open-multi-agent-kit 1.0.0 → 1.2.2

package/dist/core/verified-run/recovery-projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI9D,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAClC,OAAwB,EACxB,KAAoB,EACpB,QAIC,EACM;IACP,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,UAAU;QACjG,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IACC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC7B,OAAO,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QAExC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,IACC,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM;QACvE,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAExF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACb,IACC,CAAC,KAAK,CAAC,eAAe;gBACtB,KAAK,CAAC,UAAU;gBAChB,KAAK,CAAC,sBAAsB,KAAK,IAAI;gBACrC,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;gBAEvD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBACxE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC;YACxC,MAAM;QACP,KAAK,eAAe;YACnB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,KAAK,kBAAkB;YACtB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YAC9G,IACC,CAAC,KAAK,CAAC,WAAW;gBAClB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW;gBAC9C,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;gBAE3D,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB;gBACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAEpG,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnD,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;YAC/B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,QAAQ;QACnG,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,KAAK,GAAG;QACf,GAAG,KAAK;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;QAChC,KAAK;QACL,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,eAAe;QAC7B,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AAAA,CACF","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}
+{"version":3,"file":"recovery-projection.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI9D,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAClC,OAAwB,EACxB,KAAoB,EACpB,QAIC,EACM;IACP,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,UAAU;QACjG,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IACC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC7B,OAAO,CAAC,cAAc,KAAK,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QAExC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IAChD,IACC,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,KAAK,CAAC,kBAAkB,CAAC,MAAM;QACvE,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAExF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACb,IACC,CAAC,KAAK,CAAC,eAAe;gBACtB,KAAK,CAAC,UAAU;gBAChB,KAAK,CAAC,sBAAsB,KAAK,IAAI;gBACrC,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;gBAEvD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBACxE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAAC;YACxC,MAAM;QACP,KAAK,eAAe;YACnB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5C,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,KAAK,kBAAkB;YACtB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,sBAAsB;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YAC9G,IACC,CAAC,KAAK,CAAC,WAAW;gBAClB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,WAAW;gBAC9C,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;gBAE3D,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBACtE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzC,IACC,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB;gBACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAEpG,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACnD,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;YAC9B,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;YAC/B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM;QACP,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,QAAQ;QACnG,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,KAAK,GAAG;QACf,GAAG,KAAK;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;QAChC,KAAK;QACL,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,eAAe;QAC7B,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,IAAI;QACb,YAAY,EAAE;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;SAChC;QACD,WAAW,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AAAA,CACF","sourcesContent":["import { MAX_VERIFIED_RUN_GENERATIONS } from \"omk-protocol\";\nimport { retryTaskProjection } from \"./dag-retry-projection.ts\";\nimport type { RunEvent, WriterReduction } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\n\ntype RecoveryEvent = Extract<RunEvent, { kind: \"resumed\" | \"writer_restarted\" | \"tasks_retried\" }>;\n\n/** Shared generation/command fence; only the writer variant resets attempt-local progress. */\nexport function reduceRecoveryEvent(\n\tcontext: WriterReduction,\n\tevent: RecoveryEvent,\n\tprogress: {\n\t\treadonly commands: Set<string>;\n\t\treadonly checked: Set<string>;\n\t\treadonly activeRole: \"writer\" | \"verifier\";\n\t},\n): void {\n\tconst state = context.state;\n\tconst command = event.command;\n\tif (!state.budget) throw new VerifiedRunError(\"resume_unavailable\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tif (command.expectedRevision !== state.revision || command.expectedGeneration !== state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (\n\t\tcommand.runId !== state.runId ||\n\t\tcommand.contractDigest !== digestObject(context.contract) ||\n\t\tprogress.commands.has(command.commandId)\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (\n\t\tevent.reconciledExecutionIds.length !== state.activeExecutionIds.length ||\n\t\tevent.reconciledExecutionIds.some((id, index) => id !== state.activeExecutionIds[index])\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tlet deadline: number;\n\tlet tasks = state.tasks;\n\tswitch (event.kind) {\n\t\tcase \"resumed\":\n\t\t\tif (\n\t\t\t\t!state.candidateDigest ||\n\t\t\t\tstate.writerOpen ||\n\t\t\t\tstate.verificationDeadlineMs === null ||\n\t\t\t\tevent.command.candidateDigest !== state.candidateDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"verifier\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tdeadline = state.verificationDeadlineMs;\n\t\t\tbreak;\n\t\tcase \"tasks_retried\":\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\ttasks = retryTaskProjection(context, event);\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = tasks.every((task) => task.status === \"succeeded\");\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tcase \"writer_restarted\":\n\t\t\tif (context.contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\t\t\tif (\n\t\t\t\t!state.inputDigest ||\n\t\t\t\tstate.candidateDigest ||\n\t\t\t\tevent.command.baseDigest !== state.inputDigest ||\n\t\t\t\tstate.inputDigest !== context.contract.workspace.baseDigest\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"input_checkpoint_missing\");\n\t\t\tif (state.activeExecutionIds.length && progress.activeRole !== \"writer\")\n\t\t\t\tthrow new VerifiedRunError(\"integrity\");\n\t\t\tif (\n\t\t\t\tcontext.contract.profile === \"linux-scripted-agent-v1\" &&\n\t\t\t\tcontext.contract.writer.maxRequests - state.modelRequests < context.contract.writer.steps.length + 1\n\t\t\t)\n\t\t\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\t\t\tdeadline = state.budget.workDeadlineMs;\n\t\t\tcontext.writerStarted = false;\n\t\t\tcontext.writerFinished = false;\n\t\t\tcontext.producerStarted = false;\n\t\t\tcontext.writerCommands = 0;\n\t\t\tcontext.requestBaseline = state.modelRequests;\n\t\t\tbreak;\n\t\tdefault: {\n\t\t\tconst exhaustive: never = event;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n\tif (event.observedMs < (state.lastClockMs ?? state.budget.startedMs) || event.observedMs >= deadline)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\tprogress.commands.add(command.commandId);\n\tprogress.checked.clear();\n\tcontext.state = {\n\t\t...state,\n\t\tgeneration: state.generation + 1,\n\t\ttasks,\n\t\texecution: \"running\",\n\t\tsettlement: \"settled\",\n\t\tverification: \"not_requested\",\n\t\twriterOpen: false,\n\t\tactiveExecutionIds: [],\n\t\tprocesses: [],\n\t\tfailure: null,\n\t\tlastRecovery: {\n\t\t\tkind: event.kind,\n\t\t\tcommandId: command.commandId,\n\t\t\tgeneration: state.generation + 1,\n\t\t},\n\t\tlastClockMs: event.observedMs,\n\t};\n}\n"]}

package/dist/core/verified-run/recovery.d.ts

@@ -1,4 +1,5 @@
 import { type RunResumeCommand } from "omk-protocol";
+import type { RunAuthority } from "./authority-runtime.ts";
 import type { RunProjection } from "./run-types.ts";
 export interface RecoveryInspection {
     readonly state: RunProjection;
@@ -8,5 +9,8 @@ export interface RecoveryInspection {
     readonly ownership: "lease_required";
 }
 export declare function inspectRunRecovery(runPath: string): RecoveryInspection;
-export declare function resumeFrozenCandidate(runPath: string, command: RunResumeCommand, signal?: AbortSignal): Promise<RunProjection>;
+export declare function resumeFrozenCandidate(runPath: string, command: RunResumeCommand, options: {
+    readonly signal?: AbortSignal;
+    readonly authority: RunAuthority;
+}): Promise<RunProjection>;
 //# sourceMappingURL=recovery.d.ts.map

