open-multi-agent-kit 0.98.3 → 0.98.5

package/dist/core/verified-run/projection.js

@@ -0,0 +1,219 @@
+import { reduceDagEvent } from "./dag-projection.js";
+import { reduceRecoveryEvent } from "./recovery-projection.js";
+import { VerifiedRunError } from "./storage.js";
+import { acceptWriterDispatch, reduceWriterEvent } from "./writer-projection.js";
+/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */
+export function projectRun(events) {
+    const first = events[0];
+    if (first?.kind !== "created" || first.contract.runId !== first.command.runId)
+        throw new VerifiedRunError("integrity");
+    const context = {
+        contract: first.contract,
+        writerFinished: false,
+        writerStarted: false,
+        producerStarted: false,
+        writerCommands: 0,
+        requestBaseline: 0,
+        requests: new Set(),
+        state: {
+            runId: first.contract.runId,
+            revision: 1,
+            generation: 1,
+            execution: "ready",
+            settlement: "open",
+            verification: "not_requested",
+            application: "not_requested",
+            candidateDigest: null,
+            inputDigest: null,
+            receiptDigest: null,
+            failure: null,
+            activeExecutionIds: [],
+            writerOpen: false,
+            modelRequests: 0,
+            tasks: first.contract.profile === "linux-command-dag-v1"
+                ? first.contract.writer.tasks.map((task) => ({
+                    taskId: task.id,
+                    attempt: 0,
+                    generation: 1,
+                    status: "pending",
+                    inputDigest: null,
+                    outputDigest: null,
+                    failure: null,
+                }))
+                : [],
+            budget: null,
+            environmentDigest: null,
+            verificationDeadlineMs: null,
+            lastClockMs: null,
+            processes: [],
+        },
+    };
+    const dispatched = new Set();
+    const checked = new Set();
+    const commands = new Set([first.command.commandId]);
+    let activeRole = "writer";
+    for (const event of events.slice(1)) {
+        const state = context.state;
+        if (state.execution === "failed" || state.receiptDigest)
+            throw new VerifiedRunError("integrity");
+        switch (event.kind) {
+            case "created":
+                throw new VerifiedRunError("integrity");
+            case "budget_anchored": {
+                const budget = event.budget;
+                const limits = first.contract.budget;
+                if (state.revision !== 1 ||
+                    state.budget ||
+                    budget.workDeadlineMs - budget.startedMs !== limits.workMs ||
+                    budget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||
+                    budget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs)
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    budget,
+                    environmentDigest: event.environmentDigest,
+                    lastClockMs: budget.startedMs,
+                };
+                break;
+            }
+            case "input_checkpoint":
+                if (state.revision !== 2 ||
+                    !state.budget ||
+                    state.inputDigest ||
+                    event.digest !== first.contract.workspace.baseDigest)
+                    throw new VerifiedRunError("integrity");
+                context.state = { ...state, inputDigest: event.digest };
+                break;
+            case "task_started":
+            case "task_finished":
+            case "tasks_paused":
+                reduceDagEvent(context, event);
+                break;
+            case "writer_opened":
+            case "model_request":
+            case "writer_closed":
+                reduceWriterEvent(context, event);
+                break;
+            case "dispatch": {
+                if (state.failure || state.activeExecutionIds.length || dispatched.has(event.executionId))
+                    throw new VerifiedRunError("integrity");
+                if (event.role === "writer") {
+                    acceptWriterDispatch(context, event);
+                }
+                else {
+                    if (!context.writerFinished ||
+                        state.writerOpen ||
+                        !state.candidateDigest ||
+                        event.claimId === null ||
+                        !first.contract.checks.some((check) => check.claimId === event.claimId) ||
+                        checked.has(event.claimId))
+                        throw new VerifiedRunError("integrity");
+                    checked.add(event.claimId);
+                }
+                dispatched.add(event.executionId);
+                activeRole = event.role;
+                context.state = {
+                    ...state,
+                    execution: "running",
+                    settlement: "draining",
+                    activeExecutionIds: [event.executionId],
+                };
+                break;
+            }
+            case "process_ready":
+                if (!state.budget ||
+                    state.activeExecutionIds[0] !== event.executionId ||
+                    event.identity.bootId !== state.budget.bootId ||
+                    state.processes.some((item) => item.executionId === event.executionId))
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    processes: [...state.processes, { executionId: event.executionId, identity: event.identity }],
+                };
+                break;
+            case "exited":
+                if (state.activeExecutionIds[0] !== event.executionId ||
+                    (state.budget &&
+                        event.failure === null &&
+                        !state.processes.some((item) => item.executionId === event.executionId)))
+                    throw new VerifiedRunError("integrity");
+                if (activeRole === "writer")
+                    context.writerFinished = event.failure === null;
+                context.state = {
+                    ...state,
+                    settlement: state.writerOpen ? "open" : "settled",
+                    activeExecutionIds: [],
+                    failure: event.failure,
+                };
+                break;
+            case "candidate": {
+                if (!context.writerFinished ||
+                    state.writerOpen ||
+                    state.failure ||
+                    state.activeExecutionIds.length ||
+                    state.candidateDigest ||
+                    state.tasks.some((task) => task.status !== "succeeded" || task.generation !== state.generation))
+                    throw new VerifiedRunError("integrity");
+                if (state.budget) {
+                    if (event.observedMs === undefined ||
+                        event.verificationDeadlineMs === undefined ||
+                        event.observedMs < state.budget.startedMs ||
+                        event.observedMs > state.budget.workDeadlineMs ||
+                        event.verificationDeadlineMs !==
+                            Math.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs))
+                        throw new VerifiedRunError("integrity");
+                }
+                else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    candidateDigest: event.digest,
+                    verificationDeadlineMs: event.verificationDeadlineMs ?? null,
+                    lastClockMs: event.observedMs ?? null,
+                };
+                break;
+            }
+            case "resumed":
+            case "tasks_retried":
+            case "writer_restarted":
+                reduceRecoveryEvent(context, event, { commands, checked, activeRole });
+                break;
+            case "evaluated":
+                if (!state.candidateDigest ||
+                    state.writerOpen ||
+                    state.activeExecutionIds.length ||
+                    checked.size !== first.contract.checks.length ||
+                    (event.verified && state.failure))
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    receiptDigest: event.receiptDigest,
+                    execution: "succeeded",
+                    verification: event.verified ? "verified" : "violated",
+                    application: event.verified ? "candidate_ready" : "not_requested",
+                };
+                break;
+            case "failed":
+                context.state = {
+                    ...state,
+                    execution: "failed",
+                    failure: event.code,
+                    verification: "inconclusive",
+                    settlement: state.activeExecutionIds.length || state.writerOpen ? "quarantined" : "settled",
+                };
+                break;
+            default: {
+                const exhaustive = event;
+                throw new VerifiedRunError(String(exhaustive));
+            }
+        }
+        context.state = { ...context.state, revision: state.revision + 1 };
+    }
+    return Object.freeze({
+        ...context.state,
+        activeExecutionIds: Object.freeze([...context.state.activeExecutionIds]),
+        processes: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),
+        tasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),
+    });
+}
+//# sourceMappingURL=projection.js.map

