oxe-cc 1.2.1 → 1.3.0

package/lib/runtime/verification/verification-manifest.js

@@ -6,13 +6,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyFailure = classifyFailure;
 exports.buildManifest = buildManifest;
 exports.buildRiskLedger = buildRiskLedger;
+exports.summarizeEvidenceCoverage = summarizeEvidenceCoverage;
 exports.saveManifest = saveManifest;
 exports.loadManifest = loadManifest;
 exports.saveRiskLedger = saveRiskLedger;
 exports.loadRiskLedger = loadRiskLedger;
+exports.saveEvidenceCoverage = saveEvidenceCoverage;
+exports.loadEvidenceCoverage = loadEvidenceCoverage;
 const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+function runDir(projectRoot, runId) {
+    return path_1.default.join(projectRoot, '.oxe', 'runs', runId);
+}
+function manifestPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'verification-manifest.json');
+}
+function riskLedgerPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'residual-risk-ledger.json');
+}
+function legacyRiskLedgerPath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'residual-risks.json');
+}
+function evidenceCoveragePath(projectRoot, runId) {
+    return path_1.default.join(runDir(projectRoot, runId), 'evidence-coverage.json');
+}
 const PROFILE_REQUIRED_CHECKS = {
     quick: ['deterministic'],
     standard: ['deterministic', 'policy_failure'],
@@ -95,13 +113,25 @@ function buildRiskLedger(runId, manifest) {
         risks,
     };
 }
+function summarizeEvidenceCoverage(manifest) {
+    const totalChecks = manifest.checks.length;
+    const checksWithEvidence = manifest.checks.filter((check) => check.evidence_refs.length > 0).length;
+    const totalEvidenceRefs = manifest.checks.reduce((sum, check) => sum + check.evidence_refs.length, 0);
+    const coveragePercent = totalChecks === 0 ? 100 : Math.round((checksWithEvidence / totalChecks) * 100);
+    return {
+        total_checks: totalChecks,
+        checks_with_evidence: checksWithEvidence,
+        total_evidence_refs: totalEvidenceRefs,
+        coverage_percent: coveragePercent,
+    };
+}
 function saveManifest(projectRoot, runId, manifest) {
-    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'verification-manifest.json');
+    const p = manifestPath(projectRoot, runId);
     fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
     fs_1.default.writeFileSync(p, JSON.stringify(manifest, null, 2), 'utf8');
 }
 function loadManifest(projectRoot, runId) {
-    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'verification-manifest.json');
+    const p = manifestPath(projectRoot, runId);
     if (!fs_1.default.existsSync(p))
         return null;
     try {
@@ -112,12 +142,32 @@ function loadManifest(projectRoot, runId) {
     }
 }
 function saveRiskLedger(projectRoot, runId, ledger) {
-    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'residual-risks.json');
-    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
-    fs_1.default.writeFileSync(p, JSON.stringify(ledger, null, 2), 'utf8');
+    const canonical = riskLedgerPath(projectRoot, runId);
+    const legacy = legacyRiskLedgerPath(projectRoot, runId);
+    fs_1.default.mkdirSync(path_1.default.dirname(canonical), { recursive: true });
+    fs_1.default.writeFileSync(canonical, JSON.stringify(ledger, null, 2), 'utf8');
+    fs_1.default.writeFileSync(legacy, JSON.stringify(ledger, null, 2), 'utf8');
 }
 function loadRiskLedger(projectRoot, runId) {
-    const p = path_1.default.join(projectRoot, '.oxe', 'runs', runId, 'residual-risks.json');
+    const canonical = riskLedgerPath(projectRoot, runId);
+    const legacy = legacyRiskLedgerPath(projectRoot, runId);
+    const p = fs_1.default.existsSync(canonical) ? canonical : legacy;
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveEvidenceCoverage(projectRoot, runId, coverage) {
+    const p = evidenceCoveragePath(projectRoot, runId);
+    fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+    fs_1.default.writeFileSync(p, JSON.stringify(coverage, null, 2), 'utf8');
+}
+function loadEvidenceCoverage(projectRoot, runId) {
+    const p = evidenceCoveragePath(projectRoot, runId);
     if (!fs_1.default.existsSync(p))
         return null;
     try {

