oxe-cc 0.9.3 → 1.2.1

package/lib/runtime/verification/verification-manifest.js

@@ -0,0 +1,129 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyFailure = classifyFailure;
+exports.buildManifest = buildManifest;
+exports.buildRiskLedger = buildRiskLedger;
+exports.saveManifest = saveManifest;
+exports.loadManifest = loadManifest;
+exports.saveRiskLedger = saveRiskLedger;
+exports.loadRiskLedger = loadRiskLedger;
+const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const PROFILE_REQUIRED_CHECKS = {
+    quick: ['deterministic'],
+    standard: ['deterministic', 'policy_failure'],
+    critical: ['deterministic', 'policy_failure', 'evidence_missing', 'flaky'],
+};
+function classifyFailure(result) {
+    if (result.status === 'pass' || result.status === 'skip')
+        return null;
+    if (result.error && (result.error.toLowerCase().includes('timeout') || result.error.toLowerCase().includes('timed out')))
+        return 'timeout';
+    if (result.exit_code === null && result.error)
+        return 'env_setup';
+    if (result.stderr.toLowerCase().includes('policy') || result.stderr.toLowerCase().includes('denied')) {
+        return 'policy_failure';
+    }
+    if (result.exit_code !== 0 && result.stderr === '' && result.stdout === '')
+        return 'evidence_missing';
+    // Default: non-deterministic signals (no reliable exit code pattern)
+    return 'deterministic';
+}
+function buildManifest(runId, results, options = {}) {
+    const profile = options.profile ?? 'standard';
+    const granularity = options.granularity ?? 'run';
+    const evidenceRefs = options.evidenceRefs ?? new Map();
+    const checks = results.map((r) => ({
+        check_id: r.check_id,
+        acceptance_ref: r.acceptance_ref,
+        status: r.status,
+        failure_class: classifyFailure(r),
+        evidence_refs: evidenceRefs.get(r.check_id) ?? [],
+        duration_ms: r.duration_ms,
+    }));
+    const summary = {
+        total: checks.length,
+        pass: checks.filter((c) => c.status === 'pass').length,
+        fail: checks.filter((c) => c.status === 'fail').length,
+        skip: checks.filter((c) => c.status === 'skip').length,
+        error: checks.filter((c) => c.status === 'error').length,
+        all_passed: checks.every((c) => c.status === 'pass' || c.status === 'skip'),
+    };
+    return {
+        manifest_id: `vm-${crypto_1.default.randomBytes(4).toString('hex')}`,
+        run_id: runId,
+        work_item_id: options.workItemId ?? null,
+        wave: options.wave ?? null,
+        granularity,
+        profile,
+        compiled_at: new Date().toISOString(),
+        checks,
+        summary,
+    };
+}
+function buildRiskLedger(runId, manifest) {
+    const risks = [];
+    for (const check of manifest.checks) {
+        if (check.status === 'pass' || check.status === 'skip')
+            continue;
+        if (!check.failure_class)
+            continue;
+        const required = PROFILE_REQUIRED_CHECKS[manifest.profile];
+        if (!required.includes(check.failure_class))
+            continue;
+        risks.push({
+            risk_id: `risk-${crypto_1.default.randomBytes(3).toString('hex')}`,
+            work_item_id: manifest.work_item_id,
+            check_id: check.check_id,
+            failure_class: check.failure_class,
+            description: `Check ${check.check_id} ${check.status}: ${check.failure_class}`,
+            severity: check.failure_class === 'policy_failure' || check.failure_class === 'deterministic'
+                ? 'high'
+                : check.failure_class === 'evidence_missing'
+                    ? 'medium'
+                    : 'low',
+            mitigation: null,
+        });
+    }
+    return {
+        run_id: runId,
+        generated_at: new Date().toISOString(),
+        risks,
+    };
+}
+function saveManifest(projectRoot, runId, manifest) {
+    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'verification-manifest.json');
+    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+    fs_1.default.writeFileSync(p, JSON.stringify(manifest, null, 2), 'utf8');
+}
+function loadManifest(projectRoot, runId) {
+    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'verification-manifest.json');
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveRiskLedger(projectRoot, runId, ledger) {
+    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'residual-risks.json');
+    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+    fs_1.default.writeFileSync(p, JSON.stringify(ledger, null, 2), 'utf8');
+}
+function loadRiskLedger(projectRoot, runId) {
+    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'residual-risks.json');
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}

