limen-ai 1.0.0

package/dist/kernel/interfaces/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,gCAAgC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAID;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,KAAK,GAAG,cAAc,GAAG,UAAU,CAAC;IACtD,0DAA0D;IAC1D,QAAQ,CAAC,qBAAqB,CAAC,EAAE,aAAa,CAAC;IAC/C,oDAAoD;IACpD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC;IACjE,oDAAoD;IACpD,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACrF,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;CACrE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC;QAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnI;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;CAC3E"}

package/dist/kernel/interfaces/idempotency.js

@@ -0,0 +1,22 @@
+/**
+ * Idempotency / Resume-Token Semantics interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 12 (Idempotency / Resume-Token Semantics)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-130: Idempotency key scope: (tenant_id, caller_id, syscall_class, target_scope, key).
+ * BC-131: Idempotency keys linked to CorrelationId.
+ * BC-132: Same key + same hash → deduplicate (return cached result).
+ * BC-133: Same key + different hash → IDEMPOTENCY_CONFLICT hard error.
+ * BC-134: Payload canonicalization: SHA-256 of sorted-key JSON.
+ * BC-135: Failed operations cached (failure IS the result).
+ * BC-136: Resume token plaintext returned once in response.
+ * BC-137: Resume token stored as SHA-256 hash.
+ * BC-138: Resume token single-use consumption.
+ * BC-139: Consumed tokens retained as tombstoned record for audit.
+ * INV-130: Timing-safe comparison for resume tokens.
+ * INV-131: Idempotency key TTL enforcement.
+ * INV-132 (v1.1): Canonicalization function versioning — hash comparison checks version first.
+ */
+export {};
+//# sourceMappingURL=idempotency.js.map

