open-multi-agent-kit 0.98.4 → 0.98.5

package/dist/core/verified-run/owned-execution.d.ts

@@ -0,0 +1,21 @@
+import { type SandboxOutcome } from "./broker.ts";
+import type { VerifiedRunJournal } from "./journal.ts";
+export interface OwnedRunCommand {
+    readonly role: "writer" | "verifier";
+    readonly argv: readonly string[];
+    readonly workspace: string;
+    readonly deadline: number;
+    readonly claimId: string | null;
+}
+export interface OwnedRunResult {
+    readonly executionId: string;
+    readonly result: SandboxOutcome;
+    readonly timeoutMs: number;
+}
+/** The mandatory durable intent boundary is shared by command and AgentSession writers. */
+export declare function executeRunCommand(journal: VerifiedRunJournal, request: OwnedRunCommand, policy: {
+    readonly cleanupMs: number;
+    readonly maxOutputBytes: number;
+    readonly signal?: AbortSignal;
+}): Promise<OwnedRunResult>;
+//# sourceMappingURL=owned-execution.d.ts.map

package/dist/core/verified-run/owned-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owned-execution.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/owned-execution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AACD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,2FAA2F;AAC3F,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B,GACC,OAAO,CAAC,cAAc,CAAC,CAgCzB","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeSandbox, type SandboxOutcome } from \"./broker.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface OwnedRunCommand {\n\treadonly role: \"writer\" | \"verifier\";\n\treadonly argv: readonly string[];\n\treadonly workspace: string;\n\treadonly deadline: number;\n\treadonly claimId: string | null;\n}\nexport interface OwnedRunResult {\n\treadonly executionId: string;\n\treadonly result: SandboxOutcome;\n\treadonly timeoutMs: number;\n}\n\n/** The mandatory durable intent boundary is shared by command and AgentSession writers. */\nexport async function executeRunCommand(\n\tjournal: VerifiedRunJournal,\n\trequest: OwnedRunCommand,\n\tpolicy: {\n\t\treadonly cleanupMs: number;\n\t\treadonly maxOutputBytes: number;\n\t\treadonly signal?: AbortSignal;\n\t},\n): Promise<OwnedRunResult> {\n\tif (Math.floor(request.deadline - performance.now()) <= 0) throw new VerifiedRunError(\"deadline\");\n\tif (policy.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst generation = journal.state.generation;\n\tconst executionId = randomUUID();\n\tjournal.append({ kind: \"dispatch\", executionId, role: request.role, claimId: request.claimId });\n\tconst timeoutMs = Math.floor(request.deadline - performance.now());\n\tif (timeoutMs <= 0 || policy.signal?.aborted) {\n\t\tconst failure = policy.signal?.aborted ? \"cancelled\" : \"deadline\";\n\t\tjournal.append({ kind: \"exited\", executionId, failure });\n\t\tthrow new VerifiedRunError(failure);\n\t}\n\tconst result = await executeSandbox({\n\t\tworkspace: request.workspace,\n\t\targv: request.argv,\n\t\twritable: request.role === \"writer\",\n\t\ttimeoutMs,\n\t\tcleanupMs: policy.cleanupMs,\n\t\tmaxOutputBytes: policy.maxOutputBytes,\n\t\t...(policy.signal ? { signal: policy.signal } : {}),\n\t\t...(journal.state.budget\n\t\t\t? {\n\t\t\t\t\tonReady: (identity: NamespaceIdentity) => {\n\t\t\t\t\t\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\t\t\t\t\t\tjournal.append({ kind: \"process_ready\", executionId, identity });\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t});\n\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\tjournal.append({ kind: \"exited\", executionId, failure: request.role === \"writer\" ? result.failure : null });\n\treturn { executionId, result, timeoutMs };\n}\n"]}

package/dist/core/verified-run/owned-execution.js

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
+import { executeSandbox } from "./broker.js";
+import { VerifiedRunError } from "./storage.js";
+/** The mandatory durable intent boundary is shared by command and AgentSession writers. */
+export async function executeRunCommand(journal, request, policy) {
+    if (Math.floor(request.deadline - performance.now()) <= 0)
+        throw new VerifiedRunError("deadline");
+    if (policy.signal?.aborted)
+        throw new VerifiedRunError("cancelled");
+    const generation = journal.state.generation;
+    const executionId = randomUUID();
+    journal.append({ kind: "dispatch", executionId, role: request.role, claimId: request.claimId });
+    const timeoutMs = Math.floor(request.deadline - performance.now());
+    if (timeoutMs <= 0 || policy.signal?.aborted) {
+        const failure = policy.signal?.aborted ? "cancelled" : "deadline";
+        journal.append({ kind: "exited", executionId, failure });
+        throw new VerifiedRunError(failure);
+    }
+    const result = await executeSandbox({
+        workspace: request.workspace,
+        argv: request.argv,
+        writable: request.role === "writer",
+        timeoutMs,
+        cleanupMs: policy.cleanupMs,
+        maxOutputBytes: policy.maxOutputBytes,
+        ...(policy.signal ? { signal: policy.signal } : {}),
+        ...(journal.state.budget
+            ? {
+                onReady: (identity) => {
+                    if (journal.state.generation !== generation)
+                        throw new VerifiedRunError("stale_generation");
+                    journal.append({ kind: "process_ready", executionId, identity });
+                },
+            }
+            : {}),
+    });
+    if (journal.state.generation !== generation)
+        throw new VerifiedRunError("stale_generation");
+    journal.append({ kind: "exited", executionId, failure: request.role === "writer" ? result.failure : null });
+    return { executionId, result, timeoutMs };
+}
+//# sourceMappingURL=owned-execution.js.map

