open-multi-agent-kit 0.98.3 → 0.98.5

package/dist/core/verified-run/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/core/verified-run/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACjC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE;QACzB,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,EAAU;IACvE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5G,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AAAA,CACD;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAQ,GAAG,OAAO,EAAW;IACnE,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,YAAY,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxG,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAiB,EAAQ;IACnE,IAAI,CAAC;QACJ,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QACzF,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9G,CAAC;AAAA,CACD;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAc,EAAU;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAAA,CAC1B;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,EAAU,EAAU;IAC9D,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AAAA,CAC/B;AAED,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,SAAiB,EAAQ;IACvF,IAAI,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,MAAM;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IACC,KAAK,KAAK,EAAE;QACZ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC;QAC5C,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;AAAA,CACD;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAQ;IACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAAA,CACpH","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from \"node:fs\";\nimport { basename, dirname, join, relative, resolve } from \"node:path\";\nimport { writeExclusiveFileDurablySync } from \"../durable-file-io.ts\";\nimport { canonicalJson } from \"../run-journal.ts\";\n\nexport class VerifiedRunError extends Error {\n\treadonly code: string;\n\tconstructor(code: string) {\n\t\tsuper(`verified-run: ${code}`);\n\t\tthis.name = \"VerifiedRunError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport const digestBytes = (bytes: Uint8Array | string): string => createHash(\"sha256\").update(bytes).digest(\"hex\");\nexport const digestObject = (value: unknown): string => digestBytes(canonicalJson(value));\n\nexport function readRegularFile(path: string, maxBytes: number): Buffer {\n\tconst fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);\n\ttry {\n\t\tconst before = fstatSync(fd, { bigint: true });\n\t\tif (!before.isFile() || before.nlink !== 1n) throw new VerifiedRunError(\"file_type\");\n\t\tif (before.size > BigInt(maxBytes)) throw new VerifiedRunError(\"storage_limit\");\n\t\tconst bytes = readFileSync(fd);\n\t\tconst after = fstatSync(fd, { bigint: true });\n\t\tif (before.size !== after.size || before.ctimeNs !== after.ctimeNs || BigInt(bytes.length) !== before.size) {\n\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t}\n\t\treturn bytes;\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n}\n\nexport function readJson(path: string, maxBytes = 1048576): unknown {\n\ttry {\n\t\treturn JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(readRegularFile(path, maxBytes)));\n\t} catch (error) {\n\t\tif (error instanceof SyntaxError || error instanceof TypeError) throw new VerifiedRunError(\"integrity\");\n\t\tthrow error;\n\t}\n}\n\nexport function publishBytes(path: string, bytes: Uint8Array): void {\n\ttry {\n\t\twriteExclusiveFileDurablySync(path, bytes);\n\t} catch (error) {\n\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"EEXIST\")) throw error;\n\t\tif (!readRegularFile(path, bytes.length).equals(Buffer.from(bytes))) throw new VerifiedRunError(\"integrity\");\n\t}\n}\n\nexport function publishObject(path: string, value: unknown): string {\n\tconst bytes = Buffer.from(canonicalJson(value));\n\tpublishBytes(path, bytes);\n\treturn digestBytes(bytes);\n}\n\n/** Resolve existing parents without creating state. State must never be part of a mounted workspace. */\nexport function stateRunPath(root: string, id: string): string {\n\tif (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(id)) throw new VerifiedRunError(\"run_id\");\n\treturn join(resolve(root), id);\n}\n\nexport function assertStateOutsideWorkspace(stateRoot: string, workspace: string): void {\n\tlet cursor = resolve(stateRoot);\n\tconst tail: string[] = [];\n\twhile (true) {\n\t\ttry {\n\t\t\tcursor = join(realpathSync(cursor), ...tail);\n\t\t\tbreak;\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"ENOENT\")) throw error;\n\t\t\ttail.unshift(basename(cursor));\n\t\t\tcursor = dirname(cursor);\n\t\t}\n\t}\n\tconst base = realpathSync(workspace);\n\tconst under = relative(base, cursor);\n\tconst contains = relative(cursor, base);\n\tif (\n\t\tunder === \"\" ||\n\t\t(!under.startsWith(\"../\") && under !== \"..\") ||\n\t\tcontains === \"\" ||\n\t\t(!contains.startsWith(\"../\") && contains !== \"..\")\n\t) {\n\t\tthrow new VerifiedRunError(\"state_scope\");\n\t}\n}\n\nexport function assertDirectory(path: string): void {\n\tif (!lstatSync(path).isDirectory() || realpathSync(path) !== resolve(path)) throw new VerifiedRunError(\"file_type\");\n}\n"]}

package/dist/core/verified-run/verification-phase.d.ts

@@ -0,0 +1,5 @@
+import type { RunPhaseContext } from "./phase-context.ts";
+import type { RunProjection } from "./run-types.ts";
+/** Both start and resume use this same verification path; no writer/model code is reachable here. */
+export declare function verifyCandidate(context: RunPhaseContext): Promise<RunProjection>;
+//# sourceMappingURL=verification-phase.d.ts.map

package/dist/core/verified-run/verification-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,qGAAqG;AACrG,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAiDtF","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}