package/dist/kernel/interfaces/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/kernel/interfaces/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Kernel interface re-exports.
+ * S ref: Part XII (inter-agent handoff via interface files)
+ *
+ * All kernel interfaces are type-only -- no implementation.
+ * Team B (Orchestration) imports from this file only.
+ */
+export type { TenantId, UserId, AgentId, MissionId, TaskId, EventId, ArtifactId, PolicyId, RoleId, SessionId, Permission, OperationContext, KernelError, Result, NamespacePrefix, } from './common.js';
+export type { TenancyConfig, DatabaseConfig, DatabaseConnection, DatabaseLifecycle, MigrationEntry, MigrationResult, SchemaVerification, RunResult, ExportResult, DatabaseHealth, } from './database.js';
+export type { AuditEntry, AuditCreateInput, AuditQueryFilter, ChainVerification, ArchiveResult, TombstoneResult, AuditTrail, } from './audit.js';
+export type { CryptoConfig, EncryptedPayload, CryptoEngine, VaultOperations, } from './crypto.js';
+export type { EventScope, Propagation, EventPayload, EventHandler, EventBus, } from './events.js';
+export type { RbacEngine, } from './rbac.js';
+export type { RetentionPolicy, RetentionRunResult, RetentionScheduler, } from './retention.js';
+export type { NamespaceEnforcer, } from './namespace.js';
+export type { TenantContext, } from './tenant.js';
+export type { BucketType, RateLimitStatus, RateLimiter, } from './rate_limiter.js';
+export type { KernelConfig, KernelHealth, Kernel, CreateKernelFn, DestroyKernelFn, } from './kernel.js';
+export type { RunId, AttemptId, TraceEventId, MissionContractId, SupervisorDecisionId, SuspensionRecordId, HandoffId, CheckpointId, ArtifactLineageId, EvalCaseId, CapabilityManifestId, CorrelationId, ViolationType, LimenViolation, } from './governance_ids.js';
+export type { MissionLifecycleState, MissionActiveSubstate, TaskLifecycleState, TaskReadiness, HandoffLifecycleState, TransitionResult, TransitionEnforcer, } from './lifecycle.js';
+export type { Run, RunState, Attempt, AttemptState, AttemptPinnedVersions, AttemptFailureRef, AttemptStrategyDelta, RunStore, AttemptStore, } from './run_identity.js';
+export type { TraceEventType, TraceEvent, TraceEventInput, TraceEventPayload, TraceEmitter, RunSequencer, TraceEventStore, GovernanceQueryContext, } from './trace.js';
+export type { MissionContract, ContractCriterion, ContractSatisfactionResult, CriterionResult, MissionContractStore, ConstitutionalModeStore, } from './mission_contract.js';
+export type { SupervisorType, DecisionOutcome, SuspensionState, SuspensionTargetType, HandoffAcceptanceOutcome, HandoffRejectionReason, ResumeTokenHash, SupervisorDecision, SuspensionRecord, Handoff, SupervisorDecisionStore, SuspensionStore, HandoffStore, } from './supervisor.js';
+export type { EvalDimension, EvalProvenance, EvalCase, EvalPinnedVersions, EvalCaseStore, } from './eval.js';
+export type { ExecutionTrustTier, SideEffectClass, CapabilityManifest, RetryClassification, RetentionCategory, CapabilityManifestStore, } from './capability_manifest.js';
+export type { IdempotencyKey, IdempotencyCheckResult, ResumeToken, PayloadCanonicalizer, IdempotencyStore, ResumeTokenStore, } from './idempotency.js';
+export type { TimeProvider, } from './time.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/kernel/interfaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAChD,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EACjD,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,aAAa,EAAE,cAAc,EAAE,kBAAkB,EACjD,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,GAC5D,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAC9C,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,GAC9D,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,GAC9D,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,GAC9D,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AAGnB,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,GACxD,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,UAAU,EAAE,eAAe,EAAE,WAAW,GACzC,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,YAAY,EAAE,YAAY,EAAE,MAAM,EAClC,cAAc,EAAE,eAAe,GAChC,MAAM,aAAa,CAAC;AAKrB,YAAY,EACV,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,iBAAiB,EACjD,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EACnD,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAC3C,oBAAoB,EAAE,aAAa,EACnC,aAAa,EAAE,cAAc,GAC9B,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACV,qBAAqB,EAAE,qBAAqB,EAC5C,kBAAkB,EAAE,aAAa,EACjC,qBAAqB,EACrB,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EACpC,qBAAqB,EAAE,iBAAiB,EAAE,oBAAoB,EAC9D,QAAQ,EAAE,YAAY,GACvB,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAC9D,YAAY,EAAE,YAAY,EAAE,eAAe,EAC3C,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EAAE,iBAAiB,EAClC,0BAA0B,EAAE,eAAe,EAC3C,oBAAoB,EAAE,uBAAuB,GAC9C,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,cAAc,EAAE,eAAe,EAC/B,eAAe,EAAE,oBAAoB,EACrC,wBAAwB,EAAE,sBAAsB,EAAE,eAAe,EACjE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,EAC7C,uBAAuB,EAAE,eAAe,EAAE,YAAY,GACvD,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,kBAAkB,EAC3D,aAAa,GACd,MAAM,WAAW,CAAC;AAGnB,YAAY,EACV,kBAAkB,EAAE,eAAe,EACnC,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAC1D,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,cAAc,EAAE,sBAAsB,EACtC,WAAW,EAAE,oBAAoB,EACjC,gBAAgB,EAAE,gBAAgB,GACnC,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,YAAY,GACb,MAAM,WAAW,CAAC"}