package/dist/core/verified-run/recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAQnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,WAAW,CAAC;IACf,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACrC;AAsCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CA0CtE;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAkBxB","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunResumeCommand } from \"omk-protocol\";\nimport { commandEnvironmentDigest, probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingVerification } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\n\nexport interface RecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"legacy\"\n\t\t| \"candidate_missing\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"clock_unavailable\"\n\t\t| \"recovery_limit\"\n\t\t| \"integrity\";\n\treadonly remainingVerifyMs: number | null;\n\t/** A ready inspection is advisory; exclusive ownership is acquired only by resume. */\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertCandidateRecoverable(runPath: string, journal: JournalSnapshot): number {\n\tconst state = journal.state;\n\tif (state.receiptDigest || state.execution === \"failed\") throw new VerifiedRunError(\"resume_terminal\");\n\tif (!state.budget || !state.environmentDigest) throw new VerifiedRunError(\"recovery_legacy\");\n\tif (!state.candidateDigest || state.writerOpen || state.verificationDeadlineMs === null)\n\t\tthrow new VerifiedRunError(\"candidate_missing\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remaining = remainingVerification(state.budget, state.verificationDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = journal.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((process) => process.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"verifier\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tconst first = journal.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.candidateDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn remaining;\n}\n\nexport function inspectRunRecovery(runPath: string): RecoveryInspection {\n\tconst journal = requireRunJournal(runPath);\n\tlet readiness: RecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingVerifyMs: number | null = null;\n\ttry {\n\t\tremainingVerifyMs = assertCandidateRecoverable(runPath, journal);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_legacy\":\n\t\t\t\treadiness = \"legacy\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingVerifyMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_missing\":\n\t\t\t\treadiness = \"candidate_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_unavailable\":\n\t\t\t\treadiness = \"clock_unavailable\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: journal.state, readiness, remainingVerifyMs, ownership: \"lease_required\" });\n}\n\nexport async function resumeFrozenCandidate(\n\trunPath: string,\n\tcommand: RunResumeCommand,\n\tsignal?: AbortSignal,\n): Promise<RunProjection> {\n\tif (signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tif (signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"resumed\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\treturn verifyCandidate({ runPath, journal, contract: first.contract, ...(signal ? { signal } : {}) });\n\t});\n}\n"]}
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/recovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQ3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,WAAW,CAAC;IACf,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACrC;AAsCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CA0CtE;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAA;CAAE,GAC1E,OAAO,CAAC,aAAa,CAAC,CAwBxB","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunResumeCommand } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport { commandEnvironmentDigest, probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingVerification } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\n\nexport interface RecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"legacy\"\n\t\t| \"candidate_missing\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"clock_unavailable\"\n\t\t| \"recovery_limit\"\n\t\t| \"integrity\";\n\treadonly remainingVerifyMs: number | null;\n\t/** A ready inspection is advisory; exclusive ownership is acquired only by resume. */\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertCandidateRecoverable(runPath: string, journal: JournalSnapshot): number {\n\tconst state = journal.state;\n\tif (state.receiptDigest || state.execution === \"failed\") throw new VerifiedRunError(\"resume_terminal\");\n\tif (!state.budget || !state.environmentDigest) throw new VerifiedRunError(\"recovery_legacy\");\n\tif (!state.candidateDigest || state.writerOpen || state.verificationDeadlineMs === null)\n\t\tthrow new VerifiedRunError(\"candidate_missing\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remaining = remainingVerification(state.budget, state.verificationDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = journal.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((process) => process.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"verifier\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tconst first = journal.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.candidateDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn remaining;\n}\n\nexport function inspectRunRecovery(runPath: string): RecoveryInspection {\n\tconst journal = requireRunJournal(runPath);\n\tlet readiness: RecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingVerifyMs: number | null = null;\n\ttry {\n\t\tremainingVerifyMs = assertCandidateRecoverable(runPath, journal);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_legacy\":\n\t\t\t\treadiness = \"legacy\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingVerifyMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_missing\":\n\t\t\t\treadiness = \"candidate_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_unavailable\":\n\t\t\t\treadiness = \"clock_unavailable\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: journal.state, readiness, remainingVerifyMs, ownership: \"lease_required\" });\n}\n\nexport async function resumeFrozenCandidate(\n\trunPath: string,\n\tcommand: RunResumeCommand,\n\toptions: { readonly signal?: AbortSignal; readonly authority: RunAuthority },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"resumed\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\treturn verifyCandidate({\n\t\t\trunPath,\n\t\t\tjournal,\n\t\t\tcontract: first.contract,\n\t\t\tauthority: options.authority,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t});\n\t});\n}\n"]}

package/dist/core/verified-run/recovery.js

@@ -90,8 +90,8 @@ export function inspectRunRecovery(runPath) {
     }
     return Object.freeze({ state: journal.state, readiness, remainingVerifyMs, ownership: "lease_required" });
 }
-export async function resumeFrozenCandidate(runPath, command, signal) {
-    if (signal?.aborted)
+export async function resumeFrozenCandidate(runPath, command, options) {
+    if (options.signal?.aborted)
         throw new VerifiedRunError("cancelled");
     return withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {
         assertCandidateRecoverable(runPath, snapshot);
@@ -101,7 +101,7 @@ export async function resumeFrozenCandidate(runPath, command, signal) {
         preflightCheckReceipts(first.contract);
         probeVerifiedSandbox();
         assertCandidateRecoverable(runPath, snapshot);
-        if (signal?.aborted)
+        if (options.signal?.aborted)
             throw new VerifiedRunError("cancelled");
         journal.append({
             kind: "resumed",
@@ -109,7 +109,13 @@ export async function resumeFrozenCandidate(runPath, command, signal) {
             observedMs: readRunClock().nowMs,
             reconciledExecutionIds: snapshot.state.activeExecutionIds,
         });
-        return verifyCandidate({ runPath, journal, contract: first.contract, ...(signal ? { signal } : {}) });
+        return verifyCandidate({
+            runPath,
+            journal,
+            contract: first.contract,
+            authority: options.authority,
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
     });
 }
 //# sourceMappingURL=recovery.js.map

