intentdna 1.9.0 → 1.9.3

package/dist/runtime/executable-run-plan.js

@@ -0,0 +1,1485 @@
+import { createHash } from "node:crypto";
+import { isAbsolute, win32 } from "node:path";
+import { canonicalizeJson, } from "./canonical-json.js";
+export const EXECUTABLE_RUN_PLAN_SCHEMA_VERSION = "intentdna.executable_run_plan.v1";
+export const STORED_EXECUTABLE_RUN_PLAN_SCHEMA_VERSION = "intentdna.stored_executable_run_plan.v1";
+export const EXECUTABLE_RETRYABLE_OUTCOME_VALUES = [
+    "non_zero_exit",
+    "malformed_result",
+    "timeout",
+    "cancelled",
+    "signal",
+    "launch_error",
+];
+export const EXECUTABLE_ARTIFACT_KIND_VALUES = [
+    "file",
+    "directory",
+    "test_result",
+    "git_commit",
+    "summary",
+    "state",
+];
+export class ExecutableRunPlanError extends TypeError {
+    path;
+    constructor(path, message) {
+        super(`${path}: ${message}`);
+        this.name = "ExecutableRunPlanError";
+        this.path = path;
+    }
+}
+function record(value, path, fields) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new ExecutableRunPlanError(path, "must be an object");
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new ExecutableRunPlanError(path, "must be a plain object");
+    }
+    const unknown = Object.keys(value).filter((key) => !fields.includes(key));
+    if (unknown.length > 0) {
+        throw new ExecutableRunPlanError(path, `unknown field '${unknown[0]}'`);
+    }
+    return value;
+}
+function required(value, key, path) {
+    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+        throw new ExecutableRunPlanError(path, `missing field '${key}'`);
+    }
+    return value[key];
+}
+function string(value, path) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ExecutableRunPlanError(path, "must be a non-empty string");
+    }
+}
+function boolean(value, path) {
+    if (typeof value !== "boolean")
+        throw new ExecutableRunPlanError(path, "must be boolean");
+}
+function enumeration(value, values, path) {
+    if (typeof value !== "string" || !values.includes(value)) {
+        throw new ExecutableRunPlanError(path, `must be one of ${values.join(", ")}`);
+    }
+}
+function integer(value, path, minimum = 0) {
+    if (!Number.isSafeInteger(value) || value < minimum) {
+        throw new ExecutableRunPlanError(path, `must be a safe integer >= ${minimum}`);
+    }
+}
+function array(value, path) {
+    if (!Array.isArray(value))
+        throw new ExecutableRunPlanError(path, "must be an array");
+}
+function stringArray(value, path) {
+    array(value, path);
+    value.forEach((item, index) => string(item, `${path}[${index}]`));
+}
+function relativePath(value, path) {
+    string(value, path);
+    if (isAbsolute(value) || win32.isAbsolute(value)) {
+        throw new ExecutableRunPlanError(path, "must be relative");
+    }
+    if (value.includes("\0") || value.includes("\\")) {
+        throw new ExecutableRunPlanError(path, "must be a portable relative path");
+    }
+    const components = value.split("/");
+    if (components.includes("..")
+        || (value !== "." && components.some((component) => component === "" || component === "."))) {
+        throw new ExecutableRunPlanError(path, "must not traverse outside the workspace");
+    }
+}
+function digest(value, path) {
+    if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
+        throw new ExecutableRunPlanError(path, "must be a lowercase sha256 digest");
+    }
+}
+function unique(values, path) {
+    if (new Set(values).size !== values.length) {
+        throw new ExecutableRunPlanError(path, "must not contain duplicates");
+    }
+}
+function containsUnescapedArguments(value) {
+    let offset = value.indexOf("$ARGUMENTS");
+    while (offset >= 0) {
+        let slashCount = 0;
+        for (let index = offset - 1; index >= 0 && value[index] === "\\"; index -= 1) {
+            slashCount += 1;
+        }
+        if (slashCount % 2 === 0)
+            return true;
+        offset = value.indexOf("$ARGUMENTS", offset + "$ARGUMENTS".length);
+    }
+    return false;
+}
+function verifierTemplateProjection(verifier) {
+    switch (verifier.kind) {
+        case "artifact_exists":
+        case "artifact_non_empty":
+            return { relative_path_template: verifier.relative_path_template };
+        case "artifact_contains":
+            return { relative_path_template: verifier.relative_path_template };
+        case "evaluator_result":
+            return { relative_path_template: verifier.relative_path_template };
+        case "structured_output":
+            return {};
+        case "command":
+            return {
+                command: verifier.command,
+                relative_working_directory: verifier.relative_working_directory,
+                observation_policy: verifier.observation_policy ?? "historical_execution",
+            };
+        case "checkpoint":
+            return {
+                command: verifier.command,
+                message: verifier.message,
+                observation_policy: verifier.observation_policy ?? "historical_execution",
+            };
+    }
+}
+function rejectRuntimeTemplates(value, path) {
+    const names = new Set();
+    collectRuntimeTemplateInputs(value, path, [], names);
+    if (names.size > 0) {
+        throw new ExecutableRunPlanError(path, `must not contain runtime input templates: ${[...names].sort().join(", ")}`);
+    }
+}
+function collectRuntimeTemplateInputs(value, path, reservedTokens, names) {
+    if (typeof value === "string") {
+        let remaining = value;
+        for (const token of reservedTokens) {
+            remaining = remaining.split(token).join("");
+        }
+        remaining = remaining.replace(/\{\{([A-Za-z_][A-Za-z0-9_]*)\}\}/gu, (_match, name) => {
+            names.add(name);
+            return "";
+        });
+        if (remaining.includes("{{")) {
+            const placeholderStart = remaining.indexOf("{{");
+            const placeholderEnd = remaining.indexOf("}}", placeholderStart) + 2;
+            const placeholder = remaining.slice(Math.max(0, placeholderStart), placeholderEnd > 1 ? placeholderEnd : undefined);
+            throw new ExecutableRunPlanError(path, `contains an unsupported template placeholder '${placeholder}'`);
+        }
+        if (containsUnescapedArguments(remaining))
+            names.add("ARGUMENTS");
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectRuntimeTemplateInputs(item, `${path}[${index}]`, reservedTokens, names));
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const [key, item] of Object.entries(value)) {
+            collectRuntimeTemplateInputs(item, `${path}.${key}`, reservedTokens, names);
+        }
+    }
+}
+export function deriveWorkerRuntimeInputNames(worker, verifiers, handoffs, path = "$.worker") {
+    const reservedTokens = handoffs
+        .filter((handoff) => handoff.to_node_id === worker.node_id)
+        .flatMap((handoff) => {
+        const prefix = `{{handoff.${handoff.handoff_id}.`;
+        if (handoff.mode === "reference") {
+            if (handoff.artifact_kind === "git_commit") {
+                return [`${prefix}commit_oid}}`, `${prefix}artifact_id}}`];
+            }
+            return [`${prefix}materialized_path}}`, `${prefix}artifact_id}}`];
+        }
+        if (handoff.mode === "quote")
+            return [`${prefix}exact_text}}`];
+        return [`${prefix}json}}`];
+    });
+    const projection = {
+        packet_template: {
+            standalone_prompt: worker.packet_template.standalone_prompt,
+            constraints: worker.packet_template.constraints,
+            handoff_input_descriptions: worker.packet_template.handoff_inputs.map((input) => input.description),
+            handoff_input_paths: worker.packet_template.handoff_inputs.map((input) => input.relative_path_template),
+            output_descriptions: worker.packet_template.output_contract.map((output) => output.description),
+            output_paths: worker.packet_template.output_contract.map((output) => output.relative_path_template),
+            response_path: worker.packet_template.response_contract.kind === "document"
+                ? worker.packet_template.response_contract.relative_path_template
+                : null,
+            converter_command: worker.packet_template.response_contract.kind === "document"
+                ? worker.packet_template.response_contract.converter_command
+                : null,
+        },
+        workspace: {
+            relative_working_directory: worker.workspace.relative_working_directory,
+            readable_path_templates: worker.workspace.readable_path_templates,
+            writable_path_templates: worker.workspace.writable_path_templates,
+        },
+        verifiers: verifiers.map(verifierTemplateProjection),
+    };
+    rejectRuntimeTemplates({
+        role: worker.role,
+        handoff_input_identity: worker.packet_template.handoff_inputs.map((input) => ({
+            name: input.name,
+            schema_ref: input.schema_ref,
+        })),
+        output_identity: worker.packet_template.output_contract.map((output) => ({
+            name: output.name,
+            schema_ref: output.schema_ref,
+        })),
+        response_schema_ref: worker.packet_template.response_contract.kind === "named"
+            ? worker.packet_template.response_contract.schema_ref
+            : null,
+        response_required_sections: worker.packet_template.response_contract.kind === "document"
+            ? worker.packet_template.response_contract.required_sections
+            : null,
+        tool_policy: worker.tool_policy,
+    }, `${path}.non_parameterizable_contract`);
+    const names = new Set();
+    collectRuntimeTemplateInputs(projection, path, reservedTokens, names);
+    return [...names].sort();
+}
+function validateInputContract(value, path) {
+    const input = record(value, path, ["inputs", "allow_unknown_inputs"]);
+    if (required(input, "allow_unknown_inputs", path) !== false) {
+        throw new ExecutableRunPlanError(`${path}.allow_unknown_inputs`, "must be false");
+    }
+    const inputs = required(input, "inputs", path);
+    array(inputs, `${path}.inputs`);
+    const names = [];
+    inputs.forEach((item, index) => {
+        const itemPath = `${path}.inputs[${index}]`;
+        const definition = record(item, itemPath, [
+            "name", "type", "required", "sensitive", "description", "default_value",
+        ]);
+        string(required(definition, "name", itemPath), `${itemPath}.name`);
+        names.push(definition.name);
+        const inputType = required(definition, "type", itemPath);
+        enumeration(inputType, [
+            "string", "number", "boolean", "json", "reference", "trusted_verifier_command",
