimeBuild(),
+            hostBuild: repositoryBuild(root),
+            configDigest: sha256V3(existsSync(configPath) ? readFileSync(configPath) : Buffer.from("{}\n")),
+            approvalRecordId: "harnery-runtime-v3-auto-refresh",
+            forceNewEpoch: true,
+        });
+        return {
+            state: "refreshed",
+            ...(initialized.archived_epoch ? { archived_epoch: initialized.archived_epoch } : {}),
+            control: initialized.control,
+        };
+    });
+}
+/**
+ * Archive a valid oversized epoch intact and start a fresh one.
+ *
+ * Every canonical read validates the complete epoch, and hook producers are
+ * one-shot processes, so an unbounded active segment makes every hook's cold
+ * read scale with all history. Rotation bounds that cost: the replaced epoch
+ * (events, spool, producer states, manifests) moves whole into the V3
+ * archive, live sessions re-onboard into the new epoch on their next signal,
+ * and the writer's epoch fence keeps in-flight producers of the old epoch
+ * from ever committing into the new one. Only a currently valid, active
+ * ledger rotates; integrity failures stay closed for the explicit recovery
+ * command. The threshold comes from the isolated Event V3 config resolver
+ * unless the caller pins one; a non-positive threshold disables rotation.
+ */
+export function rotateOversizedEventLedgerV3(coordRoot, options = {}) {
+    const root = resolve(coordRoot);
+    const threshold = options.thresholdBytes ?? resolveEventLedgerRotateActiveBytesV3(root);
+    const activePath = join(root, ".harnery", "ledgers", "v3", "active.ndjson");
+    const measure = () => {
+        try {
+            return statSync(activePath).size;
+        }
+        catch {
+            return 0;
+        }
+    };
+    if (threshold <= 0) {
+        return { state: "disabled", active_bytes: measure(), threshold_bytes: threshold };
+    }
+    if (measure() < threshold) {
+        return { state: "not_oversized", active_bytes: measure(), threshold_bytes: threshold };
+    }
+    return withBootstrapLease(root, () => {
+        const activeBytes = measure();
+        if (activeBytes < threshold) {
+            return { state: "not_oversized", active_bytes: activeBytes, threshold_bytes: threshold };
+        }
+        const current = readEventV3ControlState(root);
+        if (current.state !== "active") {
+            return { state: "not_active", active_bytes: activeBytes, threshold_bytes: threshold };
+        }
+        // Flush durable ready rows into the epoch they were produced for, so the
+        // archive carries them committed instead of stranded in its spool.
+        try {
+            drainReadyEventsV3(root);
+        }
+        catch {
+            // A busy append lease only leaves rows in the archived spool; rotation
+            // itself stays safe.
+        }
+        const configPath = join(root, ".harnery", "config.jsonc");
+        const initialized = initializeEventLedgerV3Locked({
+            coordRoot: root,
+            harneryBuild: currentHarneryRuntimeBuild(),
+            hostBuild: repositoryBuild(root),
+            configDigest: sha256V3(existsSync(configPath) ? readFileSync(configPath) : Buffer.from("{}\n")),
+            approvalRecordId: "harnery-runtime-v3-size-rotation",
+            forceNewEpoch: true,
+        });
+        return {
+            state: "rotated",
+            active_bytes: activeBytes,
+            threshold_bytes: threshold,
+            ...(initialized.archived_epoch ? { archived_epoch: initialized.archived_epoch } : {}),
+            control: initialized.control,
+        };
+    });
+}
+function initializeEventLedgerV3Locked(input) {
     const root = resolve(input.coordRoot);
     let current = readEventV3ControlState(root);
     if (input.resumeCandidate && current.state === "repairable") {
@@ -100,6 +215,55 @@ export function initializeEventLedgerV3(input) {
         ...(archivedEpoch ? { archived_epoch: archivedEpoch } : {}),
     };
 }
+function runtimeCapabilityProfileCurrent(control) {
+    const expected = Object.values(ADAPTER_CAPABILITY_PROFILES_V3).map((profile) => sha256V3(canonicalJsonV3(profile)));
+    const approved = control.genesis.profile.adapter_capability_profile_digests;
+    const expectedDigests = new Set(expected);
+    return control.state === "candidate"
+        ? approved.some((digest) => expectedDigests.has(digest))
+        : expected.every((digest) => approved.includes(digest));
+}
+function withBootstrapLease(coordRoot, operation) {
+    const root = resolve(coordRoot);
+    const authority = createHash("sha256").update(root).digest("hex");
+    let lease;
+    for (let attempt = 0; attempt < BOOTSTRAP_LEASE_RETRIES; attempt += 1) {
+        try {
+            lease = acquireNoClobberLease({
+                path: join(root, ".harnery", "private", "event-v3-bootstrap-lease"),
+                scope: "event-v3-bootstrap",
+                authoritySha256: authority,
+                staleAfterMs: BOOTSTRAP_LEASE_STALE_MS,
+                validateStaleOwner: (owner) => owner.host === hostname() && !pidIsAlive(owner.pid),
+            });
+            break;
+        }
+        catch (error) {
+            if (attempt === BOOTSTRAP_LEASE_RETRIES - 1)
+                throw error;
+            Atomics.wait(bootstrapSleepCell, 0, 0, BOOTSTRAP_LEASE_RETRY_MS);
+        }
+    }
+    if (!lease)
+        throw new Error("event_v3_bootstrap_lease_busy");
+    try {
+        return operation();
+    }
+    finally {
+        lease.release();
+    }
+}
+function pidIsAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
 function activateCandidateEpoch(root, candidate, approvalRecordId) {
     const producer = candidate.event.producer;
     const activation = buildActivationManifestV3({