package/dist/core/verified-run/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAiB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;QAC5E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,OAAO,GAAoB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,eAAe;YAC7B,WAAW,EAAE,eAAe;YAC5B,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,CAAC;YAChB,KAAK,EACJ,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC/B,CAAC,IAAI,EAAqB,EAAE,CAAC,CAAC;oBAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,CAAC;oBACb,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;iBACb,CAAC,CACF;gBACF,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;SACb;KACD,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,GAA0B,QAAQ,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,iBAAiB,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrC,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,KAAK,CAAC,MAAM;oBACZ,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM;oBAC1D,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;oBAC9D,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS;oBAElE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,MAAM;oBACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,WAAW,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,kBAAkB;gBACtB,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,WAAW;oBACjB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;oBAEpD,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxD,MAAM;YACP,KAAK,cAAc,CAAC;YACpB,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc;gBAClB,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACP,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe;gBACnB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;oBACxF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACP,IACC,CAAC,OAAO,CAAC,cAAc;wBACvB,KAAK,CAAC,UAAU;wBAChB,CAAC,KAAK,CAAC,eAAe;wBACtB,KAAK,CAAC,OAAO,KAAK,IAAI;wBACtB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;wBACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;wBAE1B,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;oBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAClC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;oBACtB,kBAAkB,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;iBACvC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,eAAe;gBACnB,IACC,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW;oBACjD,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC7C,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;oBAEtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;iBAC7F,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,IACC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW;oBACjD,CAAC,KAAK,CAAC,MAAM;wBACZ,KAAK,CAAC,OAAO,KAAK,IAAI;wBACtB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;oBAEzE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,UAAU,KAAK,QAAQ;oBAAE,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC7E,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBACjD,kBAAkB,EAAE,EAAE;oBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACtB,CAAC;gBACF,MAAM;YACP,KAAK,WAAW,EAAE,CAAC;gBAClB,IACC,CAAC,OAAO,CAAC,cAAc;oBACvB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,OAAO;oBACb,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,KAAK,CAAC,eAAe;oBACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;oBAE/F,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,IACC,KAAK,CAAC,UAAU,KAAK,SAAS;wBAC9B,KAAK,CAAC,sBAAsB,KAAK,SAAS;wBAC1C,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS;wBACzC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc;wBAC9C,KAAK,CAAC,sBAAsB;4BAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;wBAEtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBACtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,eAAe,EAAE,KAAK,CAAC,MAAM;oBAC7B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,IAAI;oBAC5D,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;iBACrC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,SAAS,CAAC;YACf,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACtB,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvE,MAAM;YACP,KAAK,WAAW;gBACf,IACC,CAAC,KAAK,CAAC,eAAe;oBACtB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAC7C,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC;oBAEjC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,WAAW;oBACtB,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;iBACjE,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,YAAY,EAAE,cAAc;oBAC5B,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;iBAC3F,CAAC;gBACF,MAAM;YACP,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,OAAO,CAAC,KAAK;QAChB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { acceptWriterDispatch, reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst dispatched = new Set<string>();\n\tconst checked = new Set<string>();\n\tconst commands = new Set([first.command.commandId]);\n\tlet activeRole: \"writer\" | \"verifier\" = \"writer\";\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\": {\n\t\t\t\tif (state.failure || state.activeExecutionIds.length || dispatched.has(event.executionId))\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (event.role === \"writer\") {\n\t\t\t\t\tacceptWriterDispatch(context, event);\n\t\t\t\t} else {\n\t\t\t\t\tif (\n\t\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\t\tevent.claimId === null ||\n\t\t\t\t\t\t!first.contract.checks.some((check) => check.claimId === event.claimId) ||\n\t\t\t\t\t\tchecked.has(event.claimId)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t\tchecked.add(event.claimId);\n\t\t\t\t}\n\t\t\t\tdispatched.add(event.executionId);\n\t\t\t\tactiveRole = event.role;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"running\",\n\t\t\t\t\tsettlement: \"draining\",\n\t\t\t\t\tactiveExecutionIds: [event.executionId],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"process_ready\":\n\t\t\t\tif (\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\tevent.identity.bootId !== state.budget.bootId ||\n\t\t\t\t\tstate.processes.some((item) => item.executionId === event.executionId)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tprocesses: [...state.processes, { executionId: event.executionId, identity: event.identity }],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"exited\":\n\t\t\t\tif (\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\t(state.budget &&\n\t\t\t\t\t\tevent.failure === null &&\n\t\t\t\t\t\t!state.processes.some((item) => item.executionId === event.executionId))\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (activeRole === \"writer\") context.writerFinished = event.failure === null;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tsettlement: state.writerOpen ? \"open\" : \"settled\",\n\t\t\t\t\tactiveExecutionIds: [],\n\t\t\t\t\tfailure: event.failure,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, { commands, checked, activeRole });\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tchecked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}