+        ], `${itemPath}.type`);
+        boolean(required(definition, "required", itemPath), `${itemPath}.required`);
+        boolean(required(definition, "sensitive", itemPath), `${itemPath}.sensitive`);
+        string(required(definition, "description", itemPath), `${itemPath}.description`);
+        if (Object.prototype.hasOwnProperty.call(definition, "default_value")) {
+            if (definition.sensitive === true) {
+                throw new ExecutableRunPlanError(itemPath, "sensitive inputs cannot have defaults");
+            }
+            canonicalizeJson(definition.default_value);
+            if (((inputType === "string" || inputType === "reference" || inputType === "trusted_verifier_command") && typeof definition.default_value !== "string")
+                || (inputType === "number" && typeof definition.default_value !== "number")
+                || (inputType === "boolean" && typeof definition.default_value !== "boolean")) {
+                throw new ExecutableRunPlanError(`${itemPath}.default_value`, `must match input type ${inputType}`);
+            }
+        }
+    });
+    unique(names, `${path}.inputs names`);
+}
+function validateNullableRelativePath(value, path) {
+    if (value !== null)
+        relativePath(value, path);
+}
+function validateNullableString(value, path) {
+    if (value !== null)
+        string(value, path);
+}
+function expectedModeForArtifact(artifactKind) {
+    if (artifactKind === "summary")
+        return "quote";
+    if (artifactKind === "state")
+        return "structured";
+    return "reference";
+}
+function expectedOutputKindForArtifact(artifactKind) {
+    if (artifactKind === "summary")
+        return "text";
+    if (artifactKind === "state")
+        return "structured";
+    return "reference";
+}
+function validateWorkerHandoffInput(value, path) {
+    const input = record(value, path, [
+        "name",
+        "source",
+        "mode",
+        "artifact_kind",
+        "required",
+        "description",
+        "relative_path_template",
+        "schema_ref",
+    ]);
+    string(required(input, "name", path), `${path}.name`);
+    enumeration(required(input, "source", path), ["handoff", "external"], `${path}.source`);
+    const mode = required(input, "mode", path);
+    enumeration(mode, ["reference", "quote", "structured"], `${path}.mode`);
+    const artifactKind = required(input, "artifact_kind", path);
+    enumeration(artifactKind, EXECUTABLE_ARTIFACT_KIND_VALUES, `${path}.artifact_kind`);
+    if (mode !== expectedModeForArtifact(artifactKind)) {
+        throw new ExecutableRunPlanError(`${path}.mode`, `must match artifact kind ${artifactKind}`);
+    }
+    boolean(required(input, "required", path), `${path}.required`);
+    string(required(input, "description", path), `${path}.description`);
+    validateNullableRelativePath(required(input, "relative_path_template", path), `${path}.relative_path_template`);
+    validateNullableString(required(input, "schema_ref", path), `${path}.schema_ref`);
+}
+function validateWorkerOutput(value, path) {
+    const output = record(value, path, [
+        "name",
+        "kind",
+        "artifact_kind",
+        "required",
+        "description",
+        "relative_path_template",
+        "schema_ref",
+    ]);
+    string(required(output, "name", path), `${path}.name`);
+    const kind = required(output, "kind", path);
+    enumeration(kind, ["reference", "text", "structured"], `${path}.kind`);
+    const artifactKind = required(output, "artifact_kind", path);
+    enumeration(artifactKind, EXECUTABLE_ARTIFACT_KIND_VALUES, `${path}.artifact_kind`);
+    if (kind !== expectedOutputKindForArtifact(artifactKind)) {
+        throw new ExecutableRunPlanError(`${path}.kind`, `must match artifact kind ${artifactKind}`);
+    }
+    boolean(required(output, "required", path), `${path}.required`);
+    string(required(output, "description", path), `${path}.description`);
+    validateNullableRelativePath(required(output, "relative_path_template", path), `${path}.relative_path_template`);
+    validateNullableString(required(output, "schema_ref", path), `${path}.schema_ref`);
+}
+function validateWorkerResponseContract(value, path) {
+    const base = record(value, path, [
+        "kind",
+        "schema_ref",
+        "relative_path_template",
+        "required_sections",
+        "format",
+        "converter_command",
+    ]);
+    const kind = required(base, "kind", path);
+    enumeration(kind, ["none", "named", "document"], `${path}.kind`);
+    if (kind === "none") {
+        record(value, path, ["kind"]);
+        return;
+    }
+    if (kind === "named") {
+        const named = record(value, path, ["kind", "schema_ref"]);
+        string(required(named, "schema_ref", path), `${path}.schema_ref`);
+        return;
+    }
+    const document = record(value, path, [
+        "kind",
+        "relative_path_template",
+        "required_sections",
+        "format",
+        "converter_command",
+    ]);
+    validateNullableRelativePath(required(document, "relative_path_template", path), `${path}.relative_path_template`);
+    stringArray(required(document, "required_sections", path), `${path}.required_sections`);
+    unique(document.required_sections, `${path}.required_sections`);
+    const format = required(document, "format", path);
+    if (format !== null) {
+        enumeration(format, ["markdown", "pdf", "docx", "xlsx", "json", "csv"], `${path}.format`);
+    }
+    validateNullableString(required(document, "converter_command", path), `${path}.converter_command`);
+}
+function validateNode(value, path) {
+    const base = record(value, path, [
+        "kind", "node_id", "depends_on", "role", "packet_template", "workspace", "tool_policy",
+        "attempt_policy", "input_ports", "operation", "verifier_ids", "pass_route_ids", "fail_route_id",
+        "source", "allowed_values", "interaction_id", "prompt", "response_schema_ref",
+        "requires_attested_human", "terminal_id", "output_contract",
+    ]);
+    string(required(base, "node_id", path), `${path}.node_id`);
+    stringArray(required(base, "depends_on", path), `${path}.depends_on`);
+    unique(base.depends_on, `${path}.depends_on`);
+    const kind = required(base, "kind", path);
+    enumeration(kind, ["worker", "system", "gate", "decision", "interaction", "terminal"], `${path}.kind`);
+    if (kind === "worker") {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "role", "packet_template", "workspace", "tool_policy", "attempt_policy"]);
+        string(required(exact, "role", path), `${path}.role`);
+        const packet = record(required(exact, "packet_template", path), `${path}.packet_template`, [
+            "standalone_prompt",
+            "constraints",
+            "runtime_input_names",
+            "handoff_inputs",
+            "output_contract",
+            "response_contract",
+        ]);
+        string(required(packet, "standalone_prompt", `${path}.packet_template`), `${path}.packet_template.standalone_prompt`);
+        stringArray(required(packet, "constraints", `${path}.packet_template`), `${path}.packet_template.constraints`);
+        stringArray(required(packet, "runtime_input_names", `${path}.packet_template`), `${path}.packet_template.runtime_input_names`);
+        unique(packet.runtime_input_names, `${path}.packet_template.runtime_input_names`);
+        const handoffInputs = required(packet, "handoff_inputs", `${path}.packet_template`);
+        array(handoffInputs, `${path}.packet_template.handoff_inputs`);
+        handoffInputs.forEach((input, index) => validateWorkerHandoffInput(input, `${path}.packet_template.handoff_inputs[${index}]`));
+        unique(handoffInputs.map((input) => input.name), `${path}.packet_template.handoff_inputs names`);
+        const outputContract = required(packet, "output_contract", `${path}.packet_template`);
+        array(outputContract, `${path}.packet_template.output_contract`);
+        outputContract.forEach((output, index) => validateWorkerOutput(output, `${path}.packet_template.output_contract[${index}]`));
+        unique(outputContract.map((output) => output.name), `${path}.packet_template.output_contract names`);
+        validateWorkerResponseContract(required(packet, "response_contract", `${path}.packet_template`), `${path}.packet_template.response_contract`);
+        const workspace = record(required(exact, "workspace", path), `${path}.workspace`, [
+            "isolation",
+            "relative_working_directory",
+            "read_only",
+            "readable_path_templates",
+            "writable_path_templates",
+            "scope_relaxation",
+        ]);
+        enumeration(required(workspace, "isolation", `${path}.workspace`), ["none", "worktree"], `${path}.workspace.isolation`);
+        relativePath(required(workspace, "relative_working_directory", `${path}.workspace`), `${path}.workspace.relative_working_directory`);
+        boolean(required(workspace, "read_only", `${path}.workspace`), `${path}.workspace.read_only`);
+        stringArray(required(workspace, "readable_path_templates", `${path}.workspace`), `${path}.workspace.readable_path_templates`);
+        workspace.readable_path_templates.forEach((item, index) => relativePath(item, `${path}.workspace.readable_path_templates[${index}]`));
+        unique(workspace.readable_path_templates, `${path}.workspace.readable_path_templates`);
+        stringArray(required(workspace, "writable_path_templates", `${path}.workspace`), `${path}.workspace.writable_path_templates`);
+        workspace.writable_path_templates.forEach((item, index) => relativePath(item, `${path}.workspace.writable_path_templates[${index}]`));
+        unique(workspace.writable_path_templates, `${path}.workspace.writable_path_templates`);
+        const scopeRelaxation = required(workspace, "scope_relaxation", `${path}.workspace`);
+        if (scopeRelaxation !== null) {
+            const relaxation = record(scopeRelaxation, `${path}.workspace.scope_relaxation`, ["from_iteration", "effect"]);
+            integer(required(relaxation, "from_iteration", `${path}.workspace.scope_relaxation`), `${path}.workspace.scope_relaxation.from_iteration`, 1);
+            if (required(relaxation, "effect", `${path}.workspace.scope_relaxation`)
+                !== "disable_path_scope") {
+                throw new ExecutableRunPlanError(`${path}.workspace.scope_relaxation.effect`, "must be disable_path_scope");
+            }
+        }
+        if (workspace.read_only === true
+            && workspace.writable_path_templates.length > 0) {
+            throw new ExecutableRunPlanError(`${path}.workspace.writable_path_templates`, "read-only workers cannot declare writable paths");