package/dist/core/verified-run/recovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAyB,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAqB1D,SAAS,0BAA0B,CAAC,OAAe,EAAE,OAAwB,EAAU;IACtF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACtF,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9G,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CACpC,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;YAChC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAChC,EAAE,KAAK,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC;QACzF,IACC,QAAQ,EAAE,IAAI,KAAK,UAAU;YAC7B,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC5B,CAAC,QAAQ;YACT,cAAc,CAAC,QAAQ,CAAC,KAAK,MAAM;YAEnC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5G,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QACnF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAsB;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAoC,OAAO,CAAC;IACzD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACJ,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,QAAQ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,KAAK,iBAAiB;gBACrB,SAAS,GAAG,UAAU,CAAC;gBACvB,MAAM;YACP,KAAK,iBAAiB;gBACrB,SAAS,GAAG,QAAQ,CAAC;gBACrB,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,GAAG,SAAS,CAAC;gBACtB,iBAAiB,GAAG,CAAC,CAAC;gBACtB,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,WAAW;gBACf,SAAS,GAAG,WAAW,CAAC;gBACxB,MAAM;YACP,KAAK,eAAe;gBACnB,SAAS,GAAG,eAAe,CAAC;gBAC5B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP;gBACC,SAAS,GAAG,WAAW,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAAA,CAC1G;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAe,EACf,OAAyB,EACzB,MAAoB,EACK;IACzB,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3E,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QACzC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,oBAAoB,EAAE,CAAC;QACvB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,SAAS;YACf,OAAO;YACP,UAAU,EAAE,YAAY,EAAE,CAAC,KAAK;YAChC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB;SACzD,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAAA,CACtG,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunResumeCommand } from \"omk-protocol\";\nimport { commandEnvironmentDigest, probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingVerification } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\n\nexport interface RecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"legacy\"\n\t\t| \"candidate_missing\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"clock_unavailable\"\n\t\t| \"recovery_limit\"\n\t\t| \"integrity\";\n\treadonly remainingVerifyMs: number | null;\n\t/** A ready inspection is advisory; exclusive ownership is acquired only by resume. */\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertCandidateRecoverable(runPath: string, journal: JournalSnapshot): number {\n\tconst state = journal.state;\n\tif (state.receiptDigest || state.execution === \"failed\") throw new VerifiedRunError(\"resume_terminal\");\n\tif (!state.budget || !state.environmentDigest) throw new VerifiedRunError(\"recovery_legacy\");\n\tif (!state.candidateDigest || state.writerOpen || state.verificationDeadlineMs === null)\n\t\tthrow new VerifiedRunError(\"candidate_missing\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remaining = remainingVerification(state.budget, state.verificationDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = journal.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((process) => process.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"verifier\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tconst first = journal.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.candidateDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn remaining;\n}\n\nexport function inspectRunRecovery(runPath: string): RecoveryInspection {\n\tconst journal = requireRunJournal(runPath);\n\tlet readiness: RecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingVerifyMs: number | null = null;\n\ttry {\n\t\tremainingVerifyMs = assertCandidateRecoverable(runPath, journal);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_legacy\":\n\t\t\t\treadiness = \"legacy\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingVerifyMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_missing\":\n\t\t\t\treadiness = \"candidate_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_unavailable\":\n\t\t\t\treadiness = \"clock_unavailable\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: journal.state, readiness, remainingVerifyMs, ownership: \"lease_required\" });\n}\n\nexport async function resumeFrozenCandidate(\n\trunPath: string,\n\tcommand: RunResumeCommand,\n\tsignal?: AbortSignal,\n): Promise<RunProjection> {\n\tif (signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tif (signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"resumed\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\treturn verifyCandidate({ runPath, journal, contract: first.contract, ...(signal ? { signal } : {}) });\n\t});\n}\n"]}
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../../src/core/verified-run/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAyB,MAAM,cAAc,CAAC;AAEnF,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAqB1D,SAAS,0BAA0B,CAAC,OAAe,EAAE,OAAwB,EAAU;IACtF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACvG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI;QACtF,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,IAAI,4BAA4B;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC9G,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CACpC,CAAC,MAAM,EAAE,EAAE,CACV,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;YAChC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,CAChC,EAAE,KAAK,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC;QACzF,IACC,QAAQ,EAAE,IAAI,KAAK,UAAU;YAC7B,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC5B,CAAC,QAAQ;YACT,cAAc,CAAC,QAAQ,CAAC,KAAK,MAAM;YAEnC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACxC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5G,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QACnF,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAsB;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAoC,OAAO,CAAC;IACzD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACJ,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,QAAQ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,KAAK,iBAAiB;gBACrB,SAAS,GAAG,UAAU,CAAC;gBACvB,MAAM;YACP,KAAK,iBAAiB;gBACrB,SAAS,GAAG,QAAQ,CAAC;gBACrB,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,GAAG,SAAS,CAAC;gBACtB,iBAAiB,GAAG,CAAC,CAAC;gBACtB,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,WAAW;gBACf,SAAS,GAAG,WAAW,CAAC;gBACxB,MAAM;YACP,KAAK,eAAe;gBACnB,SAAS,GAAG,eAAe,CAAC;gBAC5B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP;gBACC,SAAS,GAAG,WAAW,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAAA,CAC1G;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAe,EACf,OAAyB,EACzB,OAA4E,EACnD;IACzB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3E,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QACzC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,oBAAoB,EAAE,CAAC;QACvB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,SAAS;YACf,OAAO;YACP,UAAU,EAAE,YAAY,EAAE,CAAC,KAAK;YAChC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB;SACzD,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;YACtB,OAAO;YACP,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { join } from \"node:path\";\nimport { MAX_VERIFIED_RUN_GENERATIONS, type RunResumeCommand } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport { commandEnvironmentDigest, probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { probeNamespace } from \"./namespace-identity.ts\";\nimport { readRunClock, remainingVerification } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { readRegularFile, VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\n\nexport interface RecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"legacy\"\n\t\t| \"candidate_missing\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"clock_unavailable\"\n\t\t| \"recovery_limit\"\n\t\t| \"integrity\";\n\treadonly remainingVerifyMs: number | null;\n\t/** A ready inspection is advisory; exclusive ownership is acquired only by resume. */\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertCandidateRecoverable(runPath: string, journal: JournalSnapshot): number {\n\tconst state = journal.state;\n\tif (state.receiptDigest || state.execution === \"failed\") throw new VerifiedRunError(\"resume_terminal\");\n\tif (!state.budget || !state.environmentDigest) throw new VerifiedRunError(\"recovery_legacy\");\n\tif (!state.candidateDigest || state.writerOpen || state.verificationDeadlineMs === null)\n\t\tthrow new VerifiedRunError(\"candidate_missing\");\n\tif (state.generation >= MAX_VERIFIED_RUN_GENERATIONS) throw new VerifiedRunError(\"recovery_limit\");\n\tconst clock = readRunClock();\n\tconst remaining = remainingVerification(state.budget, state.verificationDeadlineMs, clock);\n\tif (clock.nowMs < (state.lastClockMs ?? state.budget.startedMs)) throw new VerifiedRunError(\"clock_rollback\");\n\tif (remaining <= 0) throw new VerifiedRunError(\"deadline\");\n\tfor (const id of state.activeExecutionIds) {\n\t\tconst dispatch = journal.records.find(\n\t\t\t(record) =>\n\t\t\t\trecord.generation === state.generation &&\n\t\t\t\trecord.event.kind === \"dispatch\" &&\n\t\t\t\trecord.event.executionId === id,\n\t\t)?.event;\n\t\tconst identity = state.processes.find((process) => process.executionId === id)?.identity;\n\t\tif (\n\t\t\tdispatch?.kind !== \"dispatch\" ||\n\t\t\tdispatch.role !== \"verifier\" ||\n\t\t\t!identity ||\n\t\t\tprobeNamespace(identity) !== \"gone\"\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"unsettled\");\n\t}\n\tconst first = journal.records[0]?.event;\n\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\tif (readRegularFile(join(runPath, \"issuer.key\"), 32).length !== 32) throw new VerifiedRunError(\"integrity\");\n\tloadCandidate(runPath, state.candidateDigest, first.contract.budget);\n\tif (commandEnvironmentDigest(first.contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\treturn remaining;\n}\n\nexport function inspectRunRecovery(runPath: string): RecoveryInspection {\n\tconst journal = requireRunJournal(runPath);\n\tlet readiness: RecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingVerifyMs: number | null = null;\n\ttry {\n\t\tremainingVerifyMs = assertCandidateRecoverable(runPath, journal);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_legacy\":\n\t\t\t\treadiness = \"legacy\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingVerifyMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_missing\":\n\t\t\t\treadiness = \"candidate_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_unavailable\":\n\t\t\t\treadiness = \"clock_unavailable\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: journal.state, readiness, remainingVerifyMs, ownership: \"lease_required\" });\n}\n\nexport async function resumeFrozenCandidate(\n\trunPath: string,\n\tcommand: RunResumeCommand,\n\toptions: { readonly signal?: AbortSignal; readonly authority: RunAuthority },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertCandidateRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"resumed\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\treturn verifyCandidate({\n\t\t\trunPath,\n\t\t\tjournal,\n\t\t\tcontract: first.contract,\n\t\t\tauthority: options.authority,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t});\n\t});\n}\n"]}

package/dist/core/verified-run/run-plan.d.ts

@@ -0,0 +1,17 @@
+import { type RunContract } from "omk-protocol";
+export interface VerifiedRunApproval {
+    /** Trusted host grant, not a JSON field in the model-authored contract or command. */
+    readonly approvedContractDigest: string;
+    readonly signal?: AbortSignal;
+}
+export interface VerifiedRunPlan {
+    readonly profile: RunContract["profile"];
+    readonly contractDigest: string;
+    readonly baseDigest: string;
+    readonly baseMatches: boolean;
+    readonly environmentDigest: string;
+    readonly checks: readonly string[];
+    readonly executionRequested: false;
+}
+export declare function planVerifiedRun(input: unknown): VerifiedRunPlan;
+//# sourceMappingURL=run-plan.d.ts.map

package/dist/core/verified-run/run-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/run-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAKlE,MAAM,WAAW,mBAAmB;IACnC,sFAAsF;IACtF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B;AACD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC;CACnC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAY/D","sourcesContent":["import { parseRunContract, type RunContract } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate } from \"./candidate.ts\";\nimport { digestObject } from \"./storage.ts\";\n\nexport interface VerifiedRunApproval {\n\t/** Trusted host grant, not a JSON field in the model-authored contract or command. */\n\treadonly approvedContractDigest: string;\n\treadonly signal?: AbortSignal;\n}\nexport interface VerifiedRunPlan {\n\treadonly profile: RunContract[\"profile\"];\n\treadonly contractDigest: string;\n\treadonly baseDigest: string;\n\treadonly baseMatches: boolean;\n\treadonly environmentDigest: string;\n\treadonly checks: readonly string[];\n\treadonly executionRequested: false;\n}\n\nexport function planVerifiedRun(input: unknown): VerifiedRunPlan {\n\tconst contract = parseRunContract(input);\n\tconst snapshot = captureCandidate(contract.workspace.root, contract.budget);\n\treturn Object.freeze({\n\t\tprofile: contract.profile,\n\t\tcontractDigest: digestObject(contract),\n\t\tbaseDigest: snapshot.digest,\n\t\tbaseMatches: snapshot.digest === contract.workspace.baseDigest,\n\t\tenvironmentDigest: commandEnvironmentDigest(contract, \"gated-v1\"),\n\t\tchecks: Object.freeze(contract.checks.map((check) => check.claimId)),\n\t\texecutionRequested: false,\n\t});\n}\n"]}

package/dist/core/verified-run/run-plan.js

@@ -0,0 +1,18 @@
+import { parseRunContract } from "omk-protocol";
+import { commandEnvironmentDigest } from "./broker.js";
+import { captureCandidate } from "./candidate.js";
+import { digestObject } from "./storage.js";
+export function planVerifiedRun(input) {
+    const contract = parseRunContract(input);
+    const snapshot = captureCandidate(contract.workspace.root, contract.budget);
+    return Object.freeze({
+        profile: contract.profile,
+        contractDigest: digestObject(contract),
+        baseDigest: snapshot.digest,
+        baseMatches: snapshot.digest === contract.workspace.baseDigest,
+        environmentDigest: commandEnvironmentDigest(contract, "gated-v1"),
+        checks: Object.freeze(contract.checks.map((check) => check.claimId)),
+        executionRequested: false,
+    });
+}
+//# sourceMappingURL=run-plan.js.map

