macp-sdk-typescript 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,113 @@ All notable changes to `macp-sdk-typescript` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 project uses [Semantic Versioning](https://semver.org/).
 
+## [0.11.0](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.10.0...v0.11.0) (2026-09-22)
+
+
+### ⚠ BREAKING CHANGES
+
+* **policy:** buildDecisionPolicy's default schemaVersion is now 3 (was 2). A call that omits options.schemaVersion and uses a binding voting algorithm now fails closed on an empty decisive tally instead of silently sealing on zero ballots. Pass { schemaVersion: 1 } or { schemaVersion: 2 } explicitly to keep the old fail-open behavior.
+
+### Features
+
+* **policy:** flip Decision-policy schemaVersion default from 2 to 3 ([#97](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/97)) ([a82972a](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/a82972ae43550f4b953a6bd0e32bfb387fd25806))
+
+## [Unreleased]
+
+### ⚠ BREAKING CHANGES
+
+* **policy:** `QuorumThreshold.type` no longer accepts `'weighted'`. The
+  identifier was removed from the canonical `quorum-rules.schema.json`
+  without ever having defined semantics (no weights vocabulary, no
+  electorate rule) and every descriptor that used it was already refused by
+  the runtime at `RegisterPolicy` — so this is a compile-time break for
+  callers whose descriptors could never register in the first place.
+  `buildQuorumPolicy` now also rejects it at runtime (for JS callers or an
+  `as` cast), naming the reservation.
+* **policy:** `buildQuorumPolicy(id, desc, {})` (an omitted `threshold`) now
+  emits `threshold: { value: 1 }` instead of `value: 0`. A zero approval bar
+  is trivially satisfied by any ballot set, so the canonical schema declares
+  `value` with `exclusiveMinimum: 0`; `buildQuorumPolicy` now enforces that
+  bound for every `threshold.type`, not just `'percentage'`, and rejects a
+  non-integer or non-positive `value` with `MacpSessionError`.
+* **policy:** `buildDecisionPolicy` now enforces the canonical
+  `decision-rules.schema.json` voting constraints client-side, so calls that
+  previously returned an unregistrable descriptor now throw `MacpSessionError`
+  instead:
+  - `voting.algorithm` must be one of the six canonical values.
+  - `voting.threshold` must be `0 < threshold <= 1`.
+  - `algorithm: 'majority'` requires `threshold >= 0.5` (inclusive — a `0.3`
+    "majority" now throws).
+  - `algorithm: 'supermajority'` **at its own default `threshold: 0.5`** now
+    throws — this is the change most likely to break an existing idiomatic
+    call (`buildDecisionPolicy(id, desc, { voting: { algorithm: 'supermajority' } })`);
+    pass an explicit `threshold` above `0.5` (e.g. `0.67`).
+  - `algorithm: 'weighted'` with no `weights` now throws.
+  - `voting.weights`, if supplied at all, is now validated **unconditionally
+    at every algorithm, not only `'weighted'`**: it must be non-empty, and
+    every value must be `> 0`. `weights: { a: 0 }` now throws — a weight-0
+    participant must be expressed by omission from the map.
+* **policy:** all five `build*Policy` functions (`buildDecisionPolicy`,
+  `buildQuorumPolicy`, `buildProposalPolicy`, `buildTaskPolicy`,
+  `buildHandoffPolicy`) now throw `MacpSessionError` when
+  `commitment.authority` is `'designated_role'` and `designatedRoles` is
+  omitted or `[]`. An authority rule that names no one is unsatisfiable, and
+  every canonical rule schema already refused this combination at
+  `RegisterPolicy` — this call previously returned a descriptor the runtime
+  would reject.
+* **policy:** `buildDecisionPolicy`'s default `schemaVersion` is now `3`
+  (was `2`), decided jointly with `macp-sdk-python`'s identical default flip
+  (issue #85, see `macp-sdk-python`#65). Any `buildDecisionPolicy` call that
+  omits `options.schemaVersion` and uses a binding voting algorithm
+  (`majority`, `unanimous`, etc.) now fails closed on an empty decisive
+  tally instead of silently sealing on zero ballots. Not retroactive — a
+  stored policy always evaluates under its own recorded `schemaVersion`
+  forever (RFC-MACP-0012 §8); this only changes what new callers who don't
+  pass `schemaVersion` explicitly get going forward. Pass
+  `{ schemaVersion: 1 }` or `{ schemaVersion: 2 }` explicitly to keep the
+  old fail-open behavior.