package/dist/core/verified-run/recovery-clock.d.ts

@@ -0,0 +1,19 @@
+import type { RunPhaseBudget } from "omk-protocol";
+export interface RunClock {
+    readonly bootId: string;
+    readonly nowMs: number;
+}
+export interface RecoveryBudget {
+    readonly bootId: string;
+    readonly startedMs: number;
+    readonly workDeadlineMs: number;
+    readonly verifyCapMs: number;
+    readonly cleanupDeadlineMs: number;
+}
+export declare function readRunClock(): RunClock;
+export declare function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget;
+export declare function parseRecoveryBudget(raw: unknown): RecoveryBudget;
+export declare function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock?: RunClock): number;
+export declare const remainingVerification: typeof remainingRunTime;
+export declare function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number;
+//# sourceMappingURL=recovery-clock.d.ts.map

package/dist/core/verified-run/recovery-clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-clock.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-clock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAGD,wBAAgB,YAAY,IAAI,QAAQ,CAOvC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,cAAc,CAQvF;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAgChE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,WAAiB,GAAG,MAAM,CAM3G;AAED,eAAO,MAAM,qBAAqB,yBAAmB,CAAC;AAEtD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI5F","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { uptime } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunPhaseBudget } from \"omk-protocol\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface RunClock {\n\treadonly bootId: string;\n\treadonly nowMs: number;\n}\nexport interface RecoveryBudget {\n\treadonly bootId: string;\n\treadonly startedMs: number;\n\treadonly workDeadlineMs: number;\n\treadonly verifyCapMs: number;\n\treadonly cleanupDeadlineMs: number;\n}\nconst BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;\n\nexport function readRunClock(): RunClock {\n\tif (process.platform !== \"linux\") throw new VerifiedRunError(\"clock_unavailable\");\n\tconst bootId = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim();\n\tconst nowMs = Math.floor(uptime() * 1000);\n\tif (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)\n\t\tthrow new VerifiedRunError(\"clock_unavailable\");\n\treturn Object.freeze({ bootId, nowMs });\n}\n\nexport function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget {\n\treturn parseRecoveryBudget({\n\t\tbootId: clock.bootId,\n\t\tstartedMs: clock.nowMs,\n\t\tworkDeadlineMs: clock.nowMs + limits.workMs,\n\t\tverifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,\n\t\tcleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,\n\t});\n}\n\nexport function parseRecoveryBudget(raw: unknown): RecoveryBudget {\n\tif (\n\t\ttypeof raw !== \"object\" ||\n\t\traw === null ||\n\t\t!(\"bootId\" in raw) ||\n\t\ttypeof raw.bootId !== \"string\" ||\n\t\t!BOOT_ID.test(raw.bootId) ||\n\t\t!(\"startedMs\" in raw) ||\n\t\ttypeof raw.startedMs !== \"number\" ||\n\t\t!(\"workDeadlineMs\" in raw) ||\n\t\ttypeof raw.workDeadlineMs !== \"number\" ||\n\t\t!(\"verifyCapMs\" in raw) ||\n\t\ttypeof raw.verifyCapMs !== \"number\" ||\n\t\t!(\"cleanupDeadlineMs\" in raw) ||\n\t\ttypeof raw.cleanupDeadlineMs !== \"number\"\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];\n\tif (\n\t\tvalues.some((value) => !Number.isSafeInteger(value) || value < 0) ||\n\t\traw.workDeadlineMs <= raw.startedMs ||\n\t\traw.verifyCapMs <= raw.workDeadlineMs ||\n\t\traw.cleanupDeadlineMs <= raw.verifyCapMs\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tbootId: raw.bootId,\n\t\tstartedMs: raw.startedMs,\n\t\tworkDeadlineMs: raw.workDeadlineMs,\n\t\tverifyCapMs: raw.verifyCapMs,\n\t\tcleanupDeadlineMs: raw.cleanupDeadlineMs,\n\t});\n}\n\nexport function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock = readRunClock()): number {\n\tif (clock.bootId !== budget.bootId) throw new VerifiedRunError(\"clock_changed\");\n\tif (clock.nowMs < budget.startedMs) throw new VerifiedRunError(\"clock_rollback\");\n\tif (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Math.max(0, deadlineMs - clock.nowMs);\n}\n\nexport const remainingVerification = remainingRunTime;\n\nexport function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number {\n\tconst remaining = remainingVerification(budget, deadlineMs);\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\treturn performance.now() + remaining;\n}\n"]}

