pi-daddy 0.28.0 → 0.32.0

package/src/work-command.ts

@@ -1,197 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, resolve } from "node:path";
-import {
-  appendWorkLedgerEventOnce,
-  buildWorkOccurrenceEvent,
-  buildWorkRevisionEvent,
-  buildWorkSnapshotEvent,
-  parseWorkLedgerText,
-  projectWorkLedger,
-  type EventRef,
-  type RevisionRef,
-  type WorkFrozen,
-  type WorkOccurrencePayload,
-  type WorkProjectionContext,
-  type WorkRevision,
-} from "./work-ledger.ts";
-import { withFileLock } from "./file-lock.ts";
-import { resolveWorkSnapshotText } from "./work-ledger-snapshot.ts";
-import { readProductJson, writeProductJson } from "./product-files.ts";
-import { intentKey } from "./intent-control.ts";
-
-const ID = /^[A-Za-z0-9][A-Za-z0-9._:/@+\-]{0,127}$/;
-const DIGEST = /^[a-f0-9]{64}$/;
-const sha256 = (value: string): string => createHash("sha256").update(value).digest("hex");
-const eventRef = (event: { eventId: string; digest: string }): EventRef => ({ eventId: event.eventId, digest: event.digest });
-const revisionRef = (event: { payload: { revision: { kind: WorkRevision["kind"]; id: string; revision: number; digest: string } } }): RevisionRef => {
-  const { kind, id, revision, digest } = event.payload.revision;
-  return { kind, id, revision, digest };
-};
-
-export interface DeclaredWorkState {
-  readonly version: "pi-daddy-declared-work-v1";
-  readonly id: string;
-  readonly outcomeDigest: string;
-  readonly ledgerPath: string;
-  readonly statePath: string;
-  readonly grantLedgerPath: string | null;
-  readonly selectedSnapshot: NonNullable<WorkProjectionContext["selectedSnapshot"]>;
-  readonly scope: RevisionRef;
-  readonly intent: RevisionRef;
-  readonly obligation: RevisionRef;
-  readonly policy: RevisionRef;
-}
-
-interface StoredDeclaredWorkState extends Omit<DeclaredWorkState, "statePath"> {}
-
-export interface DeclareWorkInput {
-  cwd: string;
-  id: string;
-  outcome: string;
-}
-
-function paths(input: DeclareWorkInput): { ledgerPath: string; statePath: string; grantLedgerPath: null } {
-  const root = resolve(input.cwd);
-  return { ledgerPath: join(root, ".pi", "work.jsonl"), statePath: join(root, ".pi", "work-current.json"), grantLedgerPath: null };
-}
-
-const exactKeys = (value: object, expected: readonly string[]): boolean => {
-  const actual = Object.keys(value).sort();
-  return actual.length === expected.length && actual.every((key, index) => key === [...expected].sort()[index]);
-};
-const validRef = (value: unknown, kind: WorkRevision["kind"]): value is RevisionRef => {
-  if (!value || typeof value !== "object" || !exactKeys(value, ["kind", "id", "revision", "digest"])) return false;
-  const ref = value as RevisionRef;
-  return ref.kind === kind && ID.test(ref.id) && Number.isSafeInteger(ref.revision) && ref.revision > 0 && DIGEST.test(ref.digest);
-};
-
-export async function loadDeclaredWork(statePath: string): Promise<WorkFrozen<DeclaredWorkState> | null> {
-  let text: string;
-  try { text = await readFile(statePath, "utf8"); }
-  catch (error) { if ((error as { code?: string }).code === "ENOENT") return null; throw error; }
-  try {
-    const value = JSON.parse(text) as StoredDeclaredWorkState;
-    if (!value || typeof value !== "object" || !exactKeys(value, [
-      "version", "id", "outcomeDigest", "ledgerPath", "grantLedgerPath", "selectedSnapshot", "scope", "intent", "obligation", "policy",
-    ]) || value.version !== "pi-daddy-declared-work-v1" || !ID.test(value.id) || !DIGEST.test(value.outcomeDigest) ||
-      typeof value.ledgerPath !== "string" || !isAbsolute(value.ledgerPath) ||
-      (value.grantLedgerPath !== null && (typeof value.grantLedgerPath !== "string" || !isAbsolute(value.grantLedgerPath))) ||
-      !validRef(value.scope, "scope") || !validRef(value.intent, "goal") || !validRef(value.obligation, "obligation") || !validRef(value.policy, "policy") ||
-      !value.selectedSnapshot || typeof value.selectedSnapshot !== "object" ||
-      !exactKeys(value.selectedSnapshot, ["snapshot", "event"]) ||
-      !exactKeys(value.selectedSnapshot.snapshot, ["id", "digest"]) || !ID.test(value.selectedSnapshot.snapshot.id) || !DIGEST.test(value.selectedSnapshot.snapshot.digest) ||
-      !exactKeys(value.selectedSnapshot.event, ["eventId", "digest"]) || !ID.test(value.selectedSnapshot.event.eventId) || !DIGEST.test(value.selectedSnapshot.event.digest)) {
-      throw new Error("shape");
-    }
-    const expectedLedger = resolve(dirname(statePath), "work.jsonl");
-    if (resolve(value.ledgerPath) !== expectedLedger) throw new Error("relocated");
-    const ledger = await readFile(value.ledgerPath, "utf8");
-    const ingestion = parseWorkLedgerText(ledger);
-    const projection = projectWorkLedger(ledger, { selectedSnapshot: value.selectedSnapshot, authority: null });
-    const obligation = projection.obligations.find(item => item.binding.obligation.digest === value.obligation.digest);