package/dist/core/verified-run/verification-phase.js

@@ -0,0 +1,56 @@
+import { join } from "node:path";
+import { performance } from "node:perf_hooks";
+import { commandEnvironmentDigest } from "./broker.js";
+import { captureCandidate, loadCandidate, materializeCandidate } from "./candidate.js";
+import { storeCheckReceipt } from "./check-receipt.js";
+import { issueRunEvidence } from "./evidence.js";
+import { executeRunCommand } from "./owned-execution.js";
+import { localVerificationDeadline } from "./recovery-clock.js";
+import { digestBytes, VerifiedRunError } from "./storage.js";
+/** Both start and resume use this same verification path; no writer/model code is reachable here. */
+export async function verifyCandidate(context) {
+    const { contract, journal, runPath } = context;
+    const state = journal.state;
+    if (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)
+        throw new VerifiedRunError("resume_unavailable");
+    const deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);
+    if (commandEnvironmentDigest(contract, "gated-v1") !== state.environmentDigest)
+        throw new VerifiedRunError("environment_changed");
+    const candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);
+    const fixed = join(runPath, state.generation === 1 ? "candidate" : `candidate-${state.generation}`);
+    materializeCandidate(candidate, fixed);
+    const checks = [];
+    for (const check of contract.checks) {
+        const { executionId, result, timeoutMs } = await executeRunCommand(journal, { role: "verifier", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId }, { ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) });
+        checks.push({
+            claimId: check.claimId,
+            executionId,
+            stdoutDigest: digestBytes(result.stdout),
+            stderrDigest: digestBytes(result.stderr),
+            exitCode: result.exitCode,
+            failure: result.failure,
+            receiptCoreDigest: storeCheckReceipt(runPath, contract, {
+                check,
+                executionId,
+                result,
+                timeoutMs,
+                manifest: candidate.manifest,
+            }),
+        });
+    }
+    if (captureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||
+        commandEnvironmentDigest(contract, "gated-v1") !== state.environmentDigest)
+        throw new VerifiedRunError("integrity");
+    if (performance.now() >= deadline)
+        throw new VerifiedRunError("deadline");
+    const receipt = issueRunEvidence(runPath, contract, {
+        generation: state.generation,
+        candidateDigest: state.candidateDigest,
+        environmentDigest: state.environmentDigest,
+        checks,
+    });
+    if (performance.now() >= deadline || journal.state.generation !== state.generation)
+        throw new VerifiedRunError("deadline");
+    return journal.append({ kind: "evaluated", receiptDigest: receipt.digest, verified: receipt.verified });
+}
+//# sourceMappingURL=verification-phase.js.map

package/dist/core/verified-run/verification-phase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE7D,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAA0B;IACvF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAC/G,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAC7E,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACpG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,iBAAiB,CACjE,OAAO,EACP,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC1F,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7E,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW;YACX,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE;gBACvD,KAAK;gBACL,WAAW;gBACX,MAAM;gBACN,SAAS;gBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC5B,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;IACD,IACC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,eAAe;QACzE,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAE1E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,MAAM;KACN,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACjF,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAAA,CACxG","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}

package/dist/core/verified-run/work-recovery.d.ts

@@ -0,0 +1,8 @@
+import { type RunContract } from "omk-protocol";
+import type { JournalSnapshot } from "./journal.ts";
+/** Common immutable-input, original-budget and observed-process boundary for local work recovery. */
+export declare function assertWorkRecoverable(runPath: string, snapshot: JournalSnapshot): {
+    readonly contract: RunContract;
+    readonly remainingMs: number;
+};
+//# sourceMappingURL=work-recovery.d.ts.map

package/dist/core/verified-run/work-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/work-recovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAG9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAKpD,qGAAqG;AACrG,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,eAAe,GACvB;IAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAiClE","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunContract } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\n\n/** Common immutable-input, original-budget and observed-process boundary for local work recovery. */\nexport function assertWorkRecoverable(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n): { readonly contract: RunContract; readonly remainingMs: number } {\n\tconst state = snapshot.state;\n\tconst first = snapshot.records[0]?.event;\n\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"resume_terminal\");\n\tif (first?.kind !== \"created\" || !state.inputDigest || !state.budget || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\tif (state.candidateDigest || state.verificationDeadlineMs !== null) throw new VerifiedRunError(\"candidate_present\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remainingMs = remainingRunTime(state.budget, state.budget.workDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remainingMs <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = snapshot.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((item) => item.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"writer\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.inputDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn { contract: first.contract, remainingMs };\n}\n"]}