+        }
+        if (workspace.read_only === true && scopeRelaxation !== null) {
+            throw new ExecutableRunPlanError(`${path}.workspace.scope_relaxation`, "read-only workers cannot relax scope");
+        }
+        const toolPolicy = record(required(exact, "tool_policy", path), `${path}.tool_policy`, ["allow", "deny"]);
+        const allowedTools = required(toolPolicy, "allow", `${path}.tool_policy`);
+        if (allowedTools !== null) {
+            stringArray(allowedTools, `${path}.tool_policy.allow`);
+            unique(allowedTools, `${path}.tool_policy.allow`);
+        }
+        stringArray(required(toolPolicy, "deny", `${path}.tool_policy`), `${path}.tool_policy.deny`);
+        unique(toolPolicy.deny, `${path}.tool_policy.deny`);
+        const deniedTools = new Set(toolPolicy.deny);
+        if (allowedTools !== null
+            && allowedTools.some((tool) => deniedTools.has(tool))) {
+            throw new ExecutableRunPlanError(`${path}.tool_policy`, "tool policy allow and deny lists must not overlap");
+        }
+        const attempt = record(required(exact, "attempt_policy", path), `${path}.attempt_policy`, ["timeout_ms", "cancellation_grace_ms", "max_attempts", "backoff", "initial_delay_ms", "max_delay_ms", "retryable_outcomes", "retry_segment_id"]);
+        if (required(attempt, "timeout_ms", `${path}.attempt_policy`) !== null)
+            integer(attempt.timeout_ms, `${path}.attempt_policy.timeout_ms`);
+        integer(required(attempt, "cancellation_grace_ms", `${path}.attempt_policy`), `${path}.attempt_policy.cancellation_grace_ms`);
+        integer(required(attempt, "max_attempts", `${path}.attempt_policy`), `${path}.attempt_policy.max_attempts`, 1);
+        enumeration(required(attempt, "backoff", `${path}.attempt_policy`), ["none", "linear", "exponential"], `${path}.attempt_policy.backoff`);
+        integer(required(attempt, "initial_delay_ms", `${path}.attempt_policy`), `${path}.attempt_policy.initial_delay_ms`);
+        if (required(attempt, "max_delay_ms", `${path}.attempt_policy`) !== null)
+            integer(attempt.max_delay_ms, `${path}.attempt_policy.max_delay_ms`);
+        stringArray(required(attempt, "retryable_outcomes", `${path}.attempt_policy`), `${path}.attempt_policy.retryable_outcomes`);
+        attempt.retryable_outcomes.forEach((outcome, index) => enumeration(outcome, EXECUTABLE_RETRYABLE_OUTCOME_VALUES, `${path}.attempt_policy.retryable_outcomes[${index}]`));
+        unique(attempt.retryable_outcomes, `${path}.attempt_policy.retryable_outcomes`);
+        if (required(attempt, "retry_segment_id", `${path}.attempt_policy`) !== null)
+            string(attempt.retry_segment_id, `${path}.attempt_policy.retry_segment_id`);
+        rejectRuntimeTemplates({
+            role: exact.role,
+            handoff_input_identity: handoffInputs.map((input) => ({
+                name: input.name,
+                schema_ref: input.schema_ref,
+            })),
+            output_identity: outputContract.map((output) => ({
+                name: output.name,
+                schema_ref: output.schema_ref,
+            })),
+            response_schema_ref: packet.response_contract.kind === "named"
+                ? packet.response_contract.schema_ref
+                : null,
+            response_required_sections: packet.response_contract.kind === "document"
+                ? packet.response_contract.required_sections
+                : null,
+            tool_policy: toolPolicy,
+        }, `${path}.non_parameterizable_contract`);
+    }
+    else if (kind === "system") {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "input_ports", "output_contract", "operation"]);
+        const inputPorts = required(exact, "input_ports", path);
+        array(inputPorts, `${path}.input_ports`);
+        inputPorts.forEach((item, index) => {
+            const portPath = `${path}.input_ports[${index}]`;
+            const port = record(item, portPath, ["name", "source"]);
+            string(required(port, "name", portPath), `${portPath}.name`);
+            enumeration(required(port, "source", portPath), ["run_input", "handoff"], `${portPath}.source`);
+        });
+        unique(inputPorts.map((port) => port.name), `${path}.input_ports`);
+        const outputContract = exact.output_contract ?? [];
+        array(outputContract, `${path}.output_contract`);
+        outputContract.forEach((item, index) => validateWorkerOutput(item, `${path}.output_contract[${index}]`));
+        unique(outputContract.map((output) => output.name), `${path}.output_contract names`);
+        const operation = record(required(exact, "operation", path), `${path}.operation`, [
+            "kind",
+            "source_plan_input",
+            "source_result_input",
+            "source_reference_input",
+            "expected_digest_input",
+            "output_name",
+            "mode_input",
+            "artifacts",
+            "required_outputs",
+            "source_diagnosis_result_input",
+            "source_review_result_input",
+            "policy_id",
+            "candidates",
+            "origin_output_name",
+            "handoff_id",
+        ]);
+        const operationKind = required(operation, "kind", `${path}.operation`);
+        enumeration(operationKind, [
+            "import_result",
+            "adopt_artifact",
+            "resolve_diagnosis_source",
+            "adopt_artifact_bundle",
+            "import_result_bundle",
+            "import_review",
+            "seal_result_bundle",
+            "materialize_handoff",
+        ], `${path}.operation.kind`);
+        const validateOutputMappings = (value, mappingPath) => {
+            array(value, mappingPath);
+            value.forEach((item, index) => {
+                const itemPath = `${mappingPath}[${index}]`;
+                const mapping = record(item, itemPath, ["source_output_name", "output_name", "source_node_id"]);
+                if (mapping.source_node_id !== undefined)
+                    string(mapping.source_node_id, `${itemPath}.source_node_id`);
+                string(required(mapping, "source_output_name", itemPath), `${itemPath}.source_output_name`);
+                string(required(mapping, "output_name", itemPath), `${itemPath}.output_name`);
+            });
+        };
+        if (operationKind === "import_result" || operationKind === "adopt_artifact") {
+            const operationFields = operationKind === "import_result"
+                ? ["kind", "source_plan_input", "source_result_input", "output_name"]
+                : ["kind", "source_reference_input", "expected_digest_input", "output_name"];
+            const strictOperation = record(operation, `${path}.operation`, operationFields);
+            operationFields.filter((field) => field !== "kind").forEach((field) => string(required(strictOperation, field, `${path}.operation`), `${path}.operation.${field}`));
+        }
+        else if (operationKind === "resolve_diagnosis_source") {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "mode_input", "output_name"]);
+            string(required(strictOperation, "mode_input", `${path}.operation`), `${path}.operation.mode_input`);
+            string(required(strictOperation, "output_name", `${path}.operation`), `${path}.operation.output_name`);
+        }
+        else if (operationKind === "adopt_artifact_bundle") {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "artifacts"]);
+            const artifacts = required(strictOperation, "artifacts", `${path}.operation`);
+            array(artifacts, `${path}.operation.artifacts`);
+            artifacts.forEach((item, index) => {
+                const itemPath = `${path}.operation.artifacts[${index}]`;
+                const artifact = record(item, itemPath, ["source_reference_input", "expected_digest_input", "output_name", "artifact_kind"]);
+                ["source_reference_input", "expected_digest_input", "output_name"].forEach((field) => string(required(artifact, field, itemPath), `${itemPath}.${field}`));
+                enumeration(required(artifact, "artifact_kind", itemPath), ["file", "directory"], `${itemPath}.artifact_kind`);
+            });
+        }
+        else if (operationKind === "import_result_bundle") {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "source_plan_input", "source_result_input", "required_outputs"]);
+            string(required(strictOperation, "source_plan_input", `${path}.operation`), `${path}.operation.source_plan_input`);
+            string(required(strictOperation, "source_result_input", `${path}.operation`), `${path}.operation.source_result_input`);
+            validateOutputMappings(required(strictOperation, "required_outputs", `${path}.operation`), `${path}.operation.required_outputs`);
+        }
+        else if (operationKind === "import_review") {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "source_plan_input", "source_diagnosis_result_input", "source_review_result_input", "policy_id", "required_outputs"]);
+            for (const field of ["source_plan_input", "source_diagnosis_result_input", "source_review_result_input", "policy_id"]) {
+                string(required(strictOperation, field, `${path}.operation`), `${path}.operation.${field}`);
+            }
+            validateOutputMappings(required(strictOperation, "required_outputs", `${path}.operation`), `${path}.operation.required_outputs`);
+        }
+        else if (operationKind === "seal_result_bundle") {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "candidates", "origin_output_name"]);
+            if (strictOperation.origin_output_name !== undefined) {
+                string(strictOperation.origin_output_name, `${path}.operation.origin_output_name`);
+            }
+            const candidates = required(strictOperation, "candidates", `${path}.operation`);
+            array(candidates, `${path}.operation.candidates`);
+            candidates.forEach((item, index) => {
+                const itemPath = `${path}.operation.candidates[${index}]`;
+                const candidate = record(item, itemPath, ["required_node_ids", "outputs"]);
+                stringArray(required(candidate, "required_node_ids", itemPath), `${itemPath}.required_node_ids`);
+                validateOutputMappings(required(candidate, "outputs", itemPath), `${itemPath}.outputs`);
+            });
+        }
+        else {
+            const strictOperation = record(operation, `${path}.operation`, ["kind", "handoff_id"]);
+            string(required(strictOperation, "handoff_id", `${path}.operation`), `${path}.operation.handoff_id`);
+        }
+    }
+    else if (kind === "gate") {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "verifier_ids", "pass_route_ids", "fail_route_id"]);