+
+### Features
+
+* **policy:** `buildDecisionPolicy` accepts a new fourth `options` argument,
+  `{ schemaVersion?: 1 | 2 | 3 }`, to select a Decision policy's
+  RFC-MACP-0012 empty-tally semantics — `3` (the default) fails closed
+  (§4.1's "vacuous participation floor"); `1`/`2` fail open. An out-of-range
+  value throws `MacpSessionError`.
+
+### Bug Fixes
+
+* **policy:** `buildQuorumPolicy`, `buildProposalPolicy`, `buildTaskPolicy`,
+  and `buildHandoffPolicy` no longer emit `require_vote_quorum` into their
+  `commitment` block. Only `decision-rules.schema.json`'s commitment object
+  declares that key; the other four canonical rule schemas close with
+  `additionalProperties: false` and do not, so the previous output was
+  spec-nonconformant with no CI signal (today's runtime does not enforce
+  `additionalProperties`, but a stricter or future validator would reject
+  it). Passing `commitment.requireVoteQuorum` to these four builders is now
+  silently dropped, matching its existing "ignored for other modes"
+  documentation, rather than leaking an unrecognized key onto the wire.
+  `buildDecisionPolicy` is unaffected.
+* **projections:** all six `applyEnvelope` entry points now roll back
+  `transcript` and the `message_id` redelivery-dedup set on a failed payload
+  decode, instead of leaving a partial application in place. Previously, a
+  failed decode still marked the envelope's `message_id` "seen," so a
+  legitimate retry with a corrected payload was silently absorbed as a
+  redelivery and the envelope's effect was lost forever.
+
+## [0.10.0](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.9.0...v0.10.0) (2026-09-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* `client.sendProgress()` now throws `MacpSessionError` when exactly one of `sessionId`/`mode` is supplied. Such calls used to succeed against a runtime that had the symmetric gap; as of macp-runtime PR #137 they are rejected with `INVALID_ENVELOPE`. Pass both fields for a session-scoped Progress, or neither for an ambient one.
+* **projections:** `TaskProjection` assignee semantics changed twice. (1) The first-accept-wins guard is now per-session, not per-`task_id`: on a transcript with two `TaskRequest`s, only the first `TaskAccept` assigns — the second task keeps `assignee === undefined` and `status === 'requested'`, where it previously got its own assignee. A `TaskAccept` the guard discards also no longer sets `phase = 'InProgress'`. (2) `TaskAccept` is no longer sticky forever: a `TaskReject` from the active assignee clears `assignee` back to `undefined`, so code reading `getTask(id).assignee` after a reject now sees `undefined` (or the reassigned participant) rather than the participant who rejected.
+
+### Bug Fixes
+
+* **projections:** scope the Task assignee slot to the session and free it on reject ([#75](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/75)) ([f7841a9](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/f7841a96d120b3fc55effdfabf63a2d72f431081)), closes [#59](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/59) [#60](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/60) [#70](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/70) [#71](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/71)
+* reject mixed ambient/session-scoped Progress envelopes ([#76](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/issues/76)) ([a9e00e3](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/commit/a9e00e370b7a4bf08d09190e8b75a12d221319f8))
+
 ## [0.9.0](https://github.com/multiagentcoordinationprotocol/macp-sdk-typescript/compare/v0.8.0...v0.9.0) (2026-09-01)
 
 

package/README.md

@@ -416,7 +416,7 @@ npm run test:integration   # Integration tests (requires Docker runtime; not run
 ```
 
 CI (GitHub Actions) runs type-check, lint, format check, the coverage-gated
-test suite, and the build on Node 20, 22, and 24 for every push and pull
+test suite, and the build on Node 22 and 24 for every push and pull
 request, and posts a coverage summary comment on PRs.