package/dist/core/verified-run/work-recovery.js

@@ -0,0 +1,44 @@
+import { join } from "node:path";
+import { MAX_VERIFIED_RUN_GENERATIONS } from "omk-protocol";
+import { commandEnvironmentDigest } from "./broker.js";
+import { loadCandidate } from "./candidate.js";
+import { probeNamespace } from "./namespace-identity.js";
+import { readRunClock, remainingRunTime } from "./recovery-clock.js";
+import { readRegularFile, VerifiedRunError } from "./storage.js";
+/** Common immutable-input, original-budget and observed-process boundary for local work recovery. */
+export function assertWorkRecoverable(runPath, snapshot) {
+    const state = snapshot.state;
+    const first = snapshot.records[0]?.event;
+    if (state.execution === "failed" || state.receiptDigest)
+        throw new VerifiedRunError("resume_terminal");
+    if (first?.kind !== "created" || !state.inputDigest || !state.budget || !state.environmentDigest)
+        throw new VerifiedRunError("input_checkpoint_missing");
+    if (state.candidateDigest || state.verificationDeadlineMs !== null)
+        throw new VerifiedRunError("candidate_present");
+    if (state.generation >= MAX_VERIFIED_RUN_GENERATIONS)
+        throw new VerifiedRunError("recovery_limit");
+    const clock = readRunClock();
+    const remainingMs = remainingRunTime(state.budget, state.budget.workDeadlineMs, clock);
+    if (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs))
+        throw new VerifiedRunError("clock_rollback");
+    if (remainingMs <= 0)
+        throw new VerifiedRunError("deadline");
+    for (const id of state.activeExecutionIds) {
+        const dispatch = snapshot.records.find((record) => record.generation === state.generation &&
+            record.event.kind === "dispatch" &&
+            record.event.executionId === id)?.event;
+        const identity = state.processes.find((item) => item.executionId === id)?.identity;
+        if (dispatch?.kind !== "dispatch" ||
+            dispatch.role !== "writer" ||
+            !identity ||
+            probeNamespace(identity) !== "gone")
+            throw new VerifiedRunError("unsettled");
+    }
+    if (readRegularFile(join(runPath, "issuer.key"), 32).length !== 32)
+        throw new VerifiedRunError("integrity");
+    loadCandidate(runPath, state.inputDigest, first.contract.budget);
+    if (commandEnvironmentDigest(first.contract, "gated-v1") !== state.environmentDigest)
+        throw new VerifiedRunError("integrity");
+    return { contract: first.contract, remainingMs };
+}
+//# sourceMappingURL=work-recovery.js.map

package/dist/core/verified-run/work-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-recovery.js","sourceRoot":"","sources":["../../../src/core/verified-run/work-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAoB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CACpC,OAAe,EACf,QAAyB,EAC0C;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACzC,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACvG,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAC/F,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpH,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9G,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CACrC,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;YAChC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAChC,EAAE,KAAK,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC;QACnF,IACC,QAAQ,EAAE,IAAI,KAAK,UAAU;YAC7B,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,QAAQ;YACT,cAAc,CAAC,QAAQ,CAAC,KAAK,MAAM;YAEnC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5G,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QACnF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;AAAA,CACjD","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunContract } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\n\n/** Common immutable-input, original-budget and observed-process boundary for local work recovery. */\nexport function assertWorkRecoverable(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n): { readonly contract: RunContract; readonly remainingMs: number } {\n\tconst state = snapshot.state;\n\tconst first = snapshot.records[0]?.event;\n\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"resume_terminal\");\n\tif (first?.kind !== \"created\" || !state.inputDigest || !state.budget || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\tif (state.candidateDigest || state.verificationDeadlineMs !== null) throw new VerifiedRunError(\"candidate_present\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remainingMs = remainingRunTime(state.budget, state.budget.workDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remainingMs <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = snapshot.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((item) => item.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"writer\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.inputDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn { contract: first.contract, remainingMs };\n}\n"]}

package/dist/core/verified-run/writer-completion.d.ts

@@ -0,0 +1,4 @@
+import type { RunPhaseContext } from "./phase-context.ts";
+/** Seal output only against the input that was durably pinned before this run's first writer. */
+export declare function publishWriterCandidate(context: RunPhaseContext, workspace: string, workDeadline: number): void;
+//# sourceMappingURL=writer-completion.d.ts.map

package/dist/core/verified-run/writer-completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-completion.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-completion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAI1D,iGAAiG;AACjG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAqB9G","sourcesContent":["import { performance } from \"node:perf_hooks\";\nimport { assertCandidateScope, captureCandidate, loadCandidate, storeCandidate } from \"./candidate.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { readRunClock } from \"./recovery-clock.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/** Seal output only against the input that was durably pinned before this run's first writer. */\nexport function publishWriterCandidate(context: RunPhaseContext, workspace: string, workDeadline: number): void {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.inputDigest || !state.budget) throw new VerifiedRunError(\"input_checkpoint_missing\");\n\tconst base = loadCandidate(runPath, state.inputDigest, contract.budget);\n\tconst candidate = captureCandidate(workspace, contract.budget);\n\tassertCandidateScope(base.manifest, candidate.manifest, contract.writablePaths);\n\tstoreCandidate(candidate, runPath);\n\tconst observed = readRunClock();\n\tif (\n\t\tobserved.bootId !== state.budget.bootId ||\n\t\tobserved.nowMs > state.budget.workDeadlineMs ||\n\t\tperformance.now() >= workDeadline\n\t)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tjournal.append({\n\t\tkind: \"candidate\",\n\t\tdigest: candidate.digest,\n\t\tobservedMs: observed.nowMs,\n\t\tverificationDeadlineMs: Math.min(observed.nowMs + contract.budget.verifyMs, state.budget.verifyCapMs),\n\t});\n}\n"]}

