limen-ai 1.0.0

package/dist/kernel/interfaces/database.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Database lifecycle interface types.
+ * S ref: §3.1, §3.4, §3.6, I-01, I-05, C-05, FM-05
+ *
+ * Phase: 1 (Kernel)
+ * Implements: SQLite persistence lifecycle with WAL mode, forward-only migrations,
+ *             and crash recovery guarantees.
+ */
+import type { Result } from './common.js';
+/**
+ * Tenancy configuration per RDD-3.
+ * Consumer never knows which mode is active -- the kernel abstracts this.
+ * S ref: RDD-3 (tenancy modes)
+ */
+export interface TenancyConfig {
+    readonly mode: 'single' | 'row-level' | 'database';
+}
+/**
+ * Database configuration.
+ * S ref: §3.6 (dataDir), FM-05 (busy timeout)
+ */
+export interface DatabaseConfig {
+    readonly dataDir: string;
+    readonly tenancy: TenancyConfig;
+    readonly busyTimeoutMs?: number;
+}
+/**
+ * Run result from a prepared statement execution.
+ * S ref: §3.4 (ACID mutations)
+ */
+export interface RunResult {
+    readonly changes: number;
+    readonly lastInsertRowid: number | bigint;
+}
+/**
+ * Active database connection with transaction support.
+ * S ref: §3.4 (ACID), I-05 (transactional consistency), FM-05 (WAL + busy timeout)
+ */
+export interface DatabaseConnection {
+    readonly dataDir: string;
+    readonly schemaVersion: number;
+    readonly tenancyMode: TenancyConfig['mode'];
+    /**
+     * Execute within a transaction. If fn throws, automatic rollback.
+     * S ref: §3.4 ("Every operation fully committed or fully rolled back"), I-05
+     */
+    transaction<T>(fn: () => T): T;
+    /**
+     * Run a prepared statement (INSERT, UPDATE, DELETE).
+     * S ref: §3.4 (ACID mutations)
+     */
+    run(sql: string, params?: unknown[]): RunResult;
+    /**
+     * Query with results.
+     * S ref: §3.4 (read operations)
+     */
+    query<T>(sql: string, params?: unknown[]): T[];
+    /**
+     * Single result query.
+     * S ref: §3.4 (read operations)
+     */
+    get<T>(sql: string, params?: unknown[]): T | undefined;
+    /**
+     * Graceful close: checkpoint WAL, release connection.
+     * S ref: I-05 (crash recovery), §3.4 (WAL checkpoint on close)
+     */
+    close(): Result<void>;
+}
+/**
+ * A single forward-only migration entry.
+ * S ref: C-05 (forward-only migrations), §48 (migration strategy)
+ */
+export interface MigrationEntry {
+    version: number;
+    name: string;
+    sql: string;
+    checksum: string;
+}
+/**
+ * Result of running migrations.
+ * S ref: C-05 (forward-only migrations)
+ */
+export interface MigrationResult {
+    readonly applied: number;
+    readonly currentVersion: number;
+    readonly migrations: ReadonlyArray<{
+        version: number;
+        name: string;
+        durationMs: number;
+    }>;
+}
+/**
+ * Schema verification result.
+ * S ref: C-05 (migration integrity)
+ */
+export interface SchemaVerification {
+    readonly valid: boolean;
+    readonly currentVersion: number;
+    readonly expectedVersion: number;
+    readonly missingMigrations: readonly number[];
+}
+/**
+ * Export result metadata.
+ * S ref: §3.6 ("limen export produces single .limen archive")
+ */
+export interface ExportResult {
+    readonly path: string;
+    readonly sizeBytes: number;
+}
+/**
+ * Database health status.
+ * S ref: I-05 (transactional consistency verification)
+ */
+export interface DatabaseHealth {
+    readonly status: 'healthy' | 'unhealthy';
+    readonly walSize: number;
+    readonly pageCount: number;
+    readonly freePages: number;
+    readonly schemaVersion: number;
+    readonly integrityOk: boolean;
+}
+/**
+ * Database lifecycle management.
+ * S ref: §3.1 (SQLite foundation), §3.4 (WAL mode), §3.6 (dataDir),
+ *        I-05 (transactional consistency), C-05 (forward-only migrations)
+ */
+export interface DatabaseLifecycle {
+    /**
+     * Open database, run pending migrations, set WAL mode, return connection.
+     * Creates dataDir if it does not exist (§3.6).
+     * S ref: §3.4 (WAL mode), §3.6 (dataDir), I-05 (consistent state)
+     */
+    open(config: DatabaseConfig): Result<DatabaseConnection>;
+    /**
+     * Run all pending forward-only migrations.
+     * Each migration runs in its own transaction.
+     * Checksum verification prevents tampered migration files.
+     * S ref: C-05 (forward-only migrations)
+     */
+    migrate(conn: DatabaseConnection, migrations: MigrationEntry[]): Result<MigrationResult>;
+    /**
+     * Verify current schema matches expected version.
+     * S ref: C-05 (migration integrity verification)
+     */
+    verifySchema(conn: DatabaseConnection): Result<SchemaVerification>;
+    /**
+     * Export entire database to .limen archive.
+     * S ref: §3.6 ("limen export produces single .limen archive for transfer")
+     */
+    export(conn: DatabaseConnection, outputPath: string): Result<ExportResult>;
+    /**
+     * Get database health status.
+     * S ref: I-05 (consistency check)
+     */
+    health(conn: DatabaseConnection): Result<DatabaseHealth>;
+}
+//# sourceMappingURL=database.d.ts.map