package/dist/core/verified-run/owned-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owned-execution.js","sourceRoot":"","sources":["../../../src/core/verified-run/owned-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAGlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAehD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAA2B,EAC3B,OAAwB,EACxB,MAIC,EACyB;IAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ;QACnC,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YACvB,CAAC,CAAC;gBACA,OAAO,EAAE,CAAC,QAA2B,EAAE,EAAE,CAAC;oBACzC,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;wBAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;oBAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAAA,CACjE;aACD;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAAA,CAC1C","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeSandbox, type SandboxOutcome } from \"./broker.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface OwnedRunCommand {\n\treadonly role: \"writer\" | \"verifier\";\n\treadonly argv: readonly string[];\n\treadonly workspace: string;\n\treadonly deadline: number;\n\treadonly claimId: string | null;\n}\nexport interface OwnedRunResult {\n\treadonly executionId: string;\n\treadonly result: SandboxOutcome;\n\treadonly timeoutMs: number;\n}\n\n/** The mandatory durable intent boundary is shared by command and AgentSession writers. */\nexport async function executeRunCommand(\n\tjournal: VerifiedRunJournal,\n\trequest: OwnedRunCommand,\n\tpolicy: {\n\t\treadonly cleanupMs: number;\n\t\treadonly maxOutputBytes: number;\n\t\treadonly signal?: AbortSignal;\n\t},\n): Promise<OwnedRunResult> {\n\tif (Math.floor(request.deadline - performance.now()) <= 0) throw new VerifiedRunError(\"deadline\");\n\tif (policy.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst generation = journal.state.generation;\n\tconst executionId = randomUUID();\n\tjournal.append({ kind: \"dispatch\", executionId, role: request.role, claimId: request.claimId });\n\tconst timeoutMs = Math.floor(request.deadline - performance.now());\n\tif (timeoutMs <= 0 || policy.signal?.aborted) {\n\t\tconst failure = policy.signal?.aborted ? \"cancelled\" : \"deadline\";\n\t\tjournal.append({ kind: \"exited\", executionId, failure });\n\t\tthrow new VerifiedRunError(failure);\n\t}\n\tconst result = await executeSandbox({\n\t\tworkspace: request.workspace,\n\t\targv: request.argv,\n\t\twritable: request.role === \"writer\",\n\t\ttimeoutMs,\n\t\tcleanupMs: policy.cleanupMs,\n\t\tmaxOutputBytes: policy.maxOutputBytes,\n\t\t...(policy.signal ? { signal: policy.signal } : {}),\n\t\t...(journal.state.budget\n\t\t\t? {\n\t\t\t\t\tonReady: (identity: NamespaceIdentity) => {\n\t\t\t\t\t\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\t\t\t\t\t\tjournal.append({ kind: \"process_ready\", executionId, identity });\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t});\n\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\tjournal.append({ kind: \"exited\", executionId, failure: request.role === \"writer\" ? result.failure : null });\n\treturn { executionId, result, timeoutMs };\n}\n"]}

package/dist/core/verified-run/phase-context.d.ts

@@ -0,0 +1,9 @@
+import type { RunContract } from "omk-protocol";
+import type { VerifiedRunJournal } from "./journal.ts";
+export interface RunPhaseContext {
+    readonly contract: RunContract;
+    readonly runPath: string;
+    readonly journal: VerifiedRunJournal;
+    readonly signal?: AbortSignal;
+}
+//# sourceMappingURL=phase-context.d.ts.map

package/dist/core/verified-run/phase-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phase-context.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly signal?: AbortSignal;\n}\n"]}

package/dist/core/verified-run/phase-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=phase-context.js.map

package/dist/core/verified-run/phase-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phase-context.js","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly signal?: AbortSignal;\n}\n"]}

package/dist/core/verified-run/process-gate.d.ts

@@ -0,0 +1,5 @@
+import { type NamespaceIdentity } from "./namespace-identity.ts";
+export declare const PROCESS_GATE_ARGV: readonly ["/bin/sh", "-c", "IFS= read -r gate && [ \"$gate\" = go ] && exec \"$@\"", "omk-process-gate"];
+/** This JSON comes only from bwrap's private info FD, before any candidate code is released. */
+export declare function identityFromSandboxInfo(bytes: string): NamespaceIdentity;
+//# sourceMappingURL=process-gate.d.ts.map

package/dist/core/verified-run/process-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-gate.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/process-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG3F,eAAO,MAAM,iBAAiB,0GAKpB,CAAC;AAEX,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAoBxE","sourcesContent":["import { captureNamespaceIdentity, type NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport const PROCESS_GATE_ARGV = [\n\t\"/bin/sh\",\n\t\"-c\",\n\t'IFS= read -r gate && [ \"$gate\" = go ] && exec \"$@\"',\n\t\"omk-process-gate\",\n] as const;\n\n/** This JSON comes only from bwrap's private info FD, before any candidate code is released. */\nexport function identityFromSandboxInfo(bytes: string): NamespaceIdentity {\n\tlet info: unknown;\n\ttry {\n\t\tinfo = JSON.parse(bytes);\n\t} catch {\n\t\tthrow new VerifiedRunError(\"process_identity\");\n\t}\n\tif (\n\t\ttypeof info !== \"object\" ||\n\t\tinfo === null ||\n\t\t!(\"child-pid\" in info) ||\n\t\ttypeof info[\"child-pid\"] !== \"number\" ||\n\t\t!(\"pid-namespace\" in info) ||\n\t\ttypeof info[\"pid-namespace\"] !== \"number\" ||\n\t\t!Number.isSafeInteger(info[\"pid-namespace\"])\n\t)\n\t\tthrow new VerifiedRunError(\"process_identity\");\n\tconst identity = captureNamespaceIdentity(info[\"child-pid\"]);\n\tif (identity.namespace !== `pid:[${info[\"pid-namespace\"]}]`) throw new VerifiedRunError(\"process_identity\");\n\treturn identity;\n}\n"]}

