open-multi-agent-kit 1.2.0 → 1.2.2

package/dist/core/verified-run/supervisor-adapter.js

@@ -0,0 +1,164 @@
+import { existsSync, readdirSync, readFileSync, readlinkSync, statSync } from "node:fs";
+import { performance } from "node:perf_hooks";
+import { setTimeout as delay } from "node:timers/promises";
+import { probeNamespace } from "./namespace-identity.js";
+import { VerifiedRunError } from "./storage.js";
+/**
+ * Owned-process supervisor boundary (WP02).
+ *
+ * Three concerns are separated here so the broker only orchestrates them:
+ *
+ * - spawn: `SUPERVISOR_SYSTEM_ARGS` + `loadSupervisorBackend` describe the only
+ *   backend this package trusts — bubblewrap with `--unshare-all`, which puts
+ *   the supervised command in a fresh PID namespace whose init is the only
+ *   process the host can see. A platform without that backend has no way to
+ *   prove termination, so callers must refuse with `unsupported_boundary`
+ *   instead of degrading to best-effort signaling.
+ * - cancel: `escalateTermination` sends SIGKILL to the supervised direct
+ *   child (the bwrap supervisor). `--die-with-parent` propagates death to the
+ *   namespace init, and the kernel then SIGKILLs every remaining task in that
+ *   namespace — including non-cooperative workers and detached (`setsid`)
+ *   descendants. Signal delivery is never treated as termination.
+ * - termination witness: `probeNamespace` detects the recorded namespace
+ *   init's death and `awaitBoundaryDrained` waits for it. When a PID
+ *   namespace's init exits, the kernel SIGKILLs every remaining task in that
+ *   namespace, so init death is the exact termination witness — a `close`
+ *   event, a resolved promise, or a dead direct child with surviving
+ *   descendants is not. `namespaceMemberPids` remains as a diagnostic
+ *   enumeration only: host process-table scans are environment-dependent
+ *   (zombies keep their ns link until reaped; foreign same-uid tasks can be
+ *   unreadable) and have poisoned drains on kernels where either occurs.
+ */
+export const SUPERVISOR_BINARY = "/usr/bin/bwrap";
+export const SUPERVISOR_SYSTEM_ARGS = [
+    "--unshare-all",
+    "--die-with-parent",
+    "--new-session",
+    "--cap-drop",
+    "ALL",
+    "--clearenv",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--symlink",
+    "usr/lib",
+    "/lib",
+    "--symlink",
+    "usr/lib64",
+    "/lib64",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--setenv",
+    "PATH",
+    "/usr/bin:/bin",
+    "--setenv",
+    "LANG",
+    "C.UTF-8",
+];
+/**
+ * The only termination guarantee this package honors: a private PID namespace
+ * plus the Linux bwrap supervisor. Anything else is refused at the boundary.
+ */
+export function loadSupervisorBackend() {
+    if (process.platform !== "linux" || !existsSync(SUPERVISOR_BINARY))
+        throw new VerifiedRunError("unsupported_boundary");
+    return { binary: SUPERVISOR_BINARY, args: SUPERVISOR_SYSTEM_ARGS };
+}
+/**
+ * SIGKILL escalation to the supervised direct child. `--die-with-parent` makes
+ * the kernel kill the whole PID namespace once this supervisor dies, so no
+ * per-descendant signaling (which PID reuse would make unsafe) is needed.
+ */
+export function escalateTermination(child) {
+    child.kill("SIGKILL");
+}
+/**
+ * Enumerate host PIDs of every task still inside `identity.namespace`.
+ *
+ * Membership is keyed on the recorded namespace symlink, not on the init's
+ * PID: a fabricated or reaped direct child cannot mask surviving descendants.
+ *
+ * A task whose namespace link cannot be read is only a candidate member when
+ * it could belong to the recorded boundary at all. The backend's members
+ * always run under our real uid — the pid namespace is owned by a user
+ * namespace we created and `CAP_SETUID` is dropped — so a task owned by
+ * another uid, or one that vanished mid-scan, cannot be a member and is
+ * skipped. An unreadable task owned by our uid is conservatively counted:
+ * failing to prove emptiness must fail closed.
+ */
+export function namespaceMemberPids(identity) {
+    const members = [];
+    // A platform without getuid cannot exclude foreign-owned tasks, so every
+    // unreadable entry stays a candidate member (fail closed).
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    for (const entry of readdirSync("/proc")) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        try {
+            if (readlinkSync(`/proc/${entry}/ns/pid`) !== identity.namespace)
+                continue;
+            // A zombie still carries the namespace link until reaped, but it
+            // cannot run: counting it as a member confuses teardown with
+            // survival.
+            const stat = readFileSync(`/proc/${entry}/stat`, "utf8");
+            const state = stat
+                .slice(stat.lastIndexOf(")") + 2)
+                .trim()
+                .split(/\s+/)[0];
+            if (state !== "Z" && state !== "X")
+                members.push(Number(entry));
+        }
+        catch (error) {
+            if (!(error instanceof Error && "code" in error))
+                continue;
+            if (error.code === "ENOENT" || error.code === "ESRCH")
+                continue;
+            try {
+                if (uid === undefined || statSync(`/proc/${entry}`).uid === uid)
+                    members.push(Number(entry));
+            }
+            catch (statError) {
+                if (!(statError instanceof Error && "code" in statError) ||
+                    (statError.code !== "ENOENT" && statError.code !== "ESRCH"))
+                    members.push(Number(entry));
+            }
+        }
+    }
+    return members;
+}
+/** Init death terminates the whole namespace; a zombie init already proves teardown finished. */
+export function probeOwnedNamespace(identity) {
+    const status = probeNamespace(identity);
+    return status === "gone" ? "terminated" : status;
+}
+/**
+ * Wait for the namespace init's death within budgetMs. Init death is the
+ * termination witness: the kernel SIGKILLs every remaining task in the PID
+ * namespace when its init exits, so a drained namespace needs no process-table
+ * enumeration. `populated`/`unknown` never release claims.
+ *
+ * `unknown` is not terminal here: teardown has a transient window where the
+ * init's stat is readable but its ns link read is denied or the identity
+ * probe is inconclusive, and that window resolves to `gone` once the kernel
+ * finishes teardown. Only a probe that is still inconclusive at the deadline
+ * stays `unknown`; a still-alive init is `populated`.
+ */
+export async function awaitBoundaryDrained(identity, budgetMs) {
+    const deadline = performance.now() + Math.max(0, budgetMs);
+    for (;;) {
+        const status = probeNamespace(identity);
+        if (status === "gone")
+            return "drained";
+        if (performance.now() >= deadline)
+            return status === "alive" ? "populated" : "unknown";
+        await delay(Math.min(10, Math.max(1, deadline - performance.now())));
+    }
+}
+//# sourceMappingURL=supervisor-adapter.js.map