package/lib/runtime/workspace/strategies/ephemeral-container.d.ts

@@ -14,6 +14,7 @@ export declare class EphemeralContainerManager implements WorkspaceManager {
     private containerIds;
     private useFallback;
     constructor(projectRoot: string, opts?: ContainerOptions);
+    get isolation_level(): 'shared' | 'isolated';
     get usingFallback(): boolean;
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;

package/lib/runtime/workspace/strategies/ephemeral-container.js

@@ -30,6 +30,9 @@ class EphemeralContainerManager {
             }
         }
     }
+    get isolation_level() {
+        return this.useFallback ? this.fallbackManager.isolation_level : 'isolated';
+    }
     get usingFallback() { return this.useFallback; }
     async allocate(req) {
         if (this.useFallback)
@@ -56,6 +59,7 @@ class EphemeralContainerManager {
         return {
             workspace_id: wsId,
             strategy: 'ephemeral_container',
+            isolation_level: this.isolation_level,
             branch: null,
             base_commit: null,
             root_path: `docker:${containerId}:${this.opts.mountPath}`,

package/lib/runtime/workspace/strategies/git-worktree.d.ts

@@ -2,6 +2,7 @@ import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
 import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
 export declare class GitWorktreeManager implements WorkspaceManager {
     private readonly projectRoot;
+    readonly isolation_level: "isolated";
     private leases;
     constructor(projectRoot: string);
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;

package/lib/runtime/workspace/strategies/git-worktree.js

@@ -11,6 +11,7 @@ const crypto_1 = __importDefault(require("crypto"));
 class GitWorktreeManager {
     constructor(projectRoot) {
         this.projectRoot = projectRoot;
+        this.isolation_level = 'isolated';
         this.leases = new Map();
     }
     async allocate(req) {
@@ -24,6 +25,7 @@ class GitWorktreeManager {
         const lease = {
             workspace_id: wsId,
             strategy: 'git_worktree',
+            isolation_level: this.isolation_level,
             branch,
             base_commit: baseCommit,
             root_path: worktreePath,

package/lib/runtime/workspace/strategies/inplace.d.ts

@@ -2,6 +2,7 @@ import type { WorkspaceManager, WorkspaceRequest } from '../workspace-manager';
 import type { WorkspaceLease, SnapshotRef } from '../../models/workspace';
 export declare class InplaceWorkspaceManager implements WorkspaceManager {
     private readonly projectRoot;
+    readonly isolation_level: "shared";
     constructor(projectRoot: string);
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;

package/lib/runtime/workspace/strategies/inplace.js

@@ -8,11 +8,13 @@ const crypto_1 = __importDefault(require("crypto"));
 class InplaceWorkspaceManager {
     constructor(projectRoot) {
         this.projectRoot = projectRoot;
+        this.isolation_level = 'shared';
     }
     async allocate(req) {
         return {
             workspace_id: `ws-inplace-${req.work_item_id}-a${req.attempt_number}`,
             strategy: 'inplace',
+            isolation_level: this.isolation_level,
             branch: null,
             base_commit: null,
             root_path: this.projectRoot,

package/lib/runtime/workspace/workspace-manager.d.ts

@@ -1,4 +1,4 @@
-import type { WorkspaceLease, SnapshotRef, WorkspaceStrategy } from '../models/workspace';
+import type { WorkspaceLease, SnapshotRef, WorkspaceStrategy, WorkspaceIsolationLevel } from '../models/workspace';
 export interface WorkspaceRequest {
     work_item_id: string;
     attempt_number: number;
@@ -6,6 +6,7 @@ export interface WorkspaceRequest {
     mutation_scope: string[];
 }
 export interface WorkspaceManager {
+    readonly isolation_level: WorkspaceIsolationLevel;
     allocate(req: WorkspaceRequest): Promise<WorkspaceLease>;
     snapshot(id: string): Promise<SnapshotRef>;
     reset(id: string, snapRef: SnapshotRef): Promise<void>;