package/dist/core/verified-run/recovery-clock.js

@@ -0,0 +1,69 @@
+import { readFileSync } from "node:fs";
+import { uptime } from "node:os";
+import { performance } from "node:perf_hooks";
+import { VerifiedRunError } from "./storage.js";
+const BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+export function readRunClock() {
+    if (process.platform !== "linux")
+        throw new VerifiedRunError("clock_unavailable");
+    const bootId = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const nowMs = Math.floor(uptime() * 1000);
+    if (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new VerifiedRunError("clock_unavailable");
+    return Object.freeze({ bootId, nowMs });
+}
+export function anchorRunBudget(limits, clock) {
+    return parseRecoveryBudget({
+        bootId: clock.bootId,
+        startedMs: clock.nowMs,
+        workDeadlineMs: clock.nowMs + limits.workMs,
+        verifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,
+        cleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,
+    });
+}
+export function parseRecoveryBudget(raw) {
+    if (typeof raw !== "object" ||
+        raw === null ||
+        !("bootId" in raw) ||
+        typeof raw.bootId !== "string" ||
+        !BOOT_ID.test(raw.bootId) ||
+        !("startedMs" in raw) ||
+        typeof raw.startedMs !== "number" ||
+        !("workDeadlineMs" in raw) ||
+        typeof raw.workDeadlineMs !== "number" ||
+        !("verifyCapMs" in raw) ||
+        typeof raw.verifyCapMs !== "number" ||
+        !("cleanupDeadlineMs" in raw) ||
+        typeof raw.cleanupDeadlineMs !== "number")
+        throw new VerifiedRunError("integrity");
+    const values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];
+    if (values.some((value) => !Number.isSafeInteger(value) || value < 0) ||
+        raw.workDeadlineMs <= raw.startedMs ||
+        raw.verifyCapMs <= raw.workDeadlineMs ||
+        raw.cleanupDeadlineMs <= raw.verifyCapMs)
+        throw new VerifiedRunError("integrity");
+    return Object.freeze({
+        bootId: raw.bootId,
+        startedMs: raw.startedMs,
+        workDeadlineMs: raw.workDeadlineMs,
+        verifyCapMs: raw.verifyCapMs,
+        cleanupDeadlineMs: raw.cleanupDeadlineMs,
+    });
+}
+export function remainingRunTime(budget, deadlineMs, clock = readRunClock()) {
+    if (clock.bootId !== budget.bootId)
+        throw new VerifiedRunError("clock_changed");
+    if (clock.nowMs < budget.startedMs)
+        throw new VerifiedRunError("clock_rollback");
+    if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)
+        throw new VerifiedRunError("integrity");
+    return Math.max(0, deadlineMs - clock.nowMs);
+}
+export const remainingVerification = remainingRunTime;
+export function localVerificationDeadline(budget, deadlineMs) {
+    const remaining = remainingVerification(budget, deadlineMs);
+    if (remaining <= 0)
+        throw new VerifiedRunError("deadline");
+    return performance.now() + remaining;
+}
+//# sourceMappingURL=recovery-clock.js.map