package/dist/kernel/interfaces/index.js

@@ -0,0 +1,9 @@
+/**
+ * Kernel interface re-exports.
+ * S ref: Part XII (inter-agent handoff via interface files)
+ *
+ * All kernel interfaces are type-only -- no implementation.
+ * Team B (Orchestration) imports from this file only.
+ */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/kernel/interfaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/kernel/interfaces/kernel.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Kernel factory interface types.
+ * S ref: C-07 (Object.freeze), C-06 (no shared mutable state), §3.3 (engine not framework)
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Kernel creation and destruction with frozen, independent instances.
+ *
+ * C-07: Object.freeze on public API.
+ * C-06: Two createKernel() calls produce independent instances.
+ * §3.3: Engine, not framework -- consumer receives complete opaque object.
+ */
+import type { Result } from './common.js';
+import type { TenancyConfig, DatabaseLifecycle, DatabaseHealth } from './database.js';
+import type { AuditTrail } from './audit.js';
+import type { CryptoEngine, VaultOperations } from './crypto.js';
+import type { EventBus } from './events.js';
+import type { RbacEngine } from './rbac.js';
+import type { RetentionScheduler } from './retention.js';
+import type { NamespaceEnforcer } from './namespace.js';
+import type { TenantContext } from './tenant.js';
+import type { RateLimiter } from './rate_limiter.js';
+import type { TimeProvider } from './time.js';
+/**
+ * Configuration for creating a kernel instance.
+ * S ref: §3.6 (dataDir), I-11 (masterKey), FM-05 (busyTimeoutMs)
+ */
+export interface KernelConfig {
+    readonly dataDir: string;
+    readonly tenancy: TenancyConfig;
+    readonly masterKey: Buffer;
+    readonly busyTimeoutMs?: number;
+    readonly postQuantum?: boolean;
+}
+/**
+ * Aggregated kernel health status.
+ * S ref: I-05 (consistency), I-06 (audit chain), C-05 (migrations)
+ */
+export interface KernelHealth {
+    readonly status: 'healthy' | 'degraded' | 'unhealthy';
+    readonly database: DatabaseHealth;
+    readonly auditChainValid: boolean;
+    readonly migrationsCurrent: boolean;
+    readonly rbacActive: boolean;
+    readonly uptimeMs: number;
+}
+/**
+ * The complete kernel interface. Returned frozen by createKernel().
+ * S ref: C-07 (Object.freeze), §3.3 (engine, not framework)
+ */
+export interface Kernel {
+    readonly database: DatabaseLifecycle;
+    readonly audit: AuditTrail;
+    readonly crypto: CryptoEngine;
+    readonly vault: VaultOperations;
+    readonly events: EventBus;
+    readonly rbac: RbacEngine;
+    readonly retention: RetentionScheduler;
+    readonly namespace: NamespaceEnforcer;
+    readonly tenant: TenantContext;
+    readonly rateLimiter: RateLimiter;
+    readonly time: TimeProvider;
+    /**
+     * Aggregated kernel health check.
+     * S ref: I-05 (database consistency), I-06 (audit chain valid)
+     */
+    health(): Result<KernelHealth>;
+}
+/**
+ * Create an independent kernel instance. Returns frozen object (C-07).
+ * Two calls produce independent instances (C-06).
+ * S ref: C-07 (Object.freeze), C-06 (no shared mutable state), §3.3 (engine)
+ */
+export type CreateKernelFn = (config: KernelConfig) => Result<Readonly<Kernel>>;
+/**
+ * Graceful shutdown: close DB, flush pending webhooks, archive metrics.
+ * S ref: I-05 (clean shutdown), §3.4 (WAL checkpoint)
+ */
+export type DestroyKernelFn = (kernel: Kernel) => Result<void>;
+//# sourceMappingURL=kernel.d.ts.map

package/dist/kernel/interfaces/kernel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/kernel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAI9C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAID;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;CAChC;AAMD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC"}

package/dist/kernel/interfaces/kernel.js

@@ -0,0 +1,13 @@
+/**
+ * Kernel factory interface types.
+ * S ref: C-07 (Object.freeze), C-06 (no shared mutable state), §3.3 (engine not framework)
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Kernel creation and destruction with frozen, independent instances.
+ *
+ * C-07: Object.freeze on public API.
+ * C-06: Two createKernel() calls produce independent instances.
+ * §3.3: Engine, not framework -- consumer receives complete opaque object.
+ */
+export {};
+//# sourceMappingURL=kernel.js.map