package/dist/kernel/interfaces/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/database.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAC;CACpD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAID;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAE5C;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAE/B;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAEhD;;;OAGG;IACH,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAE/C;;;OAGG;IACH,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC;IAEvD;;;OAGG;IACH,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;CACvB;AAID;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAID;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAEzF;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAE3E;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;CAC1D"}

package/dist/kernel/interfaces/database.js

@@ -0,0 +1,10 @@
+/**
+ * Database lifecycle interface types.
+ * S ref: §3.1, §3.4, §3.6, I-01, I-05, C-05, FM-05
+ *
+ * Phase: 1 (Kernel)
+ * Implements: SQLite persistence lifecycle with WAL mode, forward-only migrations,
+ *             and crash recovery guarantees.
+ */
+export {};
+//# sourceMappingURL=database.js.map

package/dist/kernel/interfaces/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/database.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/kernel/interfaces/eval.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Eval Schema interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 8 (Eval Schema)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-090: EvalCase is an immutable evaluation record.
+ * BC-091: EvalCase created atomically with result finalization (one SQLite transaction).
+ * BC-092: EvalCase references MissionContractId (not a copy of the contract).
+ * BC-093: EvalCase carries pinnedVersions for replay stability.
+ * BC-094: EvalProvenance includes agent/capability/prompt version metadata.
+ * BC-095: When constitutionalMode=true, no Attempt completion without EvalCase.
+ * INV-X04: Every entity carries schemaVersion.
+ * EDGE-091: Legacy mode — eval case created with contractSatisfaction=null.
+ */
+import type { Result } from './common.js';
+import type { EvalCaseId, AttemptId, MissionContractId } from './governance_ids.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * BC-090: Individual evaluation dimension within an eval case.
+ * Each dimension represents a measurable quality aspect.
+ */
+export interface EvalDimension {
+    /** Dimension name (e.g., 'accuracy', 'completeness', 'relevance') */
+    readonly name: string;
+    /** Numeric score for this dimension */
+    readonly score: number;
+    /** Maximum possible score for this dimension */
+    readonly maxScore: number;
+    /** Optional evaluator rationale */
+    readonly rationale?: string;
+}
+/**
+ * BC-094: Provenance metadata for evaluation reproducibility.
+ * schemaVersion is MUST (INV-X04). Others are SHOULD for v1.
+ */
+export interface EvalProvenance {
+    /** MUST: Eval schema version (INV-X04, Amendment A12) */
+    readonly evalSchemaVersion: string;
+    /** SHOULD: Agent version that produced the result being evaluated */
+    readonly agentVersion?: string;
+    /** SHOULD: Capability snapshot at time of execution */
+    readonly capabilitySnapshot?: string;
+    /** SHOULD: Prompt version used during execution */