 
 ### Integration Tests

package/dist/client.d.ts

@@ -262,6 +262,15 @@ export declare class MacpClient {
         auth?: AuthConfig;
         deadlineMs?: number;
     }): Promise<Ack>;
+    /**
+     * Send a `Progress` message.
+     *
+     * Per RFC-MACP-0001 §6, `Progress` is legal in exactly two shapes: *ambient*
+     * (`sessionId` and `mode` both omitted/empty) or *session-scoped* (both
+     * non-empty). Supplying exactly one of the two throws `MacpSessionError` —
+     * the runtime rejects that mixed envelope with `INVALID_ENVELOPE`, so this
+     * fails fast with a message naming the mismatched field.
+     */
     sendProgress(options: {
         sessionId?: string;
         mode?: string;

package/dist/client.js

@@ -545,7 +545,17 @@ class MacpClient {
         });
         return this.send(envelope, { auth, deadlineMs: options.deadlineMs });
     }
+    /**
+     * Send a `Progress` message.
+     *
+     * Per RFC-MACP-0001 §6, `Progress` is legal in exactly two shapes: *ambient*
+     * (`sessionId` and `mode` both omitted/empty) or *session-scoped* (both
+     * non-empty). Supplying exactly one of the two throws `MacpSessionError` —
+     * the runtime rejects that mixed envelope with `INVALID_ENVELOPE`, so this
+     * fails fast with a message naming the mismatched field.
+     */
     async sendProgress(options) {
+        (0, validation_1.validateProgressScope)(options.sessionId ?? '', options.mode ?? '');
         const auth = this.requireAuth(options.auth);
         (0, auth_1.assertSenderMatchesIdentity)(auth, options.sender);
         const progressPayload = (0, envelope_1.buildProgressPayload)({

package/dist/policy.d.ts

@@ -1,8 +1,22 @@
 import type { PolicyDescriptor } from './types';
 export interface CommitmentRules {
     authority?: 'initiator_only' | 'any_participant' | 'designated_role';
+    /**
+     * Required non-empty when `authority` is `'designated_role'` — every
+     * builder throws `MacpSessionError` otherwise, since an authority rule
+     * naming no one is unsatisfiable. Ignored (serialized but inert) under the
+     * other two authorities.
+     */
     designatedRoles?: string[];
-    /** Decision-specific: require quorum before commit. Ignored for other modes. */
+    /**
+     * Decision-specific: require quorum before commit. Emitted only by
+     * `buildDecisionPolicy` (matching `decision-rules.schema.json`'s
+     * commitment object, the only one of the five that declares this key) —
+     * silently dropped, not merely ignored, when passed to the other four
+     * builders, so the still-`additionalProperties: false`
+     * quorum/proposal/task/handoff commitment schemas are unaffected (issue
+     * #87 item 1).
+     */
     requireVoteQuorum?: boolean;
     /**
      * RFC-MACP-0012 schema_version 2, Decision mode only: when `true`, a
@@ -49,15 +63,20 @@ export interface EvaluationRules {
     requiredBeforeVoting?: boolean;
 }
 export interface QuorumThreshold {
-    type: 'n_of_m' | 'percentage' | 'weighted';
+    type: 'n_of_m' | 'percentage';
     /**
      * The approval bar (RFC-MACP-0012 §4.2) — how many APPROVE commitments the
      * request needs, NOT a participation quorum. Scale depends on `type`:
-     * - `n_of_m` / `weighted`: an absolute count (or weight sum).
-     * - `percentage`: an **integer 0–100**; the runtime computes the bar as
+     * - `n_of_m`: an absolute count.
+     * - `percentage`: an **integer 1–100**; the runtime computes the bar as
      *   `ceil(value / 100 × participants)`. So `75` means "≥ 75% of participants
-     *   must approve", NOT `0.75`. `buildQuorumPolicy` validates this range and
-     *   throws on a non-integer or out-of-[0,100] value.
+     *   must approve", NOT `0.75`.
+     *
+     * Must be a **positive integer** for every `type` (`exclusiveMinimum: 0` in
+     * the canonical `quorum-rules.schema.json`, unconditional — a zero approval
+     * bar would be trivially satisfied by any ballot set). `buildQuorumPolicy`
+     * validates this and throws on a non-integer, non-positive, or (for
+     * `percentage`) out-of-[1,100] value.