+        stringArray(required(exact, "verifier_ids", path), `${path}.verifier_ids`);
+        unique(exact.verifier_ids, `${path}.verifier_ids`);
+        if (exact.verifier_ids.length === 0) {
+            throw new ExecutableRunPlanError(`${path}.verifier_ids`, "must not be empty");
+        }
+        stringArray(required(exact, "pass_route_ids", path), `${path}.pass_route_ids`);
+        unique(exact.pass_route_ids, `${path}.pass_route_ids`);
+        if (exact.pass_route_ids.length === 0) {
+            throw new ExecutableRunPlanError(`${path}.pass_route_ids`, "must not be empty");
+        }
+        string(required(exact, "fail_route_id", path), `${path}.fail_route_id`);
+    }
+    else if (kind === "decision") {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "source", "allowed_values"]);
+        const source = record(required(exact, "source", path), `${path}.source`, ["node_id", "output_name", "json_pointer"]);
+        ["node_id", "output_name", "json_pointer"].forEach((field) => string(required(source, field, `${path}.source`), `${path}.source.${field}`));
+        stringArray(required(exact, "allowed_values", path), `${path}.allowed_values`);
+        unique(exact.allowed_values, `${path}.allowed_values`);
+    }
+    else if (kind === "interaction") {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "interaction_id", "prompt", "response_schema_ref", "requires_attested_human"]);
+        ["interaction_id", "prompt", "response_schema_ref"].forEach((field) => string(required(exact, field, path), `${path}.${field}`));
+        rejectRuntimeTemplates({
+            interaction_id: exact.interaction_id,
+            prompt: exact.prompt,
+            response_schema_ref: exact.response_schema_ref,
+        }, `${path}.non_parameterizable_contract`);
+        if (required(exact, "requires_attested_human", path) !== true)
+            throw new ExecutableRunPlanError(`${path}.requires_attested_human`, "must be true");
+    }
+    else {
+        const exact = record(value, path, ["kind", "node_id", "depends_on", "terminal_id"]);
+        string(required(exact, "terminal_id", path), `${path}.terminal_id`);
+    }
+}
+function validateRoute(value, path) {
+    const route = record(value, path, ["route_id", "from_node_id", "to_node_id", "condition"]);
+    ["route_id", "from_node_id", "to_node_id"].forEach((field) => string(required(route, field, path), `${path}.${field}`));
+    const condition = record(required(route, "condition", path), `${path}.condition`, ["kind", "gate_node_id", "outcome", "decision_node_id", "value", "interaction_node_id"]);
+    const kind = required(condition, "kind", `${path}.condition`);
+    enumeration(kind, ["always", "gate", "decision", "interaction"], `${path}.condition.kind`);
+    if (kind === "always") {
+        record(condition, `${path}.condition`, ["kind"]);
+    }
+    else if (kind === "gate") {
+        const exact = record(condition, `${path}.condition`, ["kind", "gate_node_id", "outcome"]);
+        string(required(exact, "gate_node_id", `${path}.condition`), `${path}.condition.gate_node_id`);
+        enumeration(required(exact, "outcome", `${path}.condition`), ["pass", "fail"], `${path}.condition.outcome`);
+    }
+    else if (kind === "decision") {
+        const exact = record(condition, `${path}.condition`, ["kind", "decision_node_id", "value"]);
+        string(required(exact, "decision_node_id", `${path}.condition`), `${path}.condition.decision_node_id`);
+        string(required(exact, "value", `${path}.condition`), `${path}.condition.value`);
+    }
+    else {
+        const exact = record(condition, `${path}.condition`, ["kind", "interaction_node_id", "outcome"]);
+        string(required(exact, "interaction_node_id", `${path}.condition`), `${path}.condition.interaction_node_id`);
+        enumeration(required(exact, "outcome", `${path}.condition`), ["submitted", "cancelled"], `${path}.condition.outcome`);
+    }
+}
+function validateRetry(value, path) {
+    const retry = record(value, path, ["retry_segment_id", "node_ids", "retry_from_node_id", "max_rounds", "backoff", "initial_delay_ms", "max_delay_ms", "retryable_outcomes", "continue_route_id"]);
+    string(required(retry, "retry_segment_id", path), `${path}.retry_segment_id`);
+    stringArray(required(retry, "node_ids", path), `${path}.node_ids`);
+    unique(retry.node_ids, `${path}.node_ids`);
+    string(required(retry, "retry_from_node_id", path), `${path}.retry_from_node_id`);
+    integer(required(retry, "max_rounds", path), `${path}.max_rounds`, 1);
+    enumeration(required(retry, "backoff", path), ["none", "linear", "exponential"], `${path}.backoff`);
+    integer(required(retry, "initial_delay_ms", path), `${path}.initial_delay_ms`);
+    if (required(retry, "max_delay_ms", path) !== null)
+        integer(retry.max_delay_ms, `${path}.max_delay_ms`);
+    stringArray(required(retry, "retryable_outcomes", path), `${path}.retryable_outcomes`);
+    retry.retryable_outcomes.forEach((outcome, index) => enumeration(outcome, EXECUTABLE_RETRYABLE_OUTCOME_VALUES, `${path}.retryable_outcomes[${index}]`));
+    unique(retry.retryable_outcomes, `${path}.retryable_outcomes`);
+    if (Object.prototype.hasOwnProperty.call(retry, "continue_route_id")) {
+        string(retry.continue_route_id, `${path}.continue_route_id`);
+    }
+}
+function validateVerifier(value, path) {
+    const verifier = record(value, path, ["verifier_id", "subject_node_id", "kind", "relative_path_template", "pattern", "require_score", "node_id", "output_name", "schema_ref", "command", "relative_working_directory", "assertion", "message", "action", "observation_policy"]);
+    string(required(verifier, "verifier_id", path), `${path}.verifier_id`);
+    string(required(verifier, "subject_node_id", path), `${path}.subject_node_id`);
+    const kind = required(verifier, "kind", path);
+    enumeration(kind, ["artifact_exists", "artifact_non_empty", "artifact_contains", "evaluator_result", "structured_output", "command", "checkpoint"], `${path}.kind`);
+    if (kind === "artifact_exists" || kind === "artifact_non_empty") {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "relative_path_template"]);
+        relativePath(required(exact, "relative_path_template", path), `${path}.relative_path_template`);
+    }
+    else if (kind === "artifact_contains") {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "relative_path_template", "pattern"]);
+        relativePath(required(exact, "relative_path_template", path), `${path}.relative_path_template`);
+        string(required(exact, "pattern", path), `${path}.pattern`);
+    }
+    else if (kind === "evaluator_result") {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "relative_path_template", "require_score"]);
+        relativePath(required(exact, "relative_path_template", path), `${path}.relative_path_template`);
+        boolean(required(exact, "require_score", path), `${path}.require_score`);
+    }
+    else if (kind === "structured_output") {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "node_id", "output_name", "schema_ref"]);
+        ["node_id", "output_name", "schema_ref"].forEach((field) => string(required(exact, field, path), `${path}.${field}`));
+    }
+    else if (kind === "command") {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "command", "relative_working_directory", "observation_policy"]);
+        string(required(exact, "command", path), `${path}.command`);
+        relativePath(required(exact, "relative_working_directory", path), `${path}.relative_working_directory`);
+        if (Object.prototype.hasOwnProperty.call(exact, "observation_policy")) {
+            enumeration(exact.observation_policy, ["historical_execution", "current_provenance"], `${path}.observation_policy`);
+        }
+    }
+    else {
+        const exact = record(value, path, ["verifier_id", "subject_node_id", "kind", "assertion", "command", "message", "action", "observation_policy"]);
+        string(required(exact, "assertion", path), `${path}.assertion`);
+        const command = required(exact, "command", path);
+        if (command !== null)
+            string(command, `${path}.command`);
+        string(required(exact, "message", path), `${path}.message`);
+        enumeration(required(exact, "action", path), ["block", "warn"], `${path}.action`);
+        if (Object.prototype.hasOwnProperty.call(exact, "observation_policy")) {
+            enumeration(exact.observation_policy, ["historical_execution", "current_provenance"], `${path}.observation_policy`);
+        }
+    }
+}
+export function assertExecutableRunPlanPayload(value) {
+    canonicalizeJson(value);
+    const plan = record(value, "$", ["schema_version", "target", "input_contract", "nodes", "routes", "retry_segments", "terminals", "verifier_plan", "handoff_plan", "workspace_policy", "required_capabilities", "source_provenance"]);
+    if (required(plan, "schema_version", "$") !== EXECUTABLE_RUN_PLAN_SCHEMA_VERSION)
+        throw new ExecutableRunPlanError("$.schema_version", "unsupported schema version");
+    const target = record(required(plan, "target", "$"), "$.target", ["kind", "key"]);
+    enumeration(required(target, "kind", "$.target"), ["workflow", "controller"], "$.target.kind");
+    string(required(target, "key", "$.target"), "$.target.key");
+    validateInputContract(required(plan, "input_contract", "$"), "$.input_contract");
+    const nodes = required(plan, "nodes", "$.");
+    array(nodes, "$.nodes");
+    nodes.forEach((node, index) => validateNode(node, `$.nodes[${index}]`));
+    const nodeIds = nodes.map((node) => node.node_id);
+    unique(nodeIds, "$.nodes node_id");
+    const routes = required(plan, "routes", "$.");
+    array(routes, "$.routes");
+    routes.forEach((route, index) => validateRoute(route, `$.routes[${index}]`));
+    unique(routes.map((route) => route.route_id), "$.routes route_id");
+    const retries = required(plan, "retry_segments", "$.");
+    array(retries, "$.retry_segments");
+    retries.forEach((retry, index) => validateRetry(retry, `$.retry_segments[${index}]`));
+    unique(retries.map((retry) => retry.retry_segment_id), "$.retry_segments retry_segment_id");
+    const terminals = required(plan, "terminals", "$.");
+    array(terminals, "$.terminals");
+    terminals.forEach((item, index) => {
+        const path = `$.terminals[${index}]`;
+        const terminal = record(item, path, ["terminal_id", "status", "reason_code"]);
+        string(required(terminal, "terminal_id", path), `${path}.terminal_id`);
+        enumeration(required(terminal, "status", path), ["succeeded", "failed", "cancelled", "unsupported"], `${path}.status`);
+        string(required(terminal, "reason_code", path), `${path}.reason_code`);