package/dist/kernel/interfaces/kernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/kernel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/kernel/interfaces/lifecycle.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Lifecycle Transition Table interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 6 (Lifecycle Transition Tables)
+ *
+ * Phase: 0A (Governance Primitives)
+ *
+ * BC-060: 6 mission lifecycle states (replaces 10-state v3.2 MissionState).
+ * BC-061: 4 mission active substates.
+ * BC-062: TransitionEnforcer is the SOLE mechanism for lifecycle state changes.
+ * BC-063: TransitionEnforcer validates preconditions before allowing transitions.
+ * BC-064: 7 task lifecycle states with readiness discriminator.
+ * BC-065: 3 task readiness substates.
+ * BC-066: 7 handoff lifecycle states.
+ * BC-067: Suspension is orthogonal — entities freeze at current state (INV-X05).
+ * BC-068: Migration backfill mapping from v3.2 states (Binding 9).
+ * BC-069: Handoff lifecycle with acceptance/rejection typed outcomes.
+ * BC-070: No reverse transitions from terminal states.
+ * BC-071: Completing is an intermediate state between active and completed.
+ * ST-060: Mission lifecycle transition table.
+ * ST-061: Task lifecycle transition table.
+ * ST-062: Handoff lifecycle transition table.
+ * ST-063: Suspension lifecycle (active → resolved).
+ */
+import type { MissionId, TaskId, Result } from './common.js';
+import type { HandoffId, RunId } from './governance_ids.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * BC-060: 6 constitutional mission lifecycle states.
+ * Replaces v3.2's 10-state MissionState.
+ * BC-071: 'completing' is an intermediate state for result submission/eval.
+ * Terminal states: completed, failed, revoked (BC-070: no reverse transitions).
+ */
+export type MissionLifecycleState = 'created' | 'active' | 'completing' | 'completed' | 'failed' | 'revoked';
+/**
+ * BC-061: Active substates (only valid when mission is in 'active' state).
+ * These replace v3.2's PLANNING, EXECUTING, REVIEWING, DEGRADED as top-level states.
+ */
+export type MissionActiveSubstate = 'planning' | 'executing' | 'reviewing' | 'degraded';
+/**
+ * BC-064: 7 constitutional task lifecycle states.
+ * Replaces v3.2 task states with constitutional names.
+ * 'skipped' is new (no v3.2 equivalent).
+ * v3.2 BLOCKED → pending with readiness 'awaiting-dependencies'.
+ * Terminal states: completed, failed, skipped, revoked (BC-070).
+ */
+export type TaskLifecycleState = 'pending' | 'ready' | 'executing' | 'completed' | 'failed' | 'skipped' | 'revoked';
+/**
+ * BC-065: Task readiness discriminator (only valid when task is 'pending').
+ * Replaces v3.2 BLOCKED state with structured readiness tracking.
+ */
+export type TaskReadiness = 'awaiting-dependencies' | 'awaiting-scheduling' | 'ready';
+/**
+ * BC-066: 7 handoff lifecycle states.
+ * BC-069: Typed acceptance/rejection outcomes (in supervisor.ts).
+ */
+export type HandoffLifecycleState = 'issued' | 'accepted' | 'rejected' | 'active' | 'returned' | 'revoked' | 'expired';
+/**
+ * BC-062, BC-063: Result of a lifecycle transition enforcement.
+ * Records the transition that occurred (or why it was rejected).
+ */
+export interface TransitionResult {
+    /** The state before the transition */
+    readonly fromState: string;
+    /** The state after the transition */
+    readonly toState: string;
+    /** Timestamp of the transition */
+    readonly timestamp: string;