package/dist/core/verified-run/run-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../../../src/core/verified-run/run-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAiB5C,MAAM,UAAU,eAAe,CAAC,KAAc,EAAmB;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,WAAW,EAAE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,CAAC,UAAU;QAC9D,iBAAiB,EAAE,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,kBAAkB,EAAE,KAAK;KACzB,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { parseRunContract, type RunContract } from \"omk-protocol\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate } from \"./candidate.ts\";\nimport { digestObject } from \"./storage.ts\";\n\nexport interface VerifiedRunApproval {\n\t/** Trusted host grant, not a JSON field in the model-authored contract or command. */\n\treadonly approvedContractDigest: string;\n\treadonly signal?: AbortSignal;\n}\nexport interface VerifiedRunPlan {\n\treadonly profile: RunContract[\"profile\"];\n\treadonly contractDigest: string;\n\treadonly baseDigest: string;\n\treadonly baseMatches: boolean;\n\treadonly environmentDigest: string;\n\treadonly checks: readonly string[];\n\treadonly executionRequested: false;\n}\n\nexport function planVerifiedRun(input: unknown): VerifiedRunPlan {\n\tconst contract = parseRunContract(input);\n\tconst snapshot = captureCandidate(contract.workspace.root, contract.budget);\n\treturn Object.freeze({\n\t\tprofile: contract.profile,\n\t\tcontractDigest: digestObject(contract),\n\t\tbaseDigest: snapshot.digest,\n\t\tbaseMatches: snapshot.digest === contract.workspace.baseDigest,\n\t\tenvironmentDigest: commandEnvironmentDigest(contract, \"gated-v1\"),\n\t\tchecks: Object.freeze(contract.checks.map((check) => check.claimId)),\n\t\texecutionRequested: false,\n\t});\n}\n"]}

package/dist/core/verified-run/run-publish-owned.d.ts

@@ -0,0 +1,6 @@
+import type { RunPublishCommand } from "omk-protocol";
+import { type PublishOptions } from "./run-publish.ts";
+import type { RunProjection } from "./run-types.ts";
+/** SDK/CLI publisher. Unsupported supervision never falls back to the legacy synchronous writer. */
+export declare function publishVerifiedRunOwned(runPath: string, command: RunPublishCommand, options?: PublishOptions): Promise<RunProjection>;
+//# sourceMappingURL=run-publish-owned.d.ts.map

package/dist/core/verified-run/run-publish-owned.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-publish-owned.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/run-publish-owned.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAqBtD,OAAO,EAAE,KAAK,cAAc,EAAuC,MAAM,kBAAkB,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,oGAAoG;AACpG,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAyCxB","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { RunPublishCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { openRunAuthority, type RunAuthority } from \"./authority-runtime.ts\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightGitCandidate } from \"./git-candidate-preflight.ts\";\nimport { executeOwnedGitPublication } from \"./git-effect-supervisor.ts\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport {\n\tassertGitWorkspaceRoot,\n\tOMK_ACCEPTED_REF,\n\tobjectExists,\n\trepoObjectFormat,\n\tresolveRef,\n\tzeroOid,\n} from \"./git-plumbing.ts\";\nimport { ownedGitDirectory } from \"./git-sandbox-layout.ts\";\nimport { loadGitWorkerRuntime } from \"./git-worker-runtime.ts\";\nimport { type JournalSnapshot, journalPath, VerifiedRunJournal } from \"./journal.ts\";\nimport { assertPublishable } from \"./publish-preflight.ts\";\nimport { requireRunJournal } from \"./recovery-command.ts\";\nimport { type PublishOptions, publishDisposition, recordPublished } from \"./run-publish.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\nimport { loadSupervisorBackend } from \"./supervisor-adapter.ts\";\n\n/** SDK/CLI publisher. Unsupported supervision never falls back to the legacy synchronous writer. */\nexport async function publishVerifiedRunOwned(\n\trunPath: string,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions = {},\n): Promise<RunProjection> {\n\tconst initial = requireRunJournal(runPath);\n\tif (publishDisposition(initial, command) === \"completed\") return initial.state;\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\tlet opened: RunAuthority | null = null;\n\tlet result: RunProjection | undefined;\n\tconst failures: unknown[] = [];\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (publishDisposition(snapshot, command) === \"completed\") result = snapshot.state;\n\t\telse {\n\t\t\tif (!options.authority) opened = openRunAuthority(runPath);\n\t\t\tconst authority = options.authority ?? opened;\n\t\t\tif (!authority) throw new VerifiedRunError(\"authority\");\n\t\t\tresult = await executePublish(\n\t\t\t\trunPath,\n\t\t\t\tsnapshot,\n\t\t\t\tnew VerifiedRunJournal(runPath, owner),\n\t\t\t\tcommand,\n\t\t\t\toptions,\n\t\t\t\tauthority,\n\t\t\t);\n\t\t}\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\ttry {\n\t\topened?.store.release();\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\ttry {\n\t\towner.release();\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\tif (failures.length === 1) throw failures[0];\n\tif (failures.length > 1) throw new AggregateError(failures, \"Publication owner cleanup failed\");\n\tif (!result) throw new VerifiedRunError(\"integrity\");\n\treturn result;\n}\n\nasync function executePublish(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions,\n\tauthority: RunAuthority,\n): Promise<RunProjection> {\n\tconst timeoutMs = options.timeoutMs ?? 60_000;\n\tif (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) throw new VerifiedRunError(\"deadline\");\n\tconst deadlineNs = (process.hrtime.bigint() + BigInt(timeoutMs) * 1_000_000n).toString();\n\tconst budget = new GitOperationBudget({ signal: options.signal, timeoutMs });\n\tbudget.remaining();\n\tconst { contract, state } = assertPublishable(snapshot, command, runPath);\n\tconst repo = realpathSync(contract.workspace.root);\n\tassertGitWorkspaceRoot(repo, budget);\n\tconst zero = zeroOid(repoObjectFormat(repo, budget));\n\tif (command.parentOid.length !== zero.length) throw new VerifiedRunError(\"invalid_binding\");\n\tconst resumed = state.publication === \"intent\" && state.publicationCommandId === command.commandId;\n\tif (resumed) {\n\t\tconst oid = state.publicationCandidateOid;\n\t\tif (!oid) throw new VerifiedRunError(\"invalid_binding\");\n\t\tconst observed = resolveRef(repo, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === oid && objectExists(repo, oid, budget)) return recordPublished(journal, command, oid);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: \"reconciliation-required\",\n\t\t\t});\n\t}\n\tloadSupervisorBackend();\n\tprobeVerifiedSandbox();\n\townedGitDirectory(repo);\n\tconst runtime = loadGitWorkerRuntime();\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tpreflightGitCandidate(candidate.manifest, candidate.contents);\n\tbudget.remaining();\n\tconst claims = [\n\t\t{\n\t\t\tnamespace: \"git-ref\",\n\t\t\tinstanceId: \"verified-run\",\n\t\t\tcanonicalKey: `omk-accepted-ref/${digestObject(repo).slice(0, 16)}`,\n\t\t\taccess: \"write\",\n\t\t\tgeneration: String(state.generation),\n\t\t},\n\t];\n\tconst admission = authority.store.acquire({\n\t\tsessionId: authority.sessionId,\n\t\tincarnation: authority.incarnation,\n\t\tcommandId: command.commandId,\n\t\tintentDigest: digestObject({\n\t\t\tadapter: \"owned-git-v1\",\n\t\t\truntimeDigest: runtime.digest,\n\t\t\tcandidateDigest: command.candidateDigest,\n\t\t\tparentOid: command.parentOid,\n\t\t\treceiptDigest: command.receiptDigest,\n\t\t\tpolicyDigest: command.policyDigest,\n\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t}),\n\t\tclaims,\n\t\tnow: Date.now(),\n\t\tttl: timeoutMs + contract.budget.cleanupMs,\n\t});\n\tif (admission.status !== \"granted\") throw new VerifiedRunError(\"authority_blocked\");\n\ttry {\n\t\tconst result = await executeOwnedGitPublication({\n\t\t\tworkspace: repo,\n\t\t\truntime,\n\t\t\tauthority,\n\t\t\ttoken: admission.token,\n\t\t\tclaims,\n\t\t\tbudget,\n\t\t\tdeadlineNs,\n\t\t\tcleanupMs: contract.budget.cleanupMs,\n\t\t\tsignal: options.signal,\n\t\t\tafterCas: options.afterCas,\n\t\t\tinput: {\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t\tcontents: candidate.contents,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\tzeroOid: zero,\n\t\t\t\trunId: contract.runId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t},\n\t\t\tonPrepared: (candidateOid) => {\n\t\t\t\tif (resumed) {\n\t\t\t\t\tif (state.publicationCandidateOid !== candidateOid) throw new VerifiedRunError(\"invalid_binding\");\n\t\t\t\t} else\n\t\t\t\t\tjournal.append({\n\t\t\t\t\t\tkind: \"publish_intent\",\n\t\t\t\t\t\tcommandId: command.commandId,\n\t\t\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\t\t\tcandidateOid,\n\t\t\t\t\t\tparentOid: command.parentOid,\n\t\t\t\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t\t\t\tpolicyDigest: command.policyDigest,\n\t\t\t\t\t\tgeneration: state.generation,\n\t\t\t\t\t});\n\t\t\t},\n\t\t});\n\t\tconst observed = resolveRef(repo, OMK_ACCEPTED_REF);\n\t\tif (observed === result.candidateOid && objectExists(repo, result.candidateOid))\n\t\t\treturn recordPublished(journal, command, result.candidateOid);\n\t\treturn journal.append({\n\t\t\tkind: \"publish_failed\",\n\t\t\tcommandId: command.commandId,\n\t\t\tcode:\n\t\t\t\t(observed ?? zero) === command.parentOid\n\t\t\t\t\t? \"ref-rejected\"\n\t\t\t\t\t: resumed\n\t\t\t\t\t\t? \"reconciliation-required\"\n\t\t\t\t\t\t: \"stale-parent\",\n\t\t});\n\t} catch (error) {\n\t\tconst grant = authority.store.state.grants.get(admission.token.grantSequence);\n\t\ttry {\n\t\t\tif (grant?.state === \"reserved\") authority.store.cancel(admission.token);\n\t\t\tif (\n\t\t\t\tgrant?.state === \"terminated\" &&\n\t\t\t\tjournal.state.publication === \"intent\" &&\n\t\t\t\terror instanceof VerifiedRunError &&\n\t\t\t\t[\"cancelled\", \"deadline\"].includes(error.code) &&\n\t\t\t\tresolveRef(repo, OMK_ACCEPTED_REF) !== journal.state.publicationCandidateOid\n\t\t\t)\n\t\t\t\tjournal.append({ kind: \"publish_failed\", commandId: command.commandId, code: \"reconciliation-required\" });\n\t\t} catch (cleanupError) {\n\t\t\tthrow new AggregateError([error, cleanupError], \"Publication failure could not be recorded\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n"]}