+    });
+    unique(terminals.map((terminal) => terminal.terminal_id), "$.terminals terminal_id");
+    const verifiers = required(plan, "verifier_plan", "$.");
+    array(verifiers, "$.verifier_plan");
+    verifiers.forEach((verifier, index) => validateVerifier(verifier, `$.verifier_plan[${index}]`));
+    unique(verifiers.map((verifier) => verifier.verifier_id), "$.verifier_plan verifier_id");
+    const handoffs = required(plan, "handoff_plan", "$.");
+    array(handoffs, "$.handoff_plan");
+    handoffs.forEach((item, index) => {
+        const path = `$.handoff_plan[${index}]`;
+        const handoff = record(item, path, [
+            "handoff_id",
+            "from_node_id",
+            "output_name",
+            "to_node_id",
+            "input_name",
+            "mode",
+            "artifact_kind",
+            "required",
+            "schema_ref",
+        ]);
+        rejectRuntimeTemplates(handoff, `${path}.identity`);
+        ["handoff_id", "from_node_id", "output_name", "to_node_id", "input_name"].forEach((field) => string(required(handoff, field, path), `${path}.${field}`));
+        const mode = required(handoff, "mode", path);
+        enumeration(mode, ["reference", "quote", "structured"], `${path}.mode`);
+        const artifactKind = required(handoff, "artifact_kind", path);
+        enumeration(artifactKind, EXECUTABLE_ARTIFACT_KIND_VALUES, `${path}.artifact_kind`);
+        if (mode !== expectedModeForArtifact(artifactKind)) {
+            throw new ExecutableRunPlanError(`${path}.mode`, `must match artifact kind ${artifactKind}`);
+        }
+        boolean(required(handoff, "required", path), `${path}.required`);
+        if (required(handoff, "schema_ref", path) !== null)
+            string(handoff.schema_ref, `${path}.schema_ref`);
+    });
+    unique(handoffs.map((handoff) => handoff.handoff_id), "$.handoff_plan handoff_id");
+    const workspace = record(required(plan, "workspace_policy", "$"), "$.workspace_policy", [
+        "default_isolation",
+        "relative_workspace_root",
+        "allow_network",
+        "readable_path_templates",
+        "writable_path_templates",
+    ]);
+    enumeration(required(workspace, "default_isolation", "$.workspace_policy"), ["none", "worktree"], "$.workspace_policy.default_isolation");
+    relativePath(required(workspace, "relative_workspace_root", "$.workspace_policy"), "$.workspace_policy.relative_workspace_root");
+    boolean(required(workspace, "allow_network", "$.workspace_policy"), "$.workspace_policy.allow_network");
+    stringArray(required(workspace, "readable_path_templates", "$.workspace_policy"), "$.workspace_policy.readable_path_templates");
+    workspace.readable_path_templates.forEach((item, index) => relativePath(item, `$.workspace_policy.readable_path_templates[${index}]`));
+    unique(workspace.readable_path_templates, "$.workspace_policy.readable_path_templates");
+    stringArray(required(workspace, "writable_path_templates", "$.workspace_policy"), "$.workspace_policy.writable_path_templates");
+    workspace.writable_path_templates.forEach((item, index) => relativePath(item, `$.workspace_policy.writable_path_templates[${index}]`));
+    unique(workspace.writable_path_templates, "$.workspace_policy.writable_path_templates");
+    const capabilities = record(required(plan, "required_capabilities", "$"), "$.required_capabilities", ["worktree_isolation", "parallelism", "cancellation", "hook_identity", "caller_attestation", "human_interaction", "direct_structured_submission", "network_policy_enforcement"]);
+    Object.keys(capabilities).forEach((key) => boolean(required(capabilities, key, "$.required_capabilities"), `$.required_capabilities.${key}`));
+    if (Object.keys(capabilities).length !== 8)
+        throw new ExecutableRunPlanError("$.required_capabilities", "all capabilities are required");
+    if (workspace.allow_network === false && capabilities.network_policy_enforcement !== true) {
+        throw new ExecutableRunPlanError("$.required_capabilities.network_policy_enforcement", "must be true when workspace network access is denied");
+    }
+    const provenance = record(required(plan, "source_provenance", "$"), "$.source_provenance", ["compiler", "sources"]);
+    const compiler = record(required(provenance, "compiler", "$.source_provenance"), "$.source_provenance.compiler", ["name", "version"]);
+    string(required(compiler, "name", "$.source_provenance.compiler"), "$.source_provenance.compiler.name");
+    string(required(compiler, "version", "$.source_provenance.compiler"), "$.source_provenance.compiler.version");
+    const sources = required(provenance, "sources", "$.source_provenance");
+    array(sources, "$.source_provenance.sources");
+    if (sources.length === 0) {
+        throw new ExecutableRunPlanError("$.source_provenance.sources", "must contain at least one source");
+    }
+    sources.forEach((item, index) => {
+        const path = `$.source_provenance.sources[${index}]`;
+        const source = record(item, path, ["source_id", "relative_ref", "content_digest"]);
+        string(required(source, "source_id", path), `${path}.source_id`);
+        relativePath(required(source, "relative_ref", path), `${path}.relative_ref`);
+        digest(required(source, "content_digest", path), `${path}.content_digest`);
+    });
+    unique(sources.map((source) => source.source_id), "$.source_provenance.sources source_id");
+    const nodeById = new Map(nodes.map((node) => {
+        const item = node;
+        return [item.node_id, item];
+    }));
+    const workerNodesForPolicy = nodes.filter((node) => node.kind === "worker");
+    if (workerNodesForPolicy.length > 0) {
+        const union = (field) => {
+            const values = workerNodesForPolicy.flatMap((node) => node.workspace[field]);
+            return [...new Set(values)];
+        };
+        const expectedReadablePaths = union("readable_path_templates");
+        const expectedWritablePaths = union("writable_path_templates");
+        const expectedIsolation = workerNodesForPolicy.some((node) => node.workspace.isolation === "worktree") ? "worktree" : "none";
+        const requireExactPolicyProjection = (actual, expected, path) => {
+            if (actual.length !== expected.length
+                || actual.some((item, index) => item !== expected[index])) {
+                throw new ExecutableRunPlanError(path, "must exactly equal the ordered union of worker policies");
+            }
+        };
+        if (workspace.default_isolation !== expectedIsolation) {
+            throw new ExecutableRunPlanError("$.workspace_policy.default_isolation", "must equal the strongest worker isolation policy");
+        }
+        requireExactPolicyProjection(workspace.readable_path_templates, expectedReadablePaths, "$.workspace_policy.readable_path_templates");
+        requireExactPolicyProjection(workspace.writable_path_templates, expectedWritablePaths, "$.workspace_policy.writable_path_templates");
+    }
+    const routeById = new Map(routes.map((route) => {
+        const item = route;
+        return [item.route_id, item];
+    }));
+    const routeIds = new Set(routeById.keys());
+    const retryById = new Map(retries.map((retry) => {
+        const item = retry;
+        return [item.retry_segment_id, item];
+    }));
+    const retryIds = new Set(retryById.keys());
+    const terminalIds = new Set(terminals.map((terminal) => terminal.terminal_id));
+    const verifierById = new Map(verifiers.map((verifier) => {
+        const item = verifier;
+        return [item.verifier_id, item];
+    }));
+    const verifierIds = new Set(verifiers.map((verifier) => verifier.verifier_id));
+    const handoffIds = new Set(handoffs.map((handoff) => handoff.handoff_id));
+    const handoffsByTargetInput = new Map();
+    for (const handoff of handoffs) {
+        const key = `${handoff.to_node_id}\0${handoff.input_name}`;
+        const matches = handoffsByTargetInput.get(key) ?? [];
+        matches.push(handoff);
+        handoffsByTargetInput.set(key, matches);
+    }
+    const runInputDefinitions = new Map(plan.input_contract.inputs.map((input) => [input.name, input]));
+    const runInputNames = new Set(runInputDefinitions.keys());
+    const requireReference = (reference, available, path) => {
+        if (typeof reference !== "string" || !available.has(reference)) {
+            throw new ExecutableRunPlanError(path, `references unknown id '${String(reference)}'`);
+        }
+    };
+    const requireNodeKind = (reference, kind, path) => {
+        requireReference(reference, nodeById, path);
+        if (nodeById.get(reference)?.kind !== kind) {
+            throw new ExecutableRunPlanError(path, `must reference a ${kind} node`);
+        }
+    };
+    const verifierOwnerGateIds = new Map();
+    const producedOutputs = (node) => {
+        if (node.kind === "worker") {
+            return new Map(node.packet_template.output_contract
+                .map((output) => [output.name, output]));
+        }
+        if (node.kind === "system") {
+            const outputContract = node.output_contract;
+            if (outputContract !== undefined) {
+                return new Map(outputContract.map((output) => [output.name, output]));
+            }
+            const outputName = node.operation.output_name;
+            return typeof outputName === "string"
+                ? new Map([[outputName, { name: outputName }]])
+                : new Map();
+        }
+        return null;
+    };
+    const consumedInputs = (node) => {
+        if (node.kind === "worker") {
+            return new Map(node.packet_template.handoff_inputs
+                .map((input) => [input.name, input]));
+        }
+        if (node.kind !== "system")
+            return null;
+        return new Map(node.input_ports.map((port) => [port.name, port]));
+    };
+    const requireProducedOutput = (nodeReference, outputReference, path) => {
+        requireReference(nodeReference, nodeById, path);
+        const outputs = producedOutputs(nodeById.get(nodeReference));
+        if (typeof outputReference !== "string" || outputs === null || !outputs.has(outputReference)) {
+            throw new ExecutableRunPlanError(path, `references undeclared output '${String(outputReference)}'`);
+        }
+    };
+    nodes.forEach((node, index) => {
+        const item = node;
+        item.depends_on.forEach((dependency, dependencyIndex) => {
+            requireReference(dependency, nodeById, `$.nodes[${index}].depends_on[${dependencyIndex}]`);
+            if (dependency === item.node_id)
+                throw new ExecutableRunPlanError(`$.nodes[${index}].depends_on`, "cannot reference itself");
+        });
+        if (item.kind === "worker") {