      */
     value: number;
 }
@@ -109,7 +128,35 @@ export interface HandoffPolicyRulesInput {
     acceptance?: HandoffAcceptanceRules;
     commitment?: CommitmentRules;
 }
-export declare function buildDecisionPolicy(policyId: string, description: string, rules: DecisionPolicyRulesInput): PolicyDescriptor;
+export interface DecisionPolicyOptions {
+    /**
+     * RFC-MACP-0012 rule schema version the runtime evaluates this policy
+     * under (validated, never re-validated, at admission -- RFC-MACP-0012 §8
+     * item 4):
+     * - `1`/`2`: an empty decisive tally is fail-*open* (satisfies the voting
+     *   requirement).
+     * - `3`: an empty decisive tally is fail-*closed* for every algorithm
+     *   except `'none'` (RFC-MACP-0012 §4.1, adopted in spec PR #99).
+     *
+     * Defaults to `3` (issue #85, decided jointly with `macp-sdk-python`'s
+     * identical `schema_version: int = 3` default -- see that repo's issue
+     * #65): RFC-MACP-0012's authoring guidance is that new non-`'none'`
+     * policies SHOULD declare `schemaVersion: 3`, and the old default of `2`
+     * was fail-*open* on an empty tally for exactly the callers who opted into
+     * a binding algorithm (`majority`, `unanimous`, etc.) -- silently
+     * satisfying a vote that received zero ballots, which contradicts what
+     * asking for a binding algorithm means. RFC-MACP-0012 §8 makes the choice
+     * reversible and non-retroactive: a stored policy always evaluates under
+     * its own declared version forever, so this default change carries no
+     * migration risk for existing registered policies -- it only changes what
+     * new callers who don't pass `schemaVersion` explicitly get going forward.
+     * Pass `1` or `2` explicitly to keep fail-open empty-tally semantics. This
+     * is descriptor metadata, not a rule: it is never part of the serialized
+     * `rules` JSON.
+     */
+    schemaVersion?: 1 | 2 | 3;
+}
+export declare function buildDecisionPolicy(policyId: string, description: string, rules: DecisionPolicyRulesInput, options?: DecisionPolicyOptions): PolicyDescriptor;
 export declare function buildQuorumPolicy(policyId: string, description: string, rules: QuorumPolicyRulesInput): PolicyDescriptor;
 export declare function buildProposalPolicy(policyId: string, description: string, rules: ProposalPolicyRulesInput): PolicyDescriptor;
 export declare function buildTaskPolicy(policyId: string, description: string, rules: TaskPolicyRulesInput): PolicyDescriptor;

package/dist/policy.js

@@ -8,27 +8,126 @@ exports.buildHandoffPolicy = buildHandoffPolicy;
 const errors_1 = require("./errors");
 // ── Builder helpers ─────────────────────────────────────────────────
 function serializeCommitment(commitment) {
+    // `authority: 'designated_role'` with an empty (or unset) `designatedRoles`
+    // names no one, so no sender could ever satisfy it. All five rule schemas
+    // reject this combination at admission (spec PR #121) via a root-level
+    // `allOf` conditional arm, not an inline constraint on the property, so it
+    // is easy to miss. Validated once, here, so every mode builder gets it
+    // uniformly -- mirrors python-sdk `_commitment_dict`, policy.py:49-60.
+    //
+    // Explicit length check, not a truthiness test (Python's `not
+    // c.designated_roles`): the omitted-field and supplied-`[]` cases both
+    // collapse to length 0 here, and both must throw -- unlike Phase 3's
+    // weights rule, there is no supplied-vs-absent distinction to preserve.
+    if (commitment?.authority === 'designated_role' && (commitment.designatedRoles?.length ?? 0) === 0) {
+        throw new errors_1.MacpSessionError("commitment.authority is 'designated_role' but designatedRoles is empty -- this names no one, " +
+            'so no sender could ever satisfy it. Pass at least one role/participant id in designatedRoles.');
+    }
     return {
         authority: commitment?.authority ?? 'initiator_only',
         designated_roles: commitment?.designatedRoles ?? [],
-        // Parity with python-sdk `_commitment_dict`: emitted for every mode, not
-        // just decision, so policy JSON is byte-identical across SDKs.