package/lib/runtime/workspace/index.d.ts

@@ -0,0 +1,5 @@
+export * from './workspace-manager';
+export { InplaceWorkspaceManager } from './strategies/inplace';
+export { GitWorktreeManager } from './strategies/git-worktree';
+export { EphemeralContainerManager } from './strategies/ephemeral-container';
+export type { ContainerOptions } from './strategies/ephemeral-container';

package/lib/runtime/workspace/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EphemeralContainerManager = exports.GitWorktreeManager = exports.InplaceWorkspaceManager = void 0;
+__exportStar(require("./workspace-manager"), exports);
+var inplace_1 = require("./strategies/inplace");
+Object.defineProperty(exports, "InplaceWorkspaceManager", { enumerable: true, get: function () { return inplace_1.InplaceWorkspaceManager; } });
+var git_worktree_1 = require("./strategies/git-worktree");
+Object.defineProperty(exports, "GitWorktreeManager", { enumerable: true, get: function () { return git_worktree_1.GitWorktreeManager; } });
+var ephemeral_container_1 = require("./strategies/ephemeral-container");
+Object.defineProperty(exports, "EphemeralContainerManager", { enumerable: true, get: function () { return ephemeral_container_1.EphemeralContainerManager; } });

package/lib/runtime/workspace/strategies/ephemeral-container.d.ts

@@ -0,0 +1,22 @@
+import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
+import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
+export interface ContainerOptions {
+    image: string;
+    mountPath: string;
+    extraEnv?: Record<string, string>;
+    /** Gracefully fall back to git_worktree if Docker is unavailable */
+    fallback?: boolean;
+}
+export declare class EphemeralContainerManager implements WorkspaceManager {
+    private readonly projectRoot;
+    private readonly opts;
+    private readonly fallbackManager;
+    private containerIds;
+    private useFallback;
+    constructor(projectRoot: string, opts?: ContainerOptions);
+    get usingFallback(): boolean;
+    allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
+    snapshot(id: string): Promise<SnapshotRef>;
+    reset(id: string, snapRef: SnapshotRef): Promise<void>;
+    dispose(id: string): Promise<void>;
+}