-    const selected = resolveWorkSnapshotText(ledger, value.selectedSnapshot);
-    if (!ingestion.complete || projection.scopeState !== "valid" || !obligation || projection.selectedSnapshot?.digest !== value.selectedSnapshot.snapshot.digest || intentKey(obligation.binding.intent) !== intentKey(value.intent) || intentKey(obligation.binding.policy) !== intentKey(value.policy) || !selected.scope || selected.scope.digest !== value.scope.digest || selected.scope.id !== value.scope.id || selected.scope.revision !== value.scope.revision) throw new Error("unbound");
-    return Object.freeze({ ...value, statePath: resolve(statePath) });
-  } catch {
-    throw new Error("invalid declared work state; no task was selected");
-  }
-}
-
-export async function declareWork(input: DeclareWorkInput): Promise<WorkFrozen<DeclaredWorkState>> {
-  if (!input || typeof input !== "object" || Object.keys(input).some(key => !["cwd", "id", "outcome"].includes(key))) {
-    throw new TypeError("unsupported work declaration field");
-  }
-  if (!ID.test(input.id) || typeof input.outcome !== "string" || !input.outcome.trim()) throw new TypeError("work declaration requires an identifier and non-empty outcome");
-  const resolved = paths(input), outcomeDigest = sha256(input.outcome.trim());
-  const projectPi = dirname(resolved.ledgerPath);
-  try {
-    // Create only a new project control directory as private; never chmod or repurpose an existing one.
-    await mkdir(projectPi, { mode: 0o700 });
-  } catch (error) {
-    if ((error as { code?: string }).code !== "EEXIST") throw error;
-    const existing = await lstat(projectPi);
-    if (!existing.isDirectory() || existing.isSymbolicLink()) throw Error("existing .pi state is not a directory; it was not followed or changed");
-  }
-  return withFileLock(resolved.statePath, "declared work", async () => {
-    const existing = await loadDeclaredWork(resolved.statePath);
-    if (existing && (existing.id !== input.id || existing.outcomeDigest !== outcomeDigest)) throw new Error(`declared work id ${input.id} already names a different outcome`);
-    const outcomePath = join(projectPi, "work-outcomes", `${outcomeDigest}.json`);
-    const retained = await readProductJson(outcomePath);
-    if (retained && JSON.stringify(retained) !== JSON.stringify({ outcome: input.outcome.trim() })) throw Error("declared outcome identity conflict");
-    if (!retained) await writeProductJson(outcomePath, { outcome: input.outcome.trim() });
-    if (existing) return existing;
-    const pendingPath = `${resolved.statePath}.pending`;
-    let prepared: { version: "pi-daddy-work-preparation-v1"; id: string; outcomeDigest: string; createdAt: string };
-    try {
-      prepared = JSON.parse(await readFile(pendingPath, "utf8"));
-      if (!prepared || Object.keys(prepared).sort().join() !== "createdAt,id,outcomeDigest,version" || prepared.version !== "pi-daddy-work-preparation-v1" || prepared.id !== input.id || prepared.outcomeDigest !== outcomeDigest || Number.isNaN(Date.parse(prepared.createdAt))) throw new Error("invalid");
-    } catch (error) {
-      if ((error as { code?: string }).code !== "ENOENT") throw new Error("another or invalid work declaration is pending; no events were replaced");
-      prepared = { version: "pi-daddy-work-preparation-v1", id: input.id, outcomeDigest, createdAt: new Date().toISOString() };
-      await writeFile(pendingPath, `${JSON.stringify(prepared)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
-    }
-    const now = new Date(prepared.createdAt);
-    const revision = (kind: WorkRevision["kind"], name: string, patch: Partial<Omit<WorkRevision, "digest">> = {}) =>
-      buildWorkRevisionEvent({ eventId: `work:${input.id}:${name}:1`, now, revision: {
-        kind, id: `work:${input.id}:${name}`, revision: 1, scopeId: `work:${input.id}:scope`, predecessor: null,
-        contentDigest: sha256(`${name}\0${outcomeDigest}`), parent: null, dependencies: [], ownerId: "local-operator",
-        permittedEffects: [], policy: null, ...patch,
-      } });
-    const scope = revision("scope", "scope"), policy = revision("policy", "policy");
-    const intent = revision("goal", "goal", { parent: revisionRef(scope) });
-    const obligation = revision("obligation", "obligation", { parent: revisionRef(intent), policy: revisionRef(policy) });
-    const binding = { intent: revisionRef(intent), obligation: revisionRef(obligation), artifact: null, policy: revisionRef(policy) };
-    const snapshot = buildWorkSnapshotEvent({ eventId: `work:${input.id}:snapshot:1`, now, snapshot: {
-      snapshotId: `work:${input.id}:selected`, scope: revisionRef(scope), revisions: [revisionRef(policy), revisionRef(intent), revisionRef(obligation)], bindings: [binding],
-    } });
-    for (const event of [scope, policy, intent, obligation, snapshot]) await appendWorkLedgerEventOnce({ path: resolved.ledgerPath, grantLedgerPath: resolved.grantLedgerPath }, event);
-    const stored: StoredDeclaredWorkState = {