package/dist/core/verified-run/supervisor-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-adapter.js","sourceRoot":"","sources":["../../../src/core/verified-run/supervisor-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0B,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,eAAe;IACf,mBAAmB;IACnB,eAAe;IACf,YAAY;IACZ,KAAK;IACL,YAAY;IACZ,WAAW;IACX,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM;IACN,WAAW;IACX,SAAS;IACT,MAAM;IACN,WAAW;IACX,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,MAAM;IACN,UAAU;IACV,MAAM;IACN,eAAe;IACf,UAAU;IACV,MAAM;IACN,SAAS;CACA,CAAC;AAIX;;;GAGG;AACH,MAAM,UAAU,qBAAqB,GAAkE;IACtG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACjE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;AAAA,CACnE;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAsB,EAAQ;IACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAAA,CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8C,EAAY;IAC7F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC;YACJ,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,QAAQ,CAAC,SAAS;gBAAE,SAAS;YAC3E,iEAAiE;YACjE,6DAA6D;YAC7D,YAAY;YACZ,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,KAAK,OAAO,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,IAAI;iBAChB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBAChC,IAAI,EAAE;iBACN,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;gBAAE,SAAS;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,SAAS;YAChE,IAAI,CAAC;gBACJ,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACpB,IACC,CAAC,CAAC,SAAS,YAAY,KAAK,IAAI,MAAM,IAAI,SAAS,CAAC;oBACpD,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;oBAE3D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,QAA2B,EAAsC;IACpG,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAAA,CACjD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,QAA2B,EAC3B,QAAgB,EAC+B;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,SAAS,CAAC;QACT,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;AAAA,CACD","sourcesContent":["import { existsSync, readdirSync, readFileSync, readlinkSync, statSync } from \"node:fs\";\nimport { performance } from \"node:perf_hooks\";\nimport { setTimeout as delay } from \"node:timers/promises\";\nimport { type NamespaceIdentity, probeNamespace } from \"./namespace-identity.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\n/**\n * Owned-process supervisor boundary (WP02).\n *\n * Three concerns are separated here so the broker only orchestrates them:\n *\n * - spawn: `SUPERVISOR_SYSTEM_ARGS` + `loadSupervisorBackend` describe the only\n *   backend this package trusts — bubblewrap with `--unshare-all`, which puts\n *   the supervised command in a fresh PID namespace whose init is the only\n *   process the host can see. A platform without that backend has no way to\n *   prove termination, so callers must refuse with `unsupported_boundary`\n *   instead of degrading to best-effort signaling.\n * - cancel: `escalateTermination` sends SIGKILL to the supervised direct\n *   child (the bwrap supervisor). `--die-with-parent` propagates death to the\n *   namespace init, and the kernel then SIGKILLs every remaining task in that\n *   namespace — including non-cooperative workers and detached (`setsid`)\n *   descendants. Signal delivery is never treated as termination.\n * - termination witness: `probeNamespace` detects the recorded namespace\n *   init's death and `awaitBoundaryDrained` waits for it. When a PID\n *   namespace's init exits, the kernel SIGKILLs every remaining task in that\n *   namespace, so init death is the exact termination witness — a `close`\n *   event, a resolved promise, or a dead direct child with surviving\n *   descendants is not. `namespaceMemberPids` remains as a diagnostic\n *   enumeration only: host process-table scans are environment-dependent\n *   (zombies keep their ns link until reaped; foreign same-uid tasks can be\n *   unreadable) and have poisoned drains on kernels where either occurs.\n */\nexport const SUPERVISOR_BINARY = \"/usr/bin/bwrap\";\n\nexport const SUPERVISOR_SYSTEM_ARGS = [\n\t\"--unshare-all\",\n\t\"--die-with-parent\",\n\t\"--new-session\",\n\t\"--cap-drop\",\n\t\"ALL\",\n\t\"--clearenv\",\n\t\"--ro-bind\",\n\t\"/usr\",\n\t\"/usr\",\n\t\"--symlink\",\n\t\"usr/bin\",\n\t\"/bin\",\n\t\"--symlink\",\n\t\"usr/lib\",\n\t\"/lib\",\n\t\"--symlink\",\n\t\"usr/lib64\",\n\t\"/lib64\",\n\t\"--proc\",\n\t\"/proc\",\n\t\"--dev\",\n\t\"/dev\",\n\t\"--tmpfs\",\n\t\"/tmp\",\n\t\"--setenv\",\n\t\"PATH\",\n\t\"/usr/bin:/bin\",\n\t\"--setenv\",\n\t\"LANG\",\n\t\"C.UTF-8\",\n] as const;\n\nexport type SupervisorChild = { readonly kill: (signal: NodeJS.Signals) => boolean };\n\n/**\n * The only termination guarantee this package honors: a private PID namespace\n * plus the Linux bwrap supervisor. Anything else is refused at the boundary.\n */\nexport function loadSupervisorBackend(): { readonly binary: string; readonly args: readonly string[] } {\n\tif (process.platform !== \"linux\" || !existsSync(SUPERVISOR_BINARY))\n\t\tthrow new VerifiedRunError(\"unsupported_boundary\");\n\treturn { binary: SUPERVISOR_BINARY, args: SUPERVISOR_SYSTEM_ARGS };\n}\n\n/**\n * SIGKILL escalation to the supervised direct child. `--die-with-parent` makes\n * the kernel kill the whole PID namespace once this supervisor dies, so no\n * per-descendant signaling (which PID reuse would make unsafe) is needed.\n */\nexport function escalateTermination(child: SupervisorChild): void {\n\tchild.kill(\"SIGKILL\");\n}\n\n/**\n * Enumerate host PIDs of every task still inside `identity.namespace`.\n *\n * Membership is keyed on the recorded namespace symlink, not on the init's\n * PID: a fabricated or reaped direct child cannot mask surviving descendants.\n *\n * A task whose namespace link cannot be read is only a candidate member when\n * it could belong to the recorded boundary at all. The backend's members\n * always run under our real uid — the pid namespace is owned by a user\n * namespace we created and `CAP_SETUID` is dropped — so a task owned by\n * another uid, or one that vanished mid-scan, cannot be a member and is\n * skipped. An unreadable task owned by our uid is conservatively counted:\n * failing to prove emptiness must fail closed.\n */\nexport function namespaceMemberPids(identity: Pick<NamespaceIdentity, \"namespace\">): number[] {\n\tconst members: number[] = [];\n\t// A platform without getuid cannot exclude foreign-owned tasks, so every\n\t// unreadable entry stays a candidate member (fail closed).\n\tconst uid = typeof process.getuid === \"function\" ? process.getuid() : undefined;\n\tfor (const entry of readdirSync(\"/proc\")) {\n\t\tif (!/^\\d+$/.test(entry)) continue;\n\t\ttry {\n\t\t\tif (readlinkSync(`/proc/${entry}/ns/pid`) !== identity.namespace) continue;\n\t\t\t// A zombie still carries the namespace link until reaped, but it\n\t\t\t// cannot run: counting it as a member confuses teardown with\n\t\t\t// survival.\n\t\t\tconst stat = readFileSync(`/proc/${entry}/stat`, \"utf8\");\n\t\t\tconst state = stat\n\t\t\t\t.slice(stat.lastIndexOf(\")\") + 2)\n\t\t\t\t.trim()\n\t\t\t\t.split(/\\s+/)[0];\n\t\t\tif (state !== \"Z\" && state !== \"X\") members.push(Number(entry));\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof Error && \"code\" in error)) continue;\n\t\t\tif (error.code === \"ENOENT\" || error.code === \"ESRCH\") continue;\n\t\t\ttry {\n\t\t\t\tif (uid === undefined || statSync(`/proc/${entry}`).uid === uid) members.push(Number(entry));\n\t\t\t} catch (statError) {\n\t\t\t\tif (\n\t\t\t\t\t!(statError instanceof Error && \"code\" in statError) ||\n\t\t\t\t\t(statError.code !== \"ENOENT\" && statError.code !== \"ESRCH\")\n\t\t\t\t)\n\t\t\t\t\tmembers.push(Number(entry));\n\t\t\t}\n\t\t}\n\t}\n\treturn members;\n}\n\n/** Init death terminates the whole namespace; a zombie init already proves teardown finished. */\nexport function probeOwnedNamespace(identity: NamespaceIdentity): \"terminated\" | \"alive\" | \"unknown\" {\n\tconst status = probeNamespace(identity);\n\treturn status === \"gone\" ? \"terminated\" : status;\n}\n\n/**\n * Wait for the namespace init's death within budgetMs. Init death is the\n * termination witness: the kernel SIGKILLs every remaining task in the PID\n * namespace when its init exits, so a drained namespace needs no process-table\n * enumeration. `populated`/`unknown` never release claims.\n *\n * `unknown` is not terminal here: teardown has a transient window where the\n * init's stat is readable but its ns link read is denied or the identity\n * probe is inconclusive, and that window resolves to `gone` once the kernel\n * finishes teardown. Only a probe that is still inconclusive at the deadline\n * stays `unknown`; a still-alive init is `populated`.\n */\nexport async function awaitBoundaryDrained(\n\tidentity: NamespaceIdentity,\n\tbudgetMs: number,\n): Promise<\"drained\" | \"populated\" | \"unknown\"> {\n\tconst deadline = performance.now() + Math.max(0, budgetMs);\n\tfor (;;) {\n\t\tconst status = probeNamespace(identity);\n\t\tif (status === \"gone\") return \"drained\";\n\t\tif (performance.now() >= deadline) return status === \"alive\" ? \"populated\" : \"unknown\";\n\t\tawait delay(Math.min(10, Math.max(1, deadline - performance.now())));\n\t}\n}\n"]}

package/dist/core/verified-run/verification-phase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,qGAAqG;AACrG,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAiDtF","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}
+{"version":3,"file":"verification-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,qGAAqG;AACrG,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAiDtF","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, authority: context.authority, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}

package/dist/core/verified-run/verification-phase.js

@@ -21,7 +21,7 @@ export async function verifyCandidate(context) {
     materializeCandidate(candidate, fixed);
     const checks = [];
     for (const check of contract.checks) {
-        const { executionId, result, timeoutMs } = await executeRunCommand(journal, { role: "verifier", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId }, { ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) });
+        const { executionId, result, timeoutMs } = await executeRunCommand(journal, { role: "verifier", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId }, { ...contract.budget, authority: context.authority, ...(context.signal ? { signal: context.signal } : {}) });
         checks.push({
             claimId: check.claimId,
             executionId,

package/dist/core/verified-run/verification-phase.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE7D,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAA0B;IACvF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAC/G,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAC7E,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACpG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,iBAAiB,CACjE,OAAO,EACP,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC1F,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC7E,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW;YACX,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE;gBACvD,KAAK;gBACL,WAAW;gBACX,MAAM;gBACN,SAAS;gBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC5B,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;IACD,IACC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,eAAe;QACzE,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAE1E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,MAAM;KACN,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACjF,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAAA,CACxG","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}
+{"version":3,"file":"verification-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/verification-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE7D,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAA0B;IACvF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAC/G,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAC7E,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACpG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,iBAAiB,CACjE,OAAO,EACP,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAC1F,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC3G,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW;YACX,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE;gBACvD,KAAK;gBACL,WAAW;gBACX,MAAM;gBACN,SAAS;gBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC5B,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;IACD,IACC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,eAAe;QACzE,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,iBAAiB;QAE1E,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE;QACnD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,MAAM;KACN,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACjF,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAAA,CACxG","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport { commandEnvironmentDigest } from \"./broker.ts\";\nimport { captureCandidate, loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { storeCheckReceipt } from \"./check-receipt.ts\";\nimport { type CheckObservation, issueRunEvidence } from \"./evidence.ts\";\nimport { executeRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { localVerificationDeadline } from \"./recovery-clock.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport { digestBytes, VerifiedRunError } from \"./storage.ts\";\n\n/** Both start and resume use this same verification path; no writer/model code is reachable here. */\nexport async function verifyCandidate(context: RunPhaseContext): Promise<RunProjection> {\n\tconst { contract, journal, runPath } = context;\n\tconst state = journal.state;\n\tif (!state.candidateDigest || !state.budget || state.verificationDeadlineMs === null || !state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"resume_unavailable\");\n\tconst deadline = localVerificationDeadline(state.budget, state.verificationDeadlineMs);\n\tif (commandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest)\n\t\tthrow new VerifiedRunError(\"environment_changed\");\n\tconst candidate = loadCandidate(runPath, state.candidateDigest, contract.budget);\n\tconst fixed = join(runPath, state.generation === 1 ? \"candidate\" : `candidate-${state.generation}`);\n\tmaterializeCandidate(candidate, fixed);\n\tconst checks: CheckObservation[] = [];\n\tfor (const check of contract.checks) {\n\t\tconst { executionId, result, timeoutMs } = await executeRunCommand(\n\t\t\tjournal,\n\t\t\t{ role: \"verifier\", argv: check.argv, workspace: fixed, deadline, claimId: check.claimId },\n\t\t\t{ ...contract.budget, authority: context.authority, ...(context.signal ? { signal: context.signal } : {}) },\n\t\t);\n\t\tchecks.push({\n\t\t\tclaimId: check.claimId,\n\t\t\texecutionId,\n\t\t\tstdoutDigest: digestBytes(result.stdout),\n\t\t\tstderrDigest: digestBytes(result.stderr),\n\t\t\texitCode: result.exitCode,\n\t\t\tfailure: result.failure,\n\t\t\treceiptCoreDigest: storeCheckReceipt(runPath, contract, {\n\t\t\t\tcheck,\n\t\t\t\texecutionId,\n\t\t\t\tresult,\n\t\t\t\ttimeoutMs,\n\t\t\t\tmanifest: candidate.manifest,\n\t\t\t}),\n\t\t});\n\t}\n\tif (\n\t\tcaptureCandidate(fixed, contract.budget).digest !== state.candidateDigest ||\n\t\tcommandEnvironmentDigest(contract, \"gated-v1\") !== state.environmentDigest\n\t)\n\t\tthrow new VerifiedRunError(\"integrity\");\n\tif (performance.now() >= deadline) throw new VerifiedRunError(\"deadline\");\n\tconst receipt = issueRunEvidence(runPath, contract, {\n\t\tgeneration: state.generation,\n\t\tcandidateDigest: state.candidateDigest,\n\t\tenvironmentDigest: state.environmentDigest,\n\t\tchecks,\n\t});\n\tif (performance.now() >= deadline || journal.state.generation !== state.generation)\n\t\tthrow new VerifiedRunError(\"deadline\");\n\treturn journal.append({ kind: \"evaluated\", receiptDigest: receipt.digest, verified: receipt.verified });\n}\n"]}

package/dist/core/verified-run/writer-phase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAsB,aAAa,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IACR,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACtC,GACC,OAAO,CAAC,IAAI,CAAC,CA+Df","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}
+{"version":3,"file":"writer-phase.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAsB,aAAa,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE;IACR,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACtC,GACC,OAAO,CAAC,IAAI,CAAC,CAgEf","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\tauthority: context.authority,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-phase.js

