open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/core/verified-run/owned-execution.js

@@ -1,46 +1,139 @@
 import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
 import { performance } from "node:perf_hooks";
 import { executeSandbox } from "./broker.js";
-import { VerifiedRunError } from "./storage.js";
-/** The mandatory durable intent boundary is shared by command and AgentSession writers. */
+import { digestObject, VerifiedRunError } from "./storage.js";
+/**
+ * The filesystem claim a dispatched process is authorized for: exactly the
+ * workspace bind it receives inside the namespace — nothing wider. Keys are
+ * the resolved absolute path minus the leading slash so prefix containment
+ * matches real tree containment; `realpathSync` keeps two spellings of the
+ * same directory one claim.
+ */
+function workspaceClaim(workspace, access, generation) {
+    let root;
+    try {
+        root = realpathSync(workspace);
+    }
+    catch {
+        throw new VerifiedRunError("authority_claim");
+    }
+    return Object.freeze([
+        {
+            namespace: "filesystem",
+            instanceId: "verified-run",
+            canonicalKey: root.replace(/^\/+/, ""),
+            access,
+            generation: String(generation),
+        },
+    ]);
+}
+/** Rejection codes that can only be produced before the supervisor spawned. */
+const NEVER_SPAWNED = new Set(["cancelled", "deadline", "unsupported_boundary"]);
+/**
+ * Mandatory durable dispatch intent, shared by command and AgentSession
+ * writers. There is no ungated execution lane: a journal without an anchored
+ * budget cannot commit a process identity, so the supervisor boundary would
+ * be unprovable and must refuse dispatch. Every dispatch now also crosses the
+ * durable authority boundary — grant → intent → start → termination witness
+ * — so a restart can reconcile effects the journal alone cannot settle.
+ */
 export async function executeRunCommand(journal, request, policy) {
     if (Math.floor(request.deadline - performance.now()) <= 0)
         throw new VerifiedRunError("deadline");
     if (policy.signal?.aborted)
         throw new VerifiedRunError("cancelled");
+    // The supervisor boundary only exists once a budget (and therefore the
+    // gated driver) is anchored. Dispatching without it would run code whose
+    // termination cannot be witnessed — refuse rather than degrade.
+    if (!journal.state.budget)
+        throw new VerifiedRunError("unsupported_boundary");
+    const authority = policy.authority;
     const generation = journal.state.generation;
     const executionId = randomUUID();
-    journal.append({
-        kind: "dispatch",
-        executionId,
-        role: request.role,
-        claimId: request.claimId,
-        ...(request.taskId === undefined ? {} : { taskId: request.taskId }),
-    });
+    const claims = workspaceClaim(request.workspace, request.role === "writer" ? "write" : "read", generation);
     const timeoutMs = Math.floor(request.deadline - performance.now());
-    if (timeoutMs <= 0 || policy.signal?.aborted) {
-        const failure = policy.signal?.aborted ? "cancelled" : "deadline";
-        journal.append({ kind: "exited", executionId, failure });
-        throw new VerifiedRunError(failure);
-    }
-    const result = await executeSandbox({
-        workspace: request.workspace,
-        argv: request.argv,
-        writable: request.role === "writer",
-        timeoutMs,
-        cleanupMs: policy.cleanupMs,
-        maxOutputBytes: policy.maxOutputBytes,
-        ...(policy.signal ? { signal: policy.signal } : {}),
-        ...(journal.state.budget
-            ? {
-                onReady: (identity) => {
-                    if (journal.state.generation !== generation)
-                        throw new VerifiedRunError("stale_generation");
-                    journal.append({ kind: "process_ready", executionId, identity });
-                },
-            }
-            : {}),
+    const admission = authority.store.acquire({
+        sessionId: authority.sessionId,
+        incarnation: authority.incarnation,
+        commandId: executionId,
+        intentDigest: digestObject({ argv: request.argv, claims, role: request.role }),
+        claims,
+        now: Date.now(),
+        ttl: timeoutMs + policy.cleanupMs + 30000,
     });
+    if (admission.status !== "granted") {
+        // A fresh executionId can only collide with a conflicting or wedged
+        // claim — quarantined effects hold theirs until witnessed (fail closed).
+        throw new VerifiedRunError("authority_blocked");
+    }
+    const token = admission.token;
+    let supervisorInvoked = false;
+    let readyObserved = false;
+    let result;
+    try {
+        journal.append({
+            kind: "dispatch",
+            executionId,
+            role: request.role,
+            claimId: request.claimId,
+            ...(request.taskId === undefined ? {} : { taskId: request.taskId }),
+        });
+        if (timeoutMs <= 0 || policy.signal?.aborted) {
+            const failure = policy.signal?.aborted ? "cancelled" : "deadline";
+            // Provably pre-spawn: the intent never reached the adapter, so the grant
+            // settles immediately instead of wedging as an unwitnessed live effect.
+            authority.store.cancel(token);
+            authority.store.confirmTerminated(token);
+            journal.append({ kind: "exited", executionId, failure });
+            throw new VerifiedRunError(failure);
+        }
+        // The intent commits before the adapter is invoked: from this record on,
+        // the effect may be live and a crash must quarantine it, never assume
+        // it did not run.
+        if (!authority.store.dispatchIntent(token, executionId))
+            throw new VerifiedRunError("authority");
+        supervisorInvoked = true;
+        result = await executeSandbox({
+            workspace: request.workspace,
+            argv: request.argv,
+            writable: request.role === "writer",
+            timeoutMs: Math.floor(request.deadline - performance.now()),
+            cleanupMs: policy.cleanupMs,
+            maxOutputBytes: policy.maxOutputBytes,
+            ...(policy.signal ? { signal: policy.signal } : {}),
+            onReady: (identity) => {
+                readyObserved = true;
+                if (journal.state.generation !== generation)
+                    throw new VerifiedRunError("stale_generation");
+                journal.append({ kind: "process_ready", executionId, identity });
+                if (!authority.store.effectStarted(token, claims, identity))
+                    throw new VerifiedRunError("authority");
+            },
+        });
+    }
+    catch (error) {
+        // Only pre-spawn rejections prove nothing ran; everything else may have
+        // a live or dying effect, which stays owned until a witness or a later
+        // reconcile settles it.
+        try {
+            authority.store.cancel(token);
+            if (!supervisorInvoked ||
+                (!readyObserved && error instanceof VerifiedRunError && NEVER_SPAWNED.has(error.code)))
+                authority.store.confirmTerminated(token);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "Execution ownership cleanup failed");
+        }
+        throw error;
+    }
+    if (result.failure === "cancelled")
+        authority.store.cancel(token);
+    // Resolve means both witnesses fired: the direct child closed and the
+    // recorded namespace drained empty. That is the termination-observed event
+    // — the grant releases its claims here and nowhere else.
+    if (!authority.store.confirmTerminated(token))
+        throw new VerifiedRunError("authority");
     if (journal.state.generation !== generation)
         throw new VerifiedRunError("stale_generation");
     journal.append({ kind: "exited", executionId, failure: request.role === "writer" ? result.failure : null });