-      version: "pi-daddy-declared-work-v1", id: input.id, outcomeDigest, ledgerPath: resolved.ledgerPath, grantLedgerPath: resolved.grantLedgerPath,
-      selectedSnapshot: { snapshot: { id: snapshot.payload.snapshot.snapshotId, digest: snapshot.payload.snapshot.digest }, event: eventRef(snapshot) },
-      scope: revisionRef(scope), intent: revisionRef(intent), obligation: revisionRef(obligation), policy: revisionRef(policy),
-    };
-    const temporary = `${resolved.statePath}.${process.pid}.${randomUUID()}.tmp`;
-    try {
-      await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
-      await rename(temporary, resolved.statePath);
-    } finally { await rm(temporary, { force: true }); }
-    await rm(pendingPath);
-    return Object.freeze({ ...stored, statePath: resolved.statePath });
-  });
-}
-
-/** Persist an already-applied exact selection so the next governed dispatch cannot keep using the old cached declaration. */
-export async function rebindDeclaredWork(state:WorkFrozen<DeclaredWorkState>,selectedSnapshot:NonNullable<WorkProjectionContext["selectedSnapshot"]>):Promise<WorkFrozen<DeclaredWorkState>>{
- return withFileLock(state.statePath,"declared work rebind",async()=>{const current=await loadDeclaredWork(state.statePath);if(!current||intentKey(current.selectedSnapshot)!==intentKey(state.selectedSnapshot))throw Error("declared work rebind is stale; new dispatch remains unsupported");const text=await readFile(state.ledgerPath,"utf8"),resolved=resolveWorkSnapshotText(text,selectedSnapshot),binding=resolved.snapshot?.bindings[0];if(resolved.scopeState!=="valid"||!resolved.scope||!resolved.snapshot||!binding)throw Error("applied declared selection cannot bind future dispatch");const stored:StoredDeclaredWorkState={version:"pi-daddy-declared-work-v1",id:state.id,outcomeDigest:state.outcomeDigest,ledgerPath:state.ledgerPath,grantLedgerPath:state.grantLedgerPath,selectedSnapshot,scope:{kind:resolved.scope.kind,id:resolved.scope.id,revision:resolved.scope.revision,digest:resolved.scope.digest},intent:binding.intent,obligation:binding.obligation,policy:binding.policy};const temporary=`${state.statePath}.${process.pid}.${randomUUID()}.tmp`;try{await writeFile(temporary,`${JSON.stringify(stored,null,2)}\n`,{encoding:"utf8",mode:0o600,flag:"wx"});await rename(temporary,state.statePath);}finally{await rm(temporary,{force:true});}return Object.freeze({...stored,statePath:state.statePath});});
-}
-
-export type DeclaredOccurrenceIdentity = Pick<WorkOccurrencePayload["labels"], "toolCallId" | "taskId" | "workspaceId" | "definitionDigest" | "configurationDigest" | "modelId" | "effortId"> & {
-  executionId: string;
-  parentExecutionId: string | null;
-  childId: string | null;
-  variantId: string | null;
-  now: Date;
-};
-
-export async function appendDeclaredWorkOccurrence(state: WorkFrozen<DeclaredWorkState>, identity: DeclaredOccurrenceIdentity,
-  occurrenceState: WorkOccurrencePayload["state"]): Promise<void> {
-  const { executionId, parentExecutionId, childId, variantId, now, ...rawLabels } = identity;
-  const label = (name: string, value: string | null): string | null => value === null ? null : ID.test(value) ? value : `${name}:${sha256(value)}`;
-  const labels = {
-    toolCallId: label("toolcall", rawLabels.toolCallId), taskId: label("task", rawLabels.taskId),
-    workspaceId: label("workspace", rawLabels.workspaceId), definitionDigest: rawLabels.definitionDigest,
-    configurationDigest: rawLabels.configurationDigest, modelId: label("model", rawLabels.modelId), effortId: label("effort", rawLabels.effortId),
-  };
-  const event = buildWorkOccurrenceEvent({
-    eventId: `work:${state.id}:attempt:${identity.executionId}:${occurrenceState}`,
-    now,
-    payload: {
-      scope: state.scope, obligation: state.obligation, executionId,
-      parentExecutionId, childId, variantId: label("variant", variantId), artifact: null,
-      provenance: "observed", state: occurrenceState,
-      labels: { sessionId: null, branchLeafId: null, ...labels },
-    },
-  });
-  await appendWorkLedgerEventOnce({ path: state.ledgerPath, grantLedgerPath: state.grantLedgerPath }, event);
-}

package/src/work-ledger-destination.ts

@@ -1,113 +0,0 @@
-import { lstat, realpath, stat } from "node:fs/promises";
-import type { FileHandle } from "node:fs/promises";
-import type { BigIntStats } from "node:fs";
-import { constants } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { WorkLedgerWriteError } from "./work-ledger-types.ts";
-
-/** Only actual errno-class failures cross the content-free filesystem error boundary. */
-export function workFsError(error: unknown): error is NodeJS.ErrnoException {
-  return error instanceof Error && "code" in error && typeof error.code === "string" && Object.hasOwn(constants.errno, error.code);
-}
-export const validWorkPath = (path: string) => path.length > 0 && isAbsolute(path) && !path.includes("\0");
-// Node encodes string filesystem paths as UTF-8: lone UTF-16 surrogates become U+FFFD.