package/lib/sdk/README.md

@@ -47,21 +47,21 @@ const { options, warnings: w } = oxe.install.resolveOptionsFromConfig(dir, {
 | **health** | `loadOxeConfigMerged`, `validateConfigShape`, `buildHealthReport`, `suggestNextStep`, `oxePaths`, constantes de config |
 | **workflows** | `resolveWorkflowsDir`, `listWorkflowMdFiles`, `diffWorkflows`, `validateWorkflowShapes` (avisos `WORKFLOW_SHAPE`) |
 | **install** | `resolveOptionsFromConfig` |
-| **manifest** | `loadFileManifest`, `writeFileManifest`, `sha256File`, `collectFilesRecursive` |
-| **agents** | `adjustWorkflowPathsForNestedLayout`, `parseCursorCommandFrontmatter` |
-| **azure** | `azurePaths`, `detectAzureCli`, `loadAzureProfile`, `syncAzureInventory`, `planAzureOperation`, `applyAzureOperation`, `azureDoctor` |
-| **doctor** | `runDoctorChecks` — resultado estruturado (erros + avisos + diff de workflows + `workflowShape` com lint leve dos `.md`) |
+| **manifest** | `loadFileManifest`, `writeFileManifest`, `sha256File`, `collectFilesRecursive` |
+| **agents** | `adjustWorkflowPathsForNestedLayout`, `parseCursorCommandFrontmatter` |
+| **azure** | `azurePaths`, `detectAzureCli`, `loadAzureProfile`, `syncAzureInventory`, `planAzureOperation`, `applyAzureOperation`, `azureDoctor` |
+| **doctor** | `runDoctorChecks` — resultado estruturado (erros + avisos + diff de workflows + `workflowShape` com lint leve dos `.md`) |
 
 TypeScript: ver `index.d.ts` junto deste ficheiro.
 
 ## `health.buildHealthReport` e `parseLastCompactDate`
 
 - **`parseLastCompactDate(stateText)`** — lê a data em **`.oxe/STATE.md`** na secção **Último compact** (mesma convenção que **Último scan**). Devolve `Date | null` se a linha for placeholder ou ilegível.
-- **`buildHealthReport(projectRoot)`** — agrega fase, datas, avisos de SPEC/PLAN/VERIFY e o próximo passo sugerido. Campos usados em CI e em `oxe-cc status --json`:
-  - **`scanDate`**, **`stale`** — último scan e idade face a `scan_max_age_days` (`stale: { stale, days }`).
-  - **`compactDate`**, **`staleCompact`** — último compact e idade face a `compact_max_age_days`.
-  - **`azureActive`**, **`azure`** — contexto Azure resolvido, inventário materializado, warnings e pendências do provider.
-  - **`next`** — `{ step, cursorCmd, reason, artifacts }` (espelha a lógica de `suggestNextStep`).
+- **`buildHealthReport(projectRoot)`** — agrega fase, datas, avisos de SPEC/PLAN/VERIFY e o próximo passo sugerido. Campos usados em CI e em `oxe-cc status --json`:
+  - **`scanDate`**, **`stale`** — último scan e idade face a `scan_max_age_days` (`stale: { stale, days }`).
+  - **`compactDate`**, **`staleCompact`** — último compact e idade face a `compact_max_age_days`.
+  - **`azureActive`**, **`azure`** — contexto Azure resolvido, inventário materializado, warnings e pendências do provider.
+  - **`next`** — `{ step, cursorCmd, reason, artifacts }` (espelha a lógica de `suggestNextStep`).
 