package/dist/core/verified-run/owned-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"owned-execution.js","sourceRoot":"","sources":["../../../src/core/verified-run/owned-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAGlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgBhD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAA2B,EAC3B,OAAwB,EACxB,MAIC,EACyB;IAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;QAChB,WAAW;QACX,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ;QACnC,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;YACvB,CAAC,CAAC;gBACA,OAAO,EAAE,CAAC,QAA2B,EAAE,EAAE,CAAC;oBACzC,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;wBAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;oBAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAAA,CACjE;aACD;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAAA,CAC1C","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeSandbox, type SandboxOutcome } from \"./broker.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport interface OwnedRunCommand {\n\treadonly role: \"writer\" | \"verifier\";\n\treadonly argv: readonly string[];\n\treadonly workspace: string;\n\treadonly deadline: number;\n\treadonly claimId: string | null;\n\treadonly taskId?: string;\n}\nexport interface OwnedRunResult {\n\treadonly executionId: string;\n\treadonly result: SandboxOutcome;\n\treadonly timeoutMs: number;\n}\n\n/** The mandatory durable intent boundary is shared by command and AgentSession writers. */\nexport async function executeRunCommand(\n\tjournal: VerifiedRunJournal,\n\trequest: OwnedRunCommand,\n\tpolicy: {\n\t\treadonly cleanupMs: number;\n\t\treadonly maxOutputBytes: number;\n\t\treadonly signal?: AbortSignal;\n\t},\n): Promise<OwnedRunResult> {\n\tif (Math.floor(request.deadline - performance.now()) <= 0) throw new VerifiedRunError(\"deadline\");\n\tif (policy.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst generation = journal.state.generation;\n\tconst executionId = randomUUID();\n\tjournal.append({\n\t\tkind: \"dispatch\",\n\t\texecutionId,\n\t\trole: request.role,\n\t\tclaimId: request.claimId,\n\t\t...(request.taskId === undefined ? {} : { taskId: request.taskId }),\n\t});\n\tconst timeoutMs = Math.floor(request.deadline - performance.now());\n\tif (timeoutMs <= 0 || policy.signal?.aborted) {\n\t\tconst failure = policy.signal?.aborted ? \"cancelled\" : \"deadline\";\n\t\tjournal.append({ kind: \"exited\", executionId, failure });\n\t\tthrow new VerifiedRunError(failure);\n\t}\n\tconst result = await executeSandbox({\n\t\tworkspace: request.workspace,\n\t\targv: request.argv,\n\t\twritable: request.role === \"writer\",\n\t\ttimeoutMs,\n\t\tcleanupMs: policy.cleanupMs,\n\t\tmaxOutputBytes: policy.maxOutputBytes,\n\t\t...(policy.signal ? { signal: policy.signal } : {}),\n\t\t...(journal.state.budget\n\t\t\t? {\n\t\t\t\t\tonReady: (identity: NamespaceIdentity) => {\n\t\t\t\t\t\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\t\t\t\t\t\tjournal.append({ kind: \"process_ready\", executionId, identity });\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t});\n\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\tjournal.append({ kind: \"exited\", executionId, failure: request.role === \"writer\" ? result.failure : null });\n\treturn { executionId, result, timeoutMs };\n}\n"]}
+{"version":3,"file":"owned-execution.js","sourceRoot":"","sources":["../../../src/core/verified-run/owned-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAGlE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgB9D;;;;;;GAMG;AACH,SAAS,cAAc,CACtB,SAAiB,EACjB,MAAwB,EACxB,UAAkB,EACc;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB;YACC,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM;YACN,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;SAC9B;KACD,CAAC,CAAC;AAAA,CACH;AAED,+EAA+E;AAC/E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAA2B,EAC3B,OAAwB,EACxB,MAKC,EACyB;IAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,kEAAgE;IAChE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,WAAW;QACtB,YAAY,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9E,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;KACzC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,oEAAoE;QACpE,2EAAyE;QACzE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAe,SAAS,CAAC,KAAK,CAAC;IAC1C,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,UAAU;YAChB,WAAW;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;YAClE,yEAAyE;YACzE,wEAAwE;YACxE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,kBAAkB;QAClB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjG,iBAAiB,GAAG,IAAI,CAAC;QACzB,MAAM,GAAG,MAAM,cAAc,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ;YACnC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC,QAA2B,EAAE,EAAE,CAAC;gBACzC,aAAa,GAAG,IAAI,CAAC;gBACrB,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;oBAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;gBAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;oBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAAA,CACrG;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,wEAAwE;QACxE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC;YACJ,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IACC,CAAC,iBAAiB;gBAClB,CAAC,CAAC,aAAa,IAAI,KAAK,YAAY,gBAAgB,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEtF,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,oCAAoC,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,sEAAsE;IACtE,2EAA2E;IAC3E,2DAAyD;IACzD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAAA,CAC1C","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { realpathSync } from \"node:fs\";\nimport { performance } from \"node:perf_hooks\";\nimport type { ResourceClaimInput } from \"../../coordination/resource.ts\";\nimport type { GrantToken } from \"../../coordination/types.ts\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport { executeSandbox, type SandboxOutcome } from \"./broker.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\nimport type { NamespaceIdentity } from \"./namespace-identity.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport interface OwnedRunCommand {\n\treadonly role: \"writer\" | \"verifier\";\n\treadonly argv: readonly string[];\n\treadonly workspace: string;\n\treadonly deadline: number;\n\treadonly claimId: string | null;\n\treadonly taskId?: string;\n}\nexport interface OwnedRunResult {\n\treadonly executionId: string;\n\treadonly result: SandboxOutcome;\n\treadonly timeoutMs: number;\n}\n\n/**\n * The filesystem claim a dispatched process is authorized for: exactly the\n * workspace bind it receives inside the namespace — nothing wider. Keys are\n * the resolved absolute path minus the leading slash so prefix containment\n * matches real tree containment; `realpathSync` keeps two spellings of the\n * same directory one claim.\n */\nfunction workspaceClaim(\n\tworkspace: string,\n\taccess: \"read\" | \"write\",\n\tgeneration: number,\n): readonly ResourceClaimInput[] {\n\tlet root: string;\n\ttry {\n\t\troot = realpathSync(workspace);\n\t} catch {\n\t\tthrow new VerifiedRunError(\"authority_claim\");\n\t}\n\treturn Object.freeze([\n\t\t{\n\t\t\tnamespace: \"filesystem\",\n\t\t\tinstanceId: \"verified-run\",\n\t\t\tcanonicalKey: root.replace(/^\\/+/, \"\"),\n\t\t\taccess,\n\t\t\tgeneration: String(generation),\n\t\t},\n\t]);\n}\n\n/** Rejection codes that can only be produced before the supervisor spawned. */\nconst NEVER_SPAWNED = new Set([\"cancelled\", \"deadline\", \"unsupported_boundary\"]);\n\n/**\n * Mandatory durable dispatch intent, shared by command and AgentSession\n * writers. There is no ungated execution lane: a journal without an anchored\n * budget cannot commit a process identity, so the supervisor boundary would\n * be unprovable and must refuse dispatch. Every dispatch now also crosses the\n * durable authority boundary — grant → intent → start → termination witness\n * — so a restart can reconcile effects the journal alone cannot settle.\n */\nexport async function executeRunCommand(\n\tjournal: VerifiedRunJournal,\n\trequest: OwnedRunCommand,\n\tpolicy: {\n\t\treadonly cleanupMs: number;\n\t\treadonly maxOutputBytes: number;\n\t\treadonly authority: RunAuthority;\n\t\treadonly signal?: AbortSignal;\n\t},\n): Promise<OwnedRunResult> {\n\tif (Math.floor(request.deadline - performance.now()) <= 0) throw new VerifiedRunError(\"deadline\");\n\tif (policy.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t// The supervisor boundary only exists once a budget (and therefore the\n\t// gated driver) is anchored. Dispatching without it would run code whose\n\t// termination cannot be witnessed — refuse rather than degrade.\n\tif (!journal.state.budget) throw new VerifiedRunError(\"unsupported_boundary\");\n\tconst authority = policy.authority;\n\tconst generation = journal.state.generation;\n\tconst executionId = randomUUID();\n\tconst claims = workspaceClaim(request.workspace, request.role === \"writer\" ? \"write\" : \"read\", generation);\n\tconst timeoutMs = Math.floor(request.deadline - performance.now());\n\tconst admission = authority.store.acquire({\n\t\tsessionId: authority.sessionId,\n\t\tincarnation: authority.incarnation,\n\t\tcommandId: executionId,\n\t\tintentDigest: digestObject({ argv: request.argv, claims, role: request.role }),\n\t\tclaims,\n\t\tnow: Date.now(),\n\t\tttl: timeoutMs + policy.cleanupMs + 30000,\n\t});\n\tif (admission.status !== \"granted\") {\n\t\t// A fresh executionId can only collide with a conflicting or wedged\n\t\t// claim — quarantined effects hold theirs until witnessed (fail closed).\n\t\tthrow new VerifiedRunError(\"authority_blocked\");\n\t}\n\tconst token: GrantToken = admission.token;\n\tlet supervisorInvoked = false;\n\tlet readyObserved = false;\n\tlet result: SandboxOutcome;\n\ttry {\n\t\tjournal.append({\n\t\t\tkind: \"dispatch\",\n\t\t\texecutionId,\n\t\t\trole: request.role,\n\t\t\tclaimId: request.claimId,\n\t\t\t...(request.taskId === undefined ? {} : { taskId: request.taskId }),\n\t\t});\n\t\tif (timeoutMs <= 0 || policy.signal?.aborted) {\n\t\t\tconst failure = policy.signal?.aborted ? \"cancelled\" : \"deadline\";\n\t\t\t// Provably pre-spawn: the intent never reached the adapter, so the grant\n\t\t\t// settles immediately instead of wedging as an unwitnessed live effect.\n\t\t\tauthority.store.cancel(token);\n\t\t\tauthority.store.confirmTerminated(token);\n\t\t\tjournal.append({ kind: \"exited\", executionId, failure });\n\t\t\tthrow new VerifiedRunError(failure);\n\t\t}\n\t\t// The intent commits before the adapter is invoked: from this record on,\n\t\t// the effect may be live and a crash must quarantine it, never assume\n\t\t// it did not run.\n\t\tif (!authority.store.dispatchIntent(token, executionId)) throw new VerifiedRunError(\"authority\");\n\t\tsupervisorInvoked = true;\n\t\tresult = await executeSandbox({\n\t\t\tworkspace: request.workspace,\n\t\t\targv: request.argv,\n\t\t\twritable: request.role === \"writer\",\n\t\t\ttimeoutMs: Math.floor(request.deadline - performance.now()),\n\t\t\tcleanupMs: policy.cleanupMs,\n\t\t\tmaxOutputBytes: policy.maxOutputBytes,\n\t\t\t...(policy.signal ? { signal: policy.signal } : {}),\n\t\t\tonReady: (identity: NamespaceIdentity) => {\n\t\t\t\treadyObserved = true;\n\t\t\t\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\t\t\t\tjournal.append({ kind: \"process_ready\", executionId, identity });\n\t\t\t\tif (!authority.store.effectStarted(token, claims, identity)) throw new VerifiedRunError(\"authority\");\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\t// Only pre-spawn rejections prove nothing ran; everything else may have\n\t\t// a live or dying effect, which stays owned until a witness or a later\n\t\t// reconcile settles it.\n\t\ttry {\n\t\t\tauthority.store.cancel(token);\n\t\t\tif (\n\t\t\t\t!supervisorInvoked ||\n\t\t\t\t(!readyObserved && error instanceof VerifiedRunError && NEVER_SPAWNED.has(error.code))\n\t\t\t)\n\t\t\t\tauthority.store.confirmTerminated(token);\n\t\t} catch (cleanupError) {\n\t\t\tthrow new AggregateError([error, cleanupError], \"Execution ownership cleanup failed\");\n\t\t}\n\t\tthrow error;\n\t}\n\tif (result.failure === \"cancelled\") authority.store.cancel(token);\n\t// Resolve means both witnesses fired: the direct child closed and the\n\t// recorded namespace drained empty. That is the termination-observed event\n\t// — the grant releases its claims here and nowhere else.\n\tif (!authority.store.confirmTerminated(token)) throw new VerifiedRunError(\"authority\");\n\tif (journal.state.generation !== generation) throw new VerifiedRunError(\"stale_generation\");\n\tjournal.append({ kind: \"exited\", executionId, failure: request.role === \"writer\" ? result.failure : null });\n\treturn { executionId, result, timeoutMs };\n}\n"]}