+            const retryId = item.attempt_policy.retry_segment_id;
+            if (retryId !== null) {
+                requireReference(retryId, retryIds, `$.nodes[${index}].attempt_policy.retry_segment_id`);
+                if (!retryById.get(retryId).node_ids.includes(item.node_id)) {
+                    throw new ExecutableRunPlanError(`$.nodes[${index}].attempt_policy.retry_segment_id`, "must reference a retry segment containing this worker");
+                }
+            }
+            const packet = item.packet_template;
+            (packet.handoff_inputs ?? []).forEach((input, inputIndex) => {
+                const matches = handoffsByTargetInput.get(`${item.node_id}\0${input.name}`) ?? [];
+                if (input.source === "handoff" && matches.length !== 1) {
+                    throw new ExecutableRunPlanError(`$.nodes[${index}].packet_template.handoff_inputs[${inputIndex}].name`, `must have exactly one handoff definition (found ${matches.length})`);
+                }
+                if (input.source === "external" && matches.length !== 0) {
+                    throw new ExecutableRunPlanError(`$.nodes[${index}].packet_template.handoff_inputs[${inputIndex}].source`, "external inputs must not be targeted by a committed handoff");
+                }
+            });
+        }
+        else if (item.kind === "system") {
+            const operation = item.operation;
+            rejectRuntimeTemplates({
+                input_ports: item.input_ports,
+                output_identity: item.output_contract?.map((output) => ({
+                    name: output.name,
+                    schema_ref: output.schema_ref,
+                })) ?? [],
+                output_name: operation.output_name,
+                handoff_id: operation.handoff_id,
+            }, `$.nodes[${index}].system_identity`);
+            if (operation.kind === "materialize_handoff") {
+                requireReference(operation.handoff_id, handoffIds, `$.nodes[${index}].operation.handoff_id`);
+            }
+            const operationInputNames = operation.kind === "import_result"
+                ? [operation.source_plan_input, operation.source_result_input]
+                : operation.kind === "adopt_artifact"
+                    ? [operation.source_reference_input, operation.expected_digest_input]
+                    : operation.kind === "resolve_diagnosis_source"
+                        ? [operation.mode_input]
+                        : operation.kind === "adopt_artifact_bundle"
+                            ? operation.artifacts.flatMap((artifact) => [
+                                artifact.source_reference_input,
+                                artifact.expected_digest_input,
+                            ])
+                            : operation.kind === "import_result_bundle"
+                                ? [operation.source_plan_input, operation.source_result_input]
+                                : operation.kind === "import_review"
+                                    ? [
+                                        operation.source_plan_input,
+                                        operation.source_diagnosis_result_input,
+                                        operation.source_review_result_input,
+                                    ]
+                                    : [];
+            const ports = item.input_ports;
+            const portNames = ports.map((port) => port.name);
+            if (operationInputNames.length !== portNames.length
+                || operationInputNames.some((name) => !portNames.includes(name))) {
+                throw new ExecutableRunPlanError(`$.nodes[${index}].input_ports`, "must exactly declare the operation input names");
+            }
+            ports.forEach((port, portIndex) => {
+                const portPath = `$.nodes[${index}].input_ports[${portIndex}]`;
+                const name = port.name;
+                if (port.source === "run_input") {
+                    requireReference(name, runInputNames, `${portPath}.name`);
+                    const handoffMatches = handoffsByTargetInput.get(`${item.node_id}\0${name}`) ?? [];
+                    if (handoffMatches.length !== 0) {
+                        throw new ExecutableRunPlanError(`${portPath}.name`, "run_input ports must not also be targeted by a handoff");
+                    }
+                    if (runInputDefinitions.get(name)?.sensitive === true) {
+                        throw new ExecutableRunPlanError(`${portPath}.name`, "sensitive inputs require a typed secret delivery mode and cannot enter system templates");
+                    }
+                    return;
+                }
+                const matches = handoffsByTargetInput.get(`${item.node_id}\0${name}`) ?? [];
+                if (matches.length !== 1) {
+                    throw new ExecutableRunPlanError(`${portPath}.name`, `must reference exactly one handoff targeting this system input (found ${matches.length})`);
+                }
+            });
+            const outputContract = item.output_contract ?? [];
+            const contractOutputNames = outputContract.map((output) => output.name);
+            const mappedOutputNames = (mappings) => (mappings.map((mapping) => mapping.output_name));
+            let operationOutputNames;
+            if (operation.kind === "import_result"
+                || operation.kind === "adopt_artifact"
+                || operation.kind === "resolve_diagnosis_source") {
+                operationOutputNames = [operation.output_name];
+            }
+            else if (operation.kind === "adopt_artifact_bundle") {
+                operationOutputNames = operation.artifacts.map((artifact) => artifact.output_name);
+            }
+            else if (operation.kind === "import_result_bundle" || operation.kind === "import_review") {
+                operationOutputNames = mappedOutputNames(operation.required_outputs);
+            }
+            else if (operation.kind === "seal_result_bundle") {
+                const candidates = operation.candidates;
+                if (candidates.length === 0) {
+                    throw new ExecutableRunPlanError(`$.nodes[${index}].operation.candidates`, "must not be empty");
+                }
+                let expectedCandidateOutputs = null;
+                candidates.forEach((candidate, candidateIndex) => {
+                    const candidatePath = `$.nodes[${index}].operation.candidates[${candidateIndex}]`;
+                    const requiredNodeIds = candidate.required_node_ids;
+                    if (requiredNodeIds.length === 0) {
+                        throw new ExecutableRunPlanError(`${candidatePath}.required_node_ids`, "must not be empty");
+                    }
+                    requiredNodeIds.forEach((nodeId, requiredIndex) => requireReference(nodeId, nodeById, `${candidatePath}.required_node_ids[${requiredIndex}]`));
+                    const outputs = candidate.outputs;
+                    if (outputs.length === 0) {
+                        throw new ExecutableRunPlanError(`${candidatePath}.outputs`, "must not be empty");
+                    }
+                    outputs.forEach((mapping, mappingIndex) => {
+                        const mappingPath = `${candidatePath}.outputs[${mappingIndex}]`;
+                        requireReference(mapping.source_node_id, nodeById, `${mappingPath}.source_node_id`);
+                        if (!requiredNodeIds.includes(mapping.source_node_id)) {
+                            throw new ExecutableRunPlanError(`${mappingPath}.source_node_id`, "must also appear in required_node_ids");
+                        }
+                        requireProducedOutput(mapping.source_node_id, mapping.source_output_name, mappingPath);
+                    });
+                    const candidateOutputs = mappedOutputNames(outputs).sort();
+                    if (new Set(candidateOutputs).size !== candidateOutputs.length) {
+                        throw new ExecutableRunPlanError(`${candidatePath}.outputs`, "output_name values must be unique");
+                    }
+                    if (expectedCandidateOutputs !== null
+                        && canonicalizeJson(candidateOutputs) !== canonicalizeJson(expectedCandidateOutputs)) {
+                        throw new ExecutableRunPlanError(`${candidatePath}.outputs`, "all seal candidates must produce the same output names");
+                    }
+                    expectedCandidateOutputs = candidateOutputs;
+                });
+                operationOutputNames = [
+                    ...(expectedCandidateOutputs ?? []),
+                    ...(typeof operation.origin_output_name === "string"
+                        ? [operation.origin_output_name]
+                        : []),
+                ];
+            }
+            else {
+                operationOutputNames = [];
+            }
+            const sortedContractOutputs = [...contractOutputNames].sort();
+            const sortedOperationOutputs = [...operationOutputNames].sort();
+            const legacyImplicitOutputContract = item.output_contract === undefined
+                && new Set(["import_result", "adopt_artifact"]).has(operation.kind);
+            if (!legacyImplicitOutputContract
+                && (new Set(sortedOperationOutputs).size !== sortedOperationOutputs.length
+                    || canonicalizeJson(sortedContractOutputs) !== canonicalizeJson(sortedOperationOutputs))) {
+                throw new ExecutableRunPlanError(`$.nodes[${index}].output_contract`, "must exactly match the outputs produced by the system operation");
+            }
+        }
+        else if (item.kind === "gate") {
+            item.verifier_ids.forEach((verifierId, verifierIndex) => {
+                requireReference(verifierId, verifierIds, `$.nodes[${index}].verifier_ids[${verifierIndex}]`);
+                const owners = verifierOwnerGateIds.get(verifierId) ?? [];
+                owners.push(item.node_id);
+                verifierOwnerGateIds.set(verifierId, owners);
+            });
+            item.pass_route_ids.forEach((routeId, routeIndex) => {
+                requireReference(routeId, routeIds, `$.nodes[${index}].pass_route_ids[${routeIndex}]`);
+                const route = routeById.get(routeId);
+                const condition = route.condition;
+                if (route.from_node_id !== item.node_id
+                    || condition.kind !== "gate"
+                    || condition.gate_node_id !== item.node_id
+                    || condition.outcome !== "pass") {
+                    throw new ExecutableRunPlanError(`$.nodes[${index}].pass_route_ids[${routeIndex}]`, "must reference this gate's pass route");