+    readonly promptVersion?: string;
+}
+/**
+ * BC-090: EvalCase — immutable evaluation record.
+ * BC-091: Created atomically with result finalization.
+ * BC-092: References MissionContractId, not a contract copy.
+ * BC-093: Carries pinnedVersions (traceGrammarVersion, evalSchemaVersion, missionContractVersion).
+ * EDGE-091: When constitutionalMode=false, contractSatisfaction may be null.
+ */
+export interface EvalCase {
+    readonly evalCaseId: EvalCaseId;
+    readonly tenantId: string;
+    /** BC-091: Attempt this eval case evaluates */
+    readonly attemptId: AttemptId;
+    /** BC-092: Reference to the governing contract (null in legacy mode) */
+    readonly contractId: MissionContractId | null;
+    /** Evaluation dimensions with scores */
+    readonly dimensions: readonly EvalDimension[];
+    /** BC-094: Provenance metadata */
+    readonly provenance: EvalProvenance;
+    /** BC-093: Pinned governance schema versions */
+    readonly pinnedVersions: EvalPinnedVersions;
+    /** Contract satisfaction result (null in legacy mode per EDGE-091) */
+    readonly contractSatisfaction: boolean | null;
+    /** INV-X04: Governance schema version */
+    readonly schemaVersion: string;
+    readonly createdAt: string;
+}
+/**
+ * BC-093: Version pinning for eval replay stability.
+ */
+export interface EvalPinnedVersions {
+    readonly traceGrammarVersion: string;
+    readonly evalSchemaVersion: string;
+    readonly missionContractVersion: string;
+}
+/**
+ * EvalCase persistence operations.
+ * BC-091: Creation is atomic with result finalization.
+ * BC-095: When constitutionalMode=true, Attempt cannot complete without EvalCase.
+ */
+export interface EvalCaseStore {
+    /** BC-091: Create eval case atomically */
+    create(conn: DatabaseConnection, evalCase: EvalCase): Result<EvalCase>;
+    get(conn: DatabaseConnection, evalCaseId: EvalCaseId): Result<EvalCase | null>;
+    getByAttempt(conn: DatabaseConnection, attemptId: AttemptId): Result<EvalCase | null>;
+    getByContract(conn: DatabaseConnection, contractId: MissionContractId): Result<readonly EvalCase[]>;
+}
+//# sourceMappingURL=eval.d.ts.map

package/dist/kernel/interfaces/eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9C,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9C,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAID;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvE,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtF,aAAa,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;CACrG"}

package/dist/kernel/interfaces/eval.js

@@ -0,0 +1,17 @@
+/**
+ * Eval Schema interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 8 (Eval Schema)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-090: EvalCase is an immutable evaluation record.
+ * BC-091: EvalCase created atomically with result finalization (one SQLite transaction).
+ * BC-092: EvalCase references MissionContractId (not a copy of the contract).
+ * BC-093: EvalCase carries pinnedVersions for replay stability.
+ * BC-094: EvalProvenance includes agent/capability/prompt version metadata.
+ * BC-095: When constitutionalMode=true, no Attempt completion without EvalCase.
+ * INV-X04: Every entity carries schemaVersion.
+ * EDGE-091: Legacy mode — eval case created with contractSatisfaction=null.
+ */
+export {};
+//# sourceMappingURL=eval.js.map