-// Compare that exact spelling even for absent leaves/ancestors, before mkdir or lock acquisition.
-// This preserves valid Unicode verbatim; it is not Unicode normalization or case folding.
-const filesystemPath = (path: string) => Buffer.from(resolve(path), "utf8").toString("utf8");
-const invalid = (): never => { throw new WorkLedgerWriteError("WORK_DESTINATION_INVALID"); };
-const alias = (): never => { throw new WorkLedgerWriteError("WORK_DESTINATION_ALIAS"); };
-const same = (a: BigIntStats | null, b: BigIntStats | null) => a !== null && b !== null && a.dev === b.dev && a.ino === b.ino;
-function ancestors(path: string): string[] {
-  const result: string[] = [];
-  for (let p = dirname(path); ; p = dirname(p)) { result.push(p); if (dirname(p) === p) return result; }
-}
-interface PathFact {
-  path: string;
-  canonical: string | null;
-  entry: BigIntStats | null;
-  target: BigIntStats | null;
-  invalid: boolean;
-  io: boolean;
-}
-/** Internal descriptor/topology facts, never a public result, ambient grant lookup or authority input. */
-export interface WorkDestination {
-  readonly requestedPath: string;
-  readonly grantLedgerPath: string | null;
-  readonly path: string;
-  readonly existing: BigIntStats | null;
-  readonly protectedInodes: readonly BigIntStats[];
-}
-
-/** Read-only, complete preflight. A protected filename reserves its entire directory namespace too.
- * Compare lexical paths, canonical paths and exact dev/ino identities; aliases outrank failed facts,
- * which outrank unsafe topology. This is cooperative misrouting protection, NOT host containment. */
-export async function workDestination(requestedPath: string, grantLedgerPath: string | null): Promise<WorkDestination> {
-  if (!validWorkPath(requestedPath) || (grantLedgerPath !== null && !validWorkPath(grantLedgerPath))) invalid();
-  const path = filesystemPath(requestedPath), leaves = [path, path + ".lock"];
-  const protectedPaths = grantLedgerPath === null ? [] : [filesystemPath(grantLedgerPath), filesystemPath(grantLedgerPath) + ".lock"];
-  const workPaths = new Set(leaves.flatMap(p => [p, ...ancestors(p)]));
-  if (protectedPaths.some(p => workPaths.has(p))) alias(); // Proven lexical collision needs no I/O.
-  const facts = new Map<string, Promise<PathFact>>();
-  function probe(path: string): Promise<PathFact> {
-    const prior = facts.get(path); if (prior) return prior;
-    const pending = inspect(path); facts.set(path, pending); return pending;
-  }
-  async function inspect(path: string): Promise<PathFact> {
-    const fact: PathFact = { path, canonical: null, entry: null, target: null, invalid: false, io: false };
-    try { fact.entry = await lstat(path, { bigint: true }); }
-    catch (error) {
-      if (!workFsError(error)) throw error;
-      if (error.code !== "ENOENT") { fact.invalid = ["ENOTDIR", "ELOOP"].includes(error.code!); fact.io = !fact.invalid; return fact; }
-    }
-    if (fact.entry) {
-      try {
-        fact.canonical = await realpath(path);
-        fact.target = fact.entry.isSymbolicLink() ? await stat(path, { bigint: true }) : fact.entry;
-      } catch (error) {
-        if (!workFsError(error)) throw error;
-        fact.invalid = ["ENOENT", "ENOTDIR", "ELOOP"].includes(error.code!); fact.io = !fact.invalid;
-      }
-    } else {
-      const parentPath = dirname(path);
-      if (parentPath === path) { fact.invalid = true; return fact; }
-      const parent = await probe(parentPath);
-      fact.invalid = parent.invalid || (parent.target !== null && !parent.target.isDirectory()); fact.io = parent.io;
-      if (parent.canonical) fact.canonical = join(parent.canonical, basename(path));
-    }
-    return fact;
-  }
-  const protectedFacts = await Promise.all(protectedPaths.map(probe));
-  const initial = await Promise.all([...workPaths].map(probe));
-  // A symlink parent can jump INSIDE a reserved directory. Include every canonical ancestor,
-  // not just lexical ancestors whose realpath might skip over the protected directory itself.