-        require_vote_quorum: commitment?.requireVoteQuorum ?? false,
+        // `require_vote_quorum` and `allow_decline_over_approval` are NOT emitted
+        // here -- the canonical *-rules.schema.json commitment object closes with
+        // `additionalProperties: false` for every mode except Decision (issue
+        // #87 item 1, spec PR #125). Only decision-rules.schema.json's commitment
+        // object lists `require_vote_quorum`/`allow_decline_over_approval` as
+        // known keys; quorum/proposal/task/handoff-rules.schema.json's commitment
+        // object allows only `authority`/`designated_roles`. `buildDecisionPolicy`
+        // adds both fields itself, after calling this helper. Emitting them here
+        // unconditionally (as this SDK and python-sdk's `_commitment_dict` both
+        // used to, for byte-parity with each other rather than with the spec) put
+        // a key the other four modes' schemas do not recognize onto the wire --
+        // inert under today's runtime (which does not enforce
+        // `additionalProperties`) but non-conformant, and a real rejection under
+        // any stricter/future validator.
     };
 }
-function buildDecisionPolicy(policyId, description, rules) {
-    // Decision-only: extend the shared v1 commitment rules with the schema_version 2
-    // decline-over-approval switch, appended after the shared keys so it does not
-    // leak into the still-v1 quorum/proposal/task/handoff commitment blocks
-    // (parity with python-sdk `_commitment_dict` + `build_decision_policy`).
+// Typed against VotingRules['algorithm'] (not a bare string[]) so adding a
+// seventh canonical algorithm to that union without also adding it here is a
+// tsc error instead of a silent runtime-only rejection — same frozen-set
+// intent as this file's other guards (see e.g. commitment-hash-frozen-fields.test.ts).
+const DECISION_ALGORITHMS = new Set([
+    'none',
+    'majority',
+    'supermajority',
+    'unanimous',
+    'weighted',
+    'plurality',
+]);
+// RFC-MACP-0012 §8 requires runtimes to accept all three forever -- none of
+// these is a deprecation path. Mirrors macp-sdk-python policy.py's
+// _DECISION_SCHEMA_VERSIONS.
+const DECISION_SCHEMA_VERSIONS = new Set([1, 2, 3]);
+function buildDecisionPolicy(policyId, description, rules, options) {
+    const schemaVersion = options?.schemaVersion ?? 3;
+    if (!DECISION_SCHEMA_VERSIONS.has(schemaVersion)) {
+        throw new errors_1.MacpSessionError(`schemaVersion must be one of ${[...DECISION_SCHEMA_VERSIONS].sort().join(', ')}, got '${schemaVersion}'`);
+    }
+    const algorithm = rules.voting?.algorithm ?? 'none';
+    const threshold = rules.voting?.threshold ?? 0.5;
+    const weights = rules.voting?.weights;
+    // Match decision-rules.schema.json's constraints before the runtime does,
+    // same rationale as buildQuorumPolicy's threshold checks above: a bad
+    // descriptor fails immediately client-side instead of round-tripping to an
+    // INVALID_POLICY_DEFINITION from RegisterPolicy. Order matters and mirrors
+    // macp-sdk-python policy.py:148-180: algorithm enum, then threshold range,
+    // then the majority/supermajority asymmetry, then weighted-requires-weights,
+    // then the electorate rule (unconditional across every algorithm).
+    if (!DECISION_ALGORITHMS.has(algorithm)) {
+        throw new errors_1.MacpSessionError(`voting algorithm must be one of ${[...DECISION_ALGORITHMS].sort().join(', ')}, got '${algorithm}'`);
+    }
+    if (!(threshold > 0 && threshold <= 1)) {
+        throw new errors_1.MacpSessionError(`voting threshold must be > 0 and <= 1, got ${threshold}`);
+    }
+    if (algorithm === 'majority' && threshold < 0.5) {
+        throw new errors_1.MacpSessionError(`'majority' requires threshold >= 0.5 (an even split approves), got ${threshold}`);
+    }
+    // Deliberately asymmetric with the 'majority' check above: policy.std.majority
+    // sets threshold exactly 0.5 and RFC-MACP-0012 §2.2 pins that reserved profile
+    // byte-identical on every runtime, so an exclusive >= 0.5 bound here would
+    // refuse a profile the runtime pre-registers at startup. Do not "fix" this.