package/dist/core/verified-run/phase-context.d.ts

@@ -1,9 +1,11 @@
 import type { RunContract } from "omk-protocol";
+import type { RunAuthority } from "./authority-runtime.ts";
 import type { VerifiedRunJournal } from "./journal.ts";
 export interface RunPhaseContext {
     readonly contract: RunContract;
     readonly runPath: string;
     readonly journal: VerifiedRunJournal;
+    readonly authority: RunAuthority;
     readonly signal?: AbortSignal;
 }
 //# sourceMappingURL=phase-context.d.ts.map

package/dist/core/verified-run/phase-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phase-context.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly signal?: AbortSignal;\n}\n"]}
+{"version":3,"file":"phase-context.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly authority: RunAuthority;\n\treadonly signal?: AbortSignal;\n}\n"]}

package/dist/core/verified-run/phase-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"phase-context.js","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly signal?: AbortSignal;\n}\n"]}
+{"version":3,"file":"phase-context.js","sourceRoot":"","sources":["../../../src/core/verified-run/phase-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { RunContract } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport type { VerifiedRunJournal } from \"./journal.ts\";\n\nexport interface RunPhaseContext {\n\treadonly contract: RunContract;\n\treadonly runPath: string;\n\treadonly journal: VerifiedRunJournal;\n\treadonly authority: RunAuthority;\n\treadonly signal?: AbortSignal;\n}\n"]}