+                }
+            });
+            requireReference(item.fail_route_id, routeIds, `$.nodes[${index}].fail_route_id`);
+            const failRoute = routeById.get(item.fail_route_id);
+            const failCondition = failRoute.condition;
+            if (failRoute.from_node_id !== item.node_id
+                || failCondition.kind !== "gate"
+                || failCondition.gate_node_id !== item.node_id
+                || failCondition.outcome !== "fail") {
+                throw new ExecutableRunPlanError(`$.nodes[${index}].fail_route_id`, "must reference this gate's fail route");
+            }
+        }
+        else if (item.kind === "decision") {
+            const source = item.source;
+            requireProducedOutput(source.node_id, source.output_name, `$.nodes[${index}].source`);
+            const sourceNode = nodeById.get(source.node_id);
+            const sourceOutput = producedOutputs(sourceNode)?.get(source.output_name);
+            if (sourceOutput?.kind !== undefined && sourceOutput.kind !== "structured") {
+                throw new ExecutableRunPlanError(`$.nodes[${index}].source.output_name`, "must reference a structured output");
+            }
+        }
+        else if (item.kind === "interaction") {
+            if (capabilities.human_interaction !== true)
+                throw new ExecutableRunPlanError("$.required_capabilities.human_interaction", "must be true when interaction nodes exist");
+        }
+        else if (item.kind === "terminal") {
+            requireReference(item.terminal_id, terminalIds, `$.nodes[${index}].terminal_id`);
+        }
+    });
+    const dependencyState = new Map();
+    const visitDependency = (nodeId) => {
+        const state = dependencyState.get(nodeId);
+        if (state === "visiting") {
+            throw new ExecutableRunPlanError("$.nodes", `dependency cycle includes '${nodeId}'`);
+        }
+        if (state === "visited")
+            return;
+        dependencyState.set(nodeId, "visiting");
+        const node = nodeById.get(nodeId);
+        for (const dependency of node.depends_on) {
+            visitDependency(dependency);
+        }
+        dependencyState.set(nodeId, "visited");
+    };
+    for (const nodeId of nodeById.keys())
+        visitDependency(nodeId);
+    verifiers.forEach((verifier, index) => {
+        const item = verifier;
+        const verifierId = item.verifier_id;
+        const subjectNodeId = item.subject_node_id;
+        requireReference(subjectNodeId, nodeById, `$.verifier_plan[${index}].subject_node_id`);
+        rejectRuntimeTemplates({
+            verifier_id: item.verifier_id,
+            subject_node_id: item.subject_node_id,
+            pattern: item.pattern,
+            require_score: item.require_score,
+            node_id: item.node_id,
+            output_name: item.output_name,
+            schema_ref: item.schema_ref,
+            assertion: item.assertion,
+            action: item.action,
+        }, `$.verifier_plan[${index}].authority`);
+        const owners = verifierOwnerGateIds.get(verifierId) ?? [];
+        if (owners.length !== 1) {
+            throw new ExecutableRunPlanError(`$.verifier_plan[${index}].verifier_id`, `verifier '${verifierId}' must have exactly one gate owner`);
+        }
+        if (item.kind === "structured_output" && item.node_id !== subjectNodeId) {
+            throw new ExecutableRunPlanError(`$.verifier_plan[${index}].node_id`, "must match subject_node_id");
+        }
+        if (!nodeById.get(owners[0]).depends_on.includes(subjectNodeId)) {
+            throw new ExecutableRunPlanError(`$.verifier_plan[${index}].subject_node_id`, `must be a direct dependency of owner gate '${owners[0]}'`);
+        }
+        if (item.kind !== "structured_output" && nodeById.get(subjectNodeId).kind !== "worker") {
+            throw new ExecutableRunPlanError(`$.verifier_plan[${index}].subject_node_id`, "workspace verifiers must reference a worker subject");
+        }
+        if (item.kind === "command" || item.kind === "checkpoint") {
+            const command = item.command;
+            if (typeof command === "string") {
+                const trimmed = command.trim();
+                const named = /^\{\{([A-Za-z_][A-Za-z0-9_]*)\}\}$/u.exec(trimmed);
+                const wholeCommandInput = named?.[1] ?? (trimmed === "$ARGUMENTS" ? "ARGUMENTS" : null);
+                if (wholeCommandInput !== null
+                    && runInputDefinitions.get(wholeCommandInput)?.type !== "trusted_verifier_command") {
+                    throw new ExecutableRunPlanError(`$.verifier_plan[${index}].command`, `whole-command input '${wholeCommandInput}' must have type trusted_verifier_command`);
+                }
+            }
+        }
+    });
+    nodes.forEach((node, index) => {
+        const item = node;
+        if (item.kind !== "worker")
+            return;
+        const subjectVerifiers = [...verifierById.values()]
+            .filter((verifier) => verifier.subject_node_id === item.node_id);
+        const expectedRuntimeInputs = deriveWorkerRuntimeInputNames(item, subjectVerifiers, handoffs, `$.nodes[${index}]`);
+        const packet = item.packet_template;
+        const actualRuntimeInputs = packet.runtime_input_names;
+        if (actualRuntimeInputs.length !== expectedRuntimeInputs.length
+            || actualRuntimeInputs.some((name, inputIndex) => (name !== expectedRuntimeInputs[inputIndex]))) {
+            throw new ExecutableRunPlanError(`$.nodes[${index}].packet_template.runtime_input_names`, `must exactly match derived runtime inputs: ${expectedRuntimeInputs.join(", ") || "(none)"}`);
+        }
+        expectedRuntimeInputs.forEach((inputName, inputIndex) => requireReference(inputName, runInputNames, `$.nodes[${index}].packet_template.runtime_input_names[${inputIndex}]`));
+        expectedRuntimeInputs.forEach((inputName, inputIndex) => {
+            if (runInputDefinitions.get(inputName)?.sensitive === true) {
+                throw new ExecutableRunPlanError(`$.nodes[${index}].packet_template.runtime_input_names[${inputIndex}]`, "sensitive inputs require a typed secret delivery mode and cannot enter worker templates");
+            }
+        });
+    });
+    const actualRunInputNames = new Set();
+    for (const node of nodes) {
+        if (node.kind === "worker") {
+            for (const name of node.packet_template.runtime_input_names) {
+                actualRunInputNames.add(name);
+            }
+        }
+        else if (node.kind === "system") {
+            for (const port of node.input_ports) {
+                if (port.source === "run_input")
+                    actualRunInputNames.add(port.name);
+            }
+        }
+    }
+    const missingInputs = [...actualRunInputNames].filter((name) => !runInputNames.has(name));
+    const unusedInputs = [...runInputNames].filter((name) => !actualRunInputNames.has(name));
+    if (missingInputs.length > 0 || unusedInputs.length > 0) {
+        throw new ExecutableRunPlanError("$.input_contract.inputs", `must exactly equal worker and system run inputs; missing: ${missingInputs.join(", ") || "(none)"}; unused: ${unusedInputs.join(", ") || "(none)"}`);
+    }
+    routes.forEach((route, index) => {
+        const item = route;
+        requireReference(item.from_node_id, nodeById, `$.routes[${index}].from_node_id`);
+        requireReference(item.to_node_id, nodeById, `$.routes[${index}].to_node_id`);
+        const condition = item.condition;
+        if (condition.kind === "gate") {
+            requireNodeKind(condition.gate_node_id, "gate", `$.routes[${index}].condition.gate_node_id`);
+            if (item.from_node_id !== condition.gate_node_id)
+                throw new ExecutableRunPlanError(`$.routes[${index}].from_node_id`, "must match the gate condition node");
+        }
+        if (condition.kind === "decision") {
+            requireNodeKind(condition.decision_node_id, "decision", `$.routes[${index}].condition.decision_node_id`);
+            if (item.from_node_id !== condition.decision_node_id)
+                throw new ExecutableRunPlanError(`$.routes[${index}].from_node_id`, "must match the decision condition node");
+            const decision = nodeById.get(condition.decision_node_id);
+            if (!decision.allowed_values.includes(condition.value))
+                throw new ExecutableRunPlanError(`$.routes[${index}].condition.value`, "is not declared by the decision node");
+        }
+        if (condition.kind === "interaction") {
+            requireNodeKind(condition.interaction_node_id, "interaction", `$.routes[${index}].condition.interaction_node_id`);
+            if (item.from_node_id !== condition.interaction_node_id)
+                throw new ExecutableRunPlanError(`$.routes[${index}].from_node_id`, "must match the interaction condition node");
+        }
+    });
+    nodes.forEach((node, nodeIndex) => {
+        const item = node;
+        if (item.kind !== "decision" && item.kind !== "interaction" && item.kind !== "gate") {
+            return;
+        }
+        const outgoing = routes.filter((route) => route.from_node_id === item.node_id);
+        const expectedConditionKind = item.kind;
+        outgoing.forEach((route) => {
+            const condition = route.condition;
+            if (condition.kind !== expectedConditionKind) {
+                throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}]`, `${item.kind} nodes may only use ${expectedConditionKind} routes`);
+            }
+        });
+        if (item.kind === "decision") {
+            for (const value of item.allowed_values) {
+                const matches = outgoing.filter((route) => route.condition.value === value);
+                if (matches.length !== 1) {
+                    throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].allowed_values`, `decision value '${value}' must have exactly one route`);
+                }
+            }
+        }
+        else if (item.kind === "interaction") {
+            for (const outcome of ["submitted", "cancelled"]) {
+                const matches = outgoing.filter((route) => route.condition.outcome === outcome);
+                if (matches.length !== 1) {
+                    throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].interaction_id`, `interaction outcome '${outcome}' must have exactly one route`);
+                }
+            }
+        }
+        else {
+            const passRoutes = outgoing.filter((route) => route.condition.outcome === "pass");
+            const failRoutes = outgoing.filter((route) => route.condition.outcome === "fail");
+            const declaredPassRouteIds = item.pass_route_ids;
+            const actualPassRouteIds = passRoutes.map((route) => route.route_id);