+    if (algorithm === 'supermajority' && threshold <= 0.5) {
+        throw new errors_1.MacpSessionError("'supermajority' requires threshold > 0.5 -- the field's own default of 0.5 is a bare majority " +
+            `wearing the name, got ${threshold}. Pass an explicit threshold (e.g. 0.67) for supermajority.`);
+    }
+    if (algorithm === 'weighted' && (!weights || Object.keys(weights).length === 0)) {
+        throw new errors_1.MacpSessionError("'weighted' algorithm requires a non-empty 'weights' map");
+    }
+    // The weighted electorate is meaningful only when non-empty and strictly
+    // positive-valued -- enforced unconditionally, at every algorithm, not only
+    // 'weighted' (decision-rules.schema.json: voting.weights minProperties 1,
+    // additionalProperties.exclusiveMinimum 0; normative at every schema_version).
+    // A weight-0 participant is expressed by omission from this map, never by an
+    // explicit 0. `weights !== undefined`, not a truthy check: `{}` is truthy.
+    if (weights !== undefined) {
+        if (Object.keys(weights).length === 0) {
+            throw new errors_1.MacpSessionError("'weights', if provided, must be non-empty");
+        }
+        for (const [participant, weight] of Object.entries(weights)) {
+            // weight <= 0 alone would let a NaN weight slip through (NaN <= 0 is
+            // false); the runtime guards this explicitly (registry.rs:596), mirrored
+            // here even though the Python reference does not check it separately.
+            if (weight <= 0 || Number.isNaN(weight)) {
+                throw new errors_1.MacpSessionError(`weights['${participant}'] must be > 0, got ${weight} -- a weight-0 observer is expressed by ` +
+                    'omission from the map, not by an explicit 0');
+            }
+        }
+    }
+    // Decision-only: extend the shared commitment rules with the two keys
+    // decision-rules.schema.json's commitment object allows and the other four
+    // modes' commitment schemas do not -- `require_vote_quorum` and the
+    // schema_version 2 decline-over-approval switch. Appended after the shared
+    // keys so neither leaks into the still-`additionalProperties: false`
+    // quorum/proposal/task/handoff commitment blocks (see serializeCommitment).
     const commitmentSection = serializeCommitment(rules.commitment);
+    commitmentSection.require_vote_quorum = rules.commitment?.requireVoteQuorum ?? false;
     commitmentSection.allow_decline_over_approval = rules.commitment?.allowDeclineOverApproval ?? false;
     const rulesJson = {
         voting: {
-            algorithm: rules.voting?.algorithm ?? 'none',
-            threshold: rules.voting?.threshold ?? 0.5,
+            algorithm,
+            threshold,
             quorum: rules.voting?.quorum ? { type: rules.voting.quorum.type, value: rules.voting.quorum.value } : undefined,
-            weights: rules.voting?.weights ?? undefined,
+            weights,
         },
         objection_handling: {
             critical_severity_vetoes: rules.objectionHandling?.criticalSeverityVetoes ?? false,
@@ -46,22 +145,47 @@ function buildDecisionPolicy(policyId, description, rules) {
         mode: 'macp.mode.decision.v1',
         description,
         rules: JSON.stringify(rulesJson),
-        schemaVersion: 2,
+        schemaVersion,
     };
 }
 function buildQuorumPolicy(policyId, description, rules) {
-    if (rules.threshold?.type === 'percentage') {
-        const v = rules.threshold.value;
-        if (!Number.isInteger(v) || v < 0 || v > 100) {
-            throw new errors_1.MacpSessionError(`quorum percentage threshold must be an integer in [0, 100] (e.g. 75 for 75%), got ${v}. ` +
-                'The runtime computes the approval bar as ceil(value/100 × participants); a fractional value ' +
-                'like 0.75 would round to a ~1% bar.');
+    const threshold = rules.threshold;
+    if (threshold) {
+        // Match the canonical quorum-rules schema's constraints before the runtime
+        // does, so a bad descriptor fails immediately client-side instead of
+        // round-tripping to an INVALID_POLICY_DEFINITION from RegisterPolicy.