package/dist/core/verified-run/projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAmB,MAAM,gBAAgB,CAAC;AAI/E,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,aAAa,CAkLrE","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { type ProcessReduction, reduceProcessEvent } from \"./process-projection.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst progress: ProcessReduction = { dispatched: new Set(), checked: new Set(), activeRole: \"writer\" };\n\tconst commands = new Set([first.command.commandId]);\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\":\n\t\t\tcase \"process_ready\":\n\t\t\tcase \"exited\":\n\t\t\t\treduceProcessEvent(context, event, progress);\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, {\n\t\t\t\t\tcommands,\n\t\t\t\t\tchecked: progress.checked,\n\t\t\t\t\tactiveRole: progress.activeRole,\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tprogress.checked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAmB,MAAM,gBAAgB,CAAC;AAI/E,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,aAAa,CA0OrE","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { type ProcessReduction, reduceProcessEvent } from \"./process-projection.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tpublication: \"none\",\n\t\t\tpublicationCandidateOid: null,\n\t\t\tpublicationRef: null,\n\t\t\tpublicationCommandId: null,\n\t\t\tpublicationFailure: null,\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tlastRecovery: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst progress: ProcessReduction = { dispatched: new Set(), checked: new Set(), activeRole: \"writer\" };\n\tconst commands = new Set([first.command.commandId]);\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\") throw new VerifiedRunError(\"integrity\");\n\t\tif (\n\t\t\tstate.receiptDigest &&\n\t\t\tevent.kind !== \"publish_intent\" &&\n\t\t\tevent.kind !== \"published\" &&\n\t\t\tevent.kind !== \"publish_failed\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\":\n\t\t\tcase \"process_ready\":\n\t\t\tcase \"exited\":\n\t\t\t\treduceProcessEvent(context, event, progress);\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, {\n\t\t\t\t\tcommands,\n\t\t\t\t\tchecked: progress.checked,\n\t\t\t\t\tactiveRole: progress.activeRole,\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tprogress.checked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"publish_intent\":\n\t\t\t\tif (\n\t\t\t\t\tstate.verification !== \"verified\" ||\n\t\t\t\t\tstate.application !== \"candidate_ready\" ||\n\t\t\t\t\tstate.settlement !== \"settled\" ||\n\t\t\t\t\t!state.receiptDigest ||\n\t\t\t\t\tstate.receiptDigest !== event.receiptDigest ||\n\t\t\t\t\tstate.candidateDigest !== event.candidateDigest ||\n\t\t\t\t\tstate.generation !== event.generation ||\n\t\t\t\t\tevent.targetRef !== \"refs/omk/accepted\" ||\n\t\t\t\t\tstate.publication === \"intent\" ||\n\t\t\t\t\tstate.publication === \"accepted\"\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tpublication: \"intent\",\n\t\t\t\t\tpublicationCandidateOid: event.candidateOid,\n\t\t\t\t\tpublicationRef: event.targetRef,\n\t\t\t\t\tpublicationCommandId: event.commandId,\n\t\t\t\t\tpublicationFailure: null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"published\":\n\t\t\t\tif (\n\t\t\t\t\tstate.publication !== \"intent\" ||\n\t\t\t\t\tstate.publicationCommandId !== event.commandId ||\n\t\t\t\t\tstate.publicationCandidateOid !== event.candidateOid\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, publication: \"accepted\", publicationCommandId: null };\n\t\t\t\tbreak;\n\t\t\tcase \"publish_failed\":\n\t\t\t\tif (state.publication !== \"intent\" || state.publicationCommandId !== event.commandId)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tpublication: event.code === \"reconciliation-required\" ? \"reconciliation_required\" : \"failed\",\n\t\t\t\t\tpublicationCommandId: null,\n\t\t\t\t\tpublicationFailure: event.code,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tlastRecovery: context.state.lastRecovery ? Object.freeze(context.state.lastRecovery) : null,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}

package/dist/core/verified-run/projection.js

@@ -24,10 +24,16 @@ export function projectRun(events) {
             settlement: "open",
             verification: "not_requested",
             application: "not_requested",
+            publication: "none",
+            publicationCandidateOid: null,
+            publicationRef: null,
+            publicationCommandId: null,
+            publicationFailure: null,
             candidateDigest: null,
             inputDigest: null,
             receiptDigest: null,
             failure: null,
+            lastRecovery: null,
             activeExecutionIds: [],
             writerOpen: false,
             modelRequests: 0,
@@ -53,7 +59,12 @@ export function projectRun(events) {
     const commands = new Set([first.command.commandId]);
     for (const event of events.slice(1)) {
         const state = context.state;
-        if (state.execution === "failed" || state.receiptDigest)
+        if (state.execution === "failed")
+            throw new VerifiedRunError("integrity");
+        if (state.receiptDigest &&
+            event.kind !== "publish_intent" &&
+            event.kind !== "published" &&
+            event.kind !== "publish_failed")
             throw new VerifiedRunError("integrity");
         switch (event.kind) {
             case "created":
@@ -158,6 +169,44 @@ export function projectRun(events) {
                     settlement: state.activeExecutionIds.length || state.writerOpen ? "quarantined" : "settled",
                 };
                 break;
+            case "publish_intent":
+                if (state.verification !== "verified" ||
+                    state.application !== "candidate_ready" ||
+                    state.settlement !== "settled" ||
+                    !state.receiptDigest ||
+                    state.receiptDigest !== event.receiptDigest ||
+                    state.candidateDigest !== event.candidateDigest ||
+                    state.generation !== event.generation ||
+                    event.targetRef !== "refs/omk/accepted" ||
+                    state.publication === "intent" ||
+                    state.publication === "accepted")
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    publication: "intent",
+                    publicationCandidateOid: event.candidateOid,
+                    publicationRef: event.targetRef,
+                    publicationCommandId: event.commandId,
+                    publicationFailure: null,
+                };
+                break;
+            case "published":
+                if (state.publication !== "intent" ||
+                    state.publicationCommandId !== event.commandId ||
+                    state.publicationCandidateOid !== event.candidateOid)
+                    throw new VerifiedRunError("integrity");
+                context.state = { ...state, publication: "accepted", publicationCommandId: null };
+                break;
+            case "publish_failed":
+                if (state.publication !== "intent" || state.publicationCommandId !== event.commandId)
+                    throw new VerifiedRunError("integrity");
+                context.state = {
+                    ...state,
+                    publication: event.code === "reconciliation-required" ? "reconciliation_required" : "failed",
+                    publicationCommandId: null,
+                    publicationFailure: event.code,
+                };
+                break;
             default: {
                 const exhaustive = event;
                 throw new VerifiedRunError(String(exhaustive));
@@ -167,6 +216,7 @@ export function projectRun(events) {
     }
     return Object.freeze({
         ...context.state,
+        lastRecovery: context.state.lastRecovery ? Object.freeze(context.state.lastRecovery) : null,
         activeExecutionIds: Object.freeze([...context.state.activeExecutionIds]),
         processes: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),
         tasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),