package/dist/core/verified-run/process-gate.js

@@ -0,0 +1,31 @@
+import { captureNamespaceIdentity } from "./namespace-identity.js";
+import { VerifiedRunError } from "./storage.js";
+export const PROCESS_GATE_ARGV = [
+    "/bin/sh",
+    "-c",
+    'IFS= read -r gate && [ "$gate" = go ] && exec "$@"',
+    "omk-process-gate",
+];
+/** This JSON comes only from bwrap's private info FD, before any candidate code is released. */
+export function identityFromSandboxInfo(bytes) {
+    let info;
+    try {
+        info = JSON.parse(bytes);
+    }
+    catch {
+        throw new VerifiedRunError("process_identity");
+    }
+    if (typeof info !== "object" ||
+        info === null ||
+        !("child-pid" in info) ||
+        typeof info["child-pid"] !== "number" ||
+        !("pid-namespace" in info) ||
+        typeof info["pid-namespace"] !== "number" ||
+        !Number.isSafeInteger(info["pid-namespace"]))
+        throw new VerifiedRunError("process_identity");
+    const identity = captureNamespaceIdentity(info["child-pid"]);
+    if (identity.namespace !== `pid:[${info["pid-namespace"]}]`)
+        throw new VerifiedRunError("process_identity");
+    return identity;
+}
+//# sourceMappingURL=process-gate.js.map

package/dist/core/verified-run/process-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-gate.js","sourceRoot":"","sources":["../../../src/core/verified-run/process-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA0B,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,SAAS;IACT,IAAI;IACJ,oDAAoD;IACpD,kBAAkB;CACT,CAAC;AAEX,gGAAgG;AAChG,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAqB;IACzE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ;QACrC,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ;QACzC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE5C,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC5G,OAAO,QAAQ,CAAC;AAAA,CAChB","sourcesContent":["import { captureNamespaceIdentity, type NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport const PROCESS_GATE_ARGV = [\n\t\"/bin/sh\",\n\t\"-c\",\n\t'IFS= read -r gate && [ \"$gate\" = go ] && exec \"$@\"',\n\t\"omk-process-gate\",\n] as const;\n\n/** This JSON comes only from bwrap's private info FD, before any candidate code is released. */\nexport function identityFromSandboxInfo(bytes: string): NamespaceIdentity {\n\tlet info: unknown;\n\ttry {\n\t\tinfo = JSON.parse(bytes);\n\t} catch {\n\t\tthrow new VerifiedRunError(\"process_identity\");\n\t}\n\tif (\n\t\ttypeof info !== \"object\" ||\n\t\tinfo === null ||\n\t\t!(\"child-pid\" in info) ||\n\t\ttypeof info[\"child-pid\"] !== \"number\" ||\n\t\t!(\"pid-namespace\" in info) ||\n\t\ttypeof info[\"pid-namespace\"] !== \"number\" ||\n\t\t!Number.isSafeInteger(info[\"pid-namespace\"])\n\t)\n\t\tthrow new VerifiedRunError(\"process_identity\");\n\tconst identity = captureNamespaceIdentity(info[\"child-pid\"]);\n\tif (identity.namespace !== `pid:[${info[\"pid-namespace\"]}]`) throw new VerifiedRunError(\"process_identity\");\n\treturn identity;\n}\n"]}

package/dist/core/verified-run/projection.d.ts

@@ -0,0 +1,4 @@
+import type { RunEvent, RunProjection } from "./run-types.ts";
+/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */
+export declare function projectRun(events: readonly RunEvent[]): RunProjection;
+//# sourceMappingURL=projection.d.ts.map

package/dist/core/verified-run/projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAmB,MAAM,gBAAgB,CAAC;AAI/E,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,aAAa,CAmOrE","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { acceptWriterDispatch, reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst dispatched = new Set<string>();\n\tconst checked = new Set<string>();\n\tconst commands = new Set([first.command.commandId]);\n\tlet activeRole: \"writer\" | \"verifier\" = \"writer\";\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\": {\n\t\t\t\tif (state.failure || state.activeExecutionIds.length || dispatched.has(event.executionId))\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (event.role === \"writer\") {\n\t\t\t\t\tacceptWriterDispatch(context, event);\n\t\t\t\t} else {\n\t\t\t\t\tif (\n\t\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\t\tevent.claimId === null ||\n\t\t\t\t\t\t!first.contract.checks.some((check) => check.claimId === event.claimId) ||\n\t\t\t\t\t\tchecked.has(event.claimId)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t\tchecked.add(event.claimId);\n\t\t\t\t}\n\t\t\t\tdispatched.add(event.executionId);\n\t\t\t\tactiveRole = event.role;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"running\",\n\t\t\t\t\tsettlement: \"draining\",\n\t\t\t\t\tactiveExecutionIds: [event.executionId],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"process_ready\":\n\t\t\t\tif (\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\tevent.identity.bootId !== state.budget.bootId ||\n\t\t\t\t\tstate.processes.some((item) => item.executionId === event.executionId)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tprocesses: [...state.processes, { executionId: event.executionId, identity: event.identity }],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"exited\":\n\t\t\t\tif (\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\t(state.budget &&\n\t\t\t\t\t\tevent.failure === null &&\n\t\t\t\t\t\t!state.processes.some((item) => item.executionId === event.executionId))\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (activeRole === \"writer\") context.writerFinished = event.failure === null;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tsettlement: state.writerOpen ? \"open\" : \"settled\",\n\t\t\t\t\tactiveExecutionIds: [],\n\t\t\t\t\tfailure: event.failure,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, { commands, checked, activeRole });\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tchecked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}