@@ -10,6 +10,7 @@ export async function executeWriter(context, options) {
         const signals = [context.signal, toolSignal].filter((signal) => signal !== undefined);
         return executeRunCommand(journal, request, {
             ...contract.budget,
+            authority: context.authority,
             ...(signals.length ? { signal: AbortSignal.any(signals) } : {}),
         });
     };

package/dist/core/verified-run/writer-phase.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAwB,EACxB,OAIC,EACe;IAChB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAwB,EAAE,UAAwB,EAAE,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC7G,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE;YAC1C,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IAAA,CACH,CAAC;IACF,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,sBAAsB;YAC1B,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,KAAK,kBAAkB,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC5B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAI;aACb,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7E,OAAO;QACR,CAAC;QACD,KAAK,yBAAyB,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YACtE,IAAI,YAAY,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACzE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;oBAClD,OAAO;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,YAAY;oBACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,aAAa,EAAE,GAAG,EAAE,CAAC;wBACpB,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBAClF,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;wBACnE,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAAA,CAClF;oBACD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;wBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACjC,IAAI,CAAC,IAAI;4BAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;wBACrD,OAAO,OAAO,CACb,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EACjG,MAAM,CACN,CAAC;oBAAA,CACF;iBACD,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACV,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;QACR,CAAC;QACD,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;AAAA,CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}
+{"version":3,"file":"writer-phase.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-phase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAwB,EACxB,OAIC,EACe;IAChB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAwB,EAAE,UAAwB,EAAE,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC7G,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE;YAC1C,GAAG,QAAQ,CAAC,MAAM;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IAAA,CACH,CAAC;IACF,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,sBAAsB;YAC1B,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,KAAK,kBAAkB,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC5B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,IAAI;aACb,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7E,OAAO;QACR,CAAC;QACD,KAAK,yBAAyB,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YACtE,IAAI,YAAY,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YACzE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;oBAClD,OAAO;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,YAAY;oBACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,aAAa,EAAE,GAAG,EAAE,CAAC;wBACpB,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBAClF,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;wBACnE,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ;4BAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAAA,CAClF;oBACD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;wBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACjC,IAAI,CAAC,IAAI;4BAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;wBACrD,OAAO,OAAO,CACb,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EACjG,MAAM,CACN,CAAC;oBAAA,CACF;iBACD,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACV,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;QACR,CAAC;QACD,SAAS,CAAC;YACT,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;AAAA,CACD","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { performance } from \"node:perf_hooks\";\nimport { executeDag } from \"./dag-phase.ts\";\nimport { executeRunCommand, type OwnedRunCommand } from \"./owned-execution.ts\";\nimport type { RunPhaseContext } from \"./phase-context.ts\";\nimport { executeScriptedWriter } from \"./scripted-writer.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\n\nexport async function executeWriter(\n\tcontext: RunPhaseContext,\n\toptions: {\n\t\treadonly workspace: string;\n\t\treadonly deadline: number;\n\t\treadonly runtime?: VerifiedRunRuntime;\n\t},\n): Promise<void> {\n\tconst { contract, journal } = context;\n\tconst execute = (request: OwnedRunCommand, toolSignal?: AbortSignal) => {\n\t\tconst signals = [context.signal, toolSignal].filter((signal): signal is AbortSignal => signal !== undefined);\n\t\treturn executeRunCommand(journal, request, {\n\t\t\t...contract.budget,\n\t\t\tauthority: context.authority,\n\t\t\t...(signals.length ? { signal: AbortSignal.any(signals) } : {}),\n\t\t});\n\t};\n\tswitch (contract.profile) {\n\t\tcase \"linux-command-dag-v1\":\n\t\t\treturn executeDag(context, options);\n\t\tcase \"linux-command-v1\": {\n\t\t\tconst writer = await execute({\n\t\t\t\trole: \"writer\",\n\t\t\t\targv: contract.writer,\n\t\t\t\tworkspace: options.workspace,\n\t\t\t\tdeadline: options.deadline,\n\t\t\t\tclaimId: null,\n\t\t\t});\n\t\t\tif (writer.result.failure) throw new VerifiedRunError(writer.result.failure);\n\t\t\treturn;\n\t\t}\n\t\tcase \"linux-scripted-agent-v1\": {\n\t\t\tconst runtime = options.runtime;\n\t\t\tif (!runtime) throw new VerifiedRunError(\"writer_backend_missing\");\n\t\t\tconst writer = contract.writer;\n\t\t\tconst requestLimit = writer.maxRequests - journal.state.modelRequests;\n\t\t\tif (requestLimit <= 0) throw new VerifiedRunError(\"model_request_limit\");\n\t\t\tjournal.append({ kind: \"writer_opened\" });\n\t\t\tlet completed = false;\n\t\t\ttry {\n\t\t\t\tawait executeScriptedWriter(writer, contract.goal, {\n\t\t\t\t\truntime,\n\t\t\t\t\tworkspace: options.workspace,\n\t\t\t\t\tdeadline: options.deadline,\n\t\t\t\t\trequestLimit,\n\t\t\t\t\t...(context.signal ? { signal: context.signal } : {}),\n\t\t\t\t\tbeforeRequest: () => {\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t\tjournal.append({ kind: \"model_request\", requestId: randomUUID() });\n\t\t\t\t\t\tif (performance.now() >= options.deadline) throw new VerifiedRunError(\"deadline\");\n\t\t\t\t\t},\n\t\t\t\t\texecuteStep: (index, signal) => {\n\t\t\t\t\t\tconst argv = writer.steps[index];\n\t\t\t\t\t\tif (!argv) throw new VerifiedRunError(\"writer_step\");\n\t\t\t\t\t\treturn execute(\n\t\t\t\t\t\t\t{ role: \"writer\", argv, workspace: options.workspace, deadline: options.deadline, claimId: null },\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t\tcompleted = true;\n\t\t\t} finally {\n\t\t\t\tif (journal.state.activeExecutionIds.length === 0) journal.append({ kind: \"writer_closed\", completed });\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tdefault: {\n\t\t\tconst exhaustive: never = contract;\n\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t}\n\t}\n}\n"]}

package/dist/core/verified-run/writer-recovery.d.ts

@@ -1,4 +1,5 @@
 import type { RunWriterRestartCommand } from "omk-protocol";
+import type { RunAuthority } from "./authority-runtime.ts";
 import type { RunProjection } from "./run-types.ts";
 import type { VerifiedRunRuntime } from "./session-port.ts";
 export interface WriterRecoveryInspection {
@@ -12,5 +13,6 @@ export declare function inspectWriterRecovery(runPath: string): WriterRecoveryIn
 export declare function restartIsolatedWriter(runPath: string, command: RunWriterRestartCommand, options: {
     readonly runtime?: VerifiedRunRuntime;
     readonly signal?: AbortSignal;
+    readonly authority: RunAuthority;
 }): Promise<RunProjection>;
 //# sourceMappingURL=writer-recovery.d.ts.map