 ## `runDoctorChecks` e relatório de saúde
 

package/lib/sdk/index.cjs

@@ -648,22 +648,31 @@ module.exports = {
     operationalPaths: operational.operationalPaths,
     appendEvent: operational.appendEvent,
     readEvents: operational.readEvents,
-    summarizeEvents: operational.summarizeEvents,
-    writeRunState: operational.writeRunState,
-    readRunState: operational.readRunState,
-    buildOperationalGraph: operational.buildOperationalGraph,
-    serializeCanonicalState: operational.serializeCanonicalState,
-    hydrateCanonicalState: operational.hydrateCanonicalState,
-    reduceCanonicalRunState: operational.reduceCanonicalRunState,
-    compileExecutionGraphFromArtifacts: operational.compileExecutionGraphFromArtifacts,
-    compileVerificationSuiteFromArtifacts: operational.compileVerificationSuiteFromArtifacts,
-    projectRuntimeArtifacts: operational.projectRuntimeArtifacts,
-    runRuntimeCiChecks: operational.runRuntimeCiChecks,
-    applyRuntimeAction: operational.applyRuntimeAction,
-    parseCapabilityManifest: operational.parseCapabilityManifest,
-    readCapabilityCatalog: operational.readCapabilityCatalog,
+    summarizeEvents: operational.summarizeEvents,
+    writeRunState: operational.writeRunState,
+    readRunState: operational.readRunState,
+    buildOperationalGraph: operational.buildOperationalGraph,
+    serializeCanonicalState: operational.serializeCanonicalState,
+    hydrateCanonicalState: operational.hydrateCanonicalState,
+    reduceCanonicalRunState: operational.reduceCanonicalRunState,
+    compileExecutionGraphFromArtifacts: operational.compileExecutionGraphFromArtifacts,
+    compileVerificationSuiteFromArtifacts: operational.compileVerificationSuiteFromArtifacts,
+    projectRuntimeArtifacts: operational.projectRuntimeArtifacts,
+    runRuntimeCiChecks: operational.runRuntimeCiChecks,
+    buildRuntimePluginRegistry: operational.buildRuntimePluginRegistry,
+    readRuntimeGates: operational.readRuntimeGates,
+    resolveRuntimeGate: operational.resolveRuntimeGate,
+    runRuntimeVerify: operational.runRuntimeVerify,
+    runRuntimePromotion: operational.runRuntimePromotion,
+    recoverRuntimeState: operational.recoverRuntimeState,
+    applyRuntimeAction: operational.applyRuntimeAction,
+    parseCapabilityManifest: operational.parseCapabilityManifest,
+    readCapabilityCatalog: operational.readCapabilityCatalog,
     buildMemoryLayers: operational.buildMemoryLayers,
     replayEvents: operational.replayEvents,
+    replayRuntimeState: operational.replayRuntimeState,
+    readRuntimeMultiAgentStatus: operational.readRuntimeMultiAgentStatus,
+    multiAgentStatus: operational.readRuntimeMultiAgentStatus,
   },
 
   /** Context Engine V2: seleção, compressão e inspeção determinística de artefatos. */
@@ -742,13 +751,13 @@ module.exports = {
   /** Um único objeto com verificações tipo `doctor` + relatório de saúde. */
   runDoctorChecks,
 };
-
-
-// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
-// The compiled runtime lives at lib/runtime/ alongside this file.
-try {
-  const runtime = require('../runtime/index.js');
-  Object.assign(module.exports, runtime);
-} catch {
-  // Runtime not built yet — safe to skip during development
-}
+
+
+// Re-exports from @oxe/runtime (R1 — Runtime Foundation)
+// The compiled runtime lives at lib/runtime/ alongside this file.
+try {
+  const runtime = require('../runtime/index.js');
+  Object.assign(module.exports, runtime);
+} catch {
+  // Runtime not built yet — safe to skip during development
+}

package/lib/sdk/index.d.ts

@@ -100,6 +100,111 @@ export interface CopilotIntegrationReport {
   warnings: string[];
 }
 