+            if (declaredPassRouteIds.length !== actualPassRouteIds.length
+                || declaredPassRouteIds.some((routeId, index) => routeId !== actualPassRouteIds[index])) {
+                throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].pass_route_ids`, "must exactly match this gate's pass routes in route-table order");
+            }
+            if (failRoutes.length !== 1) {
+                throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].fail_route_id`, "gate outcome 'fail' must have exactly one route");
+            }
+            const passTargets = actualPassRouteIds.map((routeId) => routeById.get(routeId).to_node_id);
+            if (new Set(passTargets).size !== passTargets.length) {
+                throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].pass_route_ids`, "gate pass routes must have unique targets");
+            }
+            const consumesGateAsSealCandidate = (targetId) => {
+                const target = nodeById.get(targetId);
+                if (target.kind !== "system")
+                    return false;
+                const operation = target.operation;
+                return operation.kind === "seal_result_bundle"
+                    && operation.candidates.some((candidate) => (candidate.required_node_ids.includes(item.node_id)));
+            };
+            for (const targetId of passTargets) {
+                if (!nodeById.get(targetId).depends_on.includes(item.node_id)
+                    && !consumesGateAsSealCandidate(targetId)) {
+                    throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].pass_route_ids`, `pass route target '${targetId}' must directly depend on this gate`);
+                }
+            }
+            const directDependents = nodes
+                .map((candidate) => candidate)
+                .filter((candidate) => candidate.depends_on.includes(item.node_id))
+                .map((candidate) => candidate.node_id);
+            const routedSealConsumers = passTargets.filter(consumesGateAsSealCandidate);
+            const gateConsumers = [...directDependents, ...routedSealConsumers];
+            if (gateConsumers.length !== passTargets.length
+                || gateConsumers.some((targetId) => !passTargets.includes(targetId))) {
+                throw new ExecutableRunPlanError(`$.nodes[${nodeIndex}].pass_route_ids`, "must route exactly once to every direct dependent of this gate");
+            }
+        }
+    });
+    const routeTargets = new Map();
+    for (const route of routes) {
+        const targets = routeTargets.get(route.from_node_id) ?? [];
+        targets.push(route.to_node_id);
+        routeTargets.set(route.from_node_id, targets);
+    }
+    const routeState = new Map();
+    const visitRoute = (nodeId) => {
+        const state = routeState.get(nodeId);
+        if (state === "visiting") {
+            throw new ExecutableRunPlanError("$.routes", `route cycle includes '${nodeId}'`);
+        }
+        if (state === "visited")
+            return;
+        routeState.set(nodeId, "visiting");
+        for (const target of routeTargets.get(nodeId) ?? [])
+            visitRoute(target);
+        routeState.set(nodeId, "visited");
+    };
+    for (const nodeId of nodeById.keys())
+        visitRoute(nodeId);
+    const activationTargets = new Map();
+    const addActivationEdge = (fromNodeId, toNodeId) => {
+        const targets = activationTargets.get(fromNodeId) ?? [];
+        if (!targets.includes(toNodeId))
+            targets.push(toNodeId);
+        activationTargets.set(fromNodeId, targets);
+    };
+    for (const node of nodes) {
+        for (const dependency of node.depends_on) {
+            addActivationEdge(dependency, node.node_id);
+        }
+    }
+    for (const route of routes) {
+        addActivationEdge(route.from_node_id, route.to_node_id);
+    }
+    const activationState = new Map();
+    const visitActivation = (nodeId) => {
+        const state = activationState.get(nodeId);
+        if (state === "visiting") {
+            throw new ExecutableRunPlanError("$.nodes", `activation cycle includes '${nodeId}'`);
+        }
+        if (state === "visited")
+            return;
+        activationState.set(nodeId, "visiting");
+        for (const target of activationTargets.get(nodeId) ?? [])
+            visitActivation(target);
+        activationState.set(nodeId, "visited");
+    };
+    for (const nodeId of nodeById.keys())
+        visitActivation(nodeId);
+    const isDependencyAncestor = (ancestorId, nodeId) => {
+        const pending = [...nodeById.get(nodeId).depends_on];
+        const visited = new Set();
+        while (pending.length > 0) {
+            const candidate = pending.pop();
+            if (candidate === ancestorId)
+                return true;
+            if (visited.has(candidate))
+                continue;
+            visited.add(candidate);
+            pending.push(...nodeById.get(candidate).depends_on);
+        }
+        return false;
+    };
+    nodes.forEach((node, index) => {
+        const item = node;
+        if (item.kind !== "decision")
+            return;
+        const source = item.source;
+        if (!isDependencyAncestor(source.node_id, item.node_id)) {
+            throw new ExecutableRunPlanError(`$.nodes[${index}].source.node_id`, "must be a dependency ancestor of the decision node");
+        }
+    });
+    retries.forEach((retry, index) => {
+        const item = retry;
+        item.node_ids.forEach((nodeId, nodeIndex) => requireReference(nodeId, nodeById, `$.retry_segments[${index}].node_ids[${nodeIndex}]`));
+        requireReference(item.retry_from_node_id, nodeById, `$.retry_segments[${index}].retry_from_node_id`);
+        if (!item.node_ids.includes(item.retry_from_node_id))
+            throw new ExecutableRunPlanError(`$.retry_segments[${index}].retry_from_node_id`, "must belong to the retry segment");
+        if (typeof item.continue_route_id === "string") {
+            requireReference(item.continue_route_id, routeById, `$.retry_segments[${index}].continue_route_id`);
+            const route = routeById.get(item.continue_route_id);
+            const condition = route.condition;
+            if (condition.kind !== "decision") {
+                throw new ExecutableRunPlanError(`$.retry_segments[${index}].continue_route_id`, "must reference a typed decision route");
+            }
+            if (nodeById.get(route.to_node_id)?.kind !== "terminal") {
+                throw new ExecutableRunPlanError(`$.retry_segments[${index}].continue_route_id`, "must route to the segment exhaustion terminal");
+            }
+        }
+    });
+    verifiers.forEach((verifier, index) => {
+        const item = verifier;
+        if (item.kind === "structured_output") {
+            requireProducedOutput(item.node_id, item.output_name, `$.verifier_plan[${index}]`);
+        }
+    });
+    handoffs.forEach((handoff, index) => {
+        const item = handoff;
+        requireProducedOutput(item.from_node_id, item.output_name, `$.handoff_plan[${index}]`);
+        requireReference(item.to_node_id, nodeById, `$.handoff_plan[${index}].to_node_id`);
+        if (!isDependencyAncestor(item.from_node_id, item.to_node_id)) {
+            throw new ExecutableRunPlanError(`$.handoff_plan[${index}].from_node_id`, "must be a dependency ancestor of the target node");
+        }
+        const targetNode = nodeById.get(item.to_node_id);
+        const inputNames = consumedInputs(targetNode);
+        const isMaterializerForHandoff = targetNode.kind === "system"
+            && targetNode.operation.kind === "materialize_handoff"
+            && targetNode.operation.handoff_id === item.handoff_id;
+        if (inputNames === null
+            || (!inputNames.has(item.input_name) && !isMaterializerForHandoff)) {
+            throw new ExecutableRunPlanError(`$.handoff_plan[${index}].input_name`, `references undeclared target input '${String(item.input_name)}'`);
+        }
+        const sourceNode = nodeById.get(item.from_node_id);
+        const sourceOutput = producedOutputs(sourceNode)?.get(item.output_name);
+        if (sourceOutput?.artifact_kind !== undefined) {
+            if (sourceOutput.artifact_kind !== item.artifact_kind
+                || expectedOutputKindForArtifact(item.artifact_kind)
+                    !== sourceOutput.kind) {
+                throw new ExecutableRunPlanError(`$.handoff_plan[${index}].artifact_kind`, "must match the declared source output contract");
+            }
+        }
+        const targetInput = inputNames?.get(item.input_name);
+        if (targetNode.kind === "worker" && targetInput?.source !== undefined && (targetInput.source !== "handoff"
+            || targetInput.mode !== item.mode
+            || targetInput.artifact_kind !== item.artifact_kind
+            || targetInput.required !== item.required
+            || targetInput.schema_ref !== item.schema_ref)) {
+            throw new ExecutableRunPlanError(`$.handoff_plan[${index}].input_name`, "must match the declared target handoff input contract");
+        }
+    });
+}
+export function parseExecutableRunPlanPayload(value) {
+    assertExecutableRunPlanPayload(value);
+    return value;
+}
+export function executableRunPlanDigest(plan) {
+    assertExecutableRunPlanPayload(plan);
+    return `sha256:${createHash("sha256").update(canonicalizeJson(plan), "utf8").digest("hex")}`;
+}
+export function createStoredExecutableRunPlan(plan) {
+    const canonicalPlan = JSON.parse(canonicalizeJson(plan));
+    assertExecutableRunPlanPayload(canonicalPlan);
+    const planDigest = executableRunPlanDigest(canonicalPlan);
+    return {
+        schema_version: STORED_EXECUTABLE_RUN_PLAN_SCHEMA_VERSION,
+        plan_id: planDigest,
+        plan_digest: planDigest,
+        plan: canonicalPlan,
+    };
+}
+export function parseStoredExecutableRunPlan(value) {
+    canonicalizeJson(value);
+    const stored = record(value, "$", ["schema_version", "plan_id", "plan_digest", "plan"]);
+    if (required(stored, "schema_version", "$") !== STORED_EXECUTABLE_RUN_PLAN_SCHEMA_VERSION)
+        throw new ExecutableRunPlanError("$.schema_version", "unsupported stored plan schema version");
+    digest(required(stored, "plan_id", "$"), "$.plan_id");
+    digest(required(stored, "plan_digest", "$"), "$.plan_digest");
+    const plan = parseExecutableRunPlanPayload(required(stored, "plan", "$"));
+    const recomputed = executableRunPlanDigest(plan);
+    if (stored.plan_id !== stored.plan_digest || stored.plan_digest !== recomputed) {
+        throw new ExecutableRunPlanError("$", "plan_id, plan_digest, and canonical payload digest must match");
+    }
+    return value;
+}