-  for (const fact of initial) if (fact.canonical) for (const p of [fact.canonical, ...ancestors(fact.canonical)]) workPaths.add(p);
-  const workFacts = await Promise.all([...workPaths].map(probe));
-  for (const w of workFacts) for (const p of protectedFacts) {
-    if (w.path === p.path || (w.canonical !== null && w.canonical === p.canonical) || same(w.target, p.target)) alias();
-  }
-  const all = [...workFacts, ...protectedFacts];
-  if (all.some(f => f.io)) throw new WorkLedgerWriteError("WORK_LEDGER_WRITE_FAILED");
-  if (all.some(f => f.invalid)) invalid();
-  for (const leaf of leaves) {
-    const f = await probe(leaf);
-    if (f.entry && (!f.entry.isFile() || f.entry.nlink !== 1n)) invalid();
-  }
-  for (const p of [...ancestors(path), ...ancestors((await probe(path)).canonical!)]) {
-    const f = await probe(p);
-    if (f.target && !f.target.isDirectory()) invalid();
-  }
-  const file = await probe(path);
-  return { requestedPath, grantLedgerPath, path: file.canonical!, existing: file.target,
-    protectedInodes: protectedFacts.flatMap(f => f.target ? [f.target] : []) };
-}
-
-/** Repeat classification after mkdir/acquisition/open. Never write through a freshly resolved handle. */
-export async function recheckWorkDestination(original: WorkDestination, handle?: FileHandle): Promise<void> {
-  const current = await workDestination(original.requestedPath, original.grantLedgerPath);
-  if (handle) {
-    const actual = await handle.stat({ bigint: true });
-    if (current.protectedInodes.some(p => same(actual, p))) alias();
-    if (!actual.isFile() || actual.nlink !== 1n || !same(actual, current.existing)) invalid();
-  }
-  if (original.path !== current.path || (original.existing && !same(original.existing, current.existing))) invalid();
-}

package/src/work-ledger-json.ts

@@ -1,228 +0,0 @@
-import { createHash } from "node:crypto";
-import { WorkInputError, type WorkFrozen, type WorkProblem, type WorkConflict } from "./work-ledger-types.ts";
-
-export const WORK_EVENT_BYTES = 64 * 1024;
-export const WORK_TEXT_BYTES = 16 * 1024 * 1024;
-export const WORK_RECORDS = 10_000;
-const MAX_DEPTH = 16;
-const MAX_ARRAY = 256;
-export type WorkJson = null | boolean | number | string | WorkJson[] | { [key: string]: WorkJson };
-const invalid = (): never => { throw new WorkInputError("WORK_SCHEMA_INVALID"); };
-const limit = (): never => { throw new WorkInputError("WORK_LIMIT_EXCEEDED"); };
-
-function unicode(value: string): string {
-  // RFC 8785 refuses lone UTF-16 surrogates, including ones decoded from escapes.
-  for (let i = 0; i < value.length; i++) {
-    const code = value.charCodeAt(i);
-    if (code >= 0xd800 && code <= 0xdbff) {
-      const next = value.charCodeAt(++i);
-      if (!(next >= 0xdc00 && next <= 0xdfff)) invalid();
-    } else if (code >= 0xdc00 && code <= 0xdfff) invalid();
-  }
-  return value;
-}
-
-/** Inspect descriptors rather than serializing: no getters/toJSON or lossy JSON coercion. */
-export function ownWorkFields(value: unknown): Record<string, PropertyDescriptor> {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) invalid();
-  const prototype = Object.getPrototypeOf(value);
-  if (prototype !== Object.prototype && prototype !== null) invalid();
-  const descriptors = Object.getOwnPropertyDescriptors(value);
-  for (const key of Reflect.ownKeys(descriptors)) {
-    if (typeof key !== "string") return invalid();
-    const descriptor = descriptors[key];
-    if (!Object.hasOwn(descriptor, "value") || !descriptor.enumerable) invalid();
-    unicode(key);
-  }
-  return descriptors;
-}
-
-/** Detach only the approved JSON value profile, before any serialization or validation use. */
-export function copyWorkJson(value: unknown): WorkJson {
-  const ancestors = new Set<object>();
-  function copy(v: unknown, depth: number): WorkJson {
-    if (v === null || typeof v === "boolean") return v;
-    if (typeof v === "string") return unicode(v);
-    if (typeof v === "number") return Number.isSafeInteger(v) ? v : invalid();
-    if (typeof v !== "object") return invalid();
-    if (depth > MAX_DEPTH) limit();
-    if (ancestors.has(v)) invalid();
-    ancestors.add(v);
-    let result: WorkJson;
-    if (Array.isArray(v)) {
-      if (Object.getPrototypeOf(v) !== Array.prototype) invalid();
-      if (v.length > MAX_ARRAY) limit();
-      const fields = Object.getOwnPropertyDescriptors(v);
-      if (Reflect.ownKeys(fields).length !== v.length + 1) invalid();
-      result = [];
-      for (let i = 0; i < v.length; i++) {
-        const d = fields[String(i)];
-        if (!d || !Object.hasOwn(d, "value") || !d.enumerable) invalid();
-        result.push(copy(d.value, depth + 1));
-      }
-    } else {
-      const fields = ownWorkFields(v);
-      result = {};
-      for (const key of Object.keys(fields)) {