package/dist/core/verified-run/writer-completion.js

@@ -0,0 +1,27 @@
+import { performance } from "node:perf_hooks";
+import { assertCandidateScope, captureCandidate, loadCandidate, storeCandidate } from "./candidate.js";
+import { readRunClock } from "./recovery-clock.js";
+import { VerifiedRunError } from "./storage.js";
+/** Seal output only against the input that was durably pinned before this run's first writer. */
+export function publishWriterCandidate(context, workspace, workDeadline) {
+    const { contract, journal, runPath } = context;
+    const state = journal.state;
+    if (!state.inputDigest || !state.budget)
+        throw new VerifiedRunError("input_checkpoint_missing");
+    const base = loadCandidate(runPath, state.inputDigest, contract.budget);
+    const candidate = captureCandidate(workspace, contract.budget);
+    assertCandidateScope(base.manifest, candidate.manifest, contract.writablePaths);
+    storeCandidate(candidate, runPath);
+    const observed = readRunClock();
+    if (observed.bootId !== state.budget.bootId ||
+        observed.nowMs > state.budget.workDeadlineMs ||
+        performance.now() >= workDeadline)
+        throw new VerifiedRunError("deadline");
+    journal.append({
+        kind: "candidate",
+        digest: candidate.digest,
+        observedMs: observed.nowMs,
+        verificationDeadlineMs: Math.min(observed.nowMs + contract.budget.verifyMs, state.budget.verifyCapMs),
+    });
+}
+//# sourceMappingURL=writer-completion.js.map

package/dist/core/verified-run/writer-completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-completion.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-completion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEvG,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,SAAiB,EAAE,YAAoB,EAAQ;IAC/G,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAChF,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IACC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;QACvC,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc;QAC5C,WAAW,CAAC,GAAG,EAAE,IAAI,YAAY;QAEjC,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;KACrG,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { performance } from \"node:perf_hooks\";\nimport { assertCandidateScope, captureCandidate, loadCandidate, storeCandidate } from \"./candidate.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { readRunClock } from \"./recovery-clock.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/** Seal output only against the input that was durably pinned before this run's first writer. */\nexport function publishWriterCandidate(context: RunPhaseContext, workspace: string, workDeadline: number): void {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.inputDigest || !state.budget) throw new VerifiedRunError(\"input_checkpoint_missing\");\n\tconst base = loadCandidate(runPath, state.inputDigest, contract.budget);\n\tconst candidate = captureCandidate(workspace, contract.budget);\n\tassertCandidateScope(base.manifest, candidate.manifest, contract.writablePaths);\n\tstoreCandidate(candidate, runPath);\n\tconst observed = readRunClock();\n\tif (\n\t\tobserved.bootId !== state.budget.bootId ||\n\t\tobserved.nowMs > state.budget.workDeadlineMs ||\n\t\tperformance.now() >= workDeadline\n\t)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tjournal.append({\n\t\tkind: \"candidate\",\n\t\tdigest: candidate.digest,\n\t\tobservedMs: observed.nowMs,\n\t\tverificationDeadlineMs: Math.min(observed.nowMs + contract.budget.verifyMs, state.budget.verifyCapMs),\n\t});\n}\n"]}

package/dist/core/verified-run/writer-phase.d.ts

@@ -0,0 +1,8 @@
+import type { RunPhaseContext } from "./phase-context.ts";
+import type { VerifiedRunRuntime } from "./session-port.ts";
+export declare function executeWriter(context: RunPhaseContext, options: {
+    readonly workspace: string;
+    readonly deadline: number;
+    readonly runtime?: VerifiedRunRuntime;
+}): Promise<void>;
+//# sourceMappingURL=writer-phase.d.ts.map

package/dist/core/verified-run/writer-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAsB,aAAa,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IACR,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACtC,GACC,OAAO,CAAC,IAAI,CAAC,CA+Df","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-phase.js

@@ -0,0 +1,76 @@
+import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
+import { executeDag } from "./dag-phase.js";
+import { executeRunCommand } from "./owned-execution.js";
+import { executeScriptedWriter } from "./scripted-writer.js";
+import { VerifiedRunError } from "./storage.js";
+export async function executeWriter(context, options) {
+    const { contract, journal } = context;
+    const execute = (request, toolSignal) => {
+        const signals = [context.signal, toolSignal].filter((signal) => signal !== undefined);
+        return executeRunCommand(journal, request, {
+            ...contract.budget,
+            ...(signals.length ? { signal: AbortSignal.any(signals) } : {}),
+        });
+    };
+    switch (contract.profile) {
+        case "linux-command-dag-v1":
+            return executeDag(context, options);
+        case "linux-command-v1": {
+            const writer = await execute({
+                role: "writer",
+                argv: contract.writer,
+                workspace: options.workspace,
+                deadline: options.deadline,
+                claimId: null,
+            });
+            if (writer.result.failure)
+                throw new VerifiedRunError(writer.result.failure);
+            return;
+        }
+        case "linux-scripted-agent-v1": {
+            const runtime = options.runtime;
+            if (!runtime)
+                throw new VerifiedRunError("writer_backend_missing");
+            const writer = contract.writer;
+            const requestLimit = writer.maxRequests - journal.state.modelRequests;
+            if (requestLimit <= 0)
+                throw new VerifiedRunError("model_request_limit");
+            journal.append({ kind: "writer_opened" });
+            let completed = false;
+            try {
+                await executeScriptedWriter(writer, contract.goal, {
+                    runtime,
+                    workspace: options.workspace,
+                    deadline: options.deadline,
+                    requestLimit,
+                    ...(context.signal ? { signal: context.signal } : {}),
+                    beforeRequest: () => {
+                        if (performance.now() >= options.deadline)
+                            throw new VerifiedRunError("deadline");
+                        journal.append({ kind: "model_request", requestId: randomUUID() });
+                        if (performance.now() >= options.deadline)
+                            throw new VerifiedRunError("deadline");
+                    },
+                    executeStep: (index, signal) => {
+                        const argv = writer.steps[index];
+                        if (!argv)
+                            throw new VerifiedRunError("writer_step");
+                        return execute({ role: "writer", argv, workspace: options.workspace, deadline: options.deadline, claimId: null }, signal);
+                    },
+                });
+                completed = true;
+            }
+            finally {
+                if (journal.state.activeExecutionIds.length === 0)
+                    journal.append({ kind: "writer_closed", completed });
+            }
+            return;
+        }
+        default: {
+            const exhaustive = contract;
+            throw new VerifiedRunError(String(exhaustive));
+        }
+    }
+}
+//# sourceMappingURL=writer-phase.js.map