package/dist/core/verified-run/writer-recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-recovery.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAO5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EACf,OAAO,GACP,UAAU,GACV,0BAA0B,GAC1B,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,WAAW,CAAC;IACf,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACrC;AAaD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,wBAAwB,CA0C/E;AAED,4GAA4G;AAC5G,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAC/E,OAAO,CAAC,aAAa,CAAC,CAkCxB","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunWriterRestartCommand } from \"omk-protocol\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\nimport { assertWorkRecoverable } from \"./work-recovery.ts\";\nimport { publishWriterCandidate } from \"./writer-completion.ts\";\nimport { executeWriter } from \"./writer-phase.ts\";\n\nexport interface WriterRecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"input_checkpoint_missing\"\n\t\t| \"candidate_present\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"recovery_limit\"\n\t\t| \"model_request_limit\"\n\t\t| \"integrity\";\n\treadonly remainingWorkMs: number | null;\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertWriterRecoverable(runPath: string, snapshot: JournalSnapshot): number {\n\tconst { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);\n\tif (contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\tif (\n\t\tcontract.profile === \"linux-scripted-agent-v1\" &&\n\t\tcontract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1\n\t)\n\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\treturn remainingMs;\n}\n\nexport function inspectWriterRecovery(runPath: string): WriterRecoveryInspection {\n\tconst snapshot = requireRunJournal(runPath);\n\tlet readiness: WriterRecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingWorkMs: number | null = null;\n\ttry {\n\t\tremainingWorkMs = assertWriterRecoverable(runPath, snapshot);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingWorkMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"input_checkpoint_missing\":\n\t\t\t\treadiness = \"input_checkpoint_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_present\":\n\t\t\t\treadiness = \"candidate_present\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tcase \"model_request_limit\":\n\t\t\t\treadiness = \"model_request_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: \"lease_required\" });\n}\n\n/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */\nexport async function restartIsolatedWriter(\n\trunPath: string,\n\tcommand: RunWriterRestartCommand,\n\toptions: { readonly runtime?: VerifiedRunRuntime; readonly signal?: AbortSignal },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tif (first.contract.profile === \"linux-scripted-agent-v1\" && !options.runtime)\n\t\t\tthrow new VerifiedRunError(\"writer_backend_missing\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"writer_restarted\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\tconst state = journal.state;\n\t\tif (!state.budget || !state.inputDigest) throw new VerifiedRunError(\"integrity\");\n\t\tconst deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);\n\t\tconst base = loadCandidate(runPath, state.inputDigest, first.contract.budget);\n\t\tconst workspace = join(runPath, `writer-${state.generation}`);\n\t\tmaterializeCandidate(base, workspace);\n\t\tconst context = {\n\t\t\trunPath,\n\t\t\tcontract: first.contract,\n\t\t\tjournal,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t};\n\t\tawait executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });\n\t\tpublishWriterCandidate(context, workspace, deadline);\n\t\treturn verifyCandidate(context);\n\t});\n}\n"]}
+{"version":3,"file":"writer-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/verified-run/writer-recovery.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAO3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EACf,OAAO,GACP,UAAU,GACV,0BAA0B,GAC1B,mBAAmB,GACnB,WAAW,GACX,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,WAAW,CAAC;IACf,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACrC;AAaD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,wBAAwB,CA0C/E;AAED,4GAA4G;AAC5G,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAA;CAAE,GACjH,OAAO,CAAC,aAAa,CAAC,CAmCxB","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunWriterRestartCommand } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\nimport { assertWorkRecoverable } from \"./work-recovery.ts\";\nimport { publishWriterCandidate } from \"./writer-completion.ts\";\nimport { executeWriter } from \"./writer-phase.ts\";\n\nexport interface WriterRecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"input_checkpoint_missing\"\n\t\t| \"candidate_present\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"recovery_limit\"\n\t\t| \"model_request_limit\"\n\t\t| \"integrity\";\n\treadonly remainingWorkMs: number | null;\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertWriterRecoverable(runPath: string, snapshot: JournalSnapshot): number {\n\tconst { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);\n\tif (contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\tif (\n\t\tcontract.profile === \"linux-scripted-agent-v1\" &&\n\t\tcontract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1\n\t)\n\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\treturn remainingMs;\n}\n\nexport function inspectWriterRecovery(runPath: string): WriterRecoveryInspection {\n\tconst snapshot = requireRunJournal(runPath);\n\tlet readiness: WriterRecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingWorkMs: number | null = null;\n\ttry {\n\t\tremainingWorkMs = assertWriterRecoverable(runPath, snapshot);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingWorkMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"input_checkpoint_missing\":\n\t\t\t\treadiness = \"input_checkpoint_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_present\":\n\t\t\t\treadiness = \"candidate_present\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tcase \"model_request_limit\":\n\t\t\t\treadiness = \"model_request_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: \"lease_required\" });\n}\n\n/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */\nexport async function restartIsolatedWriter(\n\trunPath: string,\n\tcommand: RunWriterRestartCommand,\n\toptions: { readonly runtime?: VerifiedRunRuntime; readonly signal?: AbortSignal; readonly authority: RunAuthority },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tif (first.contract.profile === \"linux-scripted-agent-v1\" && !options.runtime)\n\t\t\tthrow new VerifiedRunError(\"writer_backend_missing\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"writer_restarted\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\tconst state = journal.state;\n\t\tif (!state.budget || !state.inputDigest) throw new VerifiedRunError(\"integrity\");\n\t\tconst deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);\n\t\tconst base = loadCandidate(runPath, state.inputDigest, first.contract.budget);\n\t\tconst workspace = join(runPath, `writer-${state.generation}`);\n\t\tmaterializeCandidate(base, workspace);\n\t\tconst context = {\n\t\t\trunPath,\n\t\t\tcontract: first.contract,\n\t\t\tjournal,\n\t\t\tauthority: options.authority,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t};\n\t\tawait executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });\n\t\tpublishWriterCandidate(context, workspace, deadline);\n\t\treturn verifyCandidate(context);\n\t});\n}\n"]}

package/dist/core/verified-run/writer-recovery.js

@@ -97,6 +97,7 @@ export async function restartIsolatedWriter(runPath, command, options) {
             runPath,
             contract: first.contract,
             journal,
+            authority: options.authority,
             ...(options.signal ? { signal: options.signal } : {}),
         };
         await executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });

package/dist/core/verified-run/writer-recovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer-recovery.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoBlD,SAAS,uBAAuB,CAAC,OAAe,EAAE,QAAyB,EAAU;IACpF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,KAAK,sBAAsB;QAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACtG,IACC,QAAQ,CAAC,OAAO,KAAK,yBAAyB;QAC9C,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAE7F,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC;AAAA,CACnB;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAA4B;IAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,GAA0C,OAAO,CAAC;IAC/D,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACJ,eAAe,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,QAAQ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,KAAK,iBAAiB;gBACrB,SAAS,GAAG,UAAU,CAAC;gBACvB,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,GAAG,SAAS,CAAC;gBACtB,eAAe,GAAG,CAAC,CAAC;gBACpB,MAAM;YACP,KAAK,0BAA0B;gBAC9B,SAAS,GAAG,0BAA0B,CAAC;gBACvC,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,WAAW;gBACf,SAAS,GAAG,WAAW,CAAC;gBACxB,MAAM;YACP,KAAK,eAAe;gBACnB,SAAS,GAAG,eAAe,CAAC;gBAC5B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,qBAAqB;gBACzB,SAAS,GAAG,qBAAqB,CAAC;gBAClC,MAAM;YACP;gBACC,SAAS,GAAG,WAAW,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAAA,CACzG;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAe,EACf,OAAgC,EAChC,OAAiF,EACxD;IACzB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3E,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QACzC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB,IAAI,CAAC,OAAO,CAAC,OAAO;YAC3E,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACtD,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,oBAAoB,EAAE,CAAC;QACvB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO;YACP,UAAU,EAAE,YAAY,EAAE,CAAC,KAAK;YAChC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB;SACzD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9D,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG;YACf,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;QACF,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAAA,CAChC,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunWriterRestartCommand } from \"omk-protocol\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\nimport { assertWorkRecoverable } from \"./work-recovery.ts\";\nimport { publishWriterCandidate } from \"./writer-completion.ts\";\nimport { executeWriter } from \"./writer-phase.ts\";\n\nexport interface WriterRecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"input_checkpoint_missing\"\n\t\t| \"candidate_present\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"recovery_limit\"\n\t\t| \"model_request_limit\"\n\t\t| \"integrity\";\n\treadonly remainingWorkMs: number | null;\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertWriterRecoverable(runPath: string, snapshot: JournalSnapshot): number {\n\tconst { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);\n\tif (contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\tif (\n\t\tcontract.profile === \"linux-scripted-agent-v1\" &&\n\t\tcontract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1\n\t)\n\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\treturn remainingMs;\n}\n\nexport function inspectWriterRecovery(runPath: string): WriterRecoveryInspection {\n\tconst snapshot = requireRunJournal(runPath);\n\tlet readiness: WriterRecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingWorkMs: number | null = null;\n\ttry {\n\t\tremainingWorkMs = assertWriterRecoverable(runPath, snapshot);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingWorkMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"input_checkpoint_missing\":\n\t\t\t\treadiness = \"input_checkpoint_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_present\":\n\t\t\t\treadiness = \"candidate_present\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tcase \"model_request_limit\":\n\t\t\t\treadiness = \"model_request_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: \"lease_required\" });\n}\n\n/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */\nexport async function restartIsolatedWriter(\n\trunPath: string,\n\tcommand: RunWriterRestartCommand,\n\toptions: { readonly runtime?: VerifiedRunRuntime; readonly signal?: AbortSignal },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tif (first.contract.profile === \"linux-scripted-agent-v1\" && !options.runtime)\n\t\t\tthrow new VerifiedRunError(\"writer_backend_missing\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"writer_restarted\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\tconst state = journal.state;\n\t\tif (!state.budget || !state.inputDigest) throw new VerifiedRunError(\"integrity\");\n\t\tconst deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);\n\t\tconst base = loadCandidate(runPath, state.inputDigest, first.contract.budget);\n\t\tconst workspace = join(runPath, `writer-${state.generation}`);\n\t\tmaterializeCandidate(base, workspace);\n\t\tconst context = {\n\t\t\trunPath,\n\t\t\tcontract: first.contract,\n\t\t\tjournal,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t};\n\t\tawait executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });\n\t\tpublishWriterCandidate(context, workspace, deadline);\n\t\treturn verifyCandidate(context);\n\t});\n}\n"]}
+{"version":3,"file":"writer-recovery.js","sourceRoot":"","sources":["../../../src/core/verified-run/writer-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoBlD,SAAS,uBAAuB,CAAC,OAAe,EAAE,QAAyB,EAAU;IACpF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,KAAK,sBAAsB;QAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACtG,IACC,QAAQ,CAAC,OAAO,KAAK,yBAAyB;QAC9C,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAE7F,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC;AAAA,CACnB;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAA4B;IAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,GAA0C,OAAO,CAAC;IAC/D,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACJ,eAAe,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,QAAQ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,KAAK,iBAAiB;gBACrB,SAAS,GAAG,UAAU,CAAC;gBACvB,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,GAAG,SAAS,CAAC;gBACtB,eAAe,GAAG,CAAC,CAAC;gBACpB,MAAM;YACP,KAAK,0BAA0B;gBAC9B,SAAS,GAAG,0BAA0B,CAAC;gBACvC,MAAM;YACP,KAAK,mBAAmB;gBACvB,SAAS,GAAG,mBAAmB,CAAC;gBAChC,MAAM;YACP,KAAK,WAAW;gBACf,SAAS,GAAG,WAAW,CAAC;gBACxB,MAAM;YACP,KAAK,eAAe;gBACnB,SAAS,GAAG,eAAe,CAAC;gBAC5B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,gBAAgB;gBACpB,SAAS,GAAG,gBAAgB,CAAC;gBAC7B,MAAM;YACP,KAAK,qBAAqB;gBACzB,SAAS,GAAG,qBAAqB,CAAC;gBAClC,MAAM;YACP;gBACC,SAAS,GAAG,WAAW,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAAA,CACzG;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAe,EACf,OAAgC,EAChC,OAAmH,EAC1F;IACzB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3E,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QACzC,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,yBAAyB,IAAI,CAAC,OAAO,CAAC,OAAO;YAC3E,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACtD,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,oBAAoB,EAAE,CAAC;QACvB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO;YACP,UAAU,EAAE,YAAY,EAAE,CAAC,KAAK;YAChC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB;SACzD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9D,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG;YACf,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;QACF,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAAA,CAChC,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { join } from \"node:path\";\nimport { performance } from \"node:perf_hooks\";\nimport type { RunWriterRestartCommand } from \"omk-protocol\";\nimport type { RunAuthority } from \"./authority-runtime.ts\";\nimport { probeVerifiedSandbox } from \"./broker.ts\";\nimport { loadCandidate, materializeCandidate } from \"./candidate.ts\";\nimport { preflightCheckReceipts } from \"./check-receipt.ts\";\nimport type { JournalSnapshot } from \"./journal.ts\";\nimport { readRunClock, remainingRunTime } from \"./recovery-clock.ts\";\nimport { requireRunJournal, withRecoveryLease } from \"./recovery-command.ts\";\nimport type { RunProjection } from \"./run-types.ts\";\nimport type { VerifiedRunRuntime } from \"./session-port.ts\";\nimport { VerifiedRunError } from \"./storage.ts\";\nimport { verifyCandidate } from \"./verification-phase.ts\";\nimport { assertWorkRecoverable } from \"./work-recovery.ts\";\nimport { publishWriterCandidate } from \"./writer-completion.ts\";\nimport { executeWriter } from \"./writer-phase.ts\";\n\nexport interface WriterRecoveryInspection {\n\treadonly state: RunProjection;\n\treadonly readiness:\n\t\t| \"ready\"\n\t\t| \"terminal\"\n\t\t| \"input_checkpoint_missing\"\n\t\t| \"candidate_present\"\n\t\t| \"unsettled\"\n\t\t| \"expired\"\n\t\t| \"clock_changed\"\n\t\t| \"clock_rollback\"\n\t\t| \"recovery_limit\"\n\t\t| \"model_request_limit\"\n\t\t| \"integrity\";\n\treadonly remainingWorkMs: number | null;\n\treadonly ownership: \"lease_required\";\n}\n\nfunction assertWriterRecoverable(runPath: string, snapshot: JournalSnapshot): number {\n\tconst { contract, remainingMs } = assertWorkRecoverable(runPath, snapshot);\n\tif (contract.profile === \"linux-command-dag-v1\") throw new VerifiedRunError(\"task_recovery_required\");\n\tif (\n\t\tcontract.profile === \"linux-scripted-agent-v1\" &&\n\t\tcontract.writer.maxRequests - snapshot.state.modelRequests < contract.writer.steps.length + 1\n\t)\n\t\tthrow new VerifiedRunError(\"model_request_limit\");\n\treturn remainingMs;\n}\n\nexport function inspectWriterRecovery(runPath: string): WriterRecoveryInspection {\n\tconst snapshot = requireRunJournal(runPath);\n\tlet readiness: WriterRecoveryInspection[\"readiness\"] = \"ready\";\n\tlet remainingWorkMs: number | null = null;\n\ttry {\n\t\tremainingWorkMs = assertWriterRecoverable(runPath, snapshot);\n\t} catch (error) {\n\t\tif (!(error instanceof Error)) throw error;\n\t\tswitch (error instanceof VerifiedRunError ? error.code : \"integrity\") {\n\t\t\tcase \"resume_terminal\":\n\t\t\t\treadiness = \"terminal\";\n\t\t\t\tbreak;\n\t\t\tcase \"deadline\":\n\t\t\t\treadiness = \"expired\";\n\t\t\t\tremainingWorkMs = 0;\n\t\t\t\tbreak;\n\t\t\tcase \"input_checkpoint_missing\":\n\t\t\t\treadiness = \"input_checkpoint_missing\";\n\t\t\t\tbreak;\n\t\t\tcase \"candidate_present\":\n\t\t\t\treadiness = \"candidate_present\";\n\t\t\t\tbreak;\n\t\t\tcase \"unsettled\":\n\t\t\t\treadiness = \"unsettled\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_changed\":\n\t\t\t\treadiness = \"clock_changed\";\n\t\t\t\tbreak;\n\t\t\tcase \"clock_rollback\":\n\t\t\t\treadiness = \"clock_rollback\";\n\t\t\t\tbreak;\n\t\t\tcase \"recovery_limit\":\n\t\t\t\treadiness = \"recovery_limit\";\n\t\t\t\tbreak;\n\t\t\tcase \"model_request_limit\":\n\t\t\t\treadiness = \"model_request_limit\";\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treadiness = \"integrity\";\n\t\t}\n\t}\n\treturn Object.freeze({ state: snapshot.state, readiness, remainingWorkMs, ownership: \"lease_required\" });\n}\n\n/** Re-run isolated local work in a new copy. Never reuse an interrupted workspace or replenish a budget. */\nexport async function restartIsolatedWriter(\n\trunPath: string,\n\tcommand: RunWriterRestartCommand,\n\toptions: { readonly runtime?: VerifiedRunRuntime; readonly signal?: AbortSignal; readonly authority: RunAuthority },\n): Promise<RunProjection> {\n\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\treturn withRecoveryLease(runPath, command, async ({ snapshot, journal }) => {\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tconst first = snapshot.records[0]?.event;\n\t\tif (first?.kind !== \"created\") throw new VerifiedRunError(\"integrity\");\n\t\tif (first.contract.profile === \"linux-scripted-agent-v1\" && !options.runtime)\n\t\t\tthrow new VerifiedRunError(\"writer_backend_missing\");\n\t\tpreflightCheckReceipts(first.contract);\n\t\tprobeVerifiedSandbox();\n\t\tassertWriterRecoverable(runPath, snapshot);\n\t\tif (options.signal?.aborted) throw new VerifiedRunError(\"cancelled\");\n\t\tjournal.append({\n\t\t\tkind: \"writer_restarted\",\n\t\t\tcommand,\n\t\t\tobservedMs: readRunClock().nowMs,\n\t\t\treconciledExecutionIds: snapshot.state.activeExecutionIds,\n\t\t});\n\t\tconst state = journal.state;\n\t\tif (!state.budget || !state.inputDigest) throw new VerifiedRunError(\"integrity\");\n\t\tconst deadline = performance.now() + remainingRunTime(state.budget, state.budget.workDeadlineMs);\n\t\tconst base = loadCandidate(runPath, state.inputDigest, first.contract.budget);\n\t\tconst workspace = join(runPath, `writer-${state.generation}`);\n\t\tmaterializeCandidate(base, workspace);\n\t\tconst context = {\n\t\t\trunPath,\n\t\t\tcontract: first.contract,\n\t\t\tjournal,\n\t\t\tauthority: options.authority,\n\t\t\t...(options.signal ? { signal: options.signal } : {}),\n\t\t};\n\t\tawait executeWriter(context, { workspace, deadline, ...(options.runtime ? { runtime: options.runtime } : {}) });\n\t\tpublishWriterCandidate(context, workspace, deadline);\n\t\treturn verifyCandidate(context);\n\t});\n}\n"]}

package/dist/core/workload-shard-execution-types.d.ts

@@ -12,13 +12,14 @@
  */
 import type { ResourceAdmissionDecision } from "./resource-admission.ts";
 import type { WorkloadPermitPool } from "./workload-permit-pool.ts";
-import type { WorkloadShardPlan, WorkloadShardSpec } from "./workload-shard-plan.ts";
+import type { WorkloadShardPlan, WorkloadShardProjection, WorkloadShardSpec } from "./workload-shard-plan.ts";
 import type { WorkloadShardStore } from "./workload-shard-store.ts";
 export interface ShardRunContext {
     readonly shard: WorkloadShardSpec;
     readonly attempt: number;
     readonly signal?: AbortSignal;
 }
+/** Resolves only after its owned execution boundary terminates; rejection is unproven. */
 export type ShardRunner = (context: ShardRunContext) => Promise<{
     readonly exitCode: number;
     readonly evidenceRefs?: readonly string[];
@@ -34,6 +35,8 @@ export interface ExecuteWorkloadShardPlanInput {
     readonly retryFailed?: boolean;
     /** §13.4: aborted -> pending needs an explicit resume; this call is that act. Default true. */
     readonly resumeAborted?: boolean;
+    /** Trusted recovery witness for this exact shard attempt. Missing or unknown never rearms. */
+    readonly observeTermination?: (shard: WorkloadShardProjection) => "terminated" | "unknown" | Promise<"terminated" | "unknown">;
     readonly permitWaitTimeoutMs?: number;
     readonly now?: () => Date;
 }