package/dist/core/verified-run/run-publish-owned.js

@@ -0,0 +1,199 @@
+import { realpathSync } from "node:fs";
+import { acquireSessionOwnerLeaseSync } from "../session-owner-lease.js";
+import { openRunAuthority } from "./authority-runtime.js";
+import { probeVerifiedSandbox } from "./broker.js";
+import { loadCandidate } from "./candidate.js";
+import { preflightGitCandidate } from "./git-candidate-preflight.js";
+import { executeOwnedGitPublication } from "./git-effect-supervisor.js";
+import { GitOperationBudget } from "./git-execution.js";
+import { assertGitWorkspaceRoot, OMK_ACCEPTED_REF, objectExists, repoObjectFormat, resolveRef, zeroOid, } from "./git-plumbing.js";
+import { ownedGitDirectory } from "./git-sandbox-layout.js";
+import { loadGitWorkerRuntime } from "./git-worker-runtime.js";
+import { journalPath, VerifiedRunJournal } from "./journal.js";
+import { assertPublishable } from "./publish-preflight.js";
+import { requireRunJournal } from "./recovery-command.js";
+import { publishDisposition, recordPublished } from "./run-publish.js";
+import { digestObject, VerifiedRunError } from "./storage.js";
+import { loadSupervisorBackend } from "./supervisor-adapter.js";
+/** SDK/CLI publisher. Unsupported supervision never falls back to the legacy synchronous writer. */
+export async function publishVerifiedRunOwned(runPath, command, options = {}) {
+    const initial = requireRunJournal(runPath);
+    if (publishDisposition(initial, command) === "completed")
+        return initial.state;
+    if (options.signal?.aborted)
+        throw new VerifiedRunError("cancelled");
+    const owner = acquireSessionOwnerLeaseSync(journalPath(runPath));
+    let opened = null;
+    let result;
+    const failures = [];
+    try {
+        const snapshot = requireRunJournal(runPath);
+        if (publishDisposition(snapshot, command) === "completed")
+            result = snapshot.state;
+        else {
+            if (!options.authority)
+                opened = openRunAuthority(runPath);
+            const authority = options.authority ?? opened;
+            if (!authority)
+                throw new VerifiedRunError("authority");
+            result = await executePublish(runPath, snapshot, new VerifiedRunJournal(runPath, owner), command, options, authority);
+        }
+    }
+    catch (error) {
+        failures.push(error);
+    }
+    try {
+        opened?.store.release();
+    }
+    catch (error) {
+        failures.push(error);
+    }
+    try {
+        owner.release();
+    }
+    catch (error) {
+        failures.push(error);
+    }
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1)
+        throw new AggregateError(failures, "Publication owner cleanup failed");
+    if (!result)
+        throw new VerifiedRunError("integrity");
+    return result;
+}
+async function executePublish(runPath, snapshot, journal, command, options, authority) {
+    const timeoutMs = options.timeoutMs ?? 60_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000)
+        throw new VerifiedRunError("deadline");
+    const deadlineNs = (process.hrtime.bigint() + BigInt(timeoutMs) * 1000000n).toString();
+    const budget = new GitOperationBudget({ signal: options.signal, timeoutMs });
+    budget.remaining();
+    const { contract, state } = assertPublishable(snapshot, command, runPath);
+    const repo = realpathSync(contract.workspace.root);
+    assertGitWorkspaceRoot(repo, budget);
+    const zero = zeroOid(repoObjectFormat(repo, budget));
+    if (command.parentOid.length !== zero.length)
+        throw new VerifiedRunError("invalid_binding");
+    const resumed = state.publication === "intent" && state.publicationCommandId === command.commandId;
+    if (resumed) {
+        const oid = state.publicationCandidateOid;
+        if (!oid)
+            throw new VerifiedRunError("invalid_binding");
+        const observed = resolveRef(repo, OMK_ACCEPTED_REF, budget);
+        if (observed === oid && objectExists(repo, oid, budget))
+            return recordPublished(journal, command, oid);
+        if ((observed ?? zero) !== command.parentOid)
+            return journal.append({
+                kind: "publish_failed",
+                commandId: command.commandId,
+                code: "reconciliation-required",
+            });
+    }
+    loadSupervisorBackend();
+    probeVerifiedSandbox();
+    ownedGitDirectory(repo);
+    const runtime = loadGitWorkerRuntime();
+    const candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);
+    preflightGitCandidate(candidate.manifest, candidate.contents);
+    budget.remaining();
+    const claims = [
+        {
+            namespace: "git-ref",
+            instanceId: "verified-run",
+            canonicalKey: `omk-accepted-ref/${digestObject(repo).slice(0, 16)}`,
+            access: "write",
+            generation: String(state.generation),
+        },
+    ];
+    const admission = authority.store.acquire({
+        sessionId: authority.sessionId,
+        incarnation: authority.incarnation,
+        commandId: command.commandId,
+        intentDigest: digestObject({
+            adapter: "owned-git-v1",
+            runtimeDigest: runtime.digest,
+            candidateDigest: command.candidateDigest,
+            parentOid: command.parentOid,
+            receiptDigest: command.receiptDigest,
+            policyDigest: command.policyDigest,
+            targetRef: OMK_ACCEPTED_REF,
+        }),
+        claims,
+        now: Date.now(),
+        ttl: timeoutMs + contract.budget.cleanupMs,
+    });
+    if (admission.status !== "granted")
+        throw new VerifiedRunError("authority_blocked");
+    try {
+        const result = await executeOwnedGitPublication({
+            workspace: repo,
+            runtime,
+            authority,
+            token: admission.token,
+            claims,
+            budget,
+            deadlineNs,
+            cleanupMs: contract.budget.cleanupMs,
+            signal: options.signal,
+            afterCas: options.afterCas,
+            input: {
+                manifest: candidate.manifest,
+                contents: candidate.contents,
+                parentOid: command.parentOid,
+                zeroOid: zero,
+                runId: contract.runId,
+                candidateDigest: state.candidateDigest,
+                receiptDigest: state.receiptDigest,
+            },
+            onPrepared: (candidateOid) => {
+                if (resumed) {
+                    if (state.publicationCandidateOid !== candidateOid)
+                        throw new VerifiedRunError("invalid_binding");
+                }
+                else
+                    journal.append({
+                        kind: "publish_intent",
+                        commandId: command.commandId,
+                        candidateDigest: state.candidateDigest,
+                        candidateOid,
+                        parentOid: command.parentOid,
+                        targetRef: OMK_ACCEPTED_REF,
+                        receiptDigest: state.receiptDigest,
+                        policyDigest: command.policyDigest,
+                        generation: state.generation,
+                    });
+            },
+        });
+        const observed = resolveRef(repo, OMK_ACCEPTED_REF);
+        if (observed === result.candidateOid && objectExists(repo, result.candidateOid))
+            return recordPublished(journal, command, result.candidateOid);
+        return journal.append({
+            kind: "publish_failed",
+            commandId: command.commandId,
+            code: (observed ?? zero) === command.parentOid
+                ? "ref-rejected"
+                : resumed
+                    ? "reconciliation-required"
+                    : "stale-parent",
+        });
+    }
+    catch (error) {
+        const grant = authority.store.state.grants.get(admission.token.grantSequence);
+        try {
+            if (grant?.state === "reserved")
+                authority.store.cancel(admission.token);
+            if (grant?.state === "terminated" &&
+                journal.state.publication === "intent" &&
+                error instanceof VerifiedRunError &&
+                ["cancelled", "deadline"].includes(error.code) &&
+                resolveRef(repo, OMK_ACCEPTED_REF) !== journal.state.publicationCandidateOid)
+                journal.append({ kind: "publish_failed", commandId: command.commandId, code: "reconciliation-required" });
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "Publication failure could not be recorded");
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=run-publish-owned.js.map