package/dist/core/verified-run/recovery-clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-clock.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-clock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAahD,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAEhE,MAAM,UAAU,YAAY,GAAa;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB,EAAE,KAAe,EAAkB;IACxF,OAAO,mBAAmB,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,cAAc,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM;QAC3C,WAAW,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ;QAC1D,iBAAiB,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS;KACnF,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAkB;IACjE,IACC,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC;QACrB,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAC1B,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QACtC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC;QACvB,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC;QAC7B,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAEzC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3F,IACC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,SAAS;QACnC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc;QACrC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW;QAExC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;KACxC,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAsB,EAAE,UAAkB,EAAE,KAAK,GAAG,YAAY,EAAE,EAAU;IAC5G,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,WAAW;QACzG,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,CAC7C;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,UAAU,yBAAyB,CAAC,MAAsB,EAAE,UAAkB,EAAU;IAC7F,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;AAAA,CACrC","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { uptime } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunPhaseBudget } from \"omk-protocol\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface RunClock {\n\treadonly bootId: string;\n\treadonly nowMs: number;\n}\nexport interface RecoveryBudget {\n\treadonly bootId: string;\n\treadonly startedMs: number;\n\treadonly workDeadlineMs: number;\n\treadonly verifyCapMs: number;\n\treadonly cleanupDeadlineMs: number;\n}\nconst BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;\n\nexport function readRunClock(): RunClock {\n\tif (process.platform !== \"linux\") throw new VerifiedRunError(\"clock_unavailable\");\n\tconst bootId = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim();\n\tconst nowMs = Math.floor(uptime() * 1000);\n\tif (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)\n\t\tthrow new VerifiedRunError(\"clock_unavailable\");\n\treturn Object.freeze({ bootId, nowMs });\n}\n\nexport function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget {\n\treturn parseRecoveryBudget({\n\t\tbootId: clock.bootId,\n\t\tstartedMs: clock.nowMs,\n\t\tworkDeadlineMs: clock.nowMs + limits.workMs,\n\t\tverifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,\n\t\tcleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,\n\t});\n}\n\nexport function parseRecoveryBudget(raw: unknown): RecoveryBudget {\n\tif (\n\t\ttypeof raw !== \"object\" ||\n\t\traw === null ||\n\t\t!(\"bootId\" in raw) ||\n\t\ttypeof raw.bootId !== \"string\" ||\n\t\t!BOOT_ID.test(raw.bootId) ||\n\t\t!(\"startedMs\" in raw) ||\n\t\ttypeof raw.startedMs !== \"number\" ||\n\t\t!(\"workDeadlineMs\" in raw) ||\n\t\ttypeof raw.workDeadlineMs !== \"number\" ||\n\t\t!(\"verifyCapMs\" in raw) ||\n\t\ttypeof raw.verifyCapMs !== \"number\" ||\n\t\t!(\"cleanupDeadlineMs\" in raw) ||\n\t\ttypeof raw.cleanupDeadlineMs !== \"number\"\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];\n\tif (\n\t\tvalues.some((value) => !Number.isSafeInteger(value) || value < 0) ||\n\t\traw.workDeadlineMs <= raw.startedMs ||\n\t\traw.verifyCapMs <= raw.workDeadlineMs ||\n\t\traw.cleanupDeadlineMs <= raw.verifyCapMs\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tbootId: raw.bootId,\n\t\tstartedMs: raw.startedMs,\n\t\tworkDeadlineMs: raw.workDeadlineMs,\n\t\tverifyCapMs: raw.verifyCapMs,\n\t\tcleanupDeadlineMs: raw.cleanupDeadlineMs,\n\t});\n}\n\nexport function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock = readRunClock()): number {\n\tif (clock.bootId !== budget.bootId) throw new VerifiedRunError(\"clock_changed\");\n\tif (clock.nowMs < budget.startedMs) throw new VerifiedRunError(\"clock_rollback\");\n\tif (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Math.max(0, deadlineMs - clock.nowMs);\n}\n\nexport const remainingVerification = remainingRunTime;\n\nexport function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number {\n\tconst remaining = remainingVerification(budget, deadlineMs);\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\treturn performance.now() + remaining;\n}\n"]}

package/dist/core/verified-run/recovery-command.d.ts

@@ -0,0 +1,11 @@
+import type { RunResumeCommand, RunTaskRetryCommand, RunWriterRestartCommand } from "omk-protocol";
+import { type JournalSnapshot, VerifiedRunJournal } from "./journal.ts";
+import type { RunProjection } from "./run-types.ts";
+export type RecoveryCommand = RunResumeCommand | RunWriterRestartCommand | RunTaskRetryCommand;
+export declare function requireRunJournal(runPath: string): JournalSnapshot;
+/** One lease/CAS/idempotency boundary for all explicit recovery actions. */
+export declare function withRecoveryLease(runPath: string, command: RecoveryCommand, execute: (input: {
+    readonly snapshot: JournalSnapshot;
+    readonly journal: VerifiedRunJournal;
+}) => Promise<RunProjection>): Promise<RunProjection>;
+//# sourceMappingURL=recovery-command.d.ts.map