package/dist/core/events/v3/capabilities.d.ts

@@ -7,7 +7,7 @@ export interface WaitKindCapabilityV3 {
     span_delivery: CapabilitySupportV3;
     turn_completeness: CapabilitySupportV3;
 }
-export type BaseAdapterSignalV3 = "session_start" | "session_end" | "prompt" | "turn_id" | "turn_completion" | "tool_request" | "tool_result" | "tool_failure" | "tool_call_id" | "tool_duration" | "permission" | "subagent" | "shell" | "pre_compaction" | "post_compaction" | "context_usage" | "model_identity";
+export type BaseAdapterSignalV3 = "session_start" | "session_end" | "prompt" | "turn_id" | "turn_completion" | "assistant_reply_text" | "tool_request" | "tool_result" | "tool_failure" | "tool_call_id" | "tool_duration" | "permission" | "subagent" | "shell" | "pre_compaction" | "post_compaction" | "context_usage" | "model_identity";
 export type AdapterSignalV3 = BaseAdapterSignalV3 | "model_usage" | "inference_timing" | "harness_timing" | "capability_drift";
 export interface AdapterCapabilityProfileV3 {
     format: "harnery-v3-adapter-capabilities";

package/dist/core/events/v3/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,CAAC;AAEvF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,aAAa,GACb,UAAU,GACV,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,CAAC;AAEd,eAAO,MAAM,qBAAqB,EAAE,SAAS,iBAAiB,EAQpD,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,mBAAmB,CAAC;IACnC,iBAAiB,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,aAAa,GACb,QAAQ,GACR,SAAS,GACT,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,cAAc,GACd,cAAc,GACd,eAAe,GACf,YAAY,GACZ,UAAU,GACV,OAAO,GACP,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,iCAAiC,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;CACvD;AAmED,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAatF,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAEvF;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,MAAM,EAAE,CAElF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAErB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,iBAAiB,GACtB,mBAAmB,CAErB;AAED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAUjD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,CAI3F"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,CAAC;AAEvF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,aAAa,GACb,UAAU,GACV,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,CAAC;AAEd,eAAO,MAAM,qBAAqB,EAAE,SAAS,iBAAiB,EAQpD,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,mBAAmB,CAAC;IACnC,iBAAiB,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,aAAa,GACb,QAAQ,GACR,SAAS,GACT,iBAAiB,GACjB,sBAAsB,GACtB,cAAc,GACd,aAAa,GACb,cAAc,GACd,cAAc,GACd,eAAe,GACf,YAAY,GACZ,UAAU,GACV,OAAO,GACP,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,iCAAiC,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;CACvD;AAoED,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAatF,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,0BAA0B,CAEvF;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,MAAM,EAAE,CAElF;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAErB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,iBAAiB,GACtB,mBAAmB,CAErB;AAED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,OAAO,GAAG,mBAAmB,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAUjD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,CAI3F"}