package/dist/core/workload-shard-execution-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-shard-execution-types.d.ts","sourceRoot":"","sources":["../../src/core/workload-shard-execution-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,MAAM,WAAW,GAAG,CACzB,OAAO,EAAE,eAAe,KACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEvF,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,kFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,gGAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B","sourcesContent":["/**\n * Shard execution contract.\n *\n * These declarations describe the call the executor makes and the input it\n * takes. They lived in the executor, so the runner — which the executor calls\n * to advance one shard — had to import the executor back to name its own\n * parameter type. Moving the contract below both leaves the executor free to\n * depend on the runner without the runner depending on the executor.\n *\n * Types only. Imports stay on the plan, store, admission, and permit modules,\n * none of which reach the executor or the runner.\n */\n\nimport type { ResourceAdmissionDecision } from \"./resource-admission.ts\";\nimport type { WorkloadPermitPool } from \"./workload-permit-pool.ts\";\nimport type { WorkloadShardPlan, WorkloadShardSpec } from \"./workload-shard-plan.ts\";\nimport type { WorkloadShardStore } from \"./workload-shard-store.ts\";\n\nexport interface ShardRunContext {\n\treadonly shard: WorkloadShardSpec;\n\treadonly attempt: number;\n\treadonly signal?: AbortSignal;\n}\n\nexport type ShardRunner = (\n\tcontext: ShardRunContext,\n) => Promise<{ readonly exitCode: number; readonly evidenceRefs?: readonly string[] }>;\n\nexport interface ExecuteWorkloadShardPlanInput {\n\treadonly plan: WorkloadShardPlan;\n\treadonly store: WorkloadShardStore;\n\treadonly runner: ShardRunner;\n\treadonly decision: ResourceAdmissionDecision;\n\treadonly permitPool?: WorkloadPermitPool;\n\treadonly signal?: AbortSignal;\n\t/** §13.5 step 4 retry policy: re-arm previously failed shards. Default false. */\n\treadonly retryFailed?: boolean;\n\t/** §13.4: aborted -> pending needs an explicit resume; this call is that act. Default true. */\n\treadonly resumeAborted?: boolean;\n\treadonly permitWaitTimeoutMs?: number;\n\treadonly now?: () => Date;\n}\n"]}
+{"version":3,"file":"workload-shard-execution-types.d.ts","sourceRoot":"","sources":["../../src/core/workload-shard-execution-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,0FAA0F;AAC1F,MAAM,MAAM,WAAW,GAAG,CACzB,OAAO,EAAE,eAAe,KACpB,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEvF,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,kFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,gGAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC7B,KAAK,EAAE,uBAAuB,KAC1B,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAClE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B","sourcesContent":["/**\n * Shard execution contract.\n *\n * These declarations describe the call the executor makes and the input it\n * takes. They lived in the executor, so the runner — which the executor calls\n * to advance one shard — had to import the executor back to name its own\n * parameter type. Moving the contract below both leaves the executor free to\n * depend on the runner without the runner depending on the executor.\n *\n * Types only. Imports stay on the plan, store, admission, and permit modules,\n * none of which reach the executor or the runner.\n */\n\nimport type { ResourceAdmissionDecision } from \"./resource-admission.ts\";\nimport type { WorkloadPermitPool } from \"./workload-permit-pool.ts\";\nimport type { WorkloadShardPlan, WorkloadShardProjection, WorkloadShardSpec } from \"./workload-shard-plan.ts\";\nimport type { WorkloadShardStore } from \"./workload-shard-store.ts\";\n\nexport interface ShardRunContext {\n\treadonly shard: WorkloadShardSpec;\n\treadonly attempt: number;\n\treadonly signal?: AbortSignal;\n}\n\n/** Resolves only after its owned execution boundary terminates; rejection is unproven. */\nexport type ShardRunner = (\n\tcontext: ShardRunContext,\n) => Promise<{ readonly exitCode: number; readonly evidenceRefs?: readonly string[] }>;\n\nexport interface ExecuteWorkloadShardPlanInput {\n\treadonly plan: WorkloadShardPlan;\n\treadonly store: WorkloadShardStore;\n\treadonly runner: ShardRunner;\n\treadonly decision: ResourceAdmissionDecision;\n\treadonly permitPool?: WorkloadPermitPool;\n\treadonly signal?: AbortSignal;\n\t/** §13.5 step 4 retry policy: re-arm previously failed shards. Default false. */\n\treadonly retryFailed?: boolean;\n\t/** §13.4: aborted -> pending needs an explicit resume; this call is that act. Default true. */\n\treadonly resumeAborted?: boolean;\n\t/** Trusted recovery witness for this exact shard attempt. Missing or unknown never rearms. */\n\treadonly observeTermination?: (\n\t\tshard: WorkloadShardProjection,\n\t) => \"terminated\" | \"unknown\" | Promise<\"terminated\" | \"unknown\">;\n\treadonly permitWaitTimeoutMs?: number;\n\treadonly now?: () => Date;\n}\n"]}

package/dist/core/workload-shard-execution-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"workload-shard-execution-types.js","sourceRoot":"","sources":["../../src/core/workload-shard-execution-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG","sourcesContent":["/**\n * Shard execution contract.\n *\n * These declarations describe the call the executor makes and the input it\n * takes. They lived in the executor, so the runner — which the executor calls\n * to advance one shard — had to import the executor back to name its own\n * parameter type. Moving the contract below both leaves the executor free to\n * depend on the runner without the runner depending on the executor.\n *\n * Types only. Imports stay on the plan, store, admission, and permit modules,\n * none of which reach the executor or the runner.\n */\n\nimport type { ResourceAdmissionDecision } from \"./resource-admission.ts\";\nimport type { WorkloadPermitPool } from \"./workload-permit-pool.ts\";\nimport type { WorkloadShardPlan, WorkloadShardSpec } from \"./workload-shard-plan.ts\";\nimport type { WorkloadShardStore } from \"./workload-shard-store.ts\";\n\nexport interface ShardRunContext {\n\treadonly shard: WorkloadShardSpec;\n\treadonly attempt: number;\n\treadonly signal?: AbortSignal;\n}\n\nexport type ShardRunner = (\n\tcontext: ShardRunContext,\n) => Promise<{ readonly exitCode: number; readonly evidenceRefs?: readonly string[] }>;\n\nexport interface ExecuteWorkloadShardPlanInput {\n\treadonly plan: WorkloadShardPlan;\n\treadonly store: WorkloadShardStore;\n\treadonly runner: ShardRunner;\n\treadonly decision: ResourceAdmissionDecision;\n\treadonly permitPool?: WorkloadPermitPool;\n\treadonly signal?: AbortSignal;\n\t/** §13.5 step 4 retry policy: re-arm previously failed shards. Default false. */\n\treadonly retryFailed?: boolean;\n\t/** §13.4: aborted -> pending needs an explicit resume; this call is that act. Default true. */\n\treadonly resumeAborted?: boolean;\n\treadonly permitWaitTimeoutMs?: number;\n\treadonly now?: () => Date;\n}\n"]}
+{"version":3,"file":"workload-shard-execution-types.js","sourceRoot":"","sources":["../../src/core/workload-shard-execution-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG","sourcesContent":["/**\n * Shard execution contract.\n *\n * These declarations describe the call the executor makes and the input it\n * takes. They lived in the executor, so the runner — which the executor calls\n * to advance one shard — had to import the executor back to name its own\n * parameter type. Moving the contract below both leaves the executor free to\n * depend on the runner without the runner depending on the executor.\n *\n * Types only. Imports stay on the plan, store, admission, and permit modules,\n * none of which reach the executor or the runner.\n */\n\nimport type { ResourceAdmissionDecision } from \"./resource-admission.ts\";\nimport type { WorkloadPermitPool } from \"./workload-permit-pool.ts\";\nimport type { WorkloadShardPlan, WorkloadShardProjection, WorkloadShardSpec } from \"./workload-shard-plan.ts\";\nimport type { WorkloadShardStore } from \"./workload-shard-store.ts\";\n\nexport interface ShardRunContext {\n\treadonly shard: WorkloadShardSpec;\n\treadonly attempt: number;\n\treadonly signal?: AbortSignal;\n}\n\n/** Resolves only after its owned execution boundary terminates; rejection is unproven. */\nexport type ShardRunner = (\n\tcontext: ShardRunContext,\n) => Promise<{ readonly exitCode: number; readonly evidenceRefs?: readonly string[] }>;\n\nexport interface ExecuteWorkloadShardPlanInput {\n\treadonly plan: WorkloadShardPlan;\n\treadonly store: WorkloadShardStore;\n\treadonly runner: ShardRunner;\n\treadonly decision: ResourceAdmissionDecision;\n\treadonly permitPool?: WorkloadPermitPool;\n\treadonly signal?: AbortSignal;\n\t/** §13.5 step 4 retry policy: re-arm previously failed shards. Default false. */\n\treadonly retryFailed?: boolean;\n\t/** §13.4: aborted -> pending needs an explicit resume; this call is that act. Default true. */\n\treadonly resumeAborted?: boolean;\n\t/** Trusted recovery witness for this exact shard attempt. Missing or unknown never rearms. */\n\treadonly observeTermination?: (\n\t\tshard: WorkloadShardProjection,\n\t) => \"terminated\" | \"unknown\" | Promise<\"terminated\" | \"unknown\">;\n\treadonly permitWaitTimeoutMs?: number;\n\treadonly now?: () => Date;\n}\n"]}

package/dist/core/workload-shard-executor.d.ts

@@ -6,8 +6,8 @@ export type { ExecuteWorkloadShardPlanInput, ShardRunContext, ShardRunner };
  *
  * Drives a validated `WorkloadShardPlan` through the journalled §13.4 state
  * machine: passed shards are terminal and never re-run (§13.5 step 3),
- * crash-orphaned `running` shards are recovered through `pending` re-arm
- * records, concurrency is recomputed from the CURRENT admission decision
+ * crash-orphaned `running` shards require a trusted termination witness before
+ * re-arm; concurrency is recomputed from the CURRENT admission decision
  * (§13.5 step 6) plus the shared permit pool, and completion produces an
  * aggregate evidence receipt (§13.6) — an observation input for
  * `evaluateTask()`, never a task verdict by itself.