+        // Order matters: integer first (a float reaching the range checks below
+        // would compare fine numerically but produce a confusing message), then
+        // > 0, then the percentage-specific <= 100 cap, then type. Mirrors
+        // macp-sdk-python policy.py:278-310.
+        //
+        // Number.isInteger(true) is false in TS, so unlike Python's
+        // isinstance(True, int) trap (policy.py:285-287), no separate bool guard
+        // is needed here.
+        if (!Number.isInteger(threshold.value)) {
+            throw new errors_1.MacpSessionError(`quorum threshold value must be an integer (e.g. 75 for 75%), got ${threshold.value}. ` +
+                "The canonical quorum-rules schema declares 'value' as an integer for every threshold " +
+                'type; a fractional value like 0.75 would produce a schema-invalid descriptor that the ' +
+                'runtime rejects at RegisterPolicy with worse diagnostics.');
+        }
+        if (threshold.value <= 0) {
+            throw new errors_1.MacpSessionError(`quorum threshold value must be > 0, got ${threshold.value}. A zero approval bar is ` +
+                'trivially satisfied by any ballot set, so the canonical quorum-rules schema declares ' +
+                "'value' with exclusiveMinimum 0.");
+        }
+        if (threshold.type === 'percentage' && threshold.value > 100) {
+            throw new errors_1.MacpSessionError(`quorum threshold value must be 1-100 for type 'percentage', got ${threshold.value}`);
+        }
+        if (threshold.type !== 'n_of_m' && threshold.type !== 'percentage') {
+            throw new errors_1.MacpSessionError(`quorum threshold type must be 'n_of_m' or 'percentage', got ${JSON.stringify(threshold.type)}. ` +
+                "'weighted' is reserved -- it was removed from the canonical schema without ever having " +
+                'defined semantics and must not be used.');
         }
     }
     const rulesJson = {
         threshold: {
             type: rules.threshold?.type ?? 'n_of_m',
-            value: rules.threshold?.value ?? 0,
+            value: rules.threshold?.value ?? 1,
         },
         abstention: {
             counts_toward_quorum: rules.abstention?.countsTowardQuorum ?? false,

package/dist/projections/base.js

@@ -125,6 +125,7 @@ class BaseProjection {
         // must apply WITHOUT dedup, or a feed of empty-id envelopes collapses to
         // one. This is architecturally expected (RFC-MACP-0001:306 at-least-once
         // delivery), not an anomaly — hence `debug`, never `warn`.
+        let seenIdAdded = false;
         if (envelope.messageId) {
             if (this.seenMessageIds.has(envelope.messageId)) {
                 logging_1.logger.debug('projection redelivery ignored', {
@@ -135,14 +136,32 @@ class BaseProjection {
                 return;
             }
             this.seenMessageIds.add(envelope.messageId);
+            seenIdAdded = true;
         }
         this.transcript.push(envelope);
-        if (envelope.messageType === 'Commitment') {
-            this.commitment = protoRegistry.decodeKnownPayload(envelope.mode, envelope.messageType, envelope.payload);
-            this.phase = 'Committed';
-            return;
+        // Rollback invariant (parity with macp-sdk-python's base_projection.py
+        // apply_envelope): the only fallible operation below is the payload
+        // decode. If it throws, `transcript`/`seenMessageIds` must not retain a
+        // partial application of this envelope, or a legitimate retry of the
+        // same `message_id` is silently swallowed as a redelivery and the
+        // envelope's effect is lost forever. Deliberately narrow -- this rolls
+        // back only the two mutations made above, never mode/subclass-owned
+        // state, which is safe only because every projection performs its one
+        // fallible operation (decode) strictly before any state mutation.