package/dist/core/events/v3/capabilities.js

@@ -12,6 +12,7 @@ const SHARED_SIGNAL_SUPPORT = {
     session_start: "native",
     prompt: "native",
     turn_completion: "native",
+    assistant_reply_text: "native",
     tool_request: "native",
     tool_result: "native",
     tool_failure: "native",
@@ -29,7 +30,7 @@ const BASE_SIGNAL_SUPPORT = {
         turn_id: "conditional",
         permission: "native",
         post_compaction: "native",
-        context_usage: "unsupported",
+        context_usage: "conditional",
     },
     codex: {
         ...SHARED_SIGNAL_SUPPORT,
@@ -37,7 +38,7 @@ const BASE_SIGNAL_SUPPORT = {
         turn_id: "native",
         permission: "native",
         post_compaction: "native",
-        context_usage: "unsupported",
+        context_usage: "derived",
     },
     cursor: {
         ...SHARED_SIGNAL_SUPPORT,
@@ -51,7 +52,7 @@ const BASE_SIGNAL_SUPPORT = {
         shell: "conditional",
         permission: "conditional",
         post_compaction: "unsupported",
-        context_usage: "unsupported",
+        context_usage: "conditional",
     },
 };
 function profile(adapter, economics) {

package/dist/core/events/v3/control-witness.d.ts

@@ -0,0 +1,44 @@
+import type { ActivationManifestV3, CandidateGenesisManifestV3 } from "./control.js";
+import { EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH, type EventV3AppendValidationCheckpointV3, type EventV3AuthorityStorageVersionV3 } from "./reader.js";
+export { EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH };
+interface EventV3ControlWitnessPayload {
+    format: "harnery-event-v3-control-witness";
+    format_version: 1;
+    genesis_id: `gex_${string}`;
+    activation_id: `act_${string}`;
+    genesis_event_id: `evt_${string}`;
+    activation_event_id: `evt_${string}`;
+    genesis_manifest_digest: `sha256:${string}`;
+    activation_manifest_digest: `sha256:${string}`;
+    candidate_manifest_digest: `sha256:${string}`;
+    privacy_key_epoch: `pep_${string}`;
+    root_id: `root_${string}`;
+    storage: EventV3AuthorityStorageVersionV3;
+    checkpoint_digest: `sha256:${string}`;
+}
+export interface ActiveControlWitnessBindingV3 {
+    genesis: CandidateGenesisManifestV3;
+    activation: ActivationManifestV3;
+    candidate_manifest_digest: `sha256:${string}`;
+}
+/** True only when one authenticated witness names this exact active control pair and storage. */
+export declare function activeControlWitnessMatchesV3(coordRoot: string, binding: ActiveControlWitnessBindingV3): boolean;
+/**
+ * Publish a witness only when the storage validated by the caller is still current.
+ * Failure is intentionally silent: the next read retains the canonical full-scan fallback.
+ */
+export declare function publishActiveControlWitnessV3(coordRoot: string, binding: ActiveControlWitnessBindingV3, validatedStorage: EventV3AuthorityStorageVersionV3, checkpoint: EventV3AppendValidationCheckpointV3): boolean;
+/**
+ * Capture a previously authenticated witness before the append lease mutates storage.
+ * The returned payload is safe to advance only while the caller continues to hold that lease.
+ */
+export declare function readAdvanceableControlWitnessV3(coordRoot: string): {
+    payload: EventV3ControlWitnessPayload;
+    checkpoint: EventV3AppendValidationCheckpointV3;
+} | undefined;
+/** Advance a lease-held witness after durable appends without changing writer success semantics. */
+export declare function advanceControlWitnessV3(coordRoot: string, prior: {
+    payload: EventV3ControlWitnessPayload;
+    checkpoint: EventV3AppendValidationCheckpointV3;
+}, currentGenesisId: string | undefined): boolean;
+//# sourceMappingURL=control-witness.d.ts.map