package/dist/core/verified-run/projection.js

@@ -0,0 +1,219 @@
+import { reduceDagEvent } from "./dag-projection.js";
+import { reduceRecoveryEvent } from "./recovery-projection.js";
+import { VerifiedRunError } from "./storage.js";
+import { acceptWriterDispatch, reduceWriterEvent } from "./writer-projection.js";
+/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */
+export function projectRun(events) {
+    const first = events[0];
+    if (first?.kind !== "created" || first.contract.runId !== first.command.runId)
+        throw new VerifiedRunError("integrity");
+    const context = {
+        contract: first.contract,
+        writerFinished: false,
+        writerStarted: false,
+        producerStarted: false,
+        writerCommands: 0,
+        requestBaseline: 0,
+        requests: new Set(),
+        state: {
+            runId: first.contract.runId,
+            revision: 1,
+            generation: 1,
+            execution: "ready",
+            settlement: "open",
+            verification: "not_requested",
+            application: "not_requested",
+            candidateDigest: null,
+            inputDigest: null,
+            receiptDigest: null,
+            failure: null,
+            activeExecutionIds: [],
+            writerOpen: false,
+            modelRequests: 0,
+            tasks: first.contract.profile === "linux-command-dag-v1"
+                ? first.contract.writer.tasks.map((task) => ({
+                    taskId: task.id,
+                    attempt: 0,
+                    generation: 1,
+                    status: "pending",
+                    inputDigest: null,
+                    outputDigest: null,
+                    failure: null,
+                }))
+                : [],
+            budget: null,
+            environmentDigest: null,
+            verificationDeadlineMs: null,
+            lastClockMs: null,
+            processes: [],
+        },
+    };
+    const dispatched = new Set();
+    const checked = new Set();
+    const commands = new Set([first.command.commandId]);
+    let activeRole = "writer";
+    for (const event of events.slice(1)) {
+        const state = context.state;
+        if (state.execution === "failed" || state.receiptDigest)
+            throw new VerifiedRunError("integrity");
+        switch (event.kind) {
+            case "created":
+                throw new VerifiedRunError("integrity");
+            case "budget_anchored": {
+                const budget = event.budget;
+                const limits = first.contract.budget;
+                if (state.revision !== 1 ||
+                    state.budget ||
+                    budget.workDeadlineMs - budget.startedMs !== limits.workMs ||
+                    budget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||
+                    budget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs)
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    budget,
+                    environmentDigest: event.environmentDigest,
+                    lastClockMs: budget.startedMs,
+                };
+                break;
+            }
+            case "input_checkpoint":
+                if (state.revision !== 2 ||
+                    !state.budget ||
+                    state.inputDigest ||
+                    event.digest !== first.contract.workspace.baseDigest)
+                    throw new VerifiedRunError("integrity");
+                context.state = { ...state, inputDigest: event.digest };
+                break;
+            case "task_started":
+            case "task_finished":
+            case "tasks_paused":
+                reduceDagEvent(context, event);
+                break;
+            case "writer_opened":
+            case "model_request":
+            case "writer_closed":
+                reduceWriterEvent(context, event);
+                break;
+            case "dispatch": {
+                if (state.failure || state.activeExecutionIds.length || dispatched.has(event.executionId))
+                    throw new VerifiedRunError("integrity");
+                if (event.role === "writer") {
+                    acceptWriterDispatch(context, event);
+                }
+                else {
+                    if (!context.writerFinished ||
+                        state.writerOpen ||
+                        !state.candidateDigest ||
+                        event.claimId === null ||
+                        !first.contract.checks.some((check) => check.claimId === event.claimId) ||
+                        checked.has(event.claimId))
+                        throw new VerifiedRunError("integrity");
+                    checked.add(event.claimId);
+                }
+                dispatched.add(event.executionId);
+                activeRole = event.role;
+                context.state = {
+                    ...state,
+                    execution: "running",
+                    settlement: "draining",
+                    activeExecutionIds: [event.executionId],
+                };
+                break;
+            }
+            case "process_ready":
+                if (!state.budget ||
+                    state.activeExecutionIds[0] !== event.executionId ||
+                    event.identity.bootId !== state.budget.bootId ||
+                    state.processes.some((item) => item.executionId === event.executionId))
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    processes: [...state.processes, { executionId: event.executionId, identity: event.identity }],
+                };
+                break;
+            case "exited":
+                if (state.activeExecutionIds[0] !== event.executionId ||
+                    (state.budget &&
+                        event.failure === null &&
+                        !state.processes.some((item) => item.executionId === event.executionId)))
+                    throw new VerifiedRunError("integrity");
+                if (activeRole === "writer")
+                    context.writerFinished = event.failure === null;
+                context.state = {
+                    ...state,
+                    settlement: state.writerOpen ? "open" : "settled",
+                    activeExecutionIds: [],
+                    failure: event.failure,
+                };
+                break;
+            case "candidate": {
+                if (!context.writerFinished ||
+                    state.writerOpen ||
+                    state.failure ||
+                    state.activeExecutionIds.length ||
+                    state.candidateDigest ||
+                    state.tasks.some((task) => task.status !== "succeeded" || task.generation !== state.generation))
+                    throw new VerifiedRunError("integrity");
+                if (state.budget) {
+                    if (event.observedMs === undefined ||
+                        event.verificationDeadlineMs === undefined ||
+                        event.observedMs < state.budget.startedMs ||
+                        event.observedMs > state.budget.workDeadlineMs ||
+                        event.verificationDeadlineMs !==
+                            Math.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs))
+                        throw new VerifiedRunError("integrity");
+                }
+                else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    candidateDigest: event.digest,
+                    verificationDeadlineMs: event.verificationDeadlineMs ?? null,
+                    lastClockMs: event.observedMs ?? null,
+                };
+                break;
+            }
+            case "resumed":
+            case "tasks_retried":
+            case "writer_restarted":
+                reduceRecoveryEvent(context, event, { commands, checked, activeRole });
+                break;
+            case "evaluated":
+                if (!state.candidateDigest ||
+                    state.writerOpen ||
+                    state.activeExecutionIds.length ||
+                    checked.size !== first.contract.checks.length ||
+                    (event.verified && state.failure))
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    receiptDigest: event.receiptDigest,
+                    execution: "succeeded",
+                    verification: event.verified ? "verified" : "violated",
+                    application: event.verified ? "candidate_ready" : "not_requested",
+                };
+                break;
+            case "failed":
+                context.state = {
+                    ...state,
+                    execution: "failed",
+                    failure: event.code,
+                    verification: "inconclusive",
+                    settlement: state.activeExecutionIds.length || state.writerOpen ? "quarantined" : "settled",
+                };
+                break;
+            default: {
+                const exhaustive = event;
+                throw new VerifiedRunError(String(exhaustive));
+            }
+        }
+        context.state = { ...context.state, revision: state.revision + 1 };
+    }
+    return Object.freeze({
+        ...context.state,
+        activeExecutionIds: Object.freeze([...context.state.activeExecutionIds]),
+        processes: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),
+        tasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),
+    });
+}
+//# sourceMappingURL=projection.js.map