+export interface VerificationSummary {
+  total: number;
+  pass: number;
+  fail: number;
+  skip: number;
+  error: number;
+  allPassed: boolean;
+  profile: string | null;
+  manifestPath: string;
+}
+
+export interface ResidualRiskSummary {
+  total: number;
+  highOrCritical: number;
+  ledgerPath: string;
+}
+
+export interface EvidenceCoverageSummary {
+  total_checks: number;
+  checks_with_evidence: number;
+  total_evidence_refs: number;
+  coverage_percent: number;
+}
+
+export interface PendingGatesSummary {
+  path: string;
+  total: number;
+  gateSlaHours?: number;
+  staleGateCount?: number;
+  pending: Array<Record<string, unknown>>;
+  stalePending: Array<Record<string, unknown>>;
+}
+
+export interface GateQueueSnapshot {
+  path: string;
+  total: number;
+  gate_sla_hours?: number;
+  staleCount?: number;
+  pending: Array<Record<string, unknown>>;
+  stale_pending?: Array<Record<string, unknown>>;
+  resolved_recent?: Array<Record<string, unknown>>;
+  byRun?: Record<string, number>;
+  byScope?: Record<string, number>;
+  all?: Array<Record<string, unknown>>;
+}
+
+export interface MultiAgentStatusSummary {
+  path: string | null;
+  enabled: boolean;
+  runId: string | null;
+  mode: string | null;
+  workspaceIsolationEnforced: boolean;
+  agents: Array<Record<string, unknown>>;
+  ownership: Array<Record<string, unknown>>;
+  orphanReassignments: Array<Record<string, unknown>>;
+  handoffs: Array<Record<string, unknown>>;
+  arbitrationResults: Array<Record<string, unknown>>;
+}
+
+export interface PolicyDecisionSummary {
+  total: number;
+  denied: number;
+  gated: number;
+  overridesWithoutRationale: number;
+}
+
+export interface QuotaSummary {
+  limits: {
+    maxWorkItemsPerRun: number | null;
+    maxMutationsPerRun: number | null;
+    maxRetriesPerRun: number | null;
+  };
+  consumed: {
+    workItems: number;
+    mutations: number;
+    retries: number;
+  };
+  violations: string[];
+  exceeded: boolean;
+}
+
+export interface AuditSummary {
+  path: string;
+  totalEntries: number;
+  runEntries: number;
+  warn: number;
+  critical: number;
+  oldest: string | null;
+  newest: string | null;
+  actors: string[];
+  actions: Record<string, number>;
+}
+
+export interface PromotionSummary {
+  status: string | null;
+  targetKind: string | null;
+  remote: string | null;
+  targetRef: string | null;
+  prUrl: string | null;
+  prNumber: number | null;
+  coveragePercent: number | null;
+  reasons: string[];
+  path: string;
+}
+
 /** Relatório retornado por `health.buildHealthReport` e incluído em `runDoctorChecks`.healthReport. */
 export interface OxeHealthReport {
   configPath: string | null;
@@ -130,6 +235,16 @@ export interface OxeHealthReport {
   activeRun?: Record<string, unknown> | null;
   eventsSummary?: Record<string, unknown> | null;
   memoryLayers?: Record<string, unknown> | null;
+  verificationSummary?: VerificationSummary | null;
+  residualRiskSummary?: ResidualRiskSummary | null;
+  evidenceCoverage?: EvidenceCoverageSummary | null;
+  pendingGates?: PendingGatesSummary | null;
+  policyDecisionSummary?: PolicyDecisionSummary | null;
+  enterpriseWarn?: string[];
+  quotaSummary?: QuotaSummary | null;
+  auditSummary?: AuditSummary | null;
+  promotionSummary?: PromotionSummary | null;
+  multiAgent?: MultiAgentStatusSummary | null;
   next: OxeNextSuggestion;
   azureActive?: boolean;
   azure?: AzureHealthContext | null;
@@ -478,6 +593,17 @@ export interface OxeSdk {
   parseLessonsMetrics: (metricsJson: string) => LessonMetric[];
   updateLessonMetric: (metrics: LessonMetric[], lessonId: string, outcome: LessonOutcome) => LessonMetric[];
   deprecateLowEffectiveness: (metrics: LessonMetric[], threshold?: number, minObservations?: number) => LessonMetric[];
+  verifyRun?: (input: {
+    projectRoot: string;
+    runId: string;
+    workItemId: string;
+    cwd: string;
+    suite: Record<string, unknown>;
+    pluginRegistry?: Record<string, unknown>;
+    evidenceStore?: Record<string, unknown>;
+    attemptNumber?: number;
+    timeoutMs?: number;
+  }) => Promise<Record<string, unknown>>;
 