-        Object.defineProperty(result, key, { value: copy(fields[key].value, depth + 1), enumerable: true, writable: true, configurable: true });
-      }
-    }
-    ancestors.delete(v);
-    return result;
-  }
-  return copy(value, 1);
-}
-
-/** Exact decimal arithmetic BEFORE Number conversion, without unbounded exponent allocation. */
-function integerToken(token: string): number {
-  const match = /^(-?)(\d+)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(token)!;
-  let digits = (match[2] + (match[3] ?? "")).replace(/^0+/, "");
-  if (!digits) return 0;
-  let shift = BigInt(match[4] ?? "0") - BigInt((match[3] ?? "").length);
-  const trailing = /0*$/.exec(digits)![0].length;
-  digits = digits.slice(0, digits.length - trailing);
-  shift += BigInt(trailing);
-  if (shift < 0n || BigInt(digits.length) + shift > 16n) invalid();
-  const exact = BigInt(digits) * (10n ** shift);
-  if (exact > BigInt(Number.MAX_SAFE_INTEGER)) invalid();
-  return Number(match[1] === "-" ? -exact : exact);
-}
-
-type JsonNode =
-  | { type: "literal"; value: null | boolean | string }
-  | { type: "number"; token: string }
-  | { type: "array"; items: JsonNode[] }
-  | { type: "object"; entries: Array<[string, JsonNode]> };
-
-function checkMembers(node: JsonNode): void {
-  if (node.type === "object") {
-    const names = new Set<string>();
-    for (const [key, child] of node.entries) {
-      if (names.has(key)) throw new WorkInputError("WORK_DUPLICATE_MEMBER");
-      names.add(key);
-      checkMembers(child);
-    }
-  } else if (node.type === "array") node.items.forEach(checkMembers);
-}
-function materialize(node: JsonNode): WorkJson {
-  if (node.type === "number") return integerToken(node.token);
-  if (node.type === "literal") return typeof node.value === "string" ? unicode(node.value) : node.value;
-  if (node.type === "array") return node.items.map(materialize);
-  return Object.fromEntries(node.entries.map(([key, child]) => [unicode(key), materialize(child)]));
-}
-
-/** Bounded syntax tree: syntax, decoded duplicates, then exact numeric/string profile. */
-export function parseWorkJson(text: string): WorkJson {
-  if (typeof text !== "string") invalid();
-  if (Buffer.byteLength(text, "utf8") > WORK_EVENT_BYTES) limit();
-  let at = 0;
-  const syntax = (): never => { throw new WorkInputError("WORK_JSON_INVALID"); };
-  const whitespace = () => { while (at < text.length && /[ \t\r\n]/.test(text[at])) at++; };
-  function string(): string {
-    const start = at++;
-    while (at < text.length) {
-      const char = text[at++];
-      if (char === '"') {
-        // JSON.parse is used ONLY for one lexically delimited string token, never an object.
-        return JSON.parse(text.slice(start, at)) as string;
-      }
-      if (char.charCodeAt(0) < 0x20) syntax();
-      if (char === "\\") {
-        const escape = text[at++];
-        if (escape === "u") {
-          if (!/^[0-9a-fA-F]{4}$/.test(text.slice(at, at + 4))) syntax();
-          at += 4;
-        } else if (!escape || !'"\\/bfnrt'.includes(escape)) syntax();
-      }
-    }
-    return syntax();
-  }
-  function value(depth: number): JsonNode {
-    whitespace();
-    const char = text[at];
-    if (char === '"') return { type: "literal", value: string() };
-    if (char === "{" || char === "[") {
-      if (depth > MAX_DEPTH) limit();
-      at++;
-      whitespace();
-      const object = char === "{";
-      const end = object ? "}" : "]";
-      const entries: Array<[string, JsonNode]> = [];
-      const items: JsonNode[] = [];
-      if (text[at] !== end) for (;;) {
-        whitespace();
-        let key = "";
-        if (object) {
-          if (text[at] !== '"') syntax();
-          key = string();
-          whitespace();
-          if (text[at++] !== ":") syntax();
-        } else if (items.length >= MAX_ARRAY) limit();
-        const child = value(depth + 1);
-        if (object) entries.push([key, child]); else items.push(child);
-        whitespace();
-        if (text[at] === end) break;
-        if (text[at++] !== ",") syntax();
-      }
-      at++;
-      return object ? { type: "object", entries } : { type: "array", items };
-    }
-    for (const [token, literal] of [["null", null], ["true", true], ["false", false]] as const) {
-      if (text.startsWith(token, at)) { at += token.length; return { type: "literal", value: literal }; }
-    }
-    const token = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(text.slice(at));
-    if (!token) return syntax();
-    at += token[0].length;
-    return { type: "number", token: token[0] };
-  }
-  const result = value(1);
-  whitespace();
-  if (at !== text.length) syntax();
-  checkMembers(result);
-  return materialize(result);
-}
-
-function emit(value: WorkJson): string {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(emit).join(",")}]`;
-  // Emit keys directly: reconstructing a JS object would reorder numeric-looking keys.