package/dist/core/events/v3/control-witness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-witness.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/control-witness.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAEL,yCAAyC,EACzC,sCAAsC,EACtC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,EAKtC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,yCAAyC,EAAE,sCAAsC,EAAE,CAAC;AAE7F,UAAU,4BAA4B;IACpC,MAAM,EAAE,kCAAkC,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,OAAO,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,MAAM,EAAE,CAAC;IAClC,mBAAmB,EAAE,OAAO,MAAM,EAAE,CAAC;IACrC,uBAAuB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC5C,0BAA0B,EAAE,UAAU,MAAM,EAAE,CAAC;IAC/C,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;IAC9C,iBAAiB,EAAE,OAAO,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,gCAAgC,CAAC;IAC1C,iBAAiB,EAAE,UAAU,MAAM,EAAE,CAAC;CACvC;AAOD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,0BAA0B,CAAC;IACpC,UAAU,EAAE,oBAAoB,CAAC;IACjC,yBAAyB,EAAE,UAAU,MAAM,EAAE,CAAC;CAC/C;AAED,iGAAiG;AACjG,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAYT;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,6BAA6B,EACtC,gBAAgB,EAAE,gCAAgC,EAClD,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CAYT;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAC7D;IACE,OAAO,EAAE,4BAA4B,CAAC;IACtC,UAAU,EAAE,mCAAmC,CAAC;CACjD,GACD,SAAS,CAYZ;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,OAAO,EAAE,4BAA4B,CAAC;IACtC,UAAU,EAAE,mCAAmC,CAAC;CACjD,EACD,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,OAAO,CA0BT"}