   health: {
     loadOxeConfigMerged: (targetProject: string) => { config: Record<string, unknown>; path: string | null; parseError: string | null; sources: { system: string | null; user: string | null; project: string | null } };
@@ -573,20 +699,26 @@ export interface OxeSdk {
     operationalPaths: (projectRoot: string, activeSession: string | null) => Record<string, string | null>;
     appendEvent: (projectRoot: string, activeSession: string | null, event?: Record<string, unknown>) => Record<string, unknown>;
     readEvents: (projectRoot: string, activeSession: string | null) => Array<Record<string, unknown>>;
-    summarizeEvents: (events: Array<Record<string, unknown>>) => Record<string, unknown>;
-    writeRunState: (projectRoot: string, activeSession: string | null, runState?: Record<string, unknown>) => Record<string, unknown>;
-    readRunState: (projectRoot: string, activeSession: string | null) => Record<string, unknown> | null;
-    buildOperationalGraph: (runState?: Record<string, unknown>) => { nodes: Array<Record<string, unknown>>; edges: Array<Record<string, unknown>> };
-    serializeCanonicalState: (state: unknown) => Record<string, unknown> | null;
-    hydrateCanonicalState: (serialized: unknown) => Record<string, unknown>;
-    reduceCanonicalRunState: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown> | null;
-    compileExecutionGraphFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
-    compileVerificationSuiteFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
-    projectRuntimeArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
-    runRuntimeCiChecks: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
-    applyRuntimeAction: (projectRoot: string, activeSession: string | null, input?: Record<string, unknown>) => Record<string, unknown>;
-    parseCapabilityManifest: (text: string) => Record<string, unknown>;
-    readCapabilityCatalog: (projectRoot: string) => Array<Record<string, unknown>>;
+    summarizeEvents: (events: Array<Record<string, unknown>>) => Record<string, unknown>;
+    writeRunState: (projectRoot: string, activeSession: string | null, runState?: Record<string, unknown>) => Record<string, unknown>;
+    readRunState: (projectRoot: string, activeSession: string | null) => Record<string, unknown> | null;
+    buildOperationalGraph: (runState?: Record<string, unknown>) => { nodes: Array<Record<string, unknown>>; edges: Array<Record<string, unknown>> };
+    serializeCanonicalState: (state: unknown) => Record<string, unknown> | null;
+    hydrateCanonicalState: (serialized: unknown) => Record<string, unknown>;
+    reduceCanonicalRunState: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown> | null;
+    compileExecutionGraphFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    compileVerificationSuiteFromArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    projectRuntimeArtifacts: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    runRuntimeCiChecks: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    buildRuntimePluginRegistry: (projectRoot: string) => Record<string, unknown> | null;
+    readRuntimeGates: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => GateQueueSnapshot;
+    resolveRuntimeGate: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    runRuntimeVerify: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    runRuntimePromotion: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    recoverRuntimeState: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    applyRuntimeAction: (projectRoot: string, activeSession: string | null, input?: Record<string, unknown>) => Record<string, unknown>;
+    parseCapabilityManifest: (text: string) => Record<string, unknown>;
+    readCapabilityCatalog: (projectRoot: string) => Array<Record<string, unknown>>;
     buildMemoryLayers: (projectRoot: string, activeSession: string | null) => Record<string, unknown>;
     replayEvents: (projectRoot: string, activeSession: string | null, options?: {
       fromEventId?: string;
@@ -595,6 +727,9 @@ export interface OxeSdk {
       limit?: number;
       writeReport?: boolean;
     }) => ReplayReport;
+    replayRuntimeState: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => Record<string, unknown>;
+    readRuntimeMultiAgentStatus: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => MultiAgentStatusSummary;
+    multiAgentStatus: (projectRoot: string, activeSession: string | null, options?: Record<string, unknown>) => MultiAgentStatusSummary;
   };
 