package/dist/kernel/interfaces/eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/kernel/interfaces/events.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Event bus interface types.
+ * S ref: RDD-4, §10, IP-6
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Synchronous in-process event dispatch with webhook support.
+ *
+ * RDD-4: Event bus dispatch is synchronous in-process.
+ * §10: Event propagation through mission trees (up/down/local).
+ * IP-6: Webhook delivery with at-least-once semantics, max 3 retries.
+ */
+import type { Result, MissionId, EventId, OperationContext } from './common.js';
+import type { DatabaseConnection } from './database.js';
+/** §10: Event scoping */
+export type EventScope = 'system' | 'mission' | 'task';
+/** §10: Event propagation direction */
+export type Propagation = 'up' | 'down' | 'local';
+/**
+ * Event payload for emission.
+ * S ref: §10 (event structure), RDD-4 (synchronous dispatch)
+ */
+export interface EventPayload {
+    readonly type: string;
+    readonly scope: EventScope;
+    readonly missionId?: MissionId;
+    readonly payload: Record<string, unknown>;
+    readonly propagation: Propagation;
+}
+/**
+ * Event handler callback.
+ * S ref: RDD-4 (synchronous handler invocation)
+ */
+export type EventHandler = (event: EventPayload) => void;
+/**
+ * In-process event bus with persistent event storage and webhook delivery.
+ * S ref: RDD-4 (synchronous dispatch), §10 (event propagation),
+ *        IP-6 (webhook delivery)
+ */
+export interface EventBus {
+    /**
+     * Emit event. Synchronous in-process dispatch per RDD-4.
+     * Persists event to obs_events for replay and webhook delivery.
+     * S ref: RDD-4 (synchronous dispatch), §10 (event propagation)
+     */
+    emit(conn: DatabaseConnection, ctx: OperationContext, event: EventPayload): Result<EventId>;
+    /**
+     * Subscribe to events matching pattern. Returns subscription ID.
+     * Pattern uses glob syntax: 'mission.*', 'task.failed', '*'.
+     * S ref: RDD-4 (subscription registry)
+     */
+    subscribe(pattern: string, handler: EventHandler): Result<string>;
+    /**
+     * Unsubscribe by subscription ID.
+     * S ref: RDD-4 (subscription lifecycle)
+     */
+    unsubscribe(subscriptionId: string): Result<void>;
+    /**
+     * Register webhook endpoint for external consumers.
+     * S ref: IP-6 (webhook delivery with HMAC-SHA256 signing)
+     */
+    registerWebhook(conn: DatabaseConnection, ctx: OperationContext, pattern: string, url: string, secret: string): Result<string>;
+    /**
+     * Process pending webhook deliveries (retry logic).
+     * At-least-once delivery with exponential backoff, max 3 attempts.
+     * S ref: IP-6 (at-least-once, retry with exponential backoff max 3)
+     */
+    processWebhooks(conn: DatabaseConnection): Result<{
+        delivered: number;
+        failed: number;
+        exhausted: number;
+    }>;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/kernel/interfaces/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD,yBAAyB;AACzB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAEvD,uCAAuC;AACvC,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;AAIzD;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5F;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE;;;OAGG;IACH,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAElD;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/H;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7G"}

package/dist/kernel/interfaces/events.js

@@ -0,0 +1,13 @@
+/**
+ * Event bus interface types.
+ * S ref: RDD-4, §10, IP-6
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Synchronous in-process event dispatch with webhook support.
+ *
+ * RDD-4: Event bus dispatch is synchronous in-process.
+ * §10: Event propagation through mission trees (up/down/local).
+ * IP-6: Webhook delivery with at-least-once semantics, max 3 retries.
+ */
+export {};
+//# sourceMappingURL=events.js.map