package/dist/core/verified-run/projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAyB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAiB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;QAC5E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,OAAO,GAAoB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,eAAe;YAC7B,WAAW,EAAE,eAAe;YAC5B,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,CAAC;YAChB,KAAK,EACJ,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC/B,CAAC,IAAI,EAAqB,EAAE,CAAC,CAAC;oBAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,CAAC;oBACb,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;iBACb,CAAC,CACF;gBACF,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;SACb;KACD,CAAC;IACF,MAAM,QAAQ,GAAqB,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjG,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,iBAAiB,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrC,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,KAAK,CAAC,MAAM;oBACZ,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM;oBAC1D,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;oBAC9D,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS;oBAElE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,MAAM;oBACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,WAAW,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,kBAAkB;gBACtB,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,WAAW;oBACjB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;oBAEpD,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxD,MAAM;YACP,KAAK,cAAc,CAAC;YACpB,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc;gBAClB,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACP,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe;gBACnB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACP,KAAK,UAAU,CAAC;YAChB,KAAK,eAAe,CAAC;YACrB,KAAK,QAAQ;gBACZ,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC7C,MAAM;YACP,KAAK,WAAW,EAAE,CAAC;gBAClB,IACC,CAAC,OAAO,CAAC,cAAc;oBACvB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,OAAO;oBACb,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,KAAK,CAAC,eAAe;oBACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;oBAE/F,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,IACC,KAAK,CAAC,UAAU,KAAK,SAAS;wBAC9B,KAAK,CAAC,sBAAsB,KAAK,SAAS;wBAC1C,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS;wBACzC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc;wBAC9C,KAAK,CAAC,sBAAsB;4BAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;wBAEtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBACtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,eAAe,EAAE,KAAK,CAAC,MAAM;oBAC7B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,IAAI;oBAC5D,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;iBACrC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,SAAS,CAAC;YACf,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACtB,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE;oBACnC,QAAQ;oBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAC/B,CAAC,CAAC;gBACH,MAAM;YACP,KAAK,WAAW;gBACf,IACC,CAAC,KAAK,CAAC,eAAe;oBACtB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;oBACtD,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC;oBAEjC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,WAAW;oBACtB,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;iBACjE,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,YAAY,EAAE,cAAc;oBAC5B,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;iBAC3F,CAAC;gBACF,MAAM;YACP,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,OAAO,CAAC,KAAK;QAChB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { type ProcessReduction, reduceProcessEvent } from \"./process-projection.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst progress: ProcessReduction = { dispatched: new Set(), checked: new Set(), activeRole: \"writer\" };\n\tconst commands = new Set([first.command.commandId]);\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\" || state.receiptDigest) throw new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\":\n\t\t\tcase \"process_ready\":\n\t\t\tcase \"exited\":\n\t\t\t\treduceProcessEvent(context, event, progress);\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, {\n\t\t\t\t\tcommands,\n\t\t\t\t\tchecked: progress.checked,\n\t\t\t\t\tactiveRole: progress.activeRole,\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tprogress.checked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAyB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAiB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;QAC5E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,OAAO,GAAoB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,eAAe;YAC7B,WAAW,EAAE,eAAe;YAC5B,WAAW,EAAE,MAAM;YACnB,uBAAuB,EAAE,IAAI;YAC7B,cAAc,EAAE,IAAI;YACpB,oBAAoB,EAAE,IAAI;YAC1B,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,IAAI;YAClB,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,CAAC;YAChB,KAAK,EACJ,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAChD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC/B,CAAC,IAAI,EAAqB,EAAE,CAAC,CAAC;oBAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,CAAC;oBACb,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;iBACb,CAAC,CACF;gBACF,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,IAAI;YACZ,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,IAAI;YAC5B,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;SACb;KACD,CAAC;IACF,MAAM,QAAQ,GAAqB,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1E,IACC,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC/B,KAAK,CAAC,IAAI,KAAK,WAAW;YAC1B,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAE/B,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,iBAAiB,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACrC,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,KAAK,CAAC,MAAM;oBACZ,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM;oBAC1D,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,QAAQ;oBAC9D,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS;oBAElE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,MAAM;oBACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,WAAW,EAAE,MAAM,CAAC,SAAS;iBAC7B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,kBAAkB;gBACtB,IACC,KAAK,CAAC,QAAQ,KAAK,CAAC;oBACpB,CAAC,KAAK,CAAC,MAAM;oBACb,KAAK,CAAC,WAAW;oBACjB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;oBAEpD,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxD,MAAM;YACP,KAAK,cAAc,CAAC;YACpB,KAAK,eAAe,CAAC;YACrB,KAAK,cAAc;gBAClB,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACP,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe,CAAC;YACrB,KAAK,eAAe;gBACnB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM;YACP,KAAK,UAAU,CAAC;YAChB,KAAK,eAAe,CAAC;YACrB,KAAK,QAAQ;gBACZ,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC7C,MAAM;YACP,KAAK,WAAW,EAAE,CAAC;gBAClB,IACC,CAAC,OAAO,CAAC,cAAc;oBACvB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,OAAO;oBACb,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,KAAK,CAAC,eAAe;oBACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;oBAE/F,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,IACC,KAAK,CAAC,UAAU,KAAK,SAAS;wBAC9B,KAAK,CAAC,sBAAsB,KAAK,SAAS;wBAC1C,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS;wBACzC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc;wBAC9C,KAAK,CAAC,sBAAsB;4BAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;wBAEtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS;oBACtF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,eAAe,EAAE,KAAK,CAAC,MAAM;oBAC7B,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,IAAI;oBAC5D,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;iBACrC,CAAC;gBACF,MAAM;YACP,CAAC;YACD,KAAK,SAAS,CAAC;YACf,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACtB,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE;oBACnC,QAAQ;oBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAC/B,CAAC,CAAC;gBACH,MAAM;YACP,KAAK,WAAW;gBACf,IACC,CAAC,KAAK,CAAC,eAAe;oBACtB,KAAK,CAAC,UAAU;oBAChB,KAAK,CAAC,kBAAkB,CAAC,MAAM;oBAC/B,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;oBACtD,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC;oBAEjC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,SAAS,EAAE,WAAW;oBACtB,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;iBACjE,CAAC;gBACF,MAAM;YACP,KAAK,QAAQ;gBACZ,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,YAAY,EAAE,cAAc;oBAC5B,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;iBAC3F,CAAC;gBACF,MAAM;YACP,KAAK,gBAAgB;gBACpB,IACC,KAAK,CAAC,YAAY,KAAK,UAAU;oBACjC,KAAK,CAAC,WAAW,KAAK,iBAAiB;oBACvC,KAAK,CAAC,UAAU,KAAK,SAAS;oBAC9B,CAAC,KAAK,CAAC,aAAa;oBACpB,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;oBAC3C,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;oBAC/C,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;oBACrC,KAAK,CAAC,SAAS,KAAK,mBAAmB;oBACvC,KAAK,CAAC,WAAW,KAAK,QAAQ;oBAC9B,KAAK,CAAC,WAAW,KAAK,UAAU;oBAEhC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,WAAW,EAAE,QAAQ;oBACrB,uBAAuB,EAAE,KAAK,CAAC,YAAY;oBAC3C,cAAc,EAAE,KAAK,CAAC,SAAS;oBAC/B,oBAAoB,EAAE,KAAK,CAAC,SAAS;oBACrC,kBAAkB,EAAE,IAAI;iBACxB,CAAC;gBACF,MAAM;YACP,KAAK,WAAW;gBACf,IACC,KAAK,CAAC,WAAW,KAAK,QAAQ;oBAC9B,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,SAAS;oBAC9C,KAAK,CAAC,uBAAuB,KAAK,KAAK,CAAC,YAAY;oBAEpD,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;gBAClF,MAAM;YACP,KAAK,gBAAgB;gBACpB,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,SAAS;oBACnF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,CAAC,KAAK,GAAG;oBACf,GAAG,KAAK;oBACR,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ;oBAC5F,oBAAoB,EAAE,IAAI;oBAC1B,kBAAkB,EAAE,KAAK,CAAC,IAAI;iBAC9B,CAAC;gBACF,MAAM;YACP,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,OAAO,CAAC,KAAK;QAChB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3F,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KAC5E,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { reduceDagEvent } from \"./dag-projection.ts\";\nimport type { RunTaskProjection } from \"./dag-types.ts\";\nimport { type ProcessReduction, reduceProcessEvent } from \"./process-projection.ts\";\nimport { reduceRecoveryEvent } from \"./recovery-projection.ts\";\nimport type { RunEvent, RunProjection, WriterReduction } from \"./run-types.