package/lib/runtime/workspace/strategies/ephemeral-container.js

@@ -0,0 +1,109 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EphemeralContainerManager = void 0;
+const child_process_1 = require("child_process");
+const crypto_1 = __importDefault(require("crypto"));
+const git_worktree_1 = require("./git-worktree");
+function isDockerAvailable() {
+    const result = (0, child_process_1.spawnSync)('docker', ['version', '--format', '{{.Server.Version}}'], {
+        encoding: 'utf8',
+        timeout: 5000,
+    });
+    return result.status === 0;
+}
+class EphemeralContainerManager {
+    constructor(projectRoot, opts = { image: 'node:20-alpine', mountPath: '/workspace', fallback: true }) {
+        this.projectRoot = projectRoot;
+        this.opts = opts;
+        this.containerIds = new Map();
+        this.useFallback = false;
+        this.fallbackManager = new git_worktree_1.GitWorktreeManager(projectRoot);
+        if (!isDockerAvailable()) {
+            if (opts.fallback !== false) {
+                this.useFallback = true;
+            }
+            else {
+                throw new Error('Docker is not available and fallback is disabled');
+            }
+        }
+    }
+    get usingFallback() { return this.useFallback; }
+    async allocate(req) {
+        if (this.useFallback)
+            return this.fallbackManager.allocate(req);
+        const wsId = `ws-container-${req.work_item_id}-a${req.attempt_number}`;
+        const envArgs = Object.entries(this.opts.extraEnv ?? {}).flatMap(([k, v]) => ['-e', `${k}=${v}`]);
+        const result = (0, child_process_1.spawnSync)('docker', [
+            'run', '-d',
+            '-v', `${this.projectRoot}:${this.opts.mountPath}`,
+            '-w', this.opts.mountPath,
+            ...envArgs,
+            this.opts.image,
+            'sleep', '3600',
+        ], { encoding: 'utf8' });
+        if (result.status !== 0) {
+            if (this.opts.fallback !== false) {
+                this.useFallback = true;
+                return this.fallbackManager.allocate(req);
+            }
+            throw new Error(`docker run failed: ${result.stderr}`);
+        }
+        const containerId = result.stdout.trim().slice(0, 12);
+        this.containerIds.set(wsId, containerId);
+        return {
+            workspace_id: wsId,
+            strategy: 'ephemeral_container',
+            branch: null,
+            base_commit: null,
+            root_path: `docker:${containerId}:${this.opts.mountPath}`,
+            ttl_minutes: 60,
+        };
+    }
+    async snapshot(id) {
+        if (this.useFallback)
+            return this.fallbackManager.snapshot(id);
+        const containerId = this.containerIds.get(id);
+        if (!containerId)
+            throw new Error(`Container for workspace ${id} not found`);
+        const tag = `oxe-snap-${crypto_1.default.randomBytes(4).toString('hex')}`;
+        (0, child_process_1.execFileSync)('docker', ['commit', containerId, tag]);
+        return {
+            snapshot_id: tag,
+            workspace_id: id,
+            commit: tag,
+            created_at: new Date().toISOString(),
+        };
+    }
+    async reset(id, snapRef) {
+        if (this.useFallback)
+            return this.fallbackManager.reset(id, snapRef);
+        const containerId = this.containerIds.get(id);
+        if (!containerId)
+            return;
+        // Stop current container and start from snapshot
+        (0, child_process_1.spawnSync)('docker', ['stop', containerId]);
+        (0, child_process_1.spawnSync)('docker', ['rm', containerId]);
+        const result = (0, child_process_1.spawnSync)('docker', [
+            'run', '-d',
+            '-v', `${this.projectRoot}:${this.opts.mountPath}`,
+            snapRef.commit,
+            'sleep', '3600',
+        ], { encoding: 'utf8' });
+        const newId = result.stdout.trim().slice(0, 12);
+        this.containerIds.set(id, newId);
+    }
+    async dispose(id) {
+        if (this.useFallback)
+            return this.fallbackManager.dispose(id);
+        const containerId = this.containerIds.get(id);
+        if (!containerId)
+            return;
+        (0, child_process_1.spawnSync)('docker', ['stop', containerId], { encoding: 'utf8' });
+        (0, child_process_1.spawnSync)('docker', ['rm', containerId], { encoding: 'utf8' });
+        this.containerIds.delete(id);
+    }
+}
+exports.EphemeralContainerManager = EphemeralContainerManager;

package/lib/runtime/workspace/strategies/git-worktree.d.ts

@@ -0,0 +1,12 @@
+import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
+import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
+export declare class GitWorktreeManager implements WorkspaceManager {
+    private readonly projectRoot;
+    private leases;
+    constructor(projectRoot: string);
+    allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
+    snapshot(id: string): Promise<SnapshotRef>;
+    reset(id: string, snapRef: SnapshotRef): Promise<void>;
+    dispose(id: string): Promise<void>;
+    private git;
+}