package/dist/core/verified-run/writer-phase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAwB,EACxB,OAIC,EACe;IAChB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAwB,EAAE,UAAwB,EAAE,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC7G,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE;YAC1C,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IAAA,CACH,CAAC;IACF,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,sBAAsB;YAC1B,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,KAAK,kBAAkB,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC5B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAI;aACb,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7E,OAAO;QACR,CAAC;QACD,KAAK,yBAAyB,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YACtE,IAAI,YAAY,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACzE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;oBAClD,OAAO;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,YAAY;oBACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,aAAa,EAAE,GAAG,EAAE,CAAC;wBACpB,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBAClF,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;wBACnE,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAAA,CAClF;oBACD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;wBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACjC,IAAI,CAAC,IAAI;4BAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;wBACrD,OAAO,OAAO,CACb,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EACjG,MAAM,CACN,CAAC;oBAAA,CACF;iBACD,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACV,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;QACR,CAAC;QACD,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;AAAA,CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-projection.d.ts

@@ -0,0 +1,11 @@
+import type { RunEvent, WriterReduction } from "./run-types.ts";
+type WriterEvent = Extract<RunEvent, {
+    kind: "writer_opened" | "model_request" | "writer_closed";
+}>;
+export declare function acceptWriterDispatch(context: WriterReduction, event: Extract<RunEvent, {
+    kind: "dispatch";
+}>): void;
+/** Mutates only the private replay accumulator; no work, clocks, or caller data are consulted. */
+export declare function reduceWriterEvent(context: WriterReduction, event: WriterEvent): void;
+export {};
+//# sourceMappingURL=writer-projection.d.ts.map

package/dist/core/verified-run/writer-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhE,KAAK,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC,CAAC;AAEpG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,IAAI,CA6BnH;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CA0CpF","sourcesContent":["import type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\ntype WriterEvent = Extract<RunEvent, { kind: \"writer_opened\" | \"model_request\" | \"writer_closed\" }>;\n\nexport function acceptWriterDispatch(context: WriterReduction, event: Extract<RunEvent, { kind: \"dispatch\" }>): void {\n\tconst { state, contract } = context;\n\tif (event.claimId !== null || state.candidateDigest) throw new VerifiedRunError(\"integrity\");\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\tif (context.writerStarted) throw new VerifiedRunError(\"integrity\");\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\tif (\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tcontext.writerCommands >= contract.writer.steps.length ||\n\t\t\t\tstate.modelRequests - context.requestBaseline <= context.writerCommands\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\tif (\n\t\t\t\tcontext.writerStarted ||\n\t\t\t\t!state.tasks.some((task) => task.status === \"running\" && task.generation === state.generation)\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"task_not_ready\");\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tcontext.writerStarted = true;\n\tcontext.writerCommands += 1;\n}\n\n/** Mutates only the private replay accumulator; no work, clocks, or caller data are consulted. */\nexport function reduceWriterEvent(context: WriterReduction, event: WriterEvent): void {\n\tconst state = context.state;\n\tconst scripted = context.contract.profile === \"linux-scripted-agent-v1\" ? context.contract.writer : undefined;\n\tswitch (event.kind) {\n\t\tcase \"writer_opened\":\n\t\t\tif (!scripted || context.producerStarted || context.writerStarted || state.candidateDigest)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcontext.producerStarted = true;\n\t\t\tcontext.state = { ...state, writerOpen: true, execution: \"running\", settlement: \"open\" };\n\t\t\treturn;\n\t\tcase \"model_request\":\n\t\t\tif (\n\t\t\t\t!scripted ||\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tcontext.requests.has(event.requestId) ||\n\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\tstate.modelRequests >= scripted.maxRequests\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tcontext.requests.add(event.requestId);\n\t\t\tcontext.state = { ...state, modelRequests: state.modelRequests + 1 };\n\t\t\treturn;\n\t\tcase \"writer_closed\":\n\t\t\tif (\n\t\t\t\t!scripted ||\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t(event.completed &&\n\t\t\t\t\t(!context.writerFinished ||\n\t\t\t\t\t\tstate.failure ||\n\t\t\t\t\t\tcontext.writerCommands !== scripted.steps.length ||\n\t\t\t\t\t\tstate.modelRequests - context.requestBaseline < scripted.steps.length + 1))\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcontext.writerFinished = event.completed;\n\t\t\tcontext.state = { ...state, writerOpen: false, settlement: \"settled\" };\n\t\t\treturn;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-projection.js