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { reduceWriterEvent } from \"./writer-projection.ts\";\n\n/** Deterministic replay only. Recovery observations are supplied by the trusted host adapter. */\nexport function projectRun(events: readonly RunEvent[]): RunProjection {\n\tconst first = events[0];\n\tif (first?.kind !== \"created\" || first.contract.runId !== first.command.runId)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tconst context: WriterReduction = {\n\t\tcontract: first.contract,\n\t\twriterFinished: false,\n\t\twriterStarted: false,\n\t\tproducerStarted: false,\n\t\twriterCommands: 0,\n\t\trequestBaseline: 0,\n\t\trequests: new Set(),\n\t\tstate: {\n\t\t\trunId: first.contract.runId,\n\t\t\trevision: 1,\n\t\t\tgeneration: 1,\n\t\t\texecution: \"ready\",\n\t\t\tsettlement: \"open\",\n\t\t\tverification: \"not_requested\",\n\t\t\tapplication: \"not_requested\",\n\t\t\tpublication: \"none\",\n\t\t\tpublicationCandidateOid: null,\n\t\t\tpublicationRef: null,\n\t\t\tpublicationCommandId: null,\n\t\t\tpublicationFailure: null,\n\t\t\tcandidateDigest: null,\n\t\t\tinputDigest: null,\n\t\t\treceiptDigest: null,\n\t\t\tfailure: null,\n\t\t\tlastRecovery: null,\n\t\t\tactiveExecutionIds: [],\n\t\t\twriterOpen: false,\n\t\t\tmodelRequests: 0,\n\t\t\ttasks:\n\t\t\t\tfirst.contract.profile === \"linux-command-dag-v1\"\n\t\t\t\t\t? first.contract.writer.tasks.map(\n\t\t\t\t\t\t\t(task): RunTaskProjection => ({\n\t\t\t\t\t\t\t\ttaskId: task.id,\n\t\t\t\t\t\t\t\tattempt: 0,\n\t\t\t\t\t\t\t\tgeneration: 1,\n\t\t\t\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\t\t\t\tinputDigest: null,\n\t\t\t\t\t\t\t\toutputDigest: null,\n\t\t\t\t\t\t\t\tfailure: null,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t)\n\t\t\t\t\t: [],\n\t\t\tbudget: null,\n\t\t\tenvironmentDigest: null,\n\t\t\tverificationDeadlineMs: null,\n\t\t\tlastClockMs: null,\n\t\t\tprocesses: [],\n\t\t},\n\t};\n\tconst progress: ProcessReduction = { dispatched: new Set(), checked: new Set(), activeRole: \"writer\" };\n\tconst commands = new Set([first.command.commandId]);\n\tfor (const event of events.slice(1)) {\n\t\tconst state = context.state;\n\t\tif (state.execution === \"failed\") throw new VerifiedRunError(\"integrity\");\n\t\tif (\n\t\t\tstate.receiptDigest &&\n\t\t\tevent.kind !== \"publish_intent\" &&\n\t\t\tevent.kind !== \"published\" &&\n\t\t\tevent.kind !== \"publish_failed\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\tswitch (event.kind) {\n\t\t\tcase \"created\":\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tcase \"budget_anchored\": {\n\t\t\t\tconst budget = event.budget;\n\t\t\t\tconst limits = first.contract.budget;\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 1 ||\n\t\t\t\t\tstate.budget ||\n\t\t\t\t\tbudget.workDeadlineMs - budget.startedMs !== limits.workMs ||\n\t\t\t\t\tbudget.verifyCapMs - budget.workDeadlineMs !== limits.verifyMs ||\n\t\t\t\t\tbudget.cleanupDeadlineMs - budget.verifyCapMs !== limits.cleanupMs\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tbudget,\n\t\t\t\t\tenvironmentDigest: event.environmentDigest,\n\t\t\t\t\tlastClockMs: budget.startedMs,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"input_checkpoint\":\n\t\t\t\tif (\n\t\t\t\t\tstate.revision !== 2 ||\n\t\t\t\t\t!state.budget ||\n\t\t\t\t\tstate.inputDigest ||\n\t\t\t\t\tevent.digest !== first.contract.workspace.baseDigest\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, inputDigest: event.digest };\n\t\t\t\tbreak;\n\t\t\tcase \"task_started\":\n\t\t\tcase \"task_finished\":\n\t\t\tcase \"tasks_paused\":\n\t\t\t\treduceDagEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"writer_opened\":\n\t\t\tcase \"model_request\":\n\t\t\tcase \"writer_closed\":\n\t\t\t\treduceWriterEvent(context, event);\n\t\t\t\tbreak;\n\t\t\tcase \"dispatch\":\n\t\t\tcase \"process_ready\":\n\t\t\tcase \"exited\":\n\t\t\t\treduceProcessEvent(context, event, progress);\n\t\t\t\tbreak;\n\t\t\tcase \"candidate\": {\n\t\t\t\tif (\n\t\t\t\t\t!context.writerFinished ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.failure ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tstate.candidateDigest ||\n\t\t\t\t\tstate.tasks.some((task) => task.status !== \"succeeded\" || task.generation !== state.generation)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tif (state.budget) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tevent.observedMs === undefined ||\n\t\t\t\t\t\tevent.verificationDeadlineMs === undefined ||\n\t\t\t\t\t\tevent.observedMs < state.budget.startedMs ||\n\t\t\t\t\t\tevent.observedMs > state.budget.workDeadlineMs ||\n\t\t\t\t\t\tevent.verificationDeadlineMs !==\n\t\t\t\t\t\t\tMath.min(event.observedMs + first.contract.budget.verifyMs, state.budget.verifyCapMs)\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\t} else if (event.observedMs !== undefined || event.verificationDeadlineMs !== undefined)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tcandidateDigest: event.digest,\n\t\t\t\t\tverificationDeadlineMs: event.verificationDeadlineMs ?? null,\n\t\t\t\t\tlastClockMs: event.observedMs ?? null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resumed\":\n\t\t\tcase \"tasks_retried\":\n\t\t\tcase \"writer_restarted\":\n\t\t\t\treduceRecoveryEvent(context, event, {\n\t\t\t\t\tcommands,\n\t\t\t\t\tchecked: progress.checked,\n\t\t\t\t\tactiveRole: progress.activeRole,\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\tcase \"evaluated\":\n\t\t\t\tif (\n\t\t\t\t\t!state.candidateDigest ||\n\t\t\t\t\tstate.writerOpen ||\n\t\t\t\t\tstate.activeExecutionIds.length ||\n\t\t\t\t\tprogress.checked.size !== first.contract.checks.length ||\n\t\t\t\t\t(event.verified && state.failure)\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\treceiptDigest: event.receiptDigest,\n\t\t\t\t\texecution: \"succeeded\",\n\t\t\t\t\tverification: event.verified ? \"verified\" : \"violated\",\n\t\t\t\t\tapplication: event.verified ? \"candidate_ready\" : \"not_requested\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"failed\":\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\texecution: \"failed\",\n\t\t\t\t\tfailure: event.code,\n\t\t\t\t\tverification: \"inconclusive\",\n\t\t\t\t\tsettlement: state.activeExecutionIds.length || state.writerOpen ? \"quarantined\" : \"settled\",\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"publish_intent\":\n\t\t\t\tif (\n\t\t\t\t\tstate.verification !== \"verified\" ||\n\t\t\t\t\tstate.application !== \"candidate_ready\" ||\n\t\t\t\t\tstate.settlement !== \"settled\" ||\n\t\t\t\t\t!state.receiptDigest ||\n\t\t\t\t\tstate.receiptDigest !== event.receiptDigest ||\n\t\t\t\t\tstate.candidateDigest !== event.candidateDigest ||\n\t\t\t\t\tstate.generation !== event.generation ||\n\t\t\t\t\tevent.targetRef !== \"refs/omk/accepted\" ||\n\t\t\t\t\tstate.publication === \"intent\" ||\n\t\t\t\t\tstate.publication === \"accepted\"\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tpublication: \"intent\",\n\t\t\t\t\tpublicationCandidateOid: event.candidateOid,\n\t\t\t\t\tpublicationRef: event.targetRef,\n\t\t\t\t\tpublicationCommandId: event.commandId,\n\t\t\t\t\tpublicationFailure: null,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tcase \"published\":\n\t\t\t\tif (\n\t\t\t\t\tstate.publication !== \"intent\" ||\n\t\t\t\t\tstate.publicationCommandId !== event.commandId ||\n\t\t\t\t\tstate.publicationCandidateOid !== event.candidateOid\n\t\t\t\t)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = { ...state, publication: \"accepted\", publicationCommandId: null };\n\t\t\t\tbreak;\n\t\t\tcase \"publish_failed\":\n\t\t\t\tif (state.publication !== \"intent\" || state.publicationCommandId !== event.commandId)\n\t\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\t\tcontext.state = {\n\t\t\t\t\t...state,\n\t\t\t\t\tpublication: event.code === \"reconciliation-required\" ? \"reconciliation_required\" : \"failed\",\n\t\t\t\t\tpublicationCommandId: null,\n\t\t\t\t\tpublicationFailure: event.code,\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = event;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tcontext.state = { ...context.state, revision: state.revision + 1 };\n\t}\n\treturn Object.freeze({\n\t\t...context.state,\n\t\tlastRecovery: context.state.lastRecovery ? Object.freeze(context.state.lastRecovery) : null,\n\t\tactiveExecutionIds: Object.freeze([...context.state.activeExecutionIds]),\n\t\tprocesses: Object.freeze(context.state.processes.map((item) => Object.freeze(item))),\n\t\ttasks: Object.freeze(context.state.tasks.map((task) => Object.freeze(task))),\n\t});\n}\n"]}