package/dist/core/verified-run/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAiB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;QAC5E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,OAAO,GAAoB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,eAAe;YAC7B,WAAW,EAAE,eAAe;YAC5B,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,CAAC;YAChB,KAAK,EACJ,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC/B,CAAC,IAAI,EAAqB,EAAE,CAAC,CAAC;oBAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,CAAC;oBACb,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;iBACb,CAAC,CACF;gBACF,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;SACb;KACD,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,IAAI,UAAU,GAA0B,QAAQ,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,iBAAiB,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrC,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,KAAK,CAAC,MAAM;oBACZ,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM;oBAC1D,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;oBAC9D,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS;oBAElE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,MAAM;oBACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,WAAW,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,kBAAkB;gBACtB,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,WAAW;oBACjB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;oBAEpD,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxD,MAAM;YACP,KAAK,cAAc,CAAC;YACpB,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc;gBAClB,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACP,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe;gBACnB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;oBACxF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACP,IACC,CAAC,OAAO,CAAC,cAAc;wBACvB,KAAK,CAAC,UAAU;wBAChB,CAAC,KAAK,CAAC,eAAe;wBACtB,KAAK,CAAC,OAAO,KAAK,IAAI;wBACtB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;wBACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;wBAE1B,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;oBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAClC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;oBACtB,kBAAkB,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;iBACvC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,eAAe;gBACnB,IACC,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW;oBACjD,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC7C,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;oBAEtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;iBAC7F,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,IACC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW;oBACjD,CAAC,KAAK,CAAC,MAAM;wBACZ,KAAK,CAAC,OAAO,KAAK,IAAI;wBACtB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;oBAEzE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,UAAU,KAAK,QAAQ;oBAAE,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC7E,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBACjD,kBAAkB,EAAE,EAAE;oBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACtB,CAAC;gBACF,MAAM;YACP,KAAK,WAAW,EAAE,CAAC;gBAClB,IACC,CAAC,OAAO,CAAC,cAAc;oBACvB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,OAAO;oBACb,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,KAAK,CAAC,eAAe;oBACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;oBAE/F,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,IACC,KAAK,CAAC,UAAU,KAAK,SAAS;wBAC9B,KAAK,CAAC,sBAAsB,KAAK,SAAS;wBAC1C,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS;wBACzC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc;wBAC9C,KAAK,CAAC,sBAAsB;4BAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;wBAEtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBACtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,eAAe,EAAE,KAAK,CAAC,MAAM;oBAC7B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,IAAI;oBAC5D,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;iBACrC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,SAAS,CAAC;YACf,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACtB,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvE,MAAM;YACP,KAAK,WAAW;gBACf,IACC,CAAC,KAAK,CAAC,eAAe;oBACtB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAC7C,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC;oBAEjC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,WAAW;oBACtB,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;iBACjE,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,YAAY,EAAE,cAAc;oBAC5B,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;iBAC3F,CAAC;gBACF,MAAM;YACP,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,OAAO,CAAC,KAAK;QAChB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { acceptWriterDispatch, reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst dispatched = new Set<string>();\n\tconst checked = new Set<string>();\n\tconst commands = new Set([first.command.commandId]);\n\tlet activeRole: \"writer\" | \"verifier\" = \"writer\";\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\": {\n\t\t\t\tif (state.failure || state.activeExecutionIds.length || dispatched.has(event.executionId))\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (event.role === \"writer\") {\n\t\t\t\t\tacceptWriterDispatch(context, event);\n\t\t\t\t} else {\n\t\t\t\t\tif (\n\t\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\t\tevent.claimId === null ||\n\t\t\t\t\t\t!first.contract.checks.some((check) => check.claimId === event.claimId) ||\n\t\t\t\t\t\tchecked.has(event.claimId)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t\tchecked.add(event.claimId);\n\t\t\t\t}\n\t\t\t\tdispatched.add(event.executionId);\n\t\t\t\tactiveRole = event.role;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"running\",\n\t\t\t\t\tsettlement: \"draining\",\n\t\t\t\t\tactiveExecutionIds: [event.executionId],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"process_ready\":\n\t\t\t\tif (\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\tevent.identity.bootId !== state.budget.bootId ||\n\t\t\t\t\tstate.processes.some((item) => item.executionId === event.executionId)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tprocesses: [...state.processes, { executionId: event.executionId, identity: event.identity }],\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"exited\":\n\t\t\t\tif (\n\t\t\t\t\tstate.activeExecutionIds[0] !== event.executionId ||\n\t\t\t\t\t(state.budget &&\n\t\t\t\t\t\tevent.failure === null &&\n\t\t\t\t\t\t!state.processes.some((item) => item.executionId === event.executionId))\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (activeRole === \"writer\") context.writerFinished = event.failure === null;\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tsettlement: state.writerOpen ? \"open\" : \"settled\",\n\t\t\t\t\tactiveExecutionIds: [],\n\t\t\t\t\tfailure: event.failure,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, { commands, checked, activeRole });\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tchecked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}