package/dist/core/verified-run/recovery-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-command.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEnG,OAAO,EAAE,KAAK,eAAe,EAA+B,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AAC/F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAIlE;AA4CD,4EAA4E;AAC5E,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,CAAC,KAAK,EAAE;IAChB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACrC,KAAK,OAAO,CAAC,aAAa,CAAC,GAC1B,OAAO,CAAC,aAAa,CAAC,CAsBxB","sourcesContent":["import type { RunResumeCommand, RunTaskRetryCommand, RunWriterRestartCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { type JournalSnapshot, journalPath, readRunJournal, VerifiedRunJournal } from \"./journal.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport type RecoveryCommand = RunResumeCommand | RunWriterRestartCommand | RunTaskRetryCommand;\nexport function requireRunJournal(runPath: string): JournalSnapshot {\n\tconst journal = readRunJournal(runPath);\n\tif (!journal) throw new VerifiedRunError(\"missing_run\");\n\treturn journal;\n}\n\nfunction commandDisposition(journal: JournalSnapshot, command: RecoveryCommand): \"new\" | \"duplicate\" {\n\tconst first = journal.records[0]?.event;\n\tif (\n\t\tfirst?.kind !== \"created\" ||\n\t\tfirst.contract.runId !== command.runId ||\n\t\tdigestObject(first.contract) !== command.contractDigest\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (first.command.commandId === command.commandId) throw new VerifiedRunError(\"command_conflict\");\n\tconst previous = journal.records.find(\n\t\t({ event }) =>\n\t\t\t(event.kind === \"resumed\" || event.kind === \"writer_restarted\" || event.kind === \"tasks_retried\") &&\n\t\t\tevent.command.commandId === command.commandId,\n\t)?.event;\n\tif (previous?.kind === \"resumed\" || previous?.kind === \"writer_restarted\" || previous?.kind === \"tasks_retried\") {\n\t\tif (digestObject(previous.command) !== digestObject(command)) throw new VerifiedRunError(\"command_conflict\");\n\t\treturn \"duplicate\";\n\t}\n\tif (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tswitch (command.kind) {\n\t\tcase \"resume\":\n\t\t\tif (command.candidateDigest !== journal.state.candidateDigest)\n\t\t\t\tthrow new VerifiedRunError(\"candidate_mismatch\");\n\t\t\tbreak;\n\t\tcase \"retry_tasks\":\n\t\tcase \"restart_writer\":\n\t\t\tif (!journal.state.inputDigest) throw new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (\n\t\t\t\tcommand.baseDigest !== journal.state.inputDigest ||\n\t\t\t\tcommand.baseDigest !== first.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_mismatch\");\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = command;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\treturn \"new\";\n}\n\n/** One lease/CAS/idempotency boundary for all explicit recovery actions. */\nexport async function withRecoveryLease(\n\trunPath: string,\n\tcommand: RecoveryCommand,\n\texecute: (input: {\n\t\treadonly snapshot: JournalSnapshot;\n\t\treadonly journal: VerifiedRunJournal;\n\t}) => Promise<RunProjection>,\n): Promise<RunProjection> {\n\tconst initial = requireRunJournal(runPath);\n\tif (commandDisposition(initial, command) === \"duplicate\") return initial.state;\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (commandDisposition(snapshot, command) === \"duplicate\") return snapshot.state;\n\t\tconst journal = new VerifiedRunJournal(runPath, owner);\n\t\ttry {\n\t\t\treturn await execute({ snapshot, journal });\n\t\t} catch (error) {\n\t\t\tif (\n\t\t\t\terror instanceof VerifiedRunError &&\n\t\t\t\tjournal.state.generation > snapshot.state.generation &&\n\t\t\t\t!journal.state.receiptDigest\n\t\t\t)\n\t\t\t\treturn journal.append({ kind: \"failed\", code: error.code });\n\t\t\tthrow error;\n\t\t}\n\t} finally {\n\t\towner.release();\n\t}\n}\n"]}

package/dist/core/verified-run/recovery-command.js

@@ -0,0 +1,73 @@
+import { acquireSessionOwnerLeaseSync } from "../session-owner-lease.js";
+import { journalPath, readRunJournal, VerifiedRunJournal } from "./journal.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+export function requireRunJournal(runPath) {
+    const journal = readRunJournal(runPath);
+    if (!journal)
+        throw new VerifiedRunError("missing_run");
+    return journal;
+}
+function commandDisposition(journal, command) {
+    const first = journal.records[0]?.event;
+    if (first?.kind !== "created" ||
+        first.contract.runId !== command.runId ||
+        digestObject(first.contract) !== command.contractDigest)
+        throw new VerifiedRunError("command_conflict");
+    if (first.command.commandId === command.commandId)
+        throw new VerifiedRunError("command_conflict");
+    const previous = journal.records.find(({ event }) => (event.kind === "resumed" || event.kind === "writer_restarted" || event.kind === "tasks_retried") &&
+        event.command.commandId === command.commandId)?.event;
+    if (previous?.kind === "resumed" || previous?.kind === "writer_restarted" || previous?.kind === "tasks_retried") {
+        if (digestObject(previous.command) !== digestObject(command))
+            throw new VerifiedRunError("command_conflict");
+        return "duplicate";
+    }
+    if (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)
+        throw new VerifiedRunError("stale_revision");
+    switch (command.kind) {
+        case "resume":
+            if (command.candidateDigest !== journal.state.candidateDigest)
+                throw new VerifiedRunError("candidate_mismatch");
+            break;
+        case "retry_tasks":
+        case "restart_writer":
+            if (!journal.state.inputDigest)
+                throw new VerifiedRunError("input_checkpoint_missing");
+            if (command.baseDigest !== journal.state.inputDigest ||
+                command.baseDigest !== first.contract.workspace.baseDigest)
+                throw new VerifiedRunError("input_mismatch");
+            break;
+        default: {
+            const exhaustive = command;
+            throw new VerifiedRunError(String(exhaustive));
+        }
+    }
+    return "new";
+}
+/** One lease/CAS/idempotency boundary for all explicit recovery actions. */
+export async function withRecoveryLease(runPath, command, execute) {
+    const initial = requireRunJournal(runPath);
+    if (commandDisposition(initial, command) === "duplicate")
+        return initial.state;
+    const owner = acquireSessionOwnerLeaseSync(journalPath(runPath));
+    try {
+        const snapshot = requireRunJournal(runPath);
+        if (commandDisposition(snapshot, command) === "duplicate")
+            return snapshot.state;
+        const journal = new VerifiedRunJournal(runPath, owner);
+        try {
+            return await execute({ snapshot, journal });
+        }
+        catch (error) {
+            if (error instanceof VerifiedRunError &&
+                journal.state.generation > snapshot.state.generation &&
+                !journal.state.receiptDigest)
+                return journal.append({ kind: "failed", code: error.code });
+            throw error;
+        }
+    }
+    finally {
+        owner.release();
+    }
+}
+//# sourceMappingURL=recovery-command.js.map