   azure: {

package/oxe/templates/ACTIVE-RUN.template.json

@@ -1,32 +1,32 @@
-{
-  "run_id": "oxe-run-YYYYMMDD-001",
-  "status": "planned",
-  "created_at": "YYYY-MM-DDTHH:mm:ssZ",
-  "updated_at": "YYYY-MM-DDTHH:mm:ssZ",
-  "plan_ref": "PLAN.md",
-  "session_id": null,
-  "current_wave": null,
-  "cursor": {
-    "wave": null,
-    "task": null,
-    "mode": null
-  },
-  "active_tasks": [],
-  "pending_checkpoints": [],
-  "retries": [],
-  "failures": [],
-  "evidence": [],
-  "provider_context": {
-    "azure": null
-  },
-  "graph": {
-    "nodes": [],
-    "edges": []
-  },
-  "metrics": {
-    "predicted_confidence": null,
-    "coverage_ratio": null,
-    "retry_count": 0,
-    "checkpoint_count": 0
-  }
-}
+{
+  "run_id": "oxe-run-YYYYMMDD-001",
+  "status": "planned",
+  "created_at": "YYYY-MM-DDTHH:mm:ssZ",
+  "updated_at": "YYYY-MM-DDTHH:mm:ssZ",
+  "plan_ref": "PLAN.md",
+  "session_id": null,
+  "current_wave": null,
+  "cursor": {
+    "wave": null,
+    "task": null,
+    "mode": null
+  },
+  "active_tasks": [],
+  "pending_checkpoints": [],
+  "retries": [],
+  "failures": [],
+  "evidence": [],
+  "provider_context": {
+    "azure": null
+  },
+  "graph": {
+    "nodes": [],
+    "edges": []
+  },
+  "metrics": {
+    "predicted_confidence": null,
+    "coverage_ratio": null,
+    "retry_count": 0,
+    "checkpoint_count": 0
+  }
+}

package/oxe/templates/CAPABILITIES.template.md

@@ -1,7 +1,7 @@
-# OXE — Capabilities Instaladas
-
-> Catálogo local de capabilities do projeto. Cada capability vive em `.oxe/capabilities/<id>/`.
-
-| ID | Tipo | Status | Escopo | Política | Side effects | Requer env | Evidência | Resumo |
-|----|------|--------|--------|-----------|--------------|------------|-----------|--------|
-| (vazio) | — | — | — | — | — | — | — | Nenhuma capability instalada |
+# OXE — Capabilities Instaladas
+
+> Catálogo local de capabilities do projeto. Cada capability vive em `.oxe/capabilities/<id>/`.
+
+| ID | Tipo | Status | Escopo | Política | Side effects | Requer env | Evidência | Resumo |
+|----|------|--------|--------|-----------|--------------|------------|-----------|--------|
+| (vazio) | — | — | — | — | — | — | — | Nenhuma capability instalada |

package/oxe/templates/CAPABILITY.template.md

@@ -1,45 +1,45 @@
----
-oxe_capability: true
-id: sample-capability
-version: 1
-type: script
-status: active
-scope: execute
-requires_env: []
-entrypoint: ""
-approval_policy: require_approval_if_external_side_effect
-side_effects: []
-evidence_outputs: []
-session_compatibility: [legacy, session]
----
-
-# OXE — Capability
-
-## Objetivo
-
-- O que esta capability faz.
-
-## Escopo OXE
-
-- `scan` | `ask` | `research` | `spec` | `plan` | `execute` | `verify`
-
-## Operações
-
-- Operação 1
-
-## Entradas e saídas
-
-- Entradas esperadas
-- Saídas produzidas
-
-## Requisitos
-
-- Variáveis de ambiente
-- Dependências externas
-- Aprovação necessária ou bypass permitido
-
-## Evidência e segurança
-
-- Como a capability produz evidência útil.
-- Limites e riscos.
-- Side effects possíveis e como são governados.
+---
+oxe_capability: true
+id: sample-capability
+version: 1
+type: script
+status: active
+scope: execute
+requires_env: []
+entrypoint: ""
+approval_policy: require_approval_if_external_side_effect
+side_effects: []
+evidence_outputs: []
+session_compatibility: [legacy, session]
+---
+
+# OXE — Capability
+
+## Objetivo
+
+- O que esta capability faz.
+
+## Escopo OXE
+
+- `scan` | `ask` | `research` | `spec` | `plan` | `execute` | `verify`
+
+## Operações
+
+- Operação 1
+
+## Entradas e saídas
+
+- Entradas esperadas
+- Saídas produzidas
+
+## Requisitos
+
+- Variáveis de ambiente
+- Dependências externas
+- Aprovação necessária ou bypass permitido
+
+## Evidência e segurança
+
+- Como a capability produz evidência útil.
+- Limites e riscos.
+- Side effects possíveis e como são governados.