@@ -0,0 +1,70 @@
+import { VerifiedRunError } from "./storage.js";
+export function acceptWriterDispatch(context, event) {
+    const { state, contract } = context;
+    if (event.claimId !== null || state.candidateDigest)
+        throw new VerifiedRunError("integrity");
+    switch (contract.profile) {
+        case "linux-command-v1":
+            if (context.writerStarted)
+                throw new VerifiedRunError("integrity");
+            break;
+        case "linux-scripted-agent-v1":
+            if (!state.writerOpen ||
+                context.writerCommands >= contract.writer.steps.length ||
+                state.modelRequests - context.requestBaseline <= context.writerCommands)
+                throw new VerifiedRunError("integrity");
+            break;
+        case "linux-command-dag-v1":
+            if (context.writerStarted ||
+                !state.tasks.some((task) => task.status === "running" && task.generation === state.generation))
+                throw new VerifiedRunError("task_not_ready");
+            break;
+        default: {
+            const exhaustive = contract;
+            throw new VerifiedRunError(String(exhaustive));
+        }
+    }
+    context.writerStarted = true;
+    context.writerCommands += 1;
+}
+/** Mutates only the private replay accumulator; no work, clocks, or caller data are consulted. */
+export function reduceWriterEvent(context, event) {
+    const state = context.state;
+    const scripted = context.contract.profile === "linux-scripted-agent-v1" ? context.contract.writer : undefined;
+    switch (event.kind) {
+        case "writer_opened":
+            if (!scripted || context.producerStarted || context.writerStarted || state.candidateDigest)
+                throw new VerifiedRunError("integrity");
+            context.producerStarted = true;
+            context.state = { ...state, writerOpen: true, execution: "running", settlement: "open" };
+            return;
+        case "model_request":
+            if (!scripted ||
+                !state.writerOpen ||
+                context.requests.has(event.requestId) ||
+                state.activeExecutionIds.length ||
+                state.modelRequests >= scripted.maxRequests)
+                throw new VerifiedRunError("model_request_limit");
+            context.requests.add(event.requestId);
+            context.state = { ...state, modelRequests: state.modelRequests + 1 };
+            return;
+        case "writer_closed":
+            if (!scripted ||
+                !state.writerOpen ||
+                state.activeExecutionIds.length ||
+                (event.completed &&
+                    (!context.writerFinished ||
+                        state.failure ||
+                        context.writerCommands !== scripted.steps.length ||
+                        state.modelRequests - context.requestBaseline < scripted.steps.length + 1)))
+                throw new VerifiedRunError("integrity");
+            context.writerFinished = event.completed;
+            context.state = { ...state, writerOpen: false, settlement: "settled" };
+            return;
+        default: {
+            const exhaustive = event;
+            throw new VerifiedRunError(String(exhaustive));
+        }
+    }
+}
+//# sourceMappingURL=writer-projection.js.map