package/dist/core/verified-run/recovery-clock.d.ts

@@ -0,0 +1,19 @@
+import type { RunPhaseBudget } from "omk-protocol";
+export interface RunClock {
+    readonly bootId: string;
+    readonly nowMs: number;
+}
+export interface RecoveryBudget {
+    readonly bootId: string;
+    readonly startedMs: number;
+    readonly workDeadlineMs: number;
+    readonly verifyCapMs: number;
+    readonly cleanupDeadlineMs: number;
+}
+export declare function readRunClock(): RunClock;
+export declare function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget;
+export declare function parseRecoveryBudget(raw: unknown): RecoveryBudget;
+export declare function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock?: RunClock): number;
+export declare const remainingVerification: typeof remainingRunTime;
+export declare function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number;
+//# sourceMappingURL=recovery-clock.d.ts.map

package/dist/core/verified-run/recovery-clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-clock.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-clock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAGD,wBAAgB,YAAY,IAAI,QAAQ,CAOvC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,cAAc,CAQvF;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAgChE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,WAAiB,GAAG,MAAM,CAM3G;AAED,eAAO,MAAM,qBAAqB,yBAAmB,CAAC;AAEtD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI5F","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { uptime } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunPhaseBudget } from \"omk-protocol\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface RunClock {\n\treadonly bootId: string;\n\treadonly nowMs: number;\n}\nexport interface RecoveryBudget {\n\treadonly bootId: string;\n\treadonly startedMs: number;\n\treadonly workDeadlineMs: number;\n\treadonly verifyCapMs: number;\n\treadonly cleanupDeadlineMs: number;\n}\nconst BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;\n\nexport function readRunClock(): RunClock {\n\tif (process.platform !== \"linux\") throw new VerifiedRunError(\"clock_unavailable\");\n\tconst bootId = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim();\n\tconst nowMs = Math.floor(uptime() * 1000);\n\tif (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)\n\t\tthrow new VerifiedRunError(\"clock_unavailable\");\n\treturn Object.freeze({ bootId, nowMs });\n}\n\nexport function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget {\n\treturn parseRecoveryBudget({\n\t\tbootId: clock.bootId,\n\t\tstartedMs: clock.nowMs,\n\t\tworkDeadlineMs: clock.nowMs + limits.workMs,\n\t\tverifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,\n\t\tcleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,\n\t});\n}\n\nexport function parseRecoveryBudget(raw: unknown): RecoveryBudget {\n\tif (\n\t\ttypeof raw !== \"object\" ||\n\t\traw === null ||\n\t\t!(\"bootId\" in raw) ||\n\t\ttypeof raw.bootId !== \"string\" ||\n\t\t!BOOT_ID.test(raw.bootId) ||\n\t\t!(\"startedMs\" in raw) ||\n\t\ttypeof raw.startedMs !== \"number\" ||\n\t\t!(\"workDeadlineMs\" in raw) ||\n\t\ttypeof raw.workDeadlineMs !== \"number\" ||\n\t\t!(\"verifyCapMs\" in raw) ||\n\t\ttypeof raw.verifyCapMs !== \"number\" ||\n\t\t!(\"cleanupDeadlineMs\" in raw) ||\n\t\ttypeof raw.cleanupDeadlineMs !== \"number\"\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];\n\tif (\n\t\tvalues.some((value) => !Number.isSafeInteger(value) || value < 0) ||\n\t\traw.workDeadlineMs <= raw.startedMs ||\n\t\traw.verifyCapMs <= raw.workDeadlineMs ||\n\t\traw.cleanupDeadlineMs <= raw.verifyCapMs\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tbootId: raw.bootId,\n\t\tstartedMs: raw.startedMs,\n\t\tworkDeadlineMs: raw.workDeadlineMs,\n\t\tverifyCapMs: raw.verifyCapMs,\n\t\tcleanupDeadlineMs: raw.cleanupDeadlineMs,\n\t});\n}\n\nexport function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock = readRunClock()): number {\n\tif (clock.bootId !== budget.bootId) throw new VerifiedRunError(\"clock_changed\");\n\tif (clock.nowMs < budget.startedMs) throw new VerifiedRunError(\"clock_rollback\");\n\tif (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Math.max(0, deadlineMs - clock.nowMs);\n}\n\nexport const remainingVerification = remainingRunTime;\n\nexport function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number {\n\tconst remaining = remainingVerification(budget, deadlineMs);\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\treturn performance.now() + remaining;\n}\n"]}