package/dist/core/events/v3/control-witness.js

@@ -0,0 +1,233 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { fsyncParentDirectory } from "../../workflow/durable-record.js";
+import { canonicalJsonV3, fingerprintV3, sha256V3 } from "./canonical.js";
+import { fingerprintContextV3 } from "./fingerprint-keys.js";
+import { advanceEventV3AppendValidationCheckpointV3, EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH, eventV3AuthorityStorageVersionV3, eventV3ControlCheckpointPathV3, eventV3ControlWitnessPathV3, parseEventV3AppendValidationCheckpointV3, } from "./reader.js";
+export { EVENT_V3_CONTROL_CHECKPOINT_RELATIVE_PATH, EVENT_V3_CONTROL_WITNESS_RELATIVE_PATH };
+/** True only when one authenticated witness names this exact active control pair and storage. */
+export function activeControlWitnessMatchesV3(coordRoot, binding) {
+    try {
+        const before = eventV3AuthorityStorageVersionV3(coordRoot);
+        const witness = readAuthenticatedWitnessV3(coordRoot);
+        if (!witness)
+            return false;
+        const expected = witnessPayloadV3(binding, before, witness.payload.checkpoint_digest);
+        if (canonicalJsonV3(witness.payload) !== canonicalJsonV3(expected))
+            return false;
+        const after = eventV3AuthorityStorageVersionV3(coordRoot);
+        return sameStorageVersion(before, after);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Publish a witness only when the storage validated by the caller is still current.
+ * Failure is intentionally silent: the next read retains the canonical full-scan fallback.
+ */
+export function publishActiveControlWitnessV3(coordRoot, binding, validatedStorage, checkpoint) {
+    try {
+        const current = eventV3AuthorityStorageVersionV3(coordRoot);
+        if (!sameStorageVersion(validatedStorage, current))
+            return false;
+        return publishWitnessV3(coordRoot, witnessPayloadV3(binding, current, checkpointDigestV3(checkpoint)), checkpoint);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Capture a previously authenticated witness before the append lease mutates storage.
+ * The returned payload is safe to advance only while the caller continues to hold that lease.
+ */
+export function readAdvanceableControlWitnessV3(coordRoot) {
+    try {
+        const storage = eventV3AuthorityStorageVersionV3(coordRoot);
+        const witness = readAuthenticatedWitnessV3(coordRoot);
+        if (!witness || !sameStorageVersion(witness.payload.storage, storage))
+            return undefined;
+        const checkpoint = readAuthenticatedCheckpointV3(coordRoot, witness.payload.checkpoint_digest);
+        return checkpoint && checkpoint.validated_active_bytes === storage.active_bytes
+            ? { payload: witness.payload, checkpoint }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Advance a lease-held witness after durable appends without changing writer success semantics. */
+export function advanceControlWitnessV3(coordRoot, prior, currentGenesisId) {
+    try {
+        if (currentGenesisId !== prior.payload.genesis_id)
+            return false;
+        const storageBeforeValidation = eventV3AuthorityStorageVersionV3(coordRoot);
+        const checkpoint = advanceEventV3AppendValidationCheckpointV3(coordRoot, prior.checkpoint);
+        if (!checkpoint)
+            return false;
+        const storage = eventV3AuthorityStorageVersionV3(coordRoot);
+        if (storageBeforeValidation.fingerprint !== storage.fingerprint ||
+            prior.payload.storage.stable_fingerprint !== storage.stable_fingerprint ||
+            checkpoint.validated_active_bytes !== storage.active_bytes) {
+            return false;
+        }
+        return publishWitnessV3(coordRoot, {
+            ...prior.payload,
+            storage,
+            checkpoint_digest: checkpointDigestV3(checkpoint),
+        }, checkpoint);
+    }
+    catch {
+        return false;
+    }
+}
+function witnessPayloadV3(binding, storage, checkpointDigest) {
+    const scope = binding.genesis.event.scope;
+    return {
+        format: "harnery-event-v3-control-witness",
+        format_version: 1,
+        genesis_id: binding.genesis.event.payload.genesis_id,
+        activation_id: binding.activation.activation_id,
+        genesis_event_id: binding.genesis.event.event_id,
+        activation_event_id: binding.activation.event.event_id,
+        genesis_manifest_digest: sha256V3(canonicalJsonV3(binding.genesis)),
+        activation_manifest_digest: sha256V3(canonicalJsonV3(binding.activation)),
+        candidate_manifest_digest: binding.candidate_manifest_digest,
+        privacy_key_epoch: binding.genesis.profile.privacy_key_epoch,
+        root_id: scope.root_id,
+        storage,
+        checkpoint_digest: checkpointDigest,
+    };
+}
+function readAuthenticatedWitnessV3(coordRoot) {
+    const path = eventV3ControlWitnessPathV3(coordRoot);
+    if (!existsSync(path))
+        return undefined;
+    const raw = readFileSync(path, "utf8");
+    const value = JSON.parse(raw);
+    const witness = parseWitnessV3(value);
+    if (`${canonicalJsonV3(witness)}\n` !== raw)
+        return undefined;
+    const expected = authenticatePayloadV3(coordRoot, witness.payload);
+    return canonicalJsonV3(witness.authentication) === canonicalJsonV3(expected)
+        ? witness
+        : undefined;
+}
+function publishWitnessV3(coordRoot, payload, checkpoint) {
+    if (!publishCanonicalFileV3(eventV3ControlCheckpointPathV3(coordRoot), checkpoint))
+        return false;
+    const witness = {
+        payload,
+        authentication: authenticatePayloadV3(coordRoot, payload),
+    };
+    return publishCanonicalFileV3(eventV3ControlWitnessPathV3(coordRoot), witness);
+}
+function publishCanonicalFileV3(path, value) {
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    let fd;
+    try {
+        fd = openSync(temporary, "wx", 0o600);
+        writeFileSync(fd, `${canonicalJsonV3(value)}\n`, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        chmodSync(temporary, 0o600);
+        renameSync(temporary, path);
+        fsyncParentDirectory(path);
+        return true;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+function readAuthenticatedCheckpointV3(coordRoot, expectedDigest) {
+    try {
+        const raw = readFileSync(eventV3ControlCheckpointPathV3(coordRoot), "utf8");
+        const value = JSON.parse(raw);
+        if (`${canonicalJsonV3(value)}\n` !== raw ||
+            sha256V3(canonicalJsonV3(value)) !== expectedDigest) {
+            return undefined;
+        }
+        return parseEventV3AppendValidationCheckpointV3(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function checkpointDigestV3(checkpoint) {
+    return sha256V3(canonicalJsonV3(checkpoint));
+}
+function authenticatePayloadV3(coordRoot, payload) {
+    const context = fingerprintContextV3(coordRoot, payload.root_id, undefined, payload.privacy_key_epoch);
+    return fingerprintV3(context, "control-state-witness", payload, "root");
+}
+function parseWitnessV3(value) {
+    const envelope = object(value);
+    if (Object.keys(envelope).sort().join("\0") !== "authentication\0payload") {
+        throw new Error("control witness envelope is invalid");
+    }
+    const payload = object(envelope.payload);
+    const expectedPayloadKeys = [
+        "activation_event_id",
+        "activation_id",
+        "activation_manifest_digest",
+        "candidate_manifest_digest",
+        "checkpoint_digest",
+        "format",
+        "format_version",
+        "genesis_event_id",
+        "genesis_id",
+        "genesis_manifest_digest",
+        "privacy_key_epoch",
+        "root_id",
+        "storage",
+    ];
+    if (Object.keys(payload).sort().join("\0") !== expectedPayloadKeys.sort().join("\0")) {
+        throw new Error("control witness payload shape is invalid");
+    }
+    const storage = object(payload.storage);
+    if (Object.keys(storage).sort().join("\0") !== "active_bytes\0fingerprint\0stable_fingerprint") {
+        throw new Error("control witness storage shape is invalid");
+    }
+    if (payload.format !== "harnery-event-v3-control-witness" ||
+        payload.format_version !== 1 ||
+        !token(payload.genesis_id, "gex_") ||
+        !token(payload.activation_id, "act_") ||
+        !token(payload.genesis_event_id, "evt_") ||
+        !token(payload.activation_event_id, "evt_") ||
+        !digest(payload.genesis_manifest_digest) ||
+        !digest(payload.activation_manifest_digest) ||
+        !digest(payload.candidate_manifest_digest) ||
+        !digest(payload.checkpoint_digest) ||
+        !token(payload.privacy_key_epoch, "pep_") ||
+        !token(payload.root_id, "root_") ||
+        !digest(storage.fingerprint) ||
+        !digest(storage.stable_fingerprint) ||
+        !Number.isSafeInteger(storage.active_bytes) ||
+        storage.active_bytes < 0) {
+        throw new Error("control witness payload is invalid");
+    }
+    const authentication = object(envelope.authentication);
+    return {
+        payload: payload,
+        authentication: authentication,
+    };
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("control witness value is not an object");
+    }
+    return value;
+}
+function token(value, prefix) {
+    return (typeof value === "string" && value.startsWith(prefix) && /^[a-zA-Z0-9._-]{1,160}$/.test(value));
+}
+function digest(value) {
+    return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+function sameStorageVersion(left, right) {
+    return left.fingerprint === right.fingerprint && left.active_bytes === right.active_bytes;
+}