package/dist/core/verified-run/publish-preflight.d.ts

@@ -0,0 +1,12 @@
+import type { RunContract, RunPublishCommand } from "omk-protocol";
+import type { JournalSnapshot } from "./journal.ts";
+import type { RunProjection } from "./run-types.ts";
+export declare function publishPolicyDigest(contract: RunContract): string;
+export declare function assertPublishable(snapshot: JournalSnapshot, command: RunPublishCommand, runPath: string): {
+    readonly contract: RunContract;
+    readonly state: RunProjection & {
+        readonly candidateDigest: string;
+        readonly receiptDigest: string;
+    };
+};
+//# sourceMappingURL=publish-preflight.d.ts.map

package/dist/core/verified-run/publish-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-preflight.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/publish-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAOjE;AAED,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,MAAM,GACb;IACF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACrG,CA6BA","sourcesContent":["import type { RunContract, RunPublishCommand } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { readRunEvidence } from \"./evidence.ts\";\nimport { OMK_ACCEPTED_REF } from \"./git-plumbing.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport function publishPolicyDigest(contract: RunContract): string {\n\treturn digestObject({\n\t\tapply: contract.apply,\n\t\tprofile: contract.profile,\n\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\twritablePaths: contract.writablePaths,\n\t});\n}\n\nexport function assertPublishable(\n\tsnapshot: JournalSnapshot,\n\tcommand: RunPublishCommand,\n\trunPath: string,\n): {\n\treadonly contract: RunContract;\n\treadonly state: RunProjection & { readonly candidateDigest: string; readonly receiptDigest: string };\n} {\n\tconst first = snapshot.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"missing_run\");\n\tconst contract = first.contract;\n\tconst state = snapshot.state;\n\tif (\n\t\tstate.verification !== \"verified\" ||\n\t\tstate.application !== \"candidate_ready\" ||\n\t\tstate.settlement !== \"settled\" ||\n\t\t!state.receiptDigest ||\n\t\t!state.candidateDigest ||\n\t\tstate.activeExecutionIds.length !== 0 ||\n\t\tstate.writerOpen\n\t)\n\t\tthrow new VerifiedRunError(\"unverified\");\n\tif (\n\t\tcommand.candidateDigest !== state.candidateDigest ||\n\t\tcommand.receiptDigest !== state.receiptDigest ||\n\t\tcommand.policyDigest !== publishPolicyDigest(contract)\n\t)\n\t\tthrow new VerifiedRunError(\"invalid_binding\");\n\tconst evidence = readRunEvidence(runPath, snapshot, commandEnvironmentDigest(contract, \"gated-v1\"));\n\tif (\n\t\t!evidence.verified ||\n\t\tevidence.candidateDigest !== state.candidateDigest ||\n\t\tevidence.receiptDigest !== state.receiptDigest\n\t)\n\t\tthrow new VerifiedRunError(\"invalid_binding\");\n\treturn { contract, state: { ...state, candidateDigest: state.candidateDigest, receiptDigest: state.receiptDigest } };\n}\n"]}

package/dist/core/verified-run/publish-preflight.js

@@ -0,0 +1,38 @@
+import { commandEnvironmentDigest } from "./broker.js";
+import { readRunEvidence } from "./evidence.js";
+import { OMK_ACCEPTED_REF } from "./git-plumbing.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+export function publishPolicyDigest(contract) {
+    return digestObject({
+        apply: contract.apply,
+        profile: contract.profile,
+        targetRef: OMK_ACCEPTED_REF,
+        writablePaths: contract.writablePaths,
+    });
+}
+export function assertPublishable(snapshot, command, runPath) {
+    const first = snapshot.records[0]?.event;
+    if (first?.kind !== "created")
+        throw new VerifiedRunError("missing_run");
+    const contract = first.contract;
+    const state = snapshot.state;
+    if (state.verification !== "verified" ||
+        state.application !== "candidate_ready" ||
+        state.settlement !== "settled" ||
+        !state.receiptDigest ||
+        !state.candidateDigest ||
+        state.activeExecutionIds.length !== 0 ||
+        state.writerOpen)
+        throw new VerifiedRunError("unverified");
+    if (command.candidateDigest !== state.candidateDigest ||
+        command.receiptDigest !== state.receiptDigest ||
+        command.policyDigest !== publishPolicyDigest(contract))
+        throw new VerifiedRunError("invalid_binding");
+    const evidence = readRunEvidence(runPath, snapshot, commandEnvironmentDigest(contract, "gated-v1"));
+    if (!evidence.verified ||
+        evidence.candidateDigest !== state.candidateDigest ||
+        evidence.receiptDigest !== state.receiptDigest)
+        throw new VerifiedRunError("invalid_binding");
+    return { contract, state: { ...state, candidateDigest: state.candidateDigest, receiptDigest: state.receiptDigest } };
+}
+//# sourceMappingURL=publish-preflight.js.map