package/lib/runtime/workspace/strategies/git-worktree.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitWorktreeManager = void 0;
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const crypto_1 = __importDefault(require("crypto"));
+class GitWorktreeManager {
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+        this.leases = new Map();
+    }
+    async allocate(req) {
+        const wsId = `ws-${req.work_item_id}-a${req.attempt_number}`;
+        const branch = `oxe/${req.work_item_id}-attempt${req.attempt_number}`;
+        const worktreePath = path_1.default.join(this.projectRoot, '.oxe', 'workspaces', wsId);
+        const baseCommit = this.git(['rev-parse', 'HEAD']).trim();
+        fs_1.default.mkdirSync(path_1.default.dirname(worktreePath), { recursive: true });
+        // Create worktree on a new branch starting from HEAD
+        this.git(['worktree', 'add', worktreePath, '-b', branch]);
+        const lease = {
+            workspace_id: wsId,
+            strategy: 'git_worktree',
+            branch,
+            base_commit: baseCommit,
+            root_path: worktreePath,
+            ttl_minutes: 45,
+        };
+        this.leases.set(wsId, lease);
+        return lease;
+    }
+    async snapshot(id) {
+        const lease = this.leases.get(id);
+        if (!lease || !lease.root_path)
+            throw new Error(`Workspace ${id} not found`);
+        const commit = this.git(['rev-parse', 'HEAD'], lease.root_path).trim();
+        return {
+            snapshot_id: `snap-${crypto_1.default.randomBytes(4).toString('hex')}`,
+            workspace_id: id,
+            commit,
+            created_at: new Date().toISOString(),
+        };
+    }
+    async reset(id, snapRef) {
+        const lease = this.leases.get(id);
+        if (!lease)
+            return;
+        this.git(['reset', '--hard', snapRef.commit], lease.root_path);
+    }
+    async dispose(id) {
+        const lease = this.leases.get(id);
+        if (!lease)
+            return;
+        try {
+            this.git(['worktree', 'remove', lease.root_path, '--force']);
+        }
+        catch {
+            // worktree may already be gone
+        }
+        try {
+            if (lease.branch)
+                this.git(['branch', '-D', lease.branch]);
+        }
+        catch {
+            // branch may already be deleted
+        }
+        this.leases.delete(id);
+    }
+    git(args, cwd) {
+        return (0, child_process_1.execFileSync)('git', args, {
+            cwd: cwd ?? this.projectRoot,
+            encoding: 'utf8',
+        });
+    }
+}
+exports.GitWorktreeManager = GitWorktreeManager;

package/lib/runtime/workspace/strategies/inplace.d.ts

@@ -0,0 +1,10 @@
+import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
+import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
+export declare class InplaceWorkspaceManager implements WorkspaceManager {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
+    snapshot(id: string): Promise<SnapshotRef>;
+    reset(_id: string, _snapRef: SnapshotRef): Promise<void>;
+    dispose(_id: string): Promise<void>;
+}

package/lib/runtime/workspace/strategies/inplace.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InplaceWorkspaceManager = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+class InplaceWorkspaceManager {
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    async allocate(req) {
+        return {
+            workspace_id: `ws-inplace-${req.work_item_id}-a${req.attempt_number}`,
+            strategy: 'inplace',
+            branch: null,
+            base_commit: null,
+            root_path: this.projectRoot,
+            ttl_minutes: 60,
+        };
+    }
+    async snapshot(id) {
+        return {
+            snapshot_id: `snap-${crypto_1.default.randomBytes(4).toString('hex')}`,
+            workspace_id: id,
+            commit: 'HEAD',
+            created_at: new Date().toISOString(),
+        };
+    }
+    async reset(_id, _snapRef) {
+        // inplace: no filesystem isolation — reset is a no-op
+    }
+    async dispose(_id) {
+        // inplace: nothing to tear down
+    }
+}
+exports.InplaceWorkspaceManager = InplaceWorkspaceManager;

package/lib/runtime/workspace/workspace-manager.d.ts

@@ -0,0 +1,13 @@
+import type { WorkspaceLease, SnapshotRef, WorkspaceStrategy } from '../models/workspace';
+export interface WorkspaceRequest {
+    work_item_id: string;
+    attempt_number: number;
+    strategy: WorkspaceStrategy;
+    mutation_scope: string[];
+}
+export interface WorkspaceManager {
+    allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
+    snapshot(id: string): Promise<SnapshotRef>;
+    reset(id: string, snapRef: SnapshotRef): Promise<void>;
+    dispose(id: string): Promise<void>;
+}

package/lib/runtime/workspace/workspace-manager.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/sdk/index.cjs