package/dist/kernel/interfaces/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/kernel/interfaces/governance_ids.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Governance branded ID types and violation primitives for Phase 0A.
+ * Truth Model: Deliverable 1 (Branded ID System), Deliverable 7 (Structured Error Model)
+ *
+ * Phase: 0A (Foundation)
+ * Build Order: 1 (no dependencies)
+ *
+ * BC-001 through BC-006: Branded ID compile-time safety.
+ * BC-002: Brand strings are unique across all branded types in the codebase.
+ * BC-003: No brand string collision with the 25 existing IDs.
+ * BC-006: CorrelationId links EventBus + TraceEmitter (Binding 12).
+ * BC-080: LimenViolation structured violation type.
+ * INV-001: All governance branded types exported through kernel/interfaces/index.ts.
+ *
+ * After Phase 0A: 38 total branded IDs (25 existing + 1 from split + 12 new).
+ */
+/** Table 6: Run identifier — constitutional execution envelope. BC-010 */
+export type RunId = string & {
+    readonly __brand: 'RunId';
+};
+/** Table 6: Attempt identifier — single execution try within a task. BC-011 */
+export type AttemptId = string & {
+    readonly __brand: 'AttemptId';
+};
+/** Table 6: Trace event identifier — immutable constitutional event. BC-020 */
+export type TraceEventId = string & {
+    readonly __brand: 'TraceEventId';
+};
+/** Principle 9: Mission contract identifier — immutable typed success criteria. BC-030 */
+export type MissionContractId = string & {
+    readonly __brand: 'MissionContractId';
+};
+/** Table 3: Supervisor decision identifier — immutable governance decision. BC-040 */
+export type SupervisorDecisionId = string & {
+    readonly __brand: 'SupervisorDecisionId';
+};
+/** Principle 14: Suspension record identifier. BC-047 */
+export type SuspensionRecordId = string & {
+    readonly __brand: 'SuspensionRecordId';
+};
+/** Table 2D: Handoff identifier — delegation lifecycle. BC-069 */
+export type HandoffId = string & {
+    readonly __brand: 'HandoffId';
+};
+/** Table 4: Checkpoint identifier. BC-065 */
+export type CheckpointId = string & {
+    readonly __brand: 'CheckpointId';
+};
+/** Table 1: Artifact lineage tracking identifier. BC-001 */
+export type ArtifactLineageId = string & {
+    readonly __brand: 'ArtifactLineageId';
+};
+/** Principle 8: Eval case identifier — immutable evaluation record. BC-090 */
+export type EvalCaseId = string & {
+    readonly __brand: 'EvalCaseId';
+};
+/** Principle 16: Capability manifest identifier. BC-100 */
+export type CapabilityManifestId = string & {
+    readonly __brand: 'CapabilityManifestId';
+};
+/**
+ * Binding 12: Neutral correlation identifier.
+ * Generated once per causal action at the system-call/operation level.
+ * Passed to BOTH EventBus.emit() and TraceEmitter.emit().
+ * Neither emission system generates its own.
+ * INV-X10: Same CorrelationId shared across both systems for same causal action.
+ */
+export type CorrelationId = string & {
+    readonly __brand: 'CorrelationId';
+};
+/**
+ * BC-080: Violation type categories for governance violations.
+ * Each violation is classified into exactly one of six categories.
+ */
+export type ViolationType = 'INVARIANT' | 'LIFECYCLE' | 'AUTHORITY' | 'BUDGET' | 'CAPABILITY' | 'POLICY';
+/**
+ * BC-080: Structured violation record for agent error model.
+ * BC-081: LimenError gains optional violations array using this type.
+ * BC-082: All violation messages redacted through existing error pipeline (S39 IP-4).
+ */
+export interface LimenViolation {
+    /** Violation category */
+    readonly type: ViolationType;
+    /** Machine-readable violation code */
+    readonly code: string;
+    /** Human-readable description (redacted at API boundary) */
+    readonly message: string;
+    /** Spec section reference for traceability */
+    readonly spec: string;
+    /** Additional structured context (redacted at API boundary) */
+    readonly context?: Readonly<Record<string, unknown>>;
+}
+//# sourceMappingURL=governance_ids.d.ts.map

package/dist/kernel/interfaces/governance_ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance_ids.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/governance_ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,0EAA0E;AAC1E,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAIzE,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEnF,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEzF,yDAAyD;AACzD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAErF,kEAAkE;AAClE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnE,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzE,4DAA4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAInF,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAIzF;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAI3E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,QAAQ,CAAC;AAEb;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD"}