-  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${emit(value[key])}`).join(",")}}`;
-}
-
-/** RFC 8785 emission restricted to our validated JSON profile; not an archival-byte identity. */
-export function canonicalWorkJson(value: unknown): string { return emit(copyWorkJson(value)); }
-export function workDigest(value: unknown): string {
-  return createHash("sha256").update(canonicalWorkJson(value), "utf8").digest("hex");
-}
-/** @internal ONLY validated constituents / internally constructed plain results. Output collections
- * are not wire records: they may contain >256 claims, problems, labels, or conflict alternatives.
- * Never use this emitter in place of copyWorkJson/strict ingestion at an input boundary. */
-export function workResultKey<T>(value: T): string { return emit(value as unknown as WorkJson); }
-export function sortWorkResults<T>(values: Iterable<T>): T[] {
-  const rows = new Map([...values].map(value => [workResultKey(value), value]));
-  return [...rows].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value);
-}
-export function mergeWorkProblems(values: readonly WorkFrozen<WorkProblem>[]): WorkFrozen<WorkProblem>[] {
-  const rows = new Map<string, WorkFrozen<WorkProblem>>();
-  for (const row of values) {
-    const id = workResultKey([row.code, row.reference]), prior = rows.get(id);
-    rows.set(id, { ...row, affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
-  }
-  return sortWorkResults(rows.values());
-}
-export function mergeWorkConflicts(values: readonly WorkFrozen<WorkConflict>[]): WorkFrozen<WorkConflict>[] {
-  const rows = new Map<string, WorkFrozen<WorkConflict>>();
-  for (const row of values) {
-    const id = workResultKey([row.kind, row.id]), prior = rows.get(id);
-    rows.set(id, { ...row, digests: sortWorkResults([...(prior?.digests ?? []), ...row.digests]),
-      affectedObligations: sortWorkResults([...(prior?.affectedObligations ?? []), ...row.affectedObligations]) });
-  }
-  return sortWorkResults(rows.values());
-}
-export function freezeWork<T>(value: T): WorkFrozen<T> {
-  if (value !== null && typeof value === "object") {
-    for (const child of Object.values(value)) freezeWork(child);
-    Object.freeze(value);
-  }
-  return value as WorkFrozen<T>;
-}

package/src/work-ledger-occurrences.ts

@@ -1,99 +0,0 @@
-import { workResultKey as key, sortWorkResults as sorted, mergeWorkProblems } from "./work-ledger-json.ts";
-import { workEventConflictSources, type indexWorkLedgerText } from "./work-ledger-projection.ts";
-import type {
-  WorkFrozen, WorkSnapshot, WorkOccurrenceEvent, WorkOccurrencePayload, WorkAttempt,
-  WorkAttemptBinding, WorkRuntime, WorkProblem, WorkConflict,
-} from "./work-ledger-types.ts";
-
-type Occurrence = WorkFrozen<WorkOccurrenceEvent>;
-type Problem = WorkFrozen<WorkProblem>;
-const eventRef = (e: Occurrence) => ({ eventId: e.eventId, digest: e.digest });
-const emptyLabels = (): WorkOccurrencePayload["labels"] => ({ sessionId: null, branchLeafId: null,
-  toolCallId: null, taskId: null, workspaceId: null, definitionDigest: null, configurationDigest: null, modelId: null, effortId: null });
-
-/** @internal One governed execution identity, many explicit work associations. No acceptance inferred. */
-export function foldWorkOccurrences(index: ReturnType<typeof indexWorkLedgerText>, snapshot: WorkFrozen<WorkSnapshot>) {
-  const groups = new Map<string, Occurrence[]>();
-  const effectiveRefs = new Set(index.effectiveEvents.map(e => key({ eventId: e.eventId, digest: e.digest })));
-  for (const event of index.candidates) if (event.event === "work_occurrence") {
-    const group = groups.get(event.payload.executionId) ?? [];
-    group.push(event); groups.set(event.payload.executionId, group);
-  }
-  const effective = new Map([...groups].map(([id, group]) => [id, group.filter(e => effectiveRefs.has(key(eventRef(e))))]));
-  const selectedObligations = new Set(snapshot.bindings.map(b => key(b.obligation)));
-  const selectedJoin = (e: Occurrence) => key(e.payload.scope) === key(snapshot.scope) && selectedObligations.has(key(e.payload.obligation));
-  const attempts: WorkFrozen<WorkAttempt>[] = [], occurrences: WorkFrozen<WorkRuntime>["occurrences"][number][] = [];
-  const allProblems: Problem[] = [], conflicts: WorkFrozen<WorkConflict>[] = [];
-  const eventProblems = new Map<string, readonly Problem[]>();
-  for (const [executionId, candidates] of groups) {
-    const clean = effective.get(executionId)!;
-    const bindings = new Map<string, WorkFrozen<WorkAttemptBinding>>();
-    for (const event of clean.filter(selectedJoin)) {
-      const p = event.payload, id = key([p.scope, p.obligation]), prior = bindings.get(id);