@@ -648,13 +648,20 @@ module.exports = {
     operationalPaths: operational.operationalPaths,
     appendEvent: operational.appendEvent,
     readEvents: operational.readEvents,
-    summarizeEvents: operational.summarizeEvents,
-    writeRunState: operational.writeRunState,
-    readRunState: operational.readRunState,
-    buildOperationalGraph: operational.buildOperationalGraph,
-    applyRuntimeAction: operational.applyRuntimeAction,
-    parseCapabilityManifest: operational.parseCapabilityManifest,
-    readCapabilityCatalog: operational.readCapabilityCatalog,
+    summarizeEvents: operational.summarizeEvents,
+    writeRunState: operational.writeRunState,
+    readRunState: operational.readRunState,
+    buildOperationalGraph: operational.buildOperationalGraph,
+    serializeCanonicalState: operational.serializeCanonicalState,
+    hydrateCanonicalState: operational.hydrateCanonicalState,
+    reduceCanonicalRunState: operational.reduceCanonicalRunState,
+    compileExecutionGraphFromArtifacts: operational.compileExecutionGraphFromArtifacts,
+    compileVerificationSuiteFromArtifacts: operational.compileVerificationSuiteFromArtifacts,
+    projectRuntimeArtifacts: operational.projectRuntimeArtifacts,
+    runRuntimeCiChecks: operational.runRuntimeCiChecks,
+    applyRuntimeAction: operational.applyRuntimeAction,
+    parseCapabilityManifest: operational.parseCapabilityManifest,
+    readCapabilityCatalog: operational.readCapabilityCatalog,
     buildMemoryLayers: operational.buildMemoryLayers,
     replayEvents: operational.replayEvents,
   },
@@ -735,3 +742,13 @@ module.exports = {
   /** Um único objeto com verificações tipo `doctor` + relatório de saúde. */
   runDoctorChecks,
 };
+
+
+// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
+// The compiled runtime lives at lib/runtime/ alongside this file.
+try {
+  const runtime = require('../runtime/index.js');
+  Object.assign(module.exports, runtime);
+} catch {
+  // Runtime not built yet — safe to skip during development
+}

package/lib/sdk/index.d.ts

@@ -573,13 +573,20 @@ export interface OxeSdk {
     operationalPaths: (projectRoot: string, activeSession: string | null) => Record<string, string | null>;
     appendEvent: (projectRoot: string, activeSession: string | null, event?: Record<string, unknown>) => Record<string, unknown>;
     readEvents: (projectRoot: string, activeSession: string | null) => Array<Record<string, unknown>>;
-    summarizeEvents: (events: Array<Record<string, unknown>>) => Record<string, unknown>;
-    writeRunState: (projectRoot: string, activeSession: string | null, runState?: Record<string, unknown>) => Record<string, unknown>;
-    readRunState: (projectRoot: string, activeSession: string | null) => Record<string, unknown> | null;
-    buildOperationalGraph: (runState?: Record<string, unknown>) => { nodes: Array<Record<string, unknown>>; edges: Array<Record<string, unknown>> };
-    applyRuntimeAction: (projectRoot: string, activeSession: string | null, input?: Record<string, unknown>) => Record<string, unknown>;
-    parseCapabilityManifest: (text: string) => Record<string, unknown>;
-    readCapabilityCatalog: (projectRoot: string) => Array<Record<string, unknown>>;
+    summarizeEvents: (events: Array<Record<string, unknown>>) => Record<string, unknown>;
+    writeRunState: (projectRoot: string, activeSession: string | null, runState?: Record<string, unknown>) => Record<string, unknown>;
+    readRunState: (projectRoot: string, activeSession: string | null) => Record<string, unknown> | null;
+    buildOperationalGraph: (runState?: Record<string, unknown>) => { nodes: Array<Record<string, unknown>>; edges: Array<Record<string, unknown>> };
+    serializeCanonicalState: (state: unknown) => Record<string, unknown> | null;
+    hydrateCanonicalState: (serialized: unknown) => Record<string, unknown>;
+    reduceCanonicalRunState: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown> | null;
+    compileExecutionGraphFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    compileVerificationSuiteFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    projectRuntimeArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    runRuntimeCiChecks: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    applyRuntimeAction: (projectRoot: string, activeSession: string | null, input?: Record<string, unknown>) => Record<string, unknown>;
+    parseCapabilityManifest: (text: string) => Record<string, unknown>;
+    readCapabilityCatalog: (projectRoot: string) => Array<Record<string, unknown>>;
     buildMemoryLayers: (projectRoot: string, activeSession: string | null) => Record<string, unknown>;
     replayEvents: (projectRoot: string, activeSession: string | null, options?: {
       fromEventId?: string;
@@ -631,3 +638,6 @@ export interface OxeSdk {
 