+}
+/**
+ * BC-062: TransitionEnforcer — the SOLE mechanism for lifecycle state changes.
+ * BC-063: Validates preconditions before allowing any transition.
+ * BC-070: Rejects reverse transitions from terminal states.
+ * BC-067: Checks suspension status — suspended entities cannot transition.
+ *
+ * Every state change in the system MUST go through the TransitionEnforcer.
+ * Direct SQL updates to lifecycle state columns are non-conforming.
+ */
+export interface TransitionEnforcer {
+    /**
+     * ST-060: Enforce mission lifecycle transition.
+     * Returns error if transition is invalid or entity is suspended.
+     */
+    enforceMissionTransition(conn: DatabaseConnection, missionId: MissionId, toState: MissionLifecycleState, substate?: MissionActiveSubstate): Result<TransitionResult>;
+    /**
+     * ST-061: Enforce task lifecycle transition.
+     * Returns error if transition is invalid or entity is suspended.
+     */
+    enforceTaskTransition(conn: DatabaseConnection, taskId: TaskId, toState: TaskLifecycleState, readiness?: TaskReadiness): Result<TransitionResult>;
+    /**
+     * ST-062: Enforce handoff lifecycle transition.
+     * Returns error if transition is invalid.
+     */
+    enforceHandoffTransition(conn: DatabaseConnection, handoffId: HandoffId, toState: HandoffLifecycleState): Result<TransitionResult>;
+    /**
+     * ST-020 (v1.1): Enforce run lifecycle transition.
+     * Run state is derived from mission outcome.
+     */
+    enforceRunTransition(conn: DatabaseConnection, runId: RunId, toState: 'completed' | 'failed' | 'abandoned'): Result<TransitionResult>;
+}
+/**
+ * BC-068, Binding 9: v3.2 to constitutional state mapping.
+ * Used by migration-backfill to convert existing state values.
+ */
+export declare const MISSION_STATE_BACKFILL_MAP: Readonly<Record<string, {
+    readonly state: MissionLifecycleState;
+    readonly substate: MissionActiveSubstate | null;
+}>>;
+/**
+ * BC-068: v3.2 task state to constitutional state mapping.
+ */
+export declare const TASK_STATE_BACKFILL_MAP: Readonly<Record<string, {
+    readonly state: TaskLifecycleState;
+    readonly readiness: TaskReadiness | null;
+}>>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/kernel/interfaces/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,WAAW,GACX,WAAW,GACX,UAAU,CAAC;AAIf;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,OAAO,GACP,WAAW,GACX,WAAW,GACX,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,uBAAuB,GACvB,qBAAqB,GACrB,OAAO,CAAC;AAIZ;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAC7B,QAAQ,GACR,UAAU,GACV,UAAU,GACV,QAAQ,GACR,UAAU,GACV,SAAS,GACT,SAAS,CAAC;AAId;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,wBAAwB,CACtB,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,CAAC,EAAE,qBAAqB,GAC/B,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B;;;OAGG;IACH,qBAAqB,CACnB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,kBAAkB,EAC3B,SAAS,CAAC,EAAE,aAAa,GACxB,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B;;;OAGG;IACH,wBAAwB,CACtB,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,qBAAqB,GAC7B,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B;;;OAGG;IACH,oBAAoB,CAClB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,GAC5C,MAAM,CAAC,gBAAgB,CAAC,CAAC;CAC7B;AAID;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAC/D,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACjD,CAAC,CAWQ,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;CAC1C,CAAC,CAQQ,CAAC"}