+        try {
+            if (envelope.messageType === 'Commitment') {
+                this.commitment = protoRegistry.decodeKnownPayload(envelope.mode, envelope.messageType, envelope.payload);
+                this.phase = 'Committed';
+                return;
+            }
+            this.applyMode(envelope, protoRegistry);
+        }
+        catch (err) {
+            this.transcript.pop();
+            if (seenIdAdded)
+                this.seenMessageIds.delete(envelope.messageId);
+            throw err;
         }
-        this.applyMode(envelope, protoRegistry);
     }
     /**
      * Record a cardinality anomaly: push it onto `anomalies` and emit it via

package/dist/projections/decision.d.ts

@@ -1,4 +1,4 @@
-import type { ProjectionAnomaly } from './base';
+import { BaseProjection } from './base';
 import type { Envelope } from '../types';
 import type { ProtoRegistry } from '../proto-registry';
 export interface DecisionProposalRecord {
@@ -26,59 +26,15 @@ export interface DecisionVoteRecord {
     reason?: string;
     sender: string;
 }
-export declare class DecisionProjection {
+export declare class DecisionProjection extends BaseProjection {
+    protected readonly mode = "macp.mode.decision.v1";
     readonly proposals: Map<string, DecisionProposalRecord>;
     readonly evaluations: DecisionEvaluationRecord[];
     readonly objections: DecisionObjectionRecord[];
     readonly votes: Map<string, Map<string, DecisionVoteRecord>>;
-    /**
-     * The session's accepted history, one envelope per unique `message_id`. See
-     * `BaseProjection.transcript` (`src/projections/base.ts`) for the full
-     * redelivery-idempotence contract (RFC-MACP-0006 §3.2); duplicated here
-     * only as a one-line pointer.
-     */
-    readonly transcript: Envelope[];
-    /**
-     * Cardinality anomalies recorded while replaying this projection's accepted
-     * transcript (e.g. a duplicate `Vote` from the same sender for the same
-     * `proposal_id`). See `BaseProjection.anomalies` (`src/projections/base.ts`)
-     * for the canonical description; duplicated here only as a one-line
-     * pointer.
-     */
-    readonly anomalies: ProjectionAnomaly[];
     phase: 'Proposal' | 'Evaluation' | 'Voting' | 'Committed';
-    commitment?: Record<string, unknown>;
-    /**
-     * `message_id`s already applied to this projection. See
-     * `BaseProjection.seenMessageIds` (`src/projections/base.ts`) for the full
-     * redelivery-idempotence rationale (RFC-MACP-0006 §3.2); duplicated here
-     * only as a one-line pointer.
-     */
-    private readonly seenMessageIds;
-    /**
-     * Apply one envelope to this projection's in-process state.
-     *
-     * Input contract: **accepted-only**, caller-maintained (`Envelope` carries
-     * no acceptance marker). Canonical source: `schemas/conformance/README.md`
-     * "Notes:", RFC-MACP-0007 §5.3, RFC-MACP-0011 §5. Full rationale and failure
-     * mode are documented once, on `BaseProjection.applyEnvelope`
-     * (`src/projections/base.ts`), and duplicated here only as a one-line
-     * pointer so six independent copies of the same prose cannot drift.
-     *
-     * Redelivery idempotence: a redelivered envelope (same `message_id`) is a
-     * non-event — not appended to `transcript`, not passed to the `switch`.
-     * See `BaseProjection.applyEnvelope` for the full RFC-MACP-0006 §3.2
-     * citation; duplicated here only as a one-line pointer.
-     */
-    applyEnvelope(envelope: Envelope, protoRegistry: ProtoRegistry): void;
-    /**
-     * True once at least one `ProjectionAnomaly` has been recorded. See
-     * `BaseProjection.hasAnomalies` (`src/projections/base.ts`) for the
-     * canonical description; duplicated here only as a one-line pointer.
-     */
-    get hasAnomalies(): boolean;
-    get isCommitted(): boolean;
-    get isPositiveOutcome(): boolean | undefined;
+    /** Handle a Decision-mode envelope. See `BaseProjection.applyEnvelope` for the accepted-only input contract and redelivery/rollback semantics shared by all built-in modes. */
+    protected applyMode(envelope: Envelope, protoRegistry: ProtoRegistry): void;
     voteTotals(): Record<string, number>;
     majorityWinner(): string | undefined;
     /** Returns the APPROVE vote ratio excluding ABSTAIN votes from the denominator. */