package/dist/core/events/v3/control-writer.d.ts

@@ -0,0 +1,4 @@
+import { type EventV3ControlState } from "./control.js";
+/** Repair only a manifest-first crash by appending the exact pre-minted event. */
+export declare function repairEventV3ControlPair(coordRoot: string): EventV3ControlState;
+//# sourceMappingURL=control-writer.d.ts.map

package/dist/core/events/v3/control-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-writer.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/control-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAA2B,MAAM,cAAc,CAAC;AAGjF,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAW/E"}

package/dist/core/events/v3/control-writer.js

@@ -0,0 +1,16 @@
+import { readEventV3ControlState } from "./control.js";
+import { writeEventV3 } from "./writer.js";
+/** Repair only a manifest-first crash by appending the exact pre-minted event. */
+export function repairEventV3ControlPair(coordRoot) {
+    const control = readEventV3ControlState(coordRoot);
+    if (control.state !== "repairable")
+        return control;
+    const event = control.reason === "genesis_event_missing" ? control.genesis.event : control.activation?.event;
+    if (!event)
+        return { state: "invalid", reason: "repair_event_unavailable" };
+    const result = writeEventV3(coordRoot, event);
+    if (result.state !== "committed") {
+        return { state: "invalid", reason: "control_event_repair_not_committed" };
+    }
+    return readEventV3ControlState(coordRoot);
+}

package/dist/core/events/v3/control.d.ts

@@ -101,10 +101,16 @@ export declare function validateActivationManifestV3(value: unknown, candidate:
  * Resolve the session/evidence gate from exact control-file and ledger-event pairs.
  * This function never repairs or creates state. Any ambiguity keeps the gate closed.
  */
+/**
+ * The live epoch's genesis id from the immutable manifest, or undefined when
+ * no valid genesis is published. This is the cheap epoch-identity read the
+ * writer fence uses: one small canonical file, never the event history.
+ */
+export declare function liveGenesisIdV3(coordRoot: string): `gex_${string}` | undefined;
+/** Same read for a caller that already holds the manifest path (the writer's drain). */
+export declare function genesisIdFromManifestV3(genesisPath: string): `gex_${string}` | undefined;
 export declare function readEventV3ControlState(coordRoot: string): EventV3ControlState;
 export declare function eventV3WriteGateOpen(coordRoot: string, mode: EventV3WriteMode): boolean;
-/** Repair only a manifest-first crash by appending the exact pre-minted event. */
-export declare function repairEventV3ControlPair(coordRoot: string): EventV3ControlState;
 export declare function candidateProfileDigestV3(profile: CandidateProfileV3): `sha256:${string}`;
 export declare function candidateManifestDigestV3(manifest: CandidateGenesisManifestV3): `sha256:${string}`;
 export {};