package/dist/kernel/interfaces/lifecycle.js

@@ -0,0 +1,53 @@
+/**
+ * Lifecycle Transition Table interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 6 (Lifecycle Transition Tables)
+ *
+ * Phase: 0A (Governance Primitives)
+ *
+ * BC-060: 6 mission lifecycle states (replaces 10-state v3.2 MissionState).
+ * BC-061: 4 mission active substates.
+ * BC-062: TransitionEnforcer is the SOLE mechanism for lifecycle state changes.
+ * BC-063: TransitionEnforcer validates preconditions before allowing transitions.
+ * BC-064: 7 task lifecycle states with readiness discriminator.
+ * BC-065: 3 task readiness substates.
+ * BC-066: 7 handoff lifecycle states.
+ * BC-067: Suspension is orthogonal — entities freeze at current state (INV-X05).
+ * BC-068: Migration backfill mapping from v3.2 states (Binding 9).
+ * BC-069: Handoff lifecycle with acceptance/rejection typed outcomes.
+ * BC-070: No reverse transitions from terminal states.
+ * BC-071: Completing is an intermediate state between active and completed.
+ * ST-060: Mission lifecycle transition table.
+ * ST-061: Task lifecycle transition table.
+ * ST-062: Handoff lifecycle transition table.
+ * ST-063: Suspension lifecycle (active → resolved).
+ */
+// ─── Migration Backfill Mapping (Binding 9) ───
+/**
+ * BC-068, Binding 9: v3.2 to constitutional state mapping.
+ * Used by migration-backfill to convert existing state values.
+ */
+export const MISSION_STATE_BACKFILL_MAP = {
+    CREATED: { state: 'created', substate: null },
+    PLANNING: { state: 'active', substate: 'planning' },
+    EXECUTING: { state: 'active', substate: 'executing' },
+    REVIEWING: { state: 'active', substate: 'reviewing' },
+    PAUSED: { state: 'active', substate: null }, // + suspension record
+    BLOCKED: { state: 'active', substate: null }, // + readiness: awaiting-dependencies
+    DEGRADED: { state: 'active', substate: 'degraded' },
+    COMPLETED: { state: 'completed', substate: null },
+    FAILED: { state: 'failed', substate: null },
+    CANCELLED: { state: 'revoked', substate: null },
+};
+/**
+ * BC-068: v3.2 task state to constitutional state mapping.
+ */
+export const TASK_STATE_BACKFILL_MAP = {
+    PENDING: { state: 'pending', readiness: 'awaiting-scheduling' },
+    SCHEDULED: { state: 'ready', readiness: null },
+    RUNNING: { state: 'executing', readiness: null },
+    COMPLETED: { state: 'completed', readiness: null },
+    FAILED: { state: 'failed', readiness: null },
+    CANCELLED: { state: 'revoked', readiness: null },
+    BLOCKED: { state: 'pending', readiness: 'awaiting-dependencies' },
+};
+//# sourceMappingURL=lifecycle.js.map