-      bindings.set(id, { scope: p.scope, obligation: p.obligation,
-        variantIds: sorted([...(prior?.variantIds ?? []), ...(p.variantId ? [p.variantId] : [])]),
-        artifacts: sorted([...(prior?.artifacts ?? []), ...(p.artifact ? [p.artifact] : [])]),
-      });
-    }
-    const affected = sorted([...bindings.values()].map(b => b.obligation));
-    const problems: Problem[] = [];
-    const problem = (code: WorkProblem["code"], id = executionId) => problems.push({ code, reference: { type: "execution", id }, affectedObligations: affected });
-    const badSources = sorted(candidates.flatMap(e => workEventConflictSources(index, e)));
-    for (const ref of badSources) problems.push({ code: "EVENT_CONFLICT", reference: { type: "event", ref }, affectedObligations: affected });
-    if (bindings.size) for (const id of sorted(badSources.map(ref => ref.eventId))) {
-      conflicts.push({ kind: "event", id, digests: index.conflictingEvents.filter(ref => ref.eventId === id).map(ref => ref.digest), affectedObligations: affected });
-    }
-    const parents = sorted(clean.map(e => e.payload.parentExecutionId));
-    const children = sorted(clean.flatMap(e => e.payload.childId ? [e.payload.childId] : []));
-    const identityConflict = parents.length > 1 || children.length > 1;
-    if (identityConflict) problem("OCCURRENCE_CONFLICT");
-    let parentExecutionId = parents.length === 1 ? parents[0] : null;
-    let childId = children.length === 1 ? children[0] : null;
-    const observed = clean.filter(e => e.payload.provenance === "observed");
-    const declaredLabels = sorted(clean.filter(e => e.payload.provenance === "declared").map(e => e.payload.labels));
-    const observedLabels = sorted(observed.map(e => e.payload.labels));
-    const effectiveLabels = emptyLabels();
-    for (const label of Object.keys(effectiveLabels) as Array<keyof WorkOccurrencePayload["labels"]>) {
-      const values = sorted(observed.flatMap(e => e.payload.labels[label] === null ? [] : [e.payload.labels[label]!]));
-      if (values.length > 1) problem("OBSERVATION_CONFLICT");
-      else effectiveLabels[label] = values[0] ?? null;
-    }
-    const states = new Set(observed.map(e => e.payload.state));
-    const terminalConflict = states.has("completed") && states.has("failed");
-    if (terminalConflict) problem("OBSERVATION_CONFLICT");
-    let state: WorkAttempt["state"] = terminalConflict ? "conflicted" : states.has("completed") ? "completed" :
-      states.has("failed") ? "failed" : states.has("running") ? "running" : states.has("starting") ? "starting" : "unknown";
-    if (identityConflict || badSources.length) {
-      state = "conflicted"; parentExecutionId = null; childId = null;
-      Object.assign(effectiveLabels, emptyLabels());
-    } else {
-      const seen = new Set([executionId]);
-      let parent = parentExecutionId;
-      while (parent !== null) {
-        if (seen.has(parent)) { problem("PARENT_CYCLE", parent); break; }
-        seen.add(parent);
-        const bodies = effective.get(parent);
-        if (!bodies?.length) { problem("PARENT_MISSING", parent); break; }
-        const alternatives = sorted(bodies.map(e => e.payload.parentExecutionId));
-        if (alternatives.length !== 1) { problem("OCCURRENCE_CONFLICT", parent); break; }
-        parent = alternatives[0];
-      }
-      if (effectiveLabels.branchLeafId === null) problem("BRANCH_UNKNOWN");
-    }
-    const rowProblems = mergeWorkProblems(problems);
-    // Support closure can name an occurrence even when its association is not selected. Keep its
-    // global identity diagnostics available internally; only selected joins become public attempts.
-    for (const candidate of candidates) eventProblems.set(key(eventRef(candidate)), rowProblems);
-    if (!bindings.size) continue;
-    allProblems.push(...rowProblems);
-    occurrences.push(...candidates.map(e => ({ event: eventRef(e), payload: e.payload })));
-    attempts.push({ executionId, bindings: sorted(bindings.values()), parentExecutionId, childId, declaredLabels,
-      observedLabels, effectiveLabels, state, resolution: rowProblems.length ? "unresolved" : "resolved", problems: rowProblems });
-  }
-  const runtime: WorkFrozen<WorkRuntime> = { attempts: sorted(attempts), occurrences: sorted(occurrences), counts: {
-    attempts: attempts.length,
-    variants: new Set(attempts.flatMap(a => a.bindings.flatMap(b => b.variantIds))).size,
-    observedCompletedAttempts: attempts.filter(a => a.resolution === "resolved" && a.state === "completed").length,
-  } };
-  return { runtime, problems: mergeWorkProblems(allProblems), conflicts, eventProblems };
-}