package/dist/core/verified-run/writer-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-projection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIhD,MAAM,UAAU,oBAAoB,CAAC,OAAwB,EAAE,KAA8C,EAAQ;IACpH,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7F,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,kBAAkB;YACtB,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM;QACP,KAAK,yBAAyB;YAC7B,IACC,CAAC,KAAK,CAAC,UAAU;gBACjB,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBACtD,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,cAAc;gBAEvE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM;QACP,KAAK,sBAAsB;YAC1B,IACC,OAAO,CAAC,aAAa;gBACrB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;gBAE9F,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC9C,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;AAAA,CAC5B;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,KAAkB,EAAQ;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,eAAe;YACnB,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe;gBACzF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YACzF,OAAO;QACR,KAAK,eAAe;YACnB,IACC,CAAC,QAAQ;gBACT,CAAC,KAAK,CAAC,UAAU;gBACjB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBACrC,KAAK,CAAC,kBAAkB,CAAC,MAAM;gBAC/B,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,WAAW;gBAE3C,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACrE,OAAO;QACR,KAAK,eAAe;YACnB,IACC,CAAC,QAAQ;gBACT,CAAC,KAAK,CAAC,UAAU;gBACjB,KAAK,CAAC,kBAAkB,CAAC,MAAM;gBAC/B,CAAC,KAAK,CAAC,SAAS;oBACf,CAAC,CAAC,OAAO,CAAC,cAAc;wBACvB,KAAK,CAAC,OAAO;wBACb,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;wBAChD,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAE7E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;YACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YACvE,OAAO;QACR,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;AAAA,CACD","sourcesContent":["import type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\ntype WriterEvent = Extract<RunEvent, { kind: \"writer_opened\" | \"model_request\" | \"writer_closed\" }>;\n\nexport function acceptWriterDispatch(context: WriterReduction, event: Extract<RunEvent, { kind: \"dispatch\" }>): void {\n\tconst { state, contract } = context;\n\tif (event.claimId !== null || state.candidateDigest) throw new VerifiedRunError(\"integrity\");\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-v1\":\n\t\t\tif (context.writerStarted) throw new VerifiedRunError(\"integrity\");\n\t\t\tbreak;\n\t\tcase \"linux-scripted-agent-v1\":\n\t\t\tif (\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tcontext.writerCommands >= contract.writer.steps.length ||\n\t\t\t\tstate.modelRequests - context.requestBaseline <= context.writerCommands\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tbreak;\n\t\tcase \"linux-command-dag-v1\":\n\t\t\tif (\n\t\t\t\tcontext.writerStarted ||\n\t\t\t\t!state.tasks.some((task) => task.status === \"running\" && task.generation === state.generation)\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"task_not_ready\");\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tcontext.writerStarted = true;\n\tcontext.writerCommands += 1;\n}\n\n/** Mutates only the private replay accumulator; no work, clocks, or caller data are consulted. */\nexport function reduceWriterEvent(context: WriterReduction, event: WriterEvent): void {\n\tconst state = context.state;\n\tconst scripted = context.contract.profile === \"linux-scripted-agent-v1\" ? context.contract.writer : undefined;\n\tswitch (event.kind) {\n\t\tcase \"writer_opened\":\n\t\t\tif (!scripted || context.producerStarted || context.writerStarted || state.candidateDigest)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcontext.producerStarted = true;\n\t\t\tcontext.state = { ...state, writerOpen: true, execution: \"running\", settlement: \"open\" };\n\t\t\treturn;\n\t\tcase \"model_request\":\n\t\t\tif (\n\t\t\t\t!scripted ||\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tcontext.requests.has(event.requestId) ||\n\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\tstate.modelRequests >= scripted.maxRequests\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tcontext.requests.add(event.requestId);\n\t\t\tcontext.state = { ...state, modelRequests: state.modelRequests + 1 };\n\t\t\treturn;\n\t\tcase \"writer_closed\":\n\t\t\tif (\n\t\t\t\t!scripted ||\n\t\t\t\t!state.writerOpen ||\n\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t(event.completed &&\n\t\t\t\t\t(!context.writerFinished ||\n\t\t\t\t\t\tstate.failure ||\n\t\t\t\t\t\tcontext.writerCommands !== scripted.steps.length ||\n\t\t\t\t\t\tstate.modelRequests - context.requestBaseline < scripted.steps.length + 1))\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcontext.writerFinished = event.completed;\n\t\t\tcontext.state = { ...state, writerOpen: false, settlement: \"settled\" };\n\t\t\treturn;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-recovery.d.ts

@@ -0,0 +1,16 @@
+import type { RunWriterRestartCommand } from "omk-protocol";
+import type { RunProjection } from "./run-types.ts";
+import type { VerifiedRunRuntime } from "./session-port.ts";
+export interface WriterRecoveryInspection {
+    readonly state: RunProjection;
+    readonly readiness: "ready" | "terminal" | "input_checkpoint_missing" | "candidate_present" | "unsettled" | "expired" | "clock_changed" | "clock_rollback" | "recovery_limit" | "model_request_limit" | "integrity";
+    readonly remainingWorkMs: number | null;
+    readonly ownership: "lease_required";
+}
+export declare function inspectWriterRecovery(runPath: string): WriterRecoveryInspection;
+/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */
+export declare function restartIsolatedWriter(runPath: string, command: RunWriterRestartCommand, options: {
+    readonly runtime?: VerifiedRunRuntime;
+    readonly signal?: AbortSignal;
+}): Promise<RunProjection>;
+//# sourceMappingURL=writer-recovery.d.ts.map

package/dist/core/verified-run/writer-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-recovery.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAO5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EACf,OAAO,GACP,UAAU,GACV,0BAA0B,GAC1B,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,WAAW,CAAC;IACf,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACrC;AAaD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,wBAAwB,CA0C/E;AAED,4GAA4G;AAC5G,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAC/E,OAAO,CAAC,aAAa,CAAC,CAkCxB","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunWriterRestartCommand } from \"omk-protocol\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\nimport { assertWorkRecoverable } from \"./work-recovery.ts\";\nimport { publishWriterCandidate } from \"./writer-completion.ts\";\nimport { executeWriter } from \"./writer-phase.ts\";\n\nexport interface WriterRecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"input_checkpoint_missing\"\n\t\t| \"candidate_present\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"recovery_limit\"\n\t\t| \"model_request_limit\"\n\t\t| \"integrity\";\n\treadonly remainingWorkMs: number | null;\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertWriterRecoverable(runPath: string, snapshot: JournalSnapshot): number {\n\tconst { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);\n\tif (contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\tif (\n\t\tcontract.profile === \"linux-scripted-agent-v1\" &&\n\t\tcontract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1\n\t)\n\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\treturn remainingMs;\n}\n\nexport function inspectWriterRecovery(runPath: string): WriterRecoveryInspection {\n\tconst snapshot = requireRunJournal(runPath);\n\tlet readiness: WriterRecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingWorkMs: number | null = null;\n\ttry {\n\t\tremainingWorkMs = assertWriterRecoverable(runPath, snapshot);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingWorkMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"input_checkpoint_missing\":\n\t\t\t\treadiness = \"input_checkpoint_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_present\":\n\t\t\t\treadiness = \"candidate_present\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tcase \"model_request_limit\":\n\t\t\t\treadiness = \"model_request_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: \"lease_required\" });\n}\n\n/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */\nexport async function restartIsolatedWriter(\n\trunPath: string,\n\tcommand: RunWriterRestartCommand,\n\toptions: { readonly runtime?: VerifiedRunRuntime; readonly signal?: AbortSignal },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tif (first.contract.profile === \"linux-scripted-agent-v1\" && !options.runtime)\n\t\t\tthrow new VerifiedRunError(\"writer_backend_missing\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"writer_restarted\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\tconst state = journal.state;\n\t\tif (!state.budget || !state.inputDigest) throw new VerifiedRunError(\"integrity\");\n\t\tconst deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);\n\t\tconst base = loadCandidate(runPath, state.inputDigest, first.contract.budget);\n\t\tconst workspace = join(runPath, `writer-${state.generation}`);\n\t\tmaterializeCandidate(base, workspace);\n\t\tconst context = {\n\t\t\trunPath,\n\t\t\tcontract: first.contract,\n\t\t\tjournal,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t};\n\t\tawait executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });\n\t\tpublishWriterCandidate(context, workspace, deadline);\n\t\treturn verifyCandidate(context);\n\t});\n}\n"]}