package/dist/kernel/interfaces/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA8IH,iDAAiD;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAGjC;IACJ,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7C,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;IACnD,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;IACrD,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;IACrD,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,sBAAsB;IACnE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,qCAAqC;IACnF,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;IACnD,SAAS,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;IACjD,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;CACvC,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAG9B;IACJ,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE;IAC/D,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;IAC9C,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE;IAChD,SAAS,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE;IAClD,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;IAC5C,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IAChD,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,uBAAuB,EAAE;CACzD,CAAC"}

package/dist/kernel/interfaces/mission_contract.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Mission/Outcome Contract Model interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 4 (Mission/Outcome Contract Model)
+ *
+ * Phase: 0A (Governance Primitives)
+ *
+ * BC-030: MissionContract defines immutable success/outcome criteria.
+ * BC-031: constitutionalMode per-tenant flag governs contract requirement.
+ * BC-032: Contract satisfaction evaluated atomically with result finalization.
+ * BC-033: ContractSatisfactionResult is typed (not boolean).
+ * BC-034: constitutionalMode is one-way irreversible (false → true only).
+ * BC-035: When constitutionalMode=true, all missions require a contract.
+ * BC-036: When constitutionalMode=false, missions without contract are valid (v3.2 compat).
+ * BC-037: Contract satisfaction returns specific unmet criteria on failure.
+ * BC-038 (v1.1): constitutionalMode stored in kernel config (core_config), NOT gov_ tables.
+ * INV-X04: Every entity carries schemaVersion.
+ * INV-X06: constitutionalMode one-way irreversible.
+ */
+import type { MissionId, TenantId, Result } from './common.js';
+import type { MissionContractId } from './governance_ids.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * BC-030: Individual success criterion within a mission contract.
+ * Each criterion has a description and an evaluation method identifier.
+ */
+export interface ContractCriterion {
+    /** Human-readable description of the criterion */
+    readonly description: string;
+    /** Machine-readable evaluation method identifier */
+    readonly evaluationMethod: string;
+    /** Whether this criterion is required (true) or aspirational (false) */
+    readonly required: boolean;
+}
+/**
+ * BC-030: MissionContract — immutable definition of success/outcome criteria.
+ * Once created, a contract is never modified. Versioning creates new contracts.
+ * BC-035: When constitutionalMode=true, every mission must reference a contract.
+ * INV-X04: schemaVersion tracks governance schema version.
+ */
+export interface MissionContract {
+    readonly contractId: MissionContractId;
+    readonly tenantId: string;
+    /** Mission objective this contract governs */
+    readonly objective: string;
+    /** Constraints that bound the mission's execution */
+    readonly constraints: Readonly<Record<string, unknown>>;
+    /** Ordered list of criteria that define mission success. BC-030 */
+    readonly criteria: readonly ContractCriterion[];
+    /** INV-X04: Governance schema version */
+    readonly schemaVersion: string;
+    readonly createdAt: string;
+}
+/**
+ * BC-033: Typed contract satisfaction result.
+ * Not a boolean — carries structured detail about which criteria passed/failed.
+ * BC-037: On failure, lists specific unmet criteria.
+ */
+export interface ContractSatisfactionResult {
+    /** Overall satisfaction outcome */
+    readonly satisfied: boolean;
+    /** Per-criterion results */
+    readonly criterionResults: readonly CriterionResult[];
+    /** Timestamp of evaluation */
+    readonly evaluatedAt: string;
+}
+/**
+ * BC-037: Per-criterion evaluation result.
+ * On failure, the reason is provided for programmatic analysis.
+ */
+export interface CriterionResult {
+    /** Description of the criterion evaluated */
+    readonly description: string;
+    /** Whether this criterion was satisfied */
+    readonly met: boolean;
+    /** Reason for failure (present only when met=false) */
+    readonly reason: string | null;
+}
+/**
+ * MissionContract persistence operations.
+ * BC-032: Evaluation is atomic with result finalization (one SQLite transaction).
+ */
+export interface MissionContractStore {
+    create(conn: DatabaseConnection, contract: MissionContract): Result<MissionContract>;
+    get(conn: DatabaseConnection, contractId: MissionContractId): Result<MissionContract | null>;
+    /**
+     * BC-032: Evaluate contract satisfaction atomically.
+     * BC-033: Returns typed result, not boolean.
+     * BC-037: On failure, lists unmet criteria.
+     */
+    evaluate(conn: DatabaseConnection, contractId: MissionContractId, missionId: MissionId): Result<ContractSatisfactionResult>;
+}
+/**
+ * BC-034, BC-038 (v1.1): Constitutional mode management.
+ * Stored in kernel config (core_config table), not governance tables.
+ * INV-X06: One-way irreversible (false → true only).
+ */
+export interface ConstitutionalModeStore {
+    /** Get the current constitutionalMode for a tenant */
+    get(conn: DatabaseConnection, tenantId: TenantId): Result<boolean>;
+    /**
+     * BC-034: Enable constitutionalMode (one-way, irreversible).
+     * Returns error if already enabled (idempotent) or if tenant not found.
+     */
+    enable(conn: DatabaseConnection, tenantId: TenantId): Result<void>;
+}
+//# sourceMappingURL=mission_contract.d.ts.map

package/dist/kernel/interfaces/mission_contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission_contract.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/mission_contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAID;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,8BAA8B;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAID;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACrF,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC7F;;;;OAIG;IACH,QAAQ,CACN,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,iBAAiB,EAC7B,SAAS,EAAE,SAAS,GACnB,MAAM,CAAC,0BAA0B,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;CACpE"}

package/dist/kernel/interfaces/mission_contract.js

@@ -0,0 +1,20 @@
+/**
+ * Mission/Outcome Contract Model interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 4 (Mission/Outcome Contract Model)
+ *
+ * Phase: 0A (Governance Primitives)
+ *
+ * BC-030: MissionContract defines immutable success/outcome criteria.
+ * BC-031: constitutionalMode per-tenant flag governs contract requirement.
+ * BC-032: Contract satisfaction evaluated atomically with result finalization.
+ * BC-033: ContractSatisfactionResult is typed (not boolean).
+ * BC-034: constitutionalMode is one-way irreversible (false → true only).
+ * BC-035: When constitutionalMode=true, all missions require a contract.
+ * BC-036: When constitutionalMode=false, missions without contract are valid (v3.2 compat).
+ * BC-037: Contract satisfaction returns specific unmet criteria on failure.
+ * BC-038 (v1.1): constitutionalMode stored in kernel config (core_config), NOT gov_ tables.
+ * INV-X04: Every entity carries schemaVersion.
+ * INV-X06: constitutionalMode one-way irreversible.
+ */
+export {};
+//# sourceMappingURL=mission_contract.js.map