package/dist/core/verified-run/run-publish-owned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-publish-owned.js","sourceRoot":"","sources":["../../../src/core/verified-run/run-publish-owned.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACN,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,OAAO,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAwB,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAuB,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAe,EACf,OAA0B,EAC1B,OAAO,GAAmB,EAAE,EACH;IACzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,4BAA4B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,MAAiC,CAAC;IACtC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,WAAW;YAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;aAC9E,CAAC;YACL,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;YAC9C,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,GAAG,MAAM,cAAc,CAC5B,OAAO,EACP,QAAQ,EACR,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,EACtC,OAAO,EACP,OAAO,EACP,SAAS,CACT,CAAC;QACH,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,KAAK,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAChG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,KAAK,UAAU,cAAc,CAC5B,OAAe,EACf,QAAyB,EACzB,OAA2B,EAC3B,OAA0B,EAC1B,OAAuB,EACvB,SAAuB,EACE;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,QAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,KAAK,OAAO,CAAC,SAAS,CAAC;IACnG,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,uBAAuB,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,SAAS;YAC3C,OAAO,OAAO,CAAC,MAAM,CAAC;gBACrB,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,yBAAyB;aAC/B,CAAC,CAAC;IACL,CAAC;IACD,qBAAqB,EAAE,CAAC;IACxB,oBAAoB,EAAE,CAAC;IACvB,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,qBAAqB,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG;QACd;YACC,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,oBAAoB,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACnE,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;SACpC;KACD,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QACzC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,gBAAgB;SAC3B,CAAC;QACF,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,GAAG,EAAE,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS;KAC1C,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;YAC/C,SAAS,EAAE,IAAI;YACf,OAAO;YACP,SAAS;YACT,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM;YACN,MAAM;YACN,UAAU;YACV,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE;gBACN,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,aAAa,EAAE,KAAK,CAAC,aAAa;aAClC;YACD,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC7B,IAAI,OAAO,EAAE,CAAC;oBACb,IAAI,KAAK,CAAC,uBAAuB,KAAK,YAAY;wBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;gBACnG,CAAC;;oBACA,OAAO,CAAC,MAAM,CAAC;wBACd,IAAI,EAAE,gBAAgB;wBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;wBACtC,YAAY;wBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,SAAS,EAAE,gBAAgB;wBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;qBAC5B,CAAC,CAAC;YAAA,CACJ;SACD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,MAAM,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC;YAC9E,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EACH,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,SAAS;gBACvC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,OAAO;oBACR,CAAC,CAAC,yBAAyB;oBAC3B,CAAC,CAAC,cAAc;SACnB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9E,IAAI,CAAC;YACJ,IAAI,KAAK,EAAE,KAAK,KAAK,UAAU;gBAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACzE,IACC,KAAK,EAAE,KAAK,KAAK,YAAY;gBAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ;gBACtC,KAAK,YAAY,gBAAgB;gBACjC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9C,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,uBAAuB;gBAE5E,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { RunPublishCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { openRunAuthority, type RunAuthority } from \"./authority-runtime.ts\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { preflightGitCandidate } from \"./git-candidate-preflight.ts\";\nimport { executeOwnedGitPublication } from \"./git-effect-supervisor.ts\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport {\n\tassertGitWorkspaceRoot,\n\tOMK_ACCEPTED_REF,\n\tobjectExists,\n\trepoObjectFormat,\n\tresolveRef,\n\tzeroOid,\n} from \"./git-plumbing.ts\";\nimport { ownedGitDirectory } from \"./git-sandbox-layout.ts\";\nimport { loadGitWorkerRuntime } from \"./git-worker-runtime.ts\";\nimport { type JournalSnapshot, journalPath, VerifiedRunJournal } from \"./journal.ts\";\nimport { assertPublishable } from \"./publish-preflight.ts\";\nimport { requireRunJournal } from \"./recovery-command.ts\";\nimport { type PublishOptions, publishDisposition, recordPublished } from \"./run-publish.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\nimport { loadSupervisorBackend } from \"./supervisor-adapter.ts\";\n\n/** SDK/CLI publisher. Unsupported supervision never falls back to the legacy synchronous writer. */\nexport async function publishVerifiedRunOwned(\n\trunPath: string,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions = {},\n): Promise<RunProjection> {\n\tconst initial = requireRunJournal(runPath);\n\tif (publishDisposition(initial, command) === \"completed\") return initial.state;\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\tlet opened: RunAuthority | null = null;\n\tlet result: RunProjection | undefined;\n\tconst failures: unknown[] = [];\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (publishDisposition(snapshot, command) === \"completed\") result = snapshot.state;\n\t\telse {\n\t\t\tif (!options.authority) opened = openRunAuthority(runPath);\n\t\t\tconst authority = options.authority ?? opened;\n\t\t\tif (!authority) throw new VerifiedRunError(\"authority\");\n\t\t\tresult = await executePublish(\n\t\t\t\trunPath,\n\t\t\t\tsnapshot,\n\t\t\t\tnew VerifiedRunJournal(runPath, owner),\n\t\t\t\tcommand,\n\t\t\t\toptions,\n\t\t\t\tauthority,\n\t\t\t);\n\t\t}\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\ttry {\n\t\topened?.store.release();\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\ttry {\n\t\towner.release();\n\t} catch (error) {\n\t\tfailures.push(error);\n\t}\n\tif (failures.length === 1) throw failures[0];\n\tif (failures.length > 1) throw new AggregateError(failures, \"Publication owner cleanup failed\");\n\tif (!result) throw new VerifiedRunError(\"integrity\");\n\treturn result;\n}\n\nasync function executePublish(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions,\n\tauthority: RunAuthority,\n): Promise<RunProjection> {\n\tconst timeoutMs = options.timeoutMs ?? 60_000;\n\tif (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) throw new VerifiedRunError(\"deadline\");\n\tconst deadlineNs = (process.hrtime.bigint() + BigInt(timeoutMs) * 1_000_000n).toString();\n\tconst budget = new GitOperationBudget({ signal: options.signal, timeoutMs });\n\tbudget.remaining();\n\tconst { contract, state } = assertPublishable(snapshot, command, runPath);\n\tconst repo = realpathSync(contract.workspace.root);\n\tassertGitWorkspaceRoot(repo, budget);\n\tconst zero = zeroOid(repoObjectFormat(repo, budget));\n\tif (command.parentOid.length !== zero.length) throw new VerifiedRunError(\"invalid_binding\");\n\tconst resumed = state.publication === \"intent\" && state.publicationCommandId === command.commandId;\n\tif (resumed) {\n\t\tconst oid = state.publicationCandidateOid;\n\t\tif (!oid) throw new VerifiedRunError(\"invalid_binding\");\n\t\tconst observed = resolveRef(repo, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === oid && objectExists(repo, oid, budget)) return recordPublished(journal, command, oid);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: \"reconciliation-required\",\n\t\t\t});\n\t}\n\tloadSupervisorBackend();\n\tprobeVerifiedSandbox();\n\townedGitDirectory(repo);\n\tconst runtime = loadGitWorkerRuntime();\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tpreflightGitCandidate(candidate.manifest, candidate.contents);\n\tbudget.remaining();\n\tconst claims = [\n\t\t{\n\t\t\tnamespace: \"git-ref\",\n\t\t\tinstanceId: \"verified-run\",\n\t\t\tcanonicalKey: `omk-accepted-ref/${digestObject(repo).slice(0, 16)}`,\n\t\t\taccess: \"write\",\n\t\t\tgeneration: String(state.generation),\n\t\t},\n\t];\n\tconst admission = authority.store.acquire({\n\t\tsessionId: authority.sessionId,\n\t\tincarnation: authority.incarnation,\n\t\tcommandId: command.commandId,\n\t\tintentDigest: digestObject({\n\t\t\tadapter: \"owned-git-v1\",\n\t\t\truntimeDigest: runtime.digest,\n\t\t\tcandidateDigest: command.candidateDigest,\n\t\t\tparentOid: command.parentOid,\n\t\t\treceiptDigest: command.receiptDigest,\n\t\t\tpolicyDigest: command.policyDigest,\n\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t}),\n\t\tclaims,\n\t\tnow: Date.now(),\n\t\tttl: timeoutMs + contract.budget.cleanupMs,\n\t});\n\tif (admission.status !== \"granted\") throw new VerifiedRunError(\"authority_blocked\");\n\ttry {\n\t\tconst result = await executeOwnedGitPublication({\n\t\t\tworkspace: repo,\n\t\t\truntime,\n\t\t\tauthority,\n\t\t\ttoken: admission.token,\n\t\t\tclaims,\n\t\t\tbudget,\n\t\t\tdeadlineNs,\n\t\t\tcleanupMs: contract.budget.cleanupMs,\n\t\t\tsignal: options.signal,\n\t\t\tafterCas: options.afterCas,\n\t\t\tinput: {\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t\tcontents: candidate.contents,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\tzeroOid: zero,\n\t\t\t\trunId: contract.runId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t},\n\t\t\tonPrepared: (candidateOid) => {\n\t\t\t\tif (resumed) {\n\t\t\t\t\tif (state.publicationCandidateOid !== candidateOid) throw new VerifiedRunError(\"invalid_binding\");\n\t\t\t\t} else\n\t\t\t\t\tjournal.append({\n\t\t\t\t\t\tkind: \"publish_intent\",\n\t\t\t\t\t\tcommandId: command.commandId,\n\t\t\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\t\t\tcandidateOid,\n\t\t\t\t\t\tparentOid: command.parentOid,\n\t\t\t\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t\t\t\tpolicyDigest: command.policyDigest,\n\t\t\t\t\t\tgeneration: state.generation,\n\t\t\t\t\t});\n\t\t\t},\n\t\t});\n\t\tconst observed = resolveRef(repo, OMK_ACCEPTED_REF);\n\t\tif (observed === result.candidateOid && objectExists(repo, result.candidateOid))\n\t\t\treturn recordPublished(journal, command, result.candidateOid);\n\t\treturn journal.append({\n\t\t\tkind: \"publish_failed\",\n\t\t\tcommandId: command.commandId,\n\t\t\tcode:\n\t\t\t\t(observed ?? zero) === command.parentOid\n\t\t\t\t\t? \"ref-rejected\"\n\t\t\t\t\t: resumed\n\t\t\t\t\t\t? \"reconciliation-required\"\n\t\t\t\t\t\t: \"stale-parent\",\n\t\t});\n\t} catch (error) {\n\t\tconst grant = authority.store.state.grants.get(admission.token.grantSequence);\n\t\ttry {\n\t\t\tif (grant?.state === \"reserved\") authority.store.cancel(admission.token);\n\t\t\tif (\n\t\t\t\tgrant?.state === \"terminated\" &&\n\t\t\t\tjournal.state.publication === \"intent\" &&\n\t\t\t\terror instanceof VerifiedRunError &&\n\t\t\t\t[\"cancelled\", \"deadline\"].includes(error.code) &&\n\t\t\t\tresolveRef(repo, OMK_ACCEPTED_REF) !== journal.state.publicationCandidateOid\n\t\t\t)\n\t\t\t\tjournal.append({ kind: \"publish_failed\", commandId: command.commandId, code: \"reconciliation-required\" });\n\t\t} catch (cleanupError) {\n\t\t\tthrow new AggregateError([error, cleanupError], \"Publication failure could not be recorded\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n"]}