package/dist/core/verified-run/writer-recovery.js

@@ -0,0 +1,107 @@
+import { join } from "node:path";
+import { performance } from "node:perf_hooks";
+import { probeVerifiedSandbox } from "./broker.js";
+import { loadCandidate, materializeCandidate } from "./candidate.js";
+import { preflightCheckReceipts } from "./check-receipt.js";
+import { readRunClock, remainingRunTime } from "./recovery-clock.js";
+import { requireRunJournal, withRecoveryLease } from "./recovery-command.js";
+import { VerifiedRunError } from "./storage.js";
+import { verifyCandidate } from "./verification-phase.js";
+import { assertWorkRecoverable } from "./work-recovery.js";
+import { publishWriterCandidate } from "./writer-completion.js";
+import { executeWriter } from "./writer-phase.js";
+function assertWriterRecoverable(runPath, snapshot) {
+    const { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);
+    if (contract.profile === "linux-command-dag-v1")
+        throw new VerifiedRunError("task_recovery_required");
+    if (contract.profile === "linux-scripted-agent-v1" &&
+        contract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1)
+        throw new VerifiedRunError("model_request_limit");
+    return remainingMs;
+}
+export function inspectWriterRecovery(runPath) {
+    const snapshot = requireRunJournal(runPath);
+    let readiness = "ready";
+    let remainingWorkMs = null;
+    try {
+        remainingWorkMs = assertWriterRecoverable(runPath, snapshot);
+    }
+    catch (error) {
+        if (!(error instanceof Error))
+            throw error;
+        switch (error instanceof VerifiedRunError ? error.code : "integrity") {
+            case "resume_terminal":
+                readiness = "terminal";
+                break;
+            case "deadline":
+                readiness = "expired";
+                remainingWorkMs = 0;
+                break;
+            case "input_checkpoint_missing":
+                readiness = "input_checkpoint_missing";
+                break;
+            case "candidate_present":
+                readiness = "candidate_present";
+                break;
+            case "unsettled":
+                readiness = "unsettled";
+                break;
+            case "clock_changed":
+                readiness = "clock_changed";
+                break;
+            case "clock_rollback":
+                readiness = "clock_rollback";
+                break;
+            case "recovery_limit":
+                readiness = "recovery_limit";
+                break;
+            case "model_request_limit":
+                readiness = "model_request_limit";
+                break;
+            default:
+                readiness = "integrity";
+        }
+    }
+    return Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: "lease_required" });
+}
+/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */
+export async function restartIsolatedWriter(runPath, command, options) {
+    if (options.signal?.aborted)
+        throw new VerifiedRunError("cancelled");
+    return withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {
+        assertWriterRecoverable(runPath, snapshot);
+        const first = snapshot.records[0]?.event;
+        if (first?.kind !== "created")
+            throw new VerifiedRunError("integrity");
+        if (first.contract.profile === "linux-scripted-agent-v1" && !options.runtime)
+            throw new VerifiedRunError("writer_backend_missing");
+        preflightCheckReceipts(first.contract);
+        probeVerifiedSandbox();
+        assertWriterRecoverable(runPath, snapshot);
+        if (options.signal?.aborted)
+            throw new VerifiedRunError("cancelled");
+        journal.append({
+            kind: "writer_restarted",
+            command,
+            observedMs: readRunClock().nowMs,
+            reconciledExecutionIds: snapshot.state.activeExecutionIds,
+        });
+        const state = journal.state;
+        if (!state.budget || !state.inputDigest)
+            throw new VerifiedRunError("integrity");
+        const deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);
+        const base = loadCandidate(runPath, state.inputDigest, first.contract.budget);
+        const workspace = join(runPath, `writer-${state.generation}`);
+        materializeCandidate(base, workspace);
+        const context = {
+            runPath,
+            contract: first.contract,
+            journal,
+            ...(options.signal ? { signal: options.signal } : {}),
+        };
+        await executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });
+        publishWriterCandidate(context, workspace, deadline);
+        return verifyCandidate(context);
+    });
+}
+//# sourceMappingURL=writer-recovery.js.map