package/dist/core/verified-run/recovery-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-command.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAwB,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAErG,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG9D,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAmB;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,kBAAkB,CAAC,OAAwB,EAAE,OAAwB,EAAuB;IACpG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,IACC,KAAK,EAAE,IAAI,KAAK,SAAS;QACzB,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QACtC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,cAAc;QAEvD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CACpC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACb,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC;QACjG,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAC9C,EAAE,KAAK,CAAC;IACT,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,EAAE,IAAI,KAAK,kBAAkB,IAAI,QAAQ,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;QACjH,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAC7G,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU;QACjH,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,QAAQ;YACZ,IAAI,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,KAAK,CAAC,eAAe;gBAC5D,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM;QACP,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB;YACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;gBAAE,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACvF,IACC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW;gBAChD,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;gBAE1D,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC9C,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAe,EACf,OAAwB,EACxB,OAG4B,EACH;IACzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IAC/E,MAAM,KAAK,GAAG,4BAA4B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC;YACJ,OAAO,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IACC,KAAK,YAAY,gBAAgB;gBACjC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU;gBACpD,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa;gBAE5B,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;YAAS,CAAC;QACV,KAAK,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AAAA,CACD","sourcesContent":["import type { RunResumeCommand, RunTaskRetryCommand, RunWriterRestartCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { type JournalSnapshot, journalPath, readRunJournal, VerifiedRunJournal } from \"./journal.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport type RecoveryCommand = RunResumeCommand | RunWriterRestartCommand | RunTaskRetryCommand;\nexport function requireRunJournal(runPath: string): JournalSnapshot {\n\tconst journal = readRunJournal(runPath);\n\tif (!journal) throw new VerifiedRunError(\"missing_run\");\n\treturn journal;\n}\n\nfunction commandDisposition(journal: JournalSnapshot, command: RecoveryCommand): \"new\" | \"duplicate\" {\n\tconst first = journal.records[0]?.event;\n\tif (\n\t\tfirst?.kind !== \"created\" ||\n\t\tfirst.contract.runId !== command.runId ||\n\t\tdigestObject(first.contract) !== command.contractDigest\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (first.command.commandId === command.commandId) throw new VerifiedRunError(\"command_conflict\");\n\tconst previous = journal.records.find(\n\t\t({ event }) =>\n\t\t\t(event.kind === \"resumed\" || event.kind === \"writer_restarted\" || event.kind === \"tasks_retried\") &&\n\t\t\tevent.command.commandId === command.commandId,\n\t)?.event;\n\tif (previous?.kind === \"resumed\" || previous?.kind === \"writer_restarted\" || previous?.kind === \"tasks_retried\") {\n\t\tif (digestObject(previous.command) !== digestObject(command)) throw new VerifiedRunError(\"command_conflict\");\n\t\treturn \"duplicate\";\n\t}\n\tif (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tswitch (command.kind) {\n\t\tcase \"resume\":\n\t\t\tif (command.candidateDigest !== journal.state.candidateDigest)\n\t\t\t\tthrow new VerifiedRunError(\"candidate_mismatch\");\n\t\t\tbreak;\n\t\tcase \"retry_tasks\":\n\t\tcase \"restart_writer\":\n\t\t\tif (!journal.state.inputDigest) throw new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (\n\t\t\t\tcommand.baseDigest !== journal.state.inputDigest ||\n\t\t\t\tcommand.baseDigest !== first.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_mismatch\");\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = command;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\treturn \"new\";\n}\n\n/** One lease/CAS/idempotency boundary for all explicit recovery actions. */\nexport async function withRecoveryLease(\n\trunPath: string,\n\tcommand: RecoveryCommand,\n\texecute: (input: {\n\t\treadonly snapshot: JournalSnapshot;\n\t\treadonly journal: VerifiedRunJournal;\n\t}) => Promise<RunProjection>,\n): Promise<RunProjection> {\n\tconst initial = requireRunJournal(runPath);\n\tif (commandDisposition(initial, command) === \"duplicate\") return initial.state;\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (commandDisposition(snapshot, command) === \"duplicate\") return snapshot.state;\n\t\tconst journal = new VerifiedRunJournal(runPath, owner);\n\t\ttry {\n\t\t\treturn await execute({ snapshot, journal });\n\t\t} catch (error) {\n\t\t\tif (\n\t\t\t\terror instanceof VerifiedRunError &&\n\t\t\t\tjournal.state.generation > snapshot.state.generation &&\n\t\t\t\t!journal.state.receiptDigest\n\t\t\t)\n\t\t\t\treturn journal.append({ kind: \"failed\", code: error.code });\n\t\t\tthrow error;\n\t\t}\n\t} finally {\n\t\towner.release();\n\t}\n}\n"]}

package/dist/core/verified-run/recovery-projection.d.ts

@@ -0,0 +1,12 @@
+import type { RunEvent, WriterReduction } from "./run-types.ts";
+type RecoveryEvent = Extract<RunEvent, {
+    kind: "resumed" | "writer_restarted" | "tasks_retried";
+}>;
+/** Shared generation/command fence; only the writer variant resets attempt-local progress. */
+export declare function reduceRecoveryEvent(context: WriterReduction, event: RecoveryEvent, progress: {
+    readonly commands: Set<string>;
+    readonly checked: Set<string>;
+    readonly activeRole: "writer" | "verifier";
+}): void;
+export {};
+//# sourceMappingURL=recovery-projection.d.ts.map