package/dist/core/verified-run/run-publish.d.ts

@@ -0,0 +1,19 @@
+import type { RunPublishCommand } from "omk-protocol";
+import { type RunAuthority } from "./authority-runtime.ts";
+import { OMK_ACCEPTED_REF } from "./git-plumbing.ts";
+import { type JournalSnapshot, VerifiedRunJournal } from "./journal.ts";
+import type { RunProjection } from "./run-types.ts";
+export { OMK_ACCEPTED_REF };
+export { publishPolicyDigest } from "./publish-preflight.ts";
+export declare function publishDisposition(journal: JournalSnapshot, command: RunPublishCommand): "completed" | "resume" | "new";
+export interface PublishOptions {
+    /** Fault injection after a successful CAS, before the result record. */
+    readonly afterCas?: () => void;
+    readonly signal?: AbortSignal;
+    /** One monotonic deadline shared by all Git writes, never replenished per file. */
+    readonly timeoutMs?: number;
+    readonly authority?: RunAuthority;
+}
+export declare function publishVerifiedRun(runPath: string, command: RunPublishCommand, options?: PublishOptions): RunProjection;
+export declare function recordPublished(journal: VerifiedRunJournal, command: RunPublishCommand, candidateOid: string): RunProjection;
+//# sourceMappingURL=run-publish.d.ts.map