package/dist/core/verified-run/recovery-clock.js

@@ -0,0 +1,69 @@
+import { readFileSync } from "node:fs";
+import { uptime } from "node:os";
+import { performance } from "node:perf_hooks";
+import { VerifiedRunError } from "./storage.js";
+const BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+export function readRunClock() {
+    if (process.platform !== "linux")
+        throw new VerifiedRunError("clock_unavailable");
+    const bootId = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const nowMs = Math.floor(uptime() * 1000);
+    if (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new VerifiedRunError("clock_unavailable");
+    return Object.freeze({ bootId, nowMs });
+}
+export function anchorRunBudget(limits, clock) {
+    return parseRecoveryBudget({
+        bootId: clock.bootId,
+        startedMs: clock.nowMs,
+        workDeadlineMs: clock.nowMs + limits.workMs,
+        verifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,
+        cleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,
+    });
+}
+export function parseRecoveryBudget(raw) {
+    if (typeof raw !== "object" ||
+        raw === null ||
+        !("bootId" in raw) ||
+        typeof raw.bootId !== "string" ||
+        !BOOT_ID.test(raw.bootId) ||
+        !("startedMs" in raw) ||
+        typeof raw.startedMs !== "number" ||
+        !("workDeadlineMs" in raw) ||
+        typeof raw.workDeadlineMs !== "number" ||
+        !("verifyCapMs" in raw) ||
+        typeof raw.verifyCapMs !== "number" ||
+        !("cleanupDeadlineMs" in raw) ||
+        typeof raw.cleanupDeadlineMs !== "number")
+        throw new VerifiedRunError("integrity");
+    const values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];
+    if (values.some((value) => !Number.isSafeInteger(value) || value < 0) ||
+        raw.workDeadlineMs <= raw.startedMs ||
+        raw.verifyCapMs <= raw.workDeadlineMs ||
+        raw.cleanupDeadlineMs <= raw.verifyCapMs)
+        throw new VerifiedRunError("integrity");
+    return Object.freeze({
+        bootId: raw.bootId,
+        startedMs: raw.startedMs,
+        workDeadlineMs: raw.workDeadlineMs,
+        verifyCapMs: raw.verifyCapMs,
+        cleanupDeadlineMs: raw.cleanupDeadlineMs,
+    });
+}
+export function remainingRunTime(budget, deadlineMs, clock = readRunClock()) {
+    if (clock.bootId !== budget.bootId)
+        throw new VerifiedRunError("clock_changed");
+    if (clock.nowMs < budget.startedMs)
+        throw new VerifiedRunError("clock_rollback");
+    if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)
+        throw new VerifiedRunError("integrity");
+    return Math.max(0, deadlineMs - clock.nowMs);
+}
+export const remainingVerification = remainingRunTime;
+export function localVerificationDeadline(budget, deadlineMs) {
+    const remaining = remainingVerification(budget, deadlineMs);
+    if (remaining <= 0)
+        throw new VerifiedRunError("deadline");
+    return performance.now() + remaining;
+}
+//# sourceMappingURL=recovery-clock.js.map

package/dist/core/verified-run/recovery-clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-clock.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-clock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAahD,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAEhE,MAAM,UAAU,YAAY,GAAa;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACxC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB,EAAE,KAAe,EAAkB;IACxF,OAAO,mBAAmB,CAAC;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,cAAc,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM;QAC3C,WAAW,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ;QAC1D,iBAAiB,EAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS;KACnF,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAkB;IACjE,IACC,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC;QACrB,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAC1B,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QACtC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC;QACvB,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC;QAC7B,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAEzC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3F,IACC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACjE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,SAAS;QACnC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc;QACrC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW;QAExC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;KACxC,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAsB,EAAE,UAAkB,EAAE,KAAK,GAAG,YAAY,EAAE,EAAU;IAC5G,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,WAAW;QACzG,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,CAC7C;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,UAAU,yBAAyB,CAAC,MAAsB,EAAE,UAAkB,EAAU;IAC7F,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;AAAA,CACrC","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { uptime } from \"node:os\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunPhaseBudget } from \"omk-protocol\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface RunClock {\n\treadonly bootId: string;\n\treadonly nowMs: number;\n}\nexport interface RecoveryBudget {\n\treadonly bootId: string;\n\treadonly startedMs: number;\n\treadonly workDeadlineMs: number;\n\treadonly verifyCapMs: number;\n\treadonly cleanupDeadlineMs: number;\n}\nconst BOOT_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;\n\nexport function readRunClock(): RunClock {\n\tif (process.platform !== \"linux\") throw new VerifiedRunError(\"clock_unavailable\");\n\tconst bootId = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim();\n\tconst nowMs = Math.floor(uptime() * 1000);\n\tif (!BOOT_ID.test(bootId) || !Number.isSafeInteger(nowMs) || nowMs < 0)\n\t\tthrow new VerifiedRunError(\"clock_unavailable\");\n\treturn Object.freeze({ bootId, nowMs });\n}\n\nexport function anchorRunBudget(limits: RunPhaseBudget, clock: RunClock): RecoveryBudget {\n\treturn parseRecoveryBudget({\n\t\tbootId: clock.bootId,\n\t\tstartedMs: clock.nowMs,\n\t\tworkDeadlineMs: clock.nowMs + limits.workMs,\n\t\tverifyCapMs: clock.nowMs + limits.workMs + limits.verifyMs,\n\t\tcleanupDeadlineMs: clock.nowMs + limits.workMs + limits.verifyMs + limits.cleanupMs,\n\t});\n}\n\nexport function parseRecoveryBudget(raw: unknown): RecoveryBudget {\n\tif (\n\t\ttypeof raw !== \"object\" ||\n\t\traw === null ||\n\t\t!(\"bootId\" in raw) ||\n\t\ttypeof raw.bootId !== \"string\" ||\n\t\t!BOOT_ID.test(raw.bootId) ||\n\t\t!(\"startedMs\" in raw) ||\n\t\ttypeof raw.startedMs !== \"number\" ||\n\t\t!(\"workDeadlineMs\" in raw) ||\n\t\ttypeof raw.workDeadlineMs !== \"number\" ||\n\t\t!(\"verifyCapMs\" in raw) ||\n\t\ttypeof raw.verifyCapMs !== \"number\" ||\n\t\t!(\"cleanupDeadlineMs\" in raw) ||\n\t\ttypeof raw.cleanupDeadlineMs !== \"number\"\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst values = [raw.startedMs, raw.workDeadlineMs, raw.verifyCapMs, raw.cleanupDeadlineMs];\n\tif (\n\t\tvalues.some((value) => !Number.isSafeInteger(value) || value < 0) ||\n\t\traw.workDeadlineMs <= raw.startedMs ||\n\t\traw.verifyCapMs <= raw.workDeadlineMs ||\n\t\traw.cleanupDeadlineMs <= raw.verifyCapMs\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Object.freeze({\n\t\tbootId: raw.bootId,\n\t\tstartedMs: raw.startedMs,\n\t\tworkDeadlineMs: raw.workDeadlineMs,\n\t\tverifyCapMs: raw.verifyCapMs,\n\t\tcleanupDeadlineMs: raw.cleanupDeadlineMs,\n\t});\n}\n\nexport function remainingRunTime(budget: RecoveryBudget, deadlineMs: number, clock = readRunClock()): number {\n\tif (clock.bootId !== budget.bootId) throw new VerifiedRunError(\"clock_changed\");\n\tif (clock.nowMs < budget.startedMs) throw new VerifiedRunError(\"clock_rollback\");\n\tif (!Number.isSafeInteger(deadlineMs) || deadlineMs <= budget.startedMs || deadlineMs > budget.verifyCapMs)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn Math.max(0, deadlineMs - clock.nowMs);\n}\n\nexport const remainingVerification = remainingRunTime;\n\nexport function localVerificationDeadline(budget: RecoveryBudget, deadlineMs: number): number {\n\tconst remaining = remainingVerification(budget, deadlineMs);\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\treturn performance.now() + remaining;\n}\n"]}