package/dist/core/verified-run/recovery-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhE,KAAK,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,IAAI,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,CAAA;CAAE,CAAC,CAAC;AAEnG,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE;IACT,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC3C,GACC,IAAI,CAyFN","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}

package/dist/core/verified-run/recovery-projection.js

@@ -0,0 +1,88 @@
+import { MAX_VERIFIED_RUN_GENERATIONS } from "omk-protocol";
+import { retryTaskProjection } from "./dag-retry-projection.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+/** Shared generation/command fence; only the writer variant resets attempt-local progress. */
+export function reduceRecoveryEvent(context, event, progress) {
+    const state = context.state;
+    const command = event.command;
+    if (!state.budget)
+        throw new VerifiedRunError("resume_unavailable");
+    if (state.generation >= MAX_VERIFIED_RUN_GENERATIONS)
+        throw new VerifiedRunError("recovery_limit");
+    if (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)
+        throw new VerifiedRunError("stale_revision");
+    if (command.runId !== state.runId ||
+        command.contractDigest !== digestObject(context.contract) ||
+        progress.commands.has(command.commandId))
+        throw new VerifiedRunError("command_conflict");
+    if (event.reconciledExecutionIds.length !== state.activeExecutionIds.length ||
+        event.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index]))
+        throw new VerifiedRunError("integrity");
+    let deadline;
+    let tasks = state.tasks;
+    switch (event.kind) {
+        case "resumed":
+            if (!state.candidateDigest ||
+                state.writerOpen ||
+                state.verificationDeadlineMs === null ||
+                event.command.candidateDigest !== state.candidateDigest)
+                throw new VerifiedRunError("resume_unavailable");
+            if (state.activeExecutionIds.length && progress.activeRole !== "verifier")
+                throw new VerifiedRunError("integrity");
+            deadline = state.verificationDeadlineMs;
+            break;
+        case "tasks_retried":
+            if (state.activeExecutionIds.length && progress.activeRole !== "writer")
+                throw new VerifiedRunError("integrity");
+            tasks = retryTaskProjection(context, event);
+            deadline = state.budget.workDeadlineMs;
+            context.writerStarted = false;
+            context.writerFinished = tasks.every((task) => task.status === "succeeded");
+            context.producerStarted = false;
+            context.writerCommands = 0;
+            context.requestBaseline = state.modelRequests;
+            break;
+        case "writer_restarted":
+            if (context.contract.profile === "linux-command-dag-v1")
+                throw new VerifiedRunError("task_recovery_required");
+            if (!state.inputDigest ||
+                state.candidateDigest ||
+                event.command.baseDigest !== state.inputDigest ||
+                state.inputDigest !== context.contract.workspace.baseDigest)
+                throw new VerifiedRunError("input_checkpoint_missing");
+            if (state.activeExecutionIds.length && progress.activeRole !== "writer")
+                throw new VerifiedRunError("integrity");
+            if (context.contract.profile === "linux-scripted-agent-v1" &&
+                context.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1)
+                throw new VerifiedRunError("model_request_limit");
+            deadline = state.budget.workDeadlineMs;
+            context.writerStarted = false;
+            context.writerFinished = false;
+            context.producerStarted = false;
+            context.writerCommands = 0;
+            context.requestBaseline = state.modelRequests;
+            break;
+        default: {
+            const exhaustive = event;
+            throw new VerifiedRunError(String(exhaustive));
+        }
+    }
+    if (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)
+        throw new VerifiedRunError("deadline");
+    progress.commands.add(command.commandId);
+    progress.checked.clear();
+    context.state = {
+        ...state,
+        generation: state.generation + 1,
+        tasks,
+        execution: "running",
+        settlement: "settled",
+        verification: "not_requested",
+        writerOpen: false,
+        activeExecutionIds: [],
+        processes: [],
+        failure: null,
+        lastClockMs: event.observedMs,
+    };
+}
+//# sourceMappingURL=recovery-projection.js.map

package/dist/core/verified-run/recovery-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI9D,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAClC,OAAwB,EACxB,KAAoB,EACpB,QAIC,EACM;IACP,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,UAAU;QACjG,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IACC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC7B,OAAO,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QAExC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,IACC,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM;QACvE,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAExF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACb,IACC,CAAC,KAAK,CAAC,eAAe;gBACtB,KAAK,CAAC,UAAU;gBAChB,KAAK,CAAC,sBAAsB,KAAK,IAAI;gBACrC,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;gBAEvD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBACxE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC;YACxC,MAAM;QACP,KAAK,eAAe;YACnB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,KAAK,kBAAkB;YACtB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YAC9G,IACC,CAAC,KAAK,CAAC,WAAW;gBAClB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW;gBAC9C,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;gBAE3D,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB;gBACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAEpG,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnD,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;YAC/B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,QAAQ;QACnG,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,KAAK,GAAG;QACf,GAAG,KAAK;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;QAChC,KAAK;QACL,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,eAAe;QAC7B,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AAAA,CACF","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}