package/dist/core/verified-run/run-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-publish.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/run-publish.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG7E,OAAO,EAIN,gBAAgB,EAMhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,eAAe,EAAe,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIrF,OAAO,KAAK,EAAY,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAW7D,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,iBAAiB,GACxB,WAAW,GAAG,QAAQ,GAAG,KAAK,CAyBhC;AAED,MAAM,WAAW,cAAc;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;CAClC;AAED,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,cAAmB,GAC1B,aAAa,CAqBf;AAED,wBAAgB,eAAe,CAC9B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,EAAE,MAAM,GAClB,aAAa,CAOf","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport type { RunPublishCommand } from \"omk-protocol\";\nimport { acquireSessionOwnerLeaseSync } from \"../session-owner-lease.ts\";\nimport { openRunAuthority, type RunAuthority } from \"./authority-runtime.ts\";\nimport { loadCandidate } from \"./candidate.ts\";\nimport { GitOperationBudget } from \"./git-execution.ts\";\nimport {\n\tassertGitWorkspaceRoot,\n\tcasRef,\n\tGitRefCasError,\n\tOMK_ACCEPTED_REF,\n\tobjectExists,\n\trepoObjectFormat,\n\tresolveRef,\n\tsealCandidateCommit,\n\tzeroOid,\n} from \"./git-plumbing.ts\";\nimport { type JournalSnapshot, journalPath, VerifiedRunJournal } from \"./journal.ts\";\nimport { assertPublishable } from \"./publish-preflight.ts\";\nimport { assertPublishEffectStart } from \"./publish-start.ts\";\nimport { requireRunJournal } from \"./recovery-command.ts\";\nimport type { RunEvent, RunProjection } from \"./run-types.ts\";\nimport { digestObject, VerifiedRunError } from \"./storage.ts\";\nexport { OMK_ACCEPTED_REF };\nexport { publishPolicyDigest } from \"./publish-preflight.ts\";\n\ntype PublishIntent = Extract<RunEvent, { kind: \"publish_intent\" }>;\nfunction openPublishIntents(journal: JournalSnapshot): readonly PublishIntent[] {\n\treturn journal.records.flatMap(({ event }) => (event.kind === \"publish_intent\" ? [event] : []));\n}\nfunction terminalFor(journal: JournalSnapshot, commandId: string): boolean {\n\treturn journal.records.some(\n\t\t({ event }) => (event.kind === \"published\" || event.kind === \"publish_failed\") && event.commandId === commandId,\n\t);\n}\nexport function publishDisposition(\n\tjournal: JournalSnapshot,\n\tcommand: RunPublishCommand,\n): \"completed\" | \"resume\" | \"new\" {\n\tconst first = journal.records[0]?.event;\n\tif (\n\t\tfirst?.kind !== \"created\" ||\n\t\tfirst.contract.runId !== command.runId ||\n\t\tdigestObject(first.contract) !== command.contractDigest\n\t)\n\t\tthrow new VerifiedRunError(\"command_conflict\");\n\tif (first.command.commandId === command.commandId) throw new VerifiedRunError(\"command_conflict\");\n\tconst own = openPublishIntents(journal).find((event) => event.commandId === command.commandId);\n\tif (own) {\n\t\tif (\n\t\t\town.candidateDigest !== command.candidateDigest ||\n\t\t\town.parentOid !== command.parentOid ||\n\t\t\town.receiptDigest !== command.receiptDigest ||\n\t\t\town.policyDigest !== command.policyDigest\n\t\t)\n\t\t\tthrow new VerifiedRunError(\"command_conflict\");\n\t\treturn terminalFor(journal, command.commandId) ? \"completed\" : \"resume\";\n\t}\n\tif (command.expectedRevision !== journal.state.revision || command.expectedGeneration !== journal.state.generation)\n\t\tthrow new VerifiedRunError(\"stale_revision\");\n\tif (journal.state.publication === \"intent\") throw new VerifiedRunError(\"reconciliation_required\");\n\tif (journal.state.publication === \"accepted\") throw new VerifiedRunError(\"already_published\");\n\treturn \"new\";\n}\n\nexport interface PublishOptions {\n\t/** Fault injection after a successful CAS, before the result record. */\n\treadonly afterCas?: () => void;\n\treadonly signal?: AbortSignal;\n\t/** One monotonic deadline shared by all Git writes, never replenished per file. */\n\treadonly timeoutMs?: number;\n\treadonly authority?: RunAuthority;\n}\n\nexport function publishVerifiedRun(\n\trunPath: string,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions = {},\n): RunProjection {\n\tconst initial = requireRunJournal(runPath);\n\tif (publishDisposition(initial, command) === \"completed\") return initial.state;\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\tconst owner = acquireSessionOwnerLeaseSync(journalPath(runPath));\n\tlet opened: RunAuthority | null = null;\n\ttry {\n\t\tconst snapshot = requireRunJournal(runPath);\n\t\tif (publishDisposition(snapshot, command) === \"completed\") return snapshot.state;\n\t\tif (!options.authority) opened = openRunAuthority(runPath);\n\t\tconst authority = options.authority ?? opened;\n\t\tif (!authority) throw new VerifiedRunError(\"authority\");\n\t\tconst journal = new VerifiedRunJournal(runPath, owner);\n\t\treturn executePublish(runPath, snapshot, journal, command, options, authority);\n\t} finally {\n\t\ttry {\n\t\t\topened?.store.release();\n\t\t} finally {\n\t\t\towner.release();\n\t\t}\n\t}\n}\n\nexport function recordPublished(\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\tcandidateOid: string,\n): RunProjection {\n\treturn journal.append({\n\t\tkind: \"published\",\n\t\tcommandId: command.commandId,\n\t\tcandidateOid,\n\t\tpreviousOid: command.parentOid,\n\t});\n}\n\nfunction executePublish(\n\trunPath: string,\n\tsnapshot: JournalSnapshot,\n\tjournal: VerifiedRunJournal,\n\tcommand: RunPublishCommand,\n\toptions: PublishOptions,\n\tauthority: RunAuthority,\n): RunProjection {\n\tconst budget = new GitOperationBudget({ signal: options.signal, timeoutMs: options.timeoutMs ?? 60_000 });\n\tbudget.remaining();\n\tconst { contract, state } = assertPublishable(snapshot, command, runPath);\n\tconst repoRoot = realpathSync(contract.workspace.root);\n\tassertGitWorkspaceRoot(repoRoot, budget);\n\tconst zero = zeroOid(repoObjectFormat(repoRoot, budget));\n\tif (command.parentOid.length !== zero.length) throw new VerifiedRunError(\"invalid_binding\");\n\tconst resumed = state.publication === \"intent\" && state.publicationCommandId === command.commandId;\n\t// Recovery observes the existing ref; it does not restart a terminal/unknown effect.\n\tif (resumed) {\n\t\tconst sealed = state.publicationCandidateOid;\n\t\tif (!sealed) throw new VerifiedRunError(\"invalid_binding\");\n\t\tconst observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === sealed && objectExists(repoRoot, sealed, budget))\n\t\t\treturn recordPublished(journal, command, sealed);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: \"reconciliation-required\",\n\t\t\t});\n\t}\n\tbudget.remaining();\n\tconst refClaims = [\n\t\t{\n\t\t\tnamespace: \"git-ref\",\n\t\t\tinstanceId: \"verified-run\",\n\t\t\tcanonicalKey: `omk-accepted-ref/${digestObject(repoRoot).slice(0, 16)}`,\n\t\t\taccess: \"write\",\n\t\t\tgeneration: String(state.generation),\n\t\t},\n\t];\n\tconst admission = authority.store.acquire({\n\t\tsessionId: authority.sessionId,\n\t\tincarnation: authority.incarnation,\n\t\tcommandId: command.commandId,\n\t\tintentDigest: digestObject({\n\t\t\tcandidateDigest: command.candidateDigest,\n\t\t\tparentOid: command.parentOid,\n\t\t\treceiptDigest: command.receiptDigest,\n\t\t\tpolicyDigest: command.policyDigest,\n\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t}),\n\t\tclaims: refClaims,\n\t\tnow: Date.now(),\n\t\tttl: 60_000,\n\t});\n\tif (admission.status !== \"granted\") throw new VerifiedRunError(\"authority_blocked\");\n\tconst token = admission.token;\n\t// Failure here must not settle somebody else's running/quarantined grant.\n\tassertPublishEffectStart(authority.store, token, refClaims, admission.duplicate);\n\tlet uncertain = false;\n\ttry {\n\t\tbudget.remaining();\n\t\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\t\tconst candidateOid = sealCandidateCommit(\n\t\t\trepoRoot,\n\t\t\t{\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t\tcontents: candidate.contents,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\tzeroOid: zero,\n\t\t\t\trunId: contract.runId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t},\n\t\t\tbudget,\n\t\t);\n\t\tif (resumed) {\n\t\t\tif (state.publicationCandidateOid !== candidateOid) throw new VerifiedRunError(\"invalid_binding\");\n\t\t} else {\n\t\t\tjournal.append({\n\t\t\t\tkind: \"publish_intent\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcandidateDigest: state.candidateDigest,\n\t\t\t\tcandidateOid,\n\t\t\t\tparentOid: command.parentOid,\n\t\t\t\ttargetRef: OMK_ACCEPTED_REF,\n\t\t\t\treceiptDigest: state.receiptDigest,\n\t\t\t\tpolicyDigest: command.policyDigest,\n\t\t\t\tgeneration: state.generation,\n\t\t\t});\n\t\t}\n\t\tconst observed = resolveRef(repoRoot, OMK_ACCEPTED_REF, budget);\n\t\tif (observed === candidateOid && objectExists(repoRoot, candidateOid, budget))\n\t\t\treturn recordPublished(journal, command, candidateOid);\n\t\tif ((observed ?? zero) !== command.parentOid)\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: resumed ? \"reconciliation-required\" : \"stale-parent\",\n\t\t\t});\n\t\tbudget.remaining();\n\t\tif (!authority.store.effectAuthorized(token, refClaims)) throw new VerifiedRunError(\"authority\");\n\t\ttry {\n\t\t\tcasRef(repoRoot, OMK_ACCEPTED_REF, candidateOid, command.parentOid, budget);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof GitRefCasError)) throw error;\n\t\t\tconst recoveryBudget = new GitOperationBudget({ timeoutMs: 5_000 });\n\t\t\tconst after = resolveRef(repoRoot, OMK_ACCEPTED_REF, recoveryBudget);\n\t\t\tif (after === candidateOid && objectExists(repoRoot, candidateOid, recoveryBudget))\n\t\t\t\treturn recordPublished(journal, command, candidateOid);\n\t\t\treturn journal.append({\n\t\t\t\tkind: \"publish_failed\",\n\t\t\t\tcommandId: command.commandId,\n\t\t\t\tcode: after === observed ? \"ref-rejected\" : resumed ? \"reconciliation-required\" : \"stale-parent\",\n\t\t\t});\n\t\t}\n\t\t// Once CAS succeeded, cancellation must not undo the committed publication.\n\t\toptions.afterCas?.();\n\t\treturn recordPublished(journal, command, candidateOid);\n\t} catch (error) {\n\t\tuncertain = error instanceof VerifiedRunError && error.code === \"git_outcome_unknown\";\n\t\tthrow error;\n\t} finally {\n\t\tif (uncertain) authority.store.cancel(token);\n\t\telse authority.store.confirmTerminated(token);\n\t}\n}\n"]}