 declare const sdk: OxeSdk;
 export = sdk;
+
+// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
+export * from '../runtime/index';

package/oxe/workflows/ask.md

@@ -1,5 +1,9 @@
 # OXE — Workflow: ask
 
+> **[DEPRECATED v1.1.0]** Este comando foi incorporado por `/oxe`.
+> Use: `/oxe "sua pergunta"` ou simplesmente `/oxe` para o próximo passo.
+> Este alias continuará funcionando nesta versão por compatibilidade.
+
 <objective>
 Responder perguntas sobre a situação atual do trabalho OXE com máxima robustez, usando o contexto real do repositório, a sessão ativa quando existir, e os artefatos mais recentes da trilha.
 </objective>

package/oxe/workflows/checkpoint.md

@@ -1,7 +1,11 @@
 # OXE — Workflow: checkpoint
 
+> **[DEPRECATED v1.1.0]** Este comando foi incorporado por `/oxe-execute`.
+> Use: `/oxe-execute --checkpoint "<nome>"` para criar snapshot nomeado da sessão.
+> Este alias continuará funcionando nesta versão por compatibilidade.
+
 <objective>
-Criar um **marco nomeado em disco** em `checkpoints/YYYY-MM-DD-HHmm-<slug>.md` do escopo resolvido e atualizar `CHECKPOINTS.md` correspondente (índice): **snapshot da sessão / trilha corrente** para pausar e retomar sem apagar SPEC/PLAN.
+Criar um **marco nomeado em disco** em `checkpoints/YYYY-MM-DD-HHmm-<slug>.md` do escopo resolvido e atualizar `CHECKPOINTS.md` correspondente (índice): **snapshot da sessão / trilha corrente** para pausar e retomar sem apagar SPEC/PLAN.
 
 **Não** duplica o papel de `git commit` nem de `verify`; é **registo explícito** para humanos e agentes. Para **atualizar o mapa do projeto inteiro** e alinhar `.oxe/codebase/` ao código, usar **`compact.md`** (`/oxe-compact`), não este passo.
 </objective>
@@ -9,25 +13,25 @@ Criar um **marco nomeado em disco** em `checkpoints/YYYY-MM-DD-HHmm-<slug>.md` d
 <context>
 - **Checkpoint vs compact** e **momentos chave** da rotina: tabelas canónicas em **`help.md`** (secções *Checkpoint vs compact* e *Momentos chave*) — evitar divergência; este ficheiro descreve só a execução do checkpoint.
 