package/dist/core/workload-shard-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workload-shard-executor.d.ts","sourceRoot":"","sources":["../../src/core/workload-shard-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvH,OAAO,EAKN,KAAK,kBAAkB,EACvB,MAAM,0BAA0B,CAAC;AAMlC,YAAY,EAAE,6BAA6B,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAE5E;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,kEAAgE;AAChE,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,6BAA6B,GAClC,OAAO,CAAC,8BAA8B,CAAC,CAoFzC","sourcesContent":["import type { ExecuteWorkloadShardPlanInput, ShardRunContext, ShardRunner } from \"./workload-shard-execution-types.ts\";\nimport {\n\tplanShardResume,\n\treduceShardRecords,\n\tvalidateWorkloadShardPlan,\n\ttype WorkloadShardProjection,\n\ttype WorkloadShardState,\n} from \"./workload-shard-plan.ts\";\nimport { applyTransition, runOneShard, shardById } from \"./workload-shard-runner.ts\";\nimport { WorkloadShardJournalError, type WorkloadShardStore } from \"./workload-shard-store.ts\";\n\n// The contract lives in `workload-shard-execution-types.ts` so the runner can\n// name its own parameter type without importing this module back.\nexport type { ExecuteWorkloadShardPlanInput, ShardRunContext, ShardRunner };\n\n/**\n * Workload shard executor (OMK v0.97.x roadmap §13, M5 completion slice).\n *\n * Drives a validated `WorkloadShardPlan` through the journalled §13.4 state\n * machine: passed shards are terminal and never re-run (§13.5 step 3),\n * crash-orphaned `running` shards are recovered through `pending` re-arm\n * records, concurrency is recomputed from the CURRENT admission decision\n * (§13.5 step 6) plus the shared permit pool, and completion produces an\n * aggregate evidence receipt (§13.6) — an observation input for\n * `evaluateTask()`, never a task verdict by itself.\n *\n * Fail-closed rules (§21): a corrupt journal is quarantined and the run is\n * `blocked`; a journal written for a different plan is `blocked`; an invalid\n * plan never starts. The executor never rewrites shard commands (§12.3) —\n * it only runs what the plan's descriptors already describe via the\n * injected runner.\n */\n\nexport interface ShardResultSummary {\n\treadonly shardId: string;\n\treadonly state: WorkloadShardState;\n\treadonly attempt: number;\n\treadonly evidenceRefs: readonly string[];\n\treadonly reasonCode?: string;\n}\n\n/** §13.6 aggregate evidence receipt; §15.1 observation kind. */\nexport interface WorkloadShardAggregateEvidence {\n\treadonly kind: \"workload_shard_result.v1\";\n\treadonly planId: string;\n\treadonly promptRunId: string;\n\treadonly commandDigest: string;\n\treadonly strategy: string;\n\treadonly verdict: \"passed\" | \"failed\" | \"aborted\" | \"blocked\";\n\treadonly reasonCodes: readonly string[];\n\treadonly shardCount: number;\n\treadonly counts: Readonly<Record<WorkloadShardState, number>>;\n\treadonly shards: readonly ShardResultSummary[];\n\treadonly effectiveConcurrency: number;\n\treadonly completedAt: string;\n}\n\nexport async function executeWorkloadShardPlan(\n\tinput: ExecuteWorkloadShardPlanInput,\n): Promise<WorkloadShardAggregateEvidence> {\n\tconst now = input.now ?? (() => new Date());\n\tconst planErrors = validateWorkloadShardPlan(input.plan);\n\tif (planErrors.length > 0) {\n\t\treturn blockedEvidence(input, now, [\"plan.invalid\", ...planErrors.slice(0, 3)]);\n\t}\n\n\tlet journal: ReturnType<WorkloadShardStore[\"load\"]>;\n\ttry {\n\t\tjournal = input.store.load();\n\t} catch (error) {\n\t\t// §21 fail closed: corrupt evidence is quarantined, never silently rebuilt.\n\t\tif (error instanceof WorkloadShardJournalError) {\n\t\t\tinput.store.quarantine();\n\t\t\treturn blockedEvidence(input, now, [`journal.${error.code}`]);\n\t\t}\n\t\tthrow error;\n\t}\n\tif (journal.plan === null) {\n\t\tinput.store.appendPlan(input.plan);\n\t} else if (journal.plan.planId !== input.plan.planId || journal.plan.commandDigest !== input.plan.commandDigest) {\n\t\treturn blockedEvidence(input, now, [\"plan.mismatch\"]);\n\t}\n\n\tconst projections = new Map<string, WorkloadShardProjection>(\n\t\tjournal.projections ?? reduceShardRecords(input.plan, []),\n\t);\n\tconst effectiveConcurrency = Math.max(1, Math.min(input.plan.maxConcurrency, input.decision.maxHeavyProcesses));\n\n\t// §13.5 steps 2-4: re-arm recoverable shards through explicit pending records.\n\tconst resume = planShardResume(input.plan, projections);\n\tconst rearm = [\n\t\t...resume.interrupted,\n\t\t...(input.retryFailed ? resume.retryable : []),\n\t\t...((input.resumeAborted ?? true) ? resume.resumable : []),\n\t];\n\tfor (const shardId of rearm) {\n\t\t// §13.5 step 2: a crash-orphaned `running` shard is first projected as\n\t\t// interrupted (running -> pending is illegal in §13.4), then re-armed.\n\t\tif (projections.get(shardId)?.state === \"running\") {\n\t\t\tapplyTransition(input, projections, shardId, \"interrupted\", { reasonCode: \"recovery.orphaned\", now });\n\t\t}\n\t\tapplyTransition(input, projections, shardId, \"pending\", { reasonCode: \"recovery.rearm\", now });\n\t}\n\n\t// Dependency-wave scheduler: launch ready shards up to the recomputed width.\n\tconst remaining = new Set(\n\t\tinput.plan.shards.map((shard) => shard.shardId).filter((id) => projections.get(id)?.state !== \"passed\"),\n\t);\n\tlet active = 0;\n\tlet wake: (() => void) | undefined;\n\tconst waitTurn = () =>\n\t\tnew Promise<void>((resolve) => {\n\t\t\twake = resolve;\n\t\t});\n\tconst running = new Map<string, Promise<void>>();\n\n\twhile (remaining.size > 0 && !input.signal?.aborted) {\n\t\tconst ready = [...remaining].filter((id) => {\n\t\t\tconst projection = projections.get(id);\n\t\t\tif (projection?.state !== \"pending\") return false;\n\t\t\tconst spec = shardById(input.plan, id);\n\t\t\treturn spec.dependencyIds.every((dep) => projections.get(dep)?.state === \"passed\");\n\t\t});\n\t\tconst launchable = ready.slice(0, Math.max(0, effectiveConcurrency - active));\n\t\tif (launchable.length === 0) {\n\t\t\tif (running.size === 0) break; // deadlock = blocked dependents; aggregate reports them\n\t\t\tawait Promise.race([...running.values(), waitTurn()]);\n\t\t\tcontinue;\n\t\t}\n\t\tfor (const shardId of launchable) {\n\t\t\tremaining.delete(shardId);\n\t\t\tactive += 1;\n\t\t\tconst task = runOneShard(input, projections, shardId, now).finally(() => {\n\t\t\t\tactive -= 1;\n\t\t\t\trunning.delete(shardId);\n\t\t\t\twake?.();\n\t\t\t});\n\t\t\trunning.set(shardId, task);\n\t\t}\n\t}\n\tawait Promise.all(running.values());\n\n\treturn aggregate(input, projections, effectiveConcurrency, now, input.signal?.aborted ? [\"run.aborted\"] : []);\n}\n\nfunction aggregate(\n\tinput: ExecuteWorkloadShardPlanInput,\n\tprojections: ReadonlyMap<string, WorkloadShardProjection>,\n\teffectiveConcurrency: number,\n\tnow: () => Date,\n\textraReasons: readonly string[],\n): WorkloadShardAggregateEvidence {\n\tconst counts: Record<WorkloadShardState, number> = {\n\t\tpending: 0,\n\t\trunning: 0,\n\t\tpassed: 0,\n\t\tfailed: 0,\n\t\taborted: 0,\n\t\tinterrupted: 0,\n\t};\n\tconst shards: ShardResultSummary[] = input.plan.shards.map((shard) => {\n\t\tconst projection = projections.get(shard.shardId);\n\t\tconst state = projection?.state ?? \"pending\";\n\t\tcounts[state] += 1;\n\t\treturn {\n\t\t\tshardId: shard.shardId,\n\t\t\tstate,\n\t\t\tattempt: projection?.attempt ?? 0,\n\t\t\tevidenceRefs: projection?.evidenceRefs ?? [],\n\t\t\t...(projection?.reasonCode !== undefined ? { reasonCode: projection.reasonCode } : {}),\n\t\t};\n\t});\n\tconst verdict = aggregateVerdict(counts, input.plan.shards.length, extraReasons);\n\treturn {\n\t\tkind: \"workload_shard_result.v1\",\n\t\tplanId: input.plan.planId,\n\t\tpromptRunId: input.plan.promptRunId,\n\t\tcommandDigest: input.plan.commandDigest,\n\t\tstrategy: input.plan.strategy,\n\t\tverdict,\n\t\treasonCodes: extraReasons,\n\t\tshardCount: input.plan.shards.length,\n\t\tcounts,\n\t\tshards,\n\t\teffectiveConcurrency,\n\t\tcompletedAt: now().toISOString(),\n\t};\n}\n\nfunction blockedEvidence(\n\tinput: ExecuteWorkloadShardPlanInput,\n\tnow: () => Date,\n\treasonCodes: readonly string[],\n): WorkloadShardAggregateEvidence {\n\tconst counts: Record<WorkloadShardState, number> = {\n\t\tpending: input.plan.shards.length,\n\t\trunning: 0,\n\t\tpassed: 0,\n\t\tfailed: 0,\n\t\taborted: 0,\n\t\tinterrupted: 0,\n\t};\n\treturn {\n\t\tkind: \"workload_shard_result.v1\",\n\t\tplanId: input.plan.planId,\n\t\tpromptRunId: input.plan.promptRunId,\n\t\tcommandDigest: input.plan.commandDigest,\n\t\tstrategy: input.plan.strategy,\n\t\tverdict: \"blocked\",\n\t\treasonCodes,\n\t\tshardCount: input.plan.shards.length,\n\t\tcounts,\n\t\tshards: input.plan.shards.map((shard) => ({\n\t\t\tshardId: shard.shardId,\n\t\t\tstate: \"pending\" as const,\n\t\t\tattempt: 0,\n\t\t\tevidenceRefs: [],\n\t\t})),\n\t\teffectiveConcurrency: 0,\n\t\tcompletedAt: now().toISOString(),\n\t};\n}\n\n/** §13.6: \"passed\" requires EVERY shard to hold terminal passed evidence. */\nfunction aggregateVerdict(\n\tcounts: Readonly<Record<WorkloadShardState, number>>,\n\tshardCount: number,\n\textraReasons: readonly string[],\n): WorkloadShardAggregateEvidence[\"verdict\"] {\n\tif (counts.passed === shardCount) return \"passed\";\n\tif (counts.aborted > 0 || extraReasons.includes(\"run.aborted\")) return \"aborted\";\n\treturn \"failed\";\n}\n"]}