package/dist/kernel/interfaces/governance_ids.js

@@ -0,0 +1,18 @@
+/**
+ * Governance branded ID types and violation primitives for Phase 0A.
+ * Truth Model: Deliverable 1 (Branded ID System), Deliverable 7 (Structured Error Model)
+ *
+ * Phase: 0A (Foundation)
+ * Build Order: 1 (no dependencies)
+ *
+ * BC-001 through BC-006: Branded ID compile-time safety.
+ * BC-002: Brand strings are unique across all branded types in the codebase.
+ * BC-003: No brand string collision with the 25 existing IDs.
+ * BC-006: CorrelationId links EventBus + TraceEmitter (Binding 12).
+ * BC-080: LimenViolation structured violation type.
+ * INV-001: All governance branded types exported through kernel/interfaces/index.ts.
+ *
+ * After Phase 0A: 38 total branded IDs (25 existing + 1 from split + 12 new).
+ */
+export {};
+//# sourceMappingURL=governance_ids.js.map

package/dist/kernel/interfaces/governance_ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance_ids.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/governance_ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/kernel/interfaces/idempotency.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Idempotency / Resume-Token Semantics interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 12 (Idempotency / Resume-Token Semantics)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-130: Idempotency key scope: (tenant_id, caller_id, syscall_class, target_scope, key).
+ * BC-131: Idempotency keys linked to CorrelationId.
+ * BC-132: Same key + same hash → deduplicate (return cached result).
+ * BC-133: Same key + different hash → IDEMPOTENCY_CONFLICT hard error.
+ * BC-134: Payload canonicalization: SHA-256 of sorted-key JSON.
+ * BC-135: Failed operations cached (failure IS the result).
+ * BC-136: Resume token plaintext returned once in response.
+ * BC-137: Resume token stored as SHA-256 hash.
+ * BC-138: Resume token single-use consumption.
+ * BC-139: Consumed tokens retained as tombstoned record for audit.
+ * INV-130: Timing-safe comparison for resume tokens.
+ * INV-131: Idempotency key TTL enforcement.
+ * INV-132 (v1.1): Canonicalization function versioning — hash comparison checks version first.
+ */
+import type { Result } from './common.js';
+import type { CorrelationId, SuspensionRecordId, SupervisorDecisionId } from './governance_ids.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * BC-130: Idempotency key — composite scope + caller-provided key.
+ * BC-131: Linked to CorrelationId for causal tracing.
+ * BC-134: Payload hash is SHA-256 of canonicalized JSON.
+ * INV-132 (v1.1): Canonicalization version stored for forward compatibility.
+ */
+export interface IdempotencyKey {
+    readonly tenantId: string;
+    /** Caller identity (agent ID, system call handler, etc.) */
+    readonly callerId: string;
+    /** System call class (e.g., 'SC-1', 'SC-4', 'SC-6') */
+    readonly syscallClass: string;
+    /** Target scope (e.g., mission ID, task ID) */
+    readonly targetScope: string;
+    /** Caller-provided key (unique within scope) */
+    readonly key: string;
+    /** BC-134: SHA-256 hash of canonicalized payload */
+    readonly payloadHash: string;
+    /** INV-132 (v1.1): Canonicalization function version */
+    readonly canonicalizationVersion: string;
+    /** BC-131: Correlation ID for causal linking */
+    readonly correlationId: CorrelationId;
+    /** Timestamp of key creation */
+    readonly createdAt: string;
+    /** TTL expiry timestamp (INV-131) */
+    readonly expiresAt: string;
+    /** INV-X04: Governance schema version */
+    readonly schemaVersion: string;
+}
+/**
+ * BC-132, BC-133: Result of idempotency check.
+ *   'new' — first time seeing this key, proceed with operation.
+ *   'deduplicated' — same key + same hash, return cached result (BC-132).
