reploid 0.0.0-stage → 0.1.0

package/packages/reploid/src/mesh/partitions/partition-attempt-queue.js

@@ -0,0 +1,112 @@
+import queuePolicy from './partition-attempt-queue-policy.json' with { type: 'json' };
+import { assertPartition as assert, partitionFailure } from './partition-contract.js';
+
+export const ATTEMPT_QUEUE_POLICY_SCHEMA = 'reploid.partition-attempt-queue-policy/v1';
+const POLICY_KEYS = Object.freeze(['schema', 'maxQueuedAttempts', 'maxQueuedPerRequester', 'maxQueueWaitMs']);
+const positive = value => Number.isSafeInteger(value) && value > 0;
+
+/** Every member is required and nothing is defaulted in JavaScript. */
+export function validateAttemptQueuePolicy(policy) {
+  const keys = policy && typeof policy === 'object' && !Array.isArray(policy) ? Object.keys(policy) : [];
+  assert(keys.length === POLICY_KEYS.length && POLICY_KEYS.every(key => keys.includes(key))
+    && policy.schema === ATTEMPT_QUEUE_POLICY_SCHEMA
+    && ['maxQueuedAttempts', 'maxQueuedPerRequester', 'maxQueueWaitMs'].every(key => positive(policy[key]))
+    && policy.maxQueuedPerRequester <= policy.maxQueuedAttempts && policy.maxQueueWaitMs <= 2147483647,
+  `Explicit ${ATTEMPT_QUEUE_POLICY_SCHEMA} required: ${POLICY_KEYS.join(', ')}`);
+  return Object.freeze({ ...policy });
+}
+
+/** The partitions component's own waiting bounds, checked when this module loads. */
+export const ATTEMPT_QUEUE_POLICY = validateAttemptQueuePolicy(queuePolicy);
+
+/**
+ * Coordinator admission for already-authorized ordered attempts. An attempt whose route has no
+ * free slot waits here instead of failing; while it waits nothing is tokenized, reserved, granted
+ * or disclosed to any stage. Entries are admitted in arrival order: the earliest waiting entry
+ * whose route can run it now goes first, so one route's limit never idles another route's
+ * capacity and later entries of the same route never overtake earlier ones.
+ *
+ * `admit()` resolves with a ticket the route owner holds until the attempt's coordinator-side
+ * work ends (`release()`); `opened()` marks that the attempt now holds the coordinator stage's
+ * own reservation, so a gate can count tickets that have not yet reserved it. Each gate
+ * `check({ admitted, opening })` sees its key's live tickets and every ticket not yet opened, and
+ * returns true to admit, false to keep waiting, or throws to refuse an entry its route can no
+ * longer run (that error is the entry's failure).
+ *
+ * Bounds fail explicitly: a full queue (overall or for one authenticated requester) with
+ * CAPACITY_QUEUE_FULL; a wait reaching the policy limit, or the attempt's own deadline (its
+ * disclosure window) first, with CAPACITY_QUEUE_TIMEOUT and `bound` 'policy' or 'authorization'.
+ * Cancellation removes the entry with the signal's reason; nothing was held, so nothing settles.