package/dist/kernel/interfaces/mission_contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission_contract.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/mission_contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/kernel/interfaces/namespace.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Namespace enforcer interface types.
+ * S ref: C-09
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Table namespace prefix validation for all migrations.
+ *
+ * C-09: Every table must have a namespace prefix:
+ *       core_, memory_, agent_, obs_, hitl_, meter_
+ */
+import type { Result } from './common.js';
+/**
+ * Table namespace prefix enforcer.
+ * Validates that all table operations use valid C-09 namespace prefixes.
+ * S ref: C-09 (namespace enforcement)
+ */
+export interface NamespaceEnforcer {
+    /**
+     * Validate that migration SQL only creates/alters tables with valid prefixes.
+     * Rejects any CREATE TABLE or ALTER TABLE that uses an invalid prefix.
+     * S ref: C-09 (namespace validation on migration)
+     */
+    validateMigration(sql: string): Result<void>;
+    /**
+     * Check if a table name has a valid namespace prefix.
+     * S ref: C-09 (valid prefixes: core_, memory_, agent_, obs_, hitl_, meter_)
+     */
+    isValidTableName(tableName: string): boolean;
+}
+//# sourceMappingURL=namespace.d.ts.map

package/dist/kernel/interfaces/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7C;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9C"}

package/dist/kernel/interfaces/namespace.js

@@ -0,0 +1,12 @@
+/**
+ * Namespace enforcer interface types.
+ * S ref: C-09
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Table namespace prefix validation for all migrations.
+ *
+ * C-09: Every table must have a namespace prefix:
+ *       core_, memory_, agent_, obs_, hitl_, meter_
+ */
+export {};
+//# sourceMappingURL=namespace.js.map

package/dist/kernel/interfaces/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/kernel/interfaces/rate_limiter.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Rate limiter interface types.
+ * S ref: §36
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Token-bucket rate limiting per tenant/agent.
+ *
+ * §36: Rate limiting for API calls, event emission, and propose rejections.
+ *      Per-agent rate limits with configurable buckets.
+ */
+import type { Result, OperationContext } from './common.js';
+import type { DatabaseConnection } from './database.js';
+/** §36: Bucket types for rate limiting */
+export type BucketType = 'api_calls' | 'emit_event' | 'propose_rejections';
+/**
+ * Current rate limit status for an agent.
+ * S ref: §36 (rate limit inspection)
+ */
+export interface RateLimitStatus {
+    readonly currentTokens: number;
+    readonly maxTokens: number;
+    readonly refillRate: number;
+    readonly lastRefillAt: string;
+}
+/**
+ * Token-bucket rate limiter.
+ * S ref: §36 (per-agent rate limiting)
+ */
+export interface RateLimiter {
+    /**
+     * Check if operation is allowed under rate limit. Consumes a token if allowed.
+     * Returns true if token consumed, false if rate limited.
+     * S ref: §36 (token-bucket rate limiting)
+     */
+    checkAndConsume(conn: DatabaseConnection, ctx: OperationContext, bucketType: BucketType): Result<boolean>;
+    /**
+     * Get current rate limit status for an agent.
+     * S ref: §36 (rate limit status inspection)
+     */
+    getStatus(conn: DatabaseConnection, ctx: OperationContext, bucketType: BucketType): Result<RateLimitStatus>;
+}
+//# sourceMappingURL=rate_limiter.d.ts.map

package/dist/kernel/interfaces/rate_limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate_limiter.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/rate_limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAE3E;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE1G;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;CAC7G"}

package/dist/kernel/interfaces/rate_limiter.js

@@ -0,0 +1,12 @@
+/**
+ * Rate limiter interface types.
+ * S ref: §36
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Token-bucket rate limiting per tenant/agent.
+ *
+ * §36: Rate limiting for API calls, event emission, and propose rejections.
+ *      Per-agent rate limits with configurable buckets.
+ */
+export {};
+//# sourceMappingURL=rate_limiter.js.map

package/dist/kernel/interfaces/rate_limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate_limiter.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/rate_limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}