package/dist/core/verified-run/recovery-command.d.ts

@@ -0,0 +1,11 @@
+import type { RunResumeCommand, RunTaskRetryCommand, RunWriterRestartCommand } from "omk-protocol";
+import { type JournalSnapshot, VerifiedRunJournal } from "./journal.ts";
+import type { RunProjection } from "./run-types.ts";
+export type RecoveryCommand = RunResumeCommand | RunWriterRestartCommand | RunTaskRetryCommand;
+export declare function requireRunJournal(runPath: string): JournalSnapshot;
+/** One lease/CAS/idempotency boundary for all explicit recovery actions. */
+export declare function withRecoveryLease(runPath: string, command: RecoveryCommand, execute: (input: {
+    readonly snapshot: JournalSnapshot;
+    readonly journal: VerifiedRunJournal;
+}) => Promise<RunProjection>): Promise<RunProjection>;
+//# sourceMappingURL=recovery-command.d.ts.map

package/dist/core/verified-run/recovery-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-command.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEnG,OAAO,EAAE,KAAK,eAAe,EAA+B,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AAC/F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAIlE;AA4CD,4EAA4E;AAC5E,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,CAAC,KAAK,EAAE;IAChB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACrC,KAAK,OAAO,CAAC,aAAa,CAAC,GAC1B,OAAO,CAAC,aAAa,CAAC,CAsBxB","sourcesContent":["import type { RunResumeCommand, RunTaskRetryCommand, RunWriterRestartCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { type JournalSnapshot, journalPath, readRunJournal, VerifiedRunJournal } from \"./journal.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport type RecoveryCommand = RunResumeCommand | RunWriterRestartCommand | RunTaskRetryCommand;\nexport function requireRunJournal(runPath: string): JournalSnapshot {\n\tconst journal = readRunJournal(runPath);\n\tif (!journal) throw new VerifiedRunError(\"missing_run\");\n\treturn journal;\n}\n\nfunction commandDisposition(journal: JournalSnapshot, command: RecoveryCommand): \"new\" | \"duplicate\" {\n\tconst first = journal.records[0]?.event;\n\tif (\n\t\tfirst?.kind !== \"created\" ||\n\t\tfirst.contract.runId !== command.runId ||\n\t\tdigestObject(first.contract) !== command.contractDigest\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (first.command.commandId === command.commandId) throw new VerifiedRunError(\"command_conflict\");\n\tconst previous = journal.records.find(\n\t\t({ event }) =>\n\t\t\t(event.kind === \"resumed\" || event.kind === \"writer_restarted\" || event.kind === \"tasks_retried\") &&\n\t\t\tevent.command.commandId === command.commandId,\n\t)?.event;\n\tif (previous?.kind === \"resumed\" || previous?.kind === \"writer_restarted\" || previous?.kind === \"tasks_retried\") {\n\t\tif (digestObject(previous.command) !== digestObject(command)) throw new VerifiedRunError(\"command_conflict\");\n\t\treturn \"duplicate\";\n\t}\n\tif (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tswitch (command.kind) {\n\t\tcase \"resume\":\n\t\t\tif (command.candidateDigest !== journal.state.candidateDigest)\n\t\t\t\tthrow new VerifiedRunError(\"candidate_mismatch\");\n\t\t\tbreak;\n\t\tcase \"retry_tasks\":\n\t\tcase \"restart_writer\":\n\t\t\tif (!journal.state.inputDigest) throw new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (\n\t\t\t\tcommand.baseDigest !== journal.state.inputDigest ||\n\t\t\t\tcommand.baseDigest !== first.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_mismatch\");\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = command;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\treturn \"new\";\n}\n\n/** One lease/CAS/idempotency boundary for all explicit recovery actions. */\nexport async function withRecoveryLease(\n\trunPath: string,\n\tcommand: RecoveryCommand,\n\texecute: (input: {\n\t\treadonly snapshot: JournalSnapshot;\n\t\treadonly journal: VerifiedRunJournal;\n\t}) => Promise<RunProjection>,\n): Promise<RunProjection> {\n\tconst initial = requireRunJournal(runPath);\n\tif (commandDisposition(initial, command) === \"duplicate\") return initial.state;\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (commandDisposition(snapshot, command) === \"duplicate\") return snapshot.state;\n\t\tconst journal = new VerifiedRunJournal(runPath, owner);\n\t\ttry {\n\t\t\treturn await execute({ snapshot, journal });\n\t\t} catch (error) {\n\t\t\tif (\n\t\t\t\terror instanceof VerifiedRunError &&\n\t\t\t\tjournal.state.generation > snapshot.state.generation &&\n\t\t\t\t!journal.state.receiptDigest\n\t\t\t)\n\t\t\t\treturn journal.append({ kind: \"failed\", code: error.code });\n\t\t\tthrow error;\n\t\t}\n\t} finally {\n\t\towner.release();\n\t}\n}\n"]}