package/dist/core/verified-run/publish-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-preflight.js","sourceRoot":"","sources":["../../../src/core/verified-run/publish-preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,UAAU,mBAAmB,CAAC,QAAqB,EAAU;IAClE,OAAO,YAAY,CAAC;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;KACrC,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,iBAAiB,CAChC,QAAyB,EACzB,OAA0B,EAC1B,OAAe,EAId;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACzC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IACC,KAAK,CAAC,YAAY,KAAK,UAAU;QACjC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QACvC,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,KAAK,CAAC,aAAa;QACpB,CAAC,KAAK,CAAC,eAAe;QACtB,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QACrC,KAAK,CAAC,UAAU;QAEhB,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC1C,IACC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;QACjD,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC7C,OAAO,CAAC,YAAY,KAAK,mBAAmB,CAAC,QAAQ,CAAC;QAEtD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACpG,IACC,CAAC,QAAQ,CAAC,QAAQ;QAClB,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;QAClD,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAE9C,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;AAAA,CACrH","sourcesContent":["import type { RunContract, RunPublishCommand } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { readRunEvidence } from \"./evidence.ts\";\nimport { OMK_ACCEPTED_REF } from \"./git-plumbing.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\nexport function publishPolicyDigest(contract: RunContract): string {\n\treturn digestObject({\n\t\tapply: contract.apply,\n\t\tprofile: contract.profile,\n\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\twritablePaths: contract.writablePaths,\n\t});\n}\n\nexport function assertPublishable(\n\tsnapshot: JournalSnapshot,\n\tcommand: RunPublishCommand,\n\trunPath: string,\n): {\n\treadonly contract: RunContract;\n\treadonly state: RunProjection & { readonly candidateDigest: string; readonly receiptDigest: string };\n} {\n\tconst first = snapshot.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"missing_run\");\n\tconst contract = first.contract;\n\tconst state = snapshot.state;\n\tif (\n\t\tstate.verification !== \"verified\" ||\n\t\tstate.application !== \"candidate_ready\" ||\n\t\tstate.settlement !== \"settled\" ||\n\t\t!state.receiptDigest ||\n\t\t!state.candidateDigest ||\n\t\tstate.activeExecutionIds.length !== 0 ||\n\t\tstate.writerOpen\n\t)\n\t\tthrow new VerifiedRunError(\"unverified\");\n\tif (\n\t\tcommand.candidateDigest !== state.candidateDigest ||\n\t\tcommand.receiptDigest !== state.receiptDigest ||\n\t\tcommand.policyDigest !== publishPolicyDigest(contract)\n\t)\n\t\tthrow new VerifiedRunError(\"invalid_binding\");\n\tconst evidence = readRunEvidence(runPath, snapshot, commandEnvironmentDigest(contract, \"gated-v1\"));\n\tif (\n\t\t!evidence.verified ||\n\t\tevidence.candidateDigest !== state.candidateDigest ||\n\t\tevidence.receiptDigest !== state.receiptDigest\n\t)\n\t\tthrow new VerifiedRunError(\"invalid_binding\");\n\treturn { contract, state: { ...state, candidateDigest: state.candidateDigest, receiptDigest: state.receiptDigest } };\n}\n"]}

package/dist/core/verified-run/publish-start.d.ts

@@ -0,0 +1,5 @@
+import type { ResourceClaimInput } from "../../coordination/resource.ts";
+import type { GrantToken } from "../../coordination/types.ts";
+import type { AuthorityStore } from "./authority-store.ts";
+export declare function assertPublishEffectStart(store: AuthorityStore, token: GrantToken, claims: readonly ResourceClaimInput[], _pending: boolean, now?: number): void;
+//# sourceMappingURL=publish-start.d.ts.map

package/dist/core/verified-run/publish-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-start.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/publish-start.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,QAAQ,EAAE,OAAO,EACjB,GAAG,CAAC,EAAE,MAAM,GACV,IAAI,CAGN","sourcesContent":["import type { ResourceClaimInput } from \"../../coordination/resource.ts\";\nimport type { GrantToken } from \"../../coordination/types.ts\";\nimport type { AuthorityStore } from \"./authority-store.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport function assertPublishEffectStart(\n\tstore: AuthorityStore,\n\ttoken: GrantToken,\n\tclaims: readonly ResourceClaimInput[],\n\t_pending: boolean,\n\tnow?: number,\n): void {\n\t// A lookup result cannot substitute for a fresh durable start transition.\n\tif (!store.effectStarted(token, claims, undefined, now)) throw new VerifiedRunError(\"authority\");\n}\n"]}

package/dist/core/verified-run/publish-start.js

@@ -0,0 +1,7 @@
+import { VerifiedRunError } from "./storage.js";
+export function assertPublishEffectStart(store, token, claims, _pending, now) {
+    // A lookup result cannot substitute for a fresh durable start transition.
+    if (!store.effectStarted(token, claims, undefined, now))
+        throw new VerifiedRunError("authority");
+}
+//# sourceMappingURL=publish-start.js.map

package/dist/core/verified-run/publish-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-start.js","sourceRoot":"","sources":["../../../src/core/verified-run/publish-start.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,UAAU,wBAAwB,CACvC,KAAqB,EACrB,KAAiB,EACjB,MAAqC,EACrC,QAAiB,EACjB,GAAY,EACL;IACP,0EAA0E;IAC1E,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAAA,CACjG","sourcesContent":["import type { ResourceClaimInput } from \"../../coordination/resource.ts\";\nimport type { GrantToken } from \"../../coordination/types.ts\";\nimport type { AuthorityStore } from \"./authority-store.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport function assertPublishEffectStart(\n\tstore: AuthorityStore,\n\ttoken: GrantToken,\n\tclaims: readonly ResourceClaimInput[],\n\t_pending: boolean,\n\tnow?: number,\n): void {\n\t// A lookup result cannot substitute for a fresh durable start transition.\n\tif (!store.effectStarted(token, claims, undefined, now)) throw new VerifiedRunError(\"authority\");\n}\n"]}

package/dist/core/verified-run/recovery-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhE,KAAK,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,IAAI,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,CAAA;CAAE,CAAC,CAAC;AAEnG,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE;IACT,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC3C,GACC,IAAI,CAyFN","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}
+{"version":3,"file":"recovery-projection.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGhE,KAAK,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,IAAI,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,CAAA;CAAE,CAAC,CAAC;AAEnG,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE;IACT,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC;CAC3C,GACC,IAAI,CA8FN","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastRecovery: {\n\t\t\tkind: event.kind,\n\t\t\tcommandId: command.commandId,\n\t\t\tgeneration: state.generation + 1,\n\t\t},\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}

package/dist/core/verified-run/recovery-projection.js

@@ -82,6 +82,11 @@ export function reduceRecoveryEvent(context, event, progress) {
         activeExecutionIds: [],
         processes: [],
         failure: null,
+        lastRecovery: {
+            kind: event.kind,
+            commandId: command.commandId,
+            generation: state.generation + 1,
+        },
         lastClockMs: event.observedMs,
     };
 }