+ *   'conflict' — same key + different hash, IDEMPOTENCY_CONFLICT error (BC-133).
+ */
+export interface IdempotencyCheckResult {
+    readonly outcome: 'new' | 'deduplicated' | 'conflict';
+    /** Original correlation ID (present when deduplicated) */
+    readonly originalCorrelationId?: CorrelationId;
+    /** Existing payload hash (present when conflict) */
+    readonly existingPayloadHash?: string;
+}
+/**
+ * BC-136, BC-137: Resume token for re-entering suspended operations.
+ * Plaintext returned once to caller. Only SHA-256 hash persisted.
+ * BC-138: Single-use — consumed on first valid presentation.
+ * BC-139: Consumed tokens retained as tombstoned record for audit.
+ * INV-130: Timing-safe comparison for hash verification.
+ */
+export interface ResumeToken {
+    readonly tenantId: string;
+    /** SHA-256 hash of the plaintext token (BC-137) */
+    readonly tokenHash: string;
+    /** Suspension record this token unlocks */
+    readonly suspensionRecordId: SuspensionRecordId;
+    /** Decision that created this token */
+    readonly decisionId: SupervisorDecisionId;
+    /** Token expiry timestamp */
+    readonly expiresAt: string;
+    /** Whether this token has been consumed (BC-138) */
+    readonly consumed: boolean;
+    /** Consumption timestamp (null if not consumed) */
+    readonly consumedAt: string | null;
+    readonly createdAt: string;
+    /** INV-X04: Governance schema version */
+    readonly schemaVersion: string;
+}
+/**
+ * BC-134: Payload canonicalization for idempotency hash computation.
+ * INV-132 (v1.1): Versioned — function version stored with each key.
+ * When version changes, existing keys with old version treated as expired.
+ */
+export interface PayloadCanonicalizer {
+    /** Current function version identifier */
+    readonly version: string;
+    /** Canonicalize payload to deterministic string form (sorted-key JSON) */
+    canonicalize(payload: Readonly<Record<string, unknown>>): string;
+    /** Compute SHA-256 hash of canonicalized payload */
+    hash(canonicalized: string): string;
+}
+/**
+ * Idempotency key persistence operations.
+ * BC-132: Dedup on same key + same hash.
+ * BC-133: Conflict on same key + different hash.
+ * BC-135: Failed operations cached.
+ * INV-131: TTL enforcement on reads.
+ * INV-132 (v1.1): Version-aware comparison.
+ */
+export interface IdempotencyStore {
+    /**
+     * Check if an idempotency key exists and determine outcome.
+     * INV-132: Checks canonicalization version first — mismatched versions = 'new'.
+     */
+    check(conn: DatabaseConnection, key: IdempotencyKey): Result<IdempotencyCheckResult>;
+    /** Record a new idempotency key after successful or failed operation */
+    record(conn: DatabaseConnection, key: IdempotencyKey): Result<void>;
+}
+/**
+ * Resume token persistence operations.
+ * BC-136: Create returns plaintext token (only time it's available).
+ * BC-138: Consume is single-use — second consumption returns error.
+ * BC-139: Consumed tokens tombstoned, not deleted.
+ * INV-130: Timing-safe hash comparison.
+ */
+export interface ResumeTokenStore {
+    /**
+     * BC-136: Create a resume token. Returns the plaintext token.
+     * The plaintext is returned ONCE — only the hash is persisted.
+     */
+    create(conn: DatabaseConnection, token: Omit<ResumeToken, 'consumed' | 'consumedAt'>): Result<{
+        readonly plaintextToken: string;
+    }>;
+    /**
+     * BC-138: Consume a resume token by its hash.
+     * INV-130: Uses timing-safe comparison.
+     * Returns the token record if valid, error if expired/consumed/not found.
+     */
+    consume(conn: DatabaseConnection, tokenHash: string): Result<ResumeToken>;
+}
+//# sourceMappingURL=idempotency.d.ts.map