+ */
+export function createPartitionAttemptQueue({ policy, now = Date.now }) {
+  const bounds = validateAttemptQueuePolicy(policy);
+  assert(typeof now === 'function', 'Queue clock required');
+  const waiting = [], tickets = new Set();
+  let opening = 0;
+  const admittedFor = key => [...tickets].filter(ticket => ticket.key === key).length;
+  const ask = entry => entry.check({ admitted: admittedFor(entry.key), opening });
+  function grant(key, queuedAt) {
+    const record = { key, opened: false };
+    tickets.add(record); opening++;
+    const queuedMs = queuedAt === null ? 0 : Math.max(0, now() - queuedAt);
+    return Object.freeze({ queued: queuedAt !== null, queuedMs,
+      opened() { if (!record.opened && tickets.has(record)) { record.opened = true; opening--; } },
+      release() {
+        if (!tickets.delete(record)) return;
+        if (!record.opened) { record.opened = true; opening--; }
+        pump();
+      } });
+  }
+  function settle(entry, error) {
+    const index = waiting.indexOf(entry);
+    if (index < 0) return;
+    waiting.splice(index, 1);
+    clearTimeout(entry.timer); entry.signal?.removeEventListener('abort', entry.onAbort);
+    if (error) entry.reject(error); else entry.resolve(grant(entry.key, entry.queuedAt));
+  }
+  function pump() {
+    for (const entry of [...waiting]) {
+      if (!waiting.includes(entry)) continue;
+      let admit;
+      try { admit = ask(entry) === true; } catch (error) { settle(entry, error); continue; }
+      if (admit) settle(entry, null);
+    }
+  }
+  return Object.freeze({
+    policy: bounds,
+    // Async so every refusal, including an already-aborted signal, is a rejection; the decision and
+    // any enqueueing still happen synchronously, in call order.
+    async admit({ key, attemptId, requesterId, deadlineAt = Infinity, signal, check, onQueued = () => {} }) {
+      assert(key !== undefined && key !== null && typeof attemptId === 'string' && attemptId.length > 0
+        && typeof requesterId === 'string' && requesterId.length > 0 && typeof check === 'function'
+        && typeof onQueued === 'function' && (deadlineAt === Infinity || Number.isFinite(deadlineAt)),
+      'Queued attempt key, identity, authenticated requester and admission check required');
+      signal?.throwIfAborted();
+      assert(!waiting.some(entry => entry.attemptId === attemptId), 'Attempt is already waiting for admission');
+      // Earlier arrivals take any capacity first; an entry that fits after them is admitted at once.
+      pump();
+      const entry = { key, attemptId, requesterId, check, signal, queuedAt: null };
+      let fits;
+      try { fits = ask(entry) === true; } catch (error) { return Promise.reject(error); }
+      if (fits) return Promise.resolve(grant(key, null));
+      const at = now(), policyAt = at + bounds.maxQueueWaitMs, limit = Math.min(policyAt, deadlineAt);
+      const bound = deadlineAt < policyAt ? 'authorization' : 'policy';
+      if (limit <= at) return Promise.reject(partitionFailure('CAPACITY_QUEUE_TIMEOUT', { bound }));
+      if (waiting.length >= bounds.maxQueuedAttempts
+        || waiting.filter(row => row.requesterId === requesterId).length >= bounds.maxQueuedPerRequester) {
+        return Promise.reject(partitionFailure('CAPACITY_QUEUE_FULL'));
+      }
+      const { promise, resolve, reject } = Promise.withResolvers();
+      Object.assign(entry, { resolve, reject, queuedAt: at });
+      entry.timer = setTimeout(() => settle(entry, partitionFailure('CAPACITY_QUEUE_TIMEOUT', { bound })), limit - at);
+      entry.onAbort = () => settle(entry, signal.reason ?? new Error('Queued attempt cancelled'));
+      signal?.addEventListener('abort', entry.onAbort, { once: true });
+      waiting.push(entry);
+      try { onQueued({ position: waiting.length, queuedAt: at, waitUntil: limit }); } catch {}
+      return promise;
+    },
+    /** Re-evaluate waiting entries after capacity may have changed. */
+    pump,
+    getState: () => ({ queued: waiting.length, admitted: tickets.size, opening, ...bounds })
+  });
+}

package/packages/reploid/src/mesh/partitions/partition-canonical-contract.js

@@ -0,0 +1,167 @@