-- Entrada: texto do utilizador = **slug** e/ou **nota** (ex.: `antes-refactor-auth` + “estado estável, falta T4”).
-- Nome do ficheiro: **`YYYY-MM-DD-HHmm-<slug-kebab>.md`** (hora 24h local ou UTC — documentar na nota se misturar fusos).
-- Frontmatter YAML no checkpoint (ver `oxe/templates/CHECKPOINT.template.md`): `created`, `slug`, `linked` (lista de paths relativos à raiz do repo, tipicamente `.oxe/STATE.md`, `.oxe/SPEC.md`, …).
-- Resolver `active_session` conforme `oxe/workflows/references/session-path-resolution.md`. Com sessão ativa, checkpoints vivem em `.oxe/<active_session>/checkpoints/`; sem sessão ativa, usar `.oxe/checkpoints/`.
-- **Índice** `CHECKPOINTS.md` do mesmo escopo: tabela **mais recente primeiro** com colunas **Data** | **Ficheiro** | **Slug** | **Nota (1 linha)**.
+- Entrada: texto do utilizador = **slug** e/ou **nota** (ex.: `antes-refactor-auth` + “estado estável, falta T4”).
+- Nome do ficheiro: **`YYYY-MM-DD-HHmm-<slug-kebab>.md`** (hora 24h local ou UTC — documentar na nota se misturar fusos).
+- Frontmatter YAML no checkpoint (ver `oxe/templates/CHECKPOINT.template.md`): `created`, `slug`, `linked` (lista de paths relativos à raiz do repo, tipicamente `.oxe/STATE.md`, `.oxe/SPEC.md`, …).
+- Resolver `active_session` conforme `oxe/workflows/references/session-path-resolution.md`. Com sessão ativa, checkpoints vivem em `.oxe/<active_session>/checkpoints/`; sem sessão ativa, usar `.oxe/checkpoints/`.
+- **Índice** `CHECKPOINTS.md` do mesmo escopo: tabela **mais recente primeiro** com colunas **Data** | **Ficheiro** | **Slug** | **Nota (1 linha)**.
 - Não mover nem apagar artefactos canónicos; o checkpoint é **documento adicional**.
 </context>
 
 <process>
-1. Garantir pasta `checkpoints/` do escopo resolvido.
+1. Garantir pasta `checkpoints/` do escopo resolvido.
 2. Normalizar slug a partir dos argumentos do utilizador (kebab-case, ASCII; se vazio, usar `checkpoint`).
 3. Escolher nome único; se colisão, acrescentar sufixo `-b`, `-c`, …
 4. Escrever o ficheiro de checkpoint a partir do template: preencher frontmatter `linked` com os `.oxe/*.md` relevantes que **existem**; corpo com nota do utilizador e **snapshot** (trecho de STATE, uma linha de objetivo SPEC, resumo PLAN).
-5. Se `CHECKPOINTS.md` do escopo resolvido não existir, criar com título `# OXE — Índice de checkpoints` e tabela com cabeçalho; senão, **inserir linha no topo** da tabela.
+5. Se `CHECKPOINTS.md` do escopo resolvido não existir, criar com título `# OXE — Índice de checkpoints` e tabela com cabeçalho; senão, **inserir linha no topo** da tabela.
 6. Responder no chat: caminho do ficheiro novo + como usar na retomada (ler checkpoint + `linked` + próximo `oxe:*`).
 </process>
 
 <success_criteria>
-- [ ] Novo ficheiro em `checkpoints/` do escopo correto com frontmatter e corpo úteis.
-- [ ] `CHECKPOINTS.md` do mesmo escopo atualizado com entrada correspondente.
+- [ ] Novo ficheiro em `checkpoints/` do escopo correto com frontmatter e corpo úteis.
+- [ ] `CHECKPOINTS.md` do mesmo escopo atualizado com entrada correspondente.
 - [ ] SPEC/PLAN/VERIFY intocados salvo o utilizador pedir outra coisa explicitamente.
 </success_criteria>

package/oxe/workflows/debug.md

@@ -1,37 +1,41 @@
 # OXE — Workflow: debug
 
+> **[DEPRECATED v1.1.0]** Este comando foi incorporado por `/oxe-execute`.
+> Use: `/oxe-execute --debug` para ativar diagnóstico técnico explícito.
+> Este alias continuará funcionando nesta versão por compatibilidade.
+
 <objective>
 Orientar **investigação técnica** de um sintoma (teste a falhar, erro em runtime, flake, regressão) **durante** a execução de tarefas do `PLAN.md` ou passos do `QUICK.md`: ciclo **hipótese → experiência mínima → evidência → próximo passo**.
 