+{"version":3,"file":"workload-shard-executor.d.ts","sourceRoot":"","sources":["../../src/core/workload-shard-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvH,OAAO,EAKN,KAAK,kBAAkB,EACvB,MAAM,0BAA0B,CAAC;AAMlC,YAAY,EAAE,6BAA6B,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAE5E;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,kEAAgE;AAChE,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,6BAA6B,GAClC,OAAO,CAAC,8BAA8B,CAAC,CAwDzC","sourcesContent":["import type { ExecuteWorkloadShardPlanInput, ShardRunContext, ShardRunner } from \"./workload-shard-execution-types.ts\";\nimport { runShardFrontier } from \"./workload-shard-frontier.ts\";\nimport {\n\tplanShardResume,\n\treduceShardRecords,\n\tvalidateWorkloadShardPlan,\n\ttype WorkloadShardProjection,\n\ttype WorkloadShardState,\n} from \"./workload-shard-plan.ts\";\nimport { applyTransition } from \"./workload-shard-runner.ts\";\nimport { WorkloadShardJournalError, type WorkloadShardStore } from \"./workload-shard-store.ts\";\n\n// The contract lives in `workload-shard-execution-types.ts` so the runner can\n// name its own parameter type without importing this module back.\nexport type { ExecuteWorkloadShardPlanInput, ShardRunContext, ShardRunner };\n\n/**\n * Workload shard executor (OMK v0.97.x roadmap §13, M5 completion slice).\n *\n * Drives a validated `WorkloadShardPlan` through the journalled §13.4 state\n * machine: passed shards are terminal and never re-run (§13.5 step 3),\n * crash-orphaned `running` shards require a trusted termination witness before\n * re-arm; concurrency is recomputed from the CURRENT admission decision\n * (§13.5 step 6) plus the shared permit pool, and completion produces an\n * aggregate evidence receipt (§13.6) — an observation input for\n * `evaluateTask()`, never a task verdict by itself.\n *\n * Fail-closed rules (§21): a corrupt journal is quarantined and the run is\n * `blocked`; a journal written for a different plan is `blocked`; an invalid\n * plan never starts. The executor never rewrites shard commands (§12.3) —\n * it only runs what the plan's descriptors already describe via the\n * injected runner.\n */\n\nexport interface ShardResultSummary {\n\treadonly shardId: string;\n\treadonly state: WorkloadShardState;\n\treadonly attempt: number;\n\treadonly evidenceRefs: readonly string[];\n\treadonly reasonCode?: string;\n}\n\n/** §13.6 aggregate evidence receipt; §15.1 observation kind. */\nexport interface WorkloadShardAggregateEvidence {\n\treadonly kind: \"workload_shard_result.v1\";\n\treadonly planId: string;\n\treadonly promptRunId: string;\n\treadonly commandDigest: string;\n\treadonly strategy: string;\n\treadonly verdict: \"passed\" | \"failed\" | \"aborted\" | \"blocked\";\n\treadonly reasonCodes: readonly string[];\n\treadonly shardCount: number;\n\treadonly counts: Readonly<Record<WorkloadShardState, number>>;\n\treadonly shards: readonly ShardResultSummary[];\n\treadonly effectiveConcurrency: number;\n\treadonly completedAt: string;\n}\n\nexport async function executeWorkloadShardPlan(\n\tinput: ExecuteWorkloadShardPlanInput,\n): Promise<WorkloadShardAggregateEvidence> {\n\tconst now = input.now ?? (() => new Date());\n\tconst planErrors = validateWorkloadShardPlan(input.plan);\n\tif (planErrors.length > 0) {\n\t\treturn blockedEvidence(input, now, [\"plan.invalid\", ...planErrors.slice(0, 3)]);\n\t}\n\n\tlet journal: ReturnType<WorkloadShardStore[\"load\"]>;\n\ttry {\n\t\tjournal = input.store.load();\n\t} catch (error) {\n\t\t// §21 fail closed: corrupt evidence is quarantined, never silently rebuilt.\n\t\tif (error instanceof WorkloadShardJournalError) {\n\t\t\tinput.store.quarantine();\n\t\t\treturn blockedEvidence(input, now, [`journal.${error.code}`]);\n\t\t}\n\t\tthrow error;\n\t}\n\tif (journal.plan === null) {\n\t\tinput.store.appendPlan(input.plan);\n\t} else if (journal.plan.planId !== input.plan.planId || journal.plan.commandDigest !== input.plan.commandDigest) {\n\t\treturn blockedEvidence(input, now, [\"plan.mismatch\"]);\n\t}\n\n\tconst projections = new Map<string, WorkloadShardProjection>(\n\t\tjournal.projections ?? reduceShardRecords(input.plan, []),\n\t);\n\tconst cap = input.decision.maxHeavyProcesses;\n\tif (!Number.isSafeInteger(cap) || cap < 0) return blockedEvidence(input, now, [\"resource.invalid_capacity\"]);\n\tconst effectiveConcurrency = Math.min(input.plan.maxConcurrency, cap);\n\tif (effectiveConcurrency === 0) return aggregate(input, projections, 0, now, [\"resource.capacity_zero\"]);\n\n\t// §13.5 steps 2-4: re-arm recoverable shards through explicit pending records.\n\tconst resume = planShardResume(input.plan, projections);\n\tfor (const id of resume.interrupted) {\n\t\tconst shard = projections.get(id);\n\t\tif (!shard || (await input.observeTermination?.(shard)) !== \"terminated\")\n\t\t\treturn aggregate(input, projections, effectiveConcurrency, now, [\"recovery.termination_unproven\"]);\n\t}\n\tconst rearm = [\n\t\t...resume.interrupted,\n\t\t...(input.retryFailed ? resume.retryable : []),\n\t\t...((input.resumeAborted ?? true) ? resume.resumable : []),\n\t];\n\tfor (const shardId of rearm) {\n\t\t// §13.5 step 2: a crash-orphaned `running` shard is first projected as\n\t\t// interrupted (running -> pending is illegal in §13.4), then re-armed.\n\t\tif (projections.get(shardId)?.state === \"running\") {\n\t\t\tapplyTransition(input, projections, shardId, \"interrupted\", { reasonCode: \"recovery.orphaned\", now });\n\t\t}\n\t\tapplyTransition(input, projections, shardId, \"pending\", { reasonCode: \"recovery.rearm\", now });\n\t}\n\n\tawait runShardFrontier(input, projections, effectiveConcurrency, now);\n\n\treturn aggregate(input, projections, effectiveConcurrency, now, input.signal?.aborted ? [\"run.aborted\"] : []);\n}\n\nfunction aggregate(\n\tinput: ExecuteWorkloadShardPlanInput,\n\tprojections: ReadonlyMap<string, WorkloadShardProjection>,\n\teffectiveConcurrency: number,\n\tnow: () => Date,\n\textraReasons: readonly string[],\n): WorkloadShardAggregateEvidence {\n\tconst counts: Record<WorkloadShardState, number> = {\n\t\tpending: 0,\n\t\trunning: 0,\n\t\tpassed: 0,\n\t\tfailed: 0,\n\t\taborted: 0,\n\t\tinterrupted: 0,\n\t};\n\tconst shards: ShardResultSummary[] = input.plan.shards.map((shard) => {\n\t\tconst projection = projections.get(shard.shardId);\n\t\tconst state = projection?.state ?? \"pending\";\n\t\tcounts[state] += 1;\n\t\treturn {\n\t\t\tshardId: shard.shardId,\n\t\t\tstate,\n\t\t\tattempt: projection?.attempt ?? 0,\n\t\t\tevidenceRefs: projection?.evidenceRefs ?? [],\n\t\t\t...(projection?.reasonCode !== undefined ? { reasonCode: projection.reasonCode } : {}),\n\t\t};\n\t});\n\tconst verdict = aggregateVerdict(counts, input.plan.shards.length, extraReasons);\n\treturn {\n\t\tkind: \"workload_shard_result.v1\",\n\t\tplanId: input.plan.planId,\n\t\tpromptRunId: input.plan.promptRunId,\n\t\tcommandDigest: input.plan.commandDigest,\n\t\tstrategy: input.plan.strategy,\n\t\tverdict,\n\t\treasonCodes: extraReasons,\n\t\tshardCount: input.plan.shards.length,\n\t\tcounts,\n\t\tshards,\n\t\teffectiveConcurrency,\n\t\tcompletedAt: now().toISOString(),\n\t};\n}\n\nfunction blockedEvidence(\n\tinput: ExecuteWorkloadShardPlanInput,\n\tnow: () => Date,\n\treasonCodes: readonly string[],\n): WorkloadShardAggregateEvidence {\n\tconst counts: Record<WorkloadShardState, number> = {\n\t\tpending: input.plan.shards.length,\n\t\trunning: 0,\n\t\tpassed: 0,\n\t\tfailed: 0,\n\t\taborted: 0,\n\t\tinterrupted: 0,\n\t};\n\treturn {\n\t\tkind: \"workload_shard_result.v1\",\n\t\tplanId: input.plan.planId,\n\t\tpromptRunId: input.plan.promptRunId,\n\t\tcommandDigest: input.plan.commandDigest,\n\t\tstrategy: input.plan.strategy,\n\t\tverdict: \"blocked\",\n\t\treasonCodes,\n\t\tshardCount: input.plan.shards.length,\n\t\tcounts,\n\t\tshards: input.plan.shards.map((shard) => ({\n\t\t\tshardId: shard.shardId,\n\t\t\tstate: \"pending\" as const,\n\t\t\tattempt: 0,\n\t\t\tevidenceRefs: [],\n\t\t})),\n\t\teffectiveConcurrency: 0,\n\t\tcompletedAt: now().toISOString(),\n\t};\n}\n\n/** §13.6: \"passed\" requires EVERY shard to hold terminal passed evidence. */\nfunction aggregateVerdict(\n\tcounts: Readonly<Record<WorkloadShardState, number>>,\n\tshardCount: number,\n\textraReasons: readonly string[],\n): WorkloadShardAggregateEvidence[\"verdict\"] {\n\tif (counts.passed === shardCount) return \"passed\";\n\tif (extraReasons.some((reason) => reason.startsWith(\"resource.\") || reason.startsWith(\"recovery.\")))\n\t\treturn \"blocked\";\n\tif (counts.aborted > 0 || extraReasons.includes(\"run.aborted\")) return \"aborted\";\n\treturn \"failed\";\n}\n"]}