 Diferente de **`verify`**, que audita **aceite** contra SPEC/PLAN. Depois de estabilizar com debug, a trilha continua com **`execute`** e, no fecho, **`verify`**.
 </objective>
 
-<context>
-- Aplicar `oxe/workflows/references/reasoning-execution.md`. O debug deve partir de evidência real, testar hipóteses pequenas e fechar com próximo passo único.
-- Pré-requisito: sintoma reproduzível ou descrição clara (mensagem de erro, Tn em falha).
-- Preferir ancorar ao identificador de tarefa **`Tn`** do `PLAN.md` do escopo resolvido quando existir.
-- Resolver `active_session` conforme `oxe/workflows/references/session-path-resolution.md`. Com sessão ativa, usar `.oxe/<active_session>/execution/DEBUG.md`; sem sessão ativa, usar `.oxe/DEBUG.md`.
-- Artefato: **`DEBUG.md`** no escopo correto — ficheiro único com **sessões** datadas (append); não dispersar em vários ficheiros sem convenção.
+<context>
+- Aplicar `oxe/workflows/references/reasoning-execution.md`. O debug deve partir de evidência real, testar hipóteses pequenas e fechar com próximo passo único.
+- Pré-requisito: sintoma reproduzível ou descrição clara (mensagem de erro, Tn em falha).
+- Preferir ancorar ao identificador de tarefa **`Tn`** do `PLAN.md` do escopo resolvido quando existir.
+- Resolver `active_session` conforme `oxe/workflows/references/session-path-resolution.md`. Com sessão ativa, usar `.oxe/<active_session>/execution/DEBUG.md`; sem sessão ativa, usar `.oxe/DEBUG.md`.
+- Artefato: **`DEBUG.md`** no escopo correto — ficheiro único com **sessões** datadas (append); não dispersar em vários ficheiros sem convenção.
 </context>
 
 <process>
-1. Ler `PLAN.md` do escopo resolvido e `.oxe/STATE.md`; se o foco for uma tarefa, localizar **Tn** e o bloco **Verificar**.
-2. Registar em **`DEBUG.md`** do escopo resolvido uma nova sessão:
+1. Ler `PLAN.md` do escopo resolvido e `.oxe/STATE.md`; se o foco for uma tarefa, localizar **Tn** e o bloco **Verificar**.
+2. Registar em **`DEBUG.md`** do escopo resolvido uma nova sessão:
    - **Data** / **Sintoma** (com stack ou comando que falhou).
    - **Hipóteses** (ordenadas por plausibilidade).
    - **Experiências** — o que foi tentado e resultado (uma linha cada).
    - **Evidência atual** — ficheiros, linhas, conclusão parcial.
    - **Próximo passo:** `execute` (continuar correção) | `discuss` (decisão técnica em grupo) | `spec` ou `plan` (requisito ambíguo ou impossível como escrito).
 3. Se a causa for **requisito errado**, documentar em DEBUG e recomendar **`/oxe-spec`** ou **`/oxe-plan`** (e opcionalmente **`/oxe-discuss`**).
-4. Resumo no chat em ≤8 linhas, nesta ordem:
-   - **Contexto lido**
-   - **Hipótese principal**
-   - **Evidência atual**
-   - **Próximo passo**
-</process>
+4. Resumo no chat em ≤8 linhas, nesta ordem:
+   - **Contexto lido**
+   - **Hipótese principal**
+   - **Evidência atual**
+   - **Próximo passo**
+</process>
 
 <success_criteria>
-- [ ] `DEBUG.md` no escopo correto contém sessão datada com sintoma e **Próximo passo** explícito.
+- [ ] `DEBUG.md` no escopo correto contém sessão datada com sintoma e **Próximo passo** explícito.
 - [ ] Quando aplicável, a sessão referencia **Tn** do PLAN.
 - [ ] Não se confunde com verify: não se declara “entrega aprovada” só com debug.
 </success_criteria>