+import { assertPartition as assert, samePartitionIdentity, canonicalPartitionBinding,
+  partitionActivationContract, matchingPartitionActivation } from './partition-contract.js';
+import { verifyPartitionStageCommit } from './partition-stage-commit.js';
+import { PUBLICATION_RECEIPT_SCHEMA } from './partition-ordered-publication.js';
+import { sha256Hex } from '../../artifacts/signatures.js';
+
+const SCHEMA = 'reploid.canonical-partition-request/v1';
+const stepKeys = ['schema', 'operation', 'phase', 'identity', 'canonicalAttempt', 'generationId', 'sequence',
+  'step', 'tokenPosition', 'inputTokenCount', 'inputTokenIds', 'baseCursorId', 'baseCursor', 'grant', 'continuation'];
+const exact = (value, keys) => assert(value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key)), 'Invalid canonical wire fields');
+
+/** Wire admission only. Doppler owns the declared tensor/cursor/publication contracts. */
+export function createCanonicalPartitionContract({ runtime, plan, planId, modelIdentity }) {
+  for (const name of ['metadataDigest', 'tokenDigest', 'residentAttemptDigest', 'validateResidentAttemptIdentity',
+    'validateResidentCursor', 'validateOrdinaryActivation', 'validateExecutionPublication', 'validateAdmissionPublication',
+    'serializeActivationFrame', 'validateActivationFrameForPlan']) assert(typeof runtime?.[name] === 'function', `Canonical partition capability required: ${name}`);
+  plan = structuredClone(plan);
+  const layout = partitionActivationContract(runtime, plan);
+  const hash = (schema, value) => runtime.metadataDigest(schema, value);
+  const equal = (a, b) => hash('reploid.canonical-wire-value/v1', a) === hash('reploid.canonical-wire-value/v1', b);
+  const binding = request => {
+    assert(equal(request.identity, canonicalPartitionBinding(request.identity)), 'Unknown canonical identity fields');
+    assert(request.schema === SCHEMA && request.identity.modelId === plan.modelId && request.identity.modelIdentity === modelIdentity
+      && request.identity.planId === planId, 'Canonical wire model/plan mismatch');
+    const attempt = runtime.validateResidentAttemptIdentity(request.canonicalAttempt);
+    assert(attempt.routeKind === 'two-stage-layer' && attempt.attemptId === request.identity.attemptId
+      && attempt.requesterId === request.identity.requesterId && attempt.generationId === request.generationId
+      && attempt.stages[0].participantId === request.identity.participantA && attempt.stages[1].participantId === request.identity.participantB,
+    'Canonical wire attempt mismatch');
+    assert(equal(attempt, request.grant.claim.canonicalAttempt) && request.grant.claim.vocabSize === plan.vocabSize
+      && request.grant.claim.generation.generationId === attempt.generationId, 'Canonical wire grant binding mismatch');
+    assert(Number.isSafeInteger(request.sequence) && request.sequence >= 0 && request.step === request.sequence,
+      'Canonical wire sequence mismatch');
+    return attempt;
+  };
+  const activationHeader = (request, byteLength, payloadDigest) => {
+    const attempt = binding(request);
+    assert(Number.isSafeInteger(request.tokenPosition) && request.tokenPosition >= 0
+      && Number.isSafeInteger(request.inputTokenCount) && request.inputTokenCount > 0
+      && Array.isArray(request.inputTokenIds) && request.inputTokenIds.length === request.inputTokenCount,
+    'Canonical token row mismatch');
+    const inputDigest = runtime.tokenDigest(request.inputTokenIds, plan.vocabSize, request.grant.claim.limits.maxPromptTokens);
+    let tokenContextDigest = inputDigest;
+    if (request.sequence === 0) assert(request.baseCursor === null && request.baseCursorId === null && request.tokenPosition === 0 && attempt.inputDigest === inputDigest,
+      'Canonical bootstrap parent mismatch');
+    else {
+      const cursor = runtime.validateResidentCursor(request.baseCursor, request.grant.claim.generation.policy, plan.vocabSize);
+      assert(cursor.cursorId === request.baseCursorId && cursor.generationId === attempt.generationId && !cursor.terminal
+        && cursor.revision + 1 === request.sequence && cursor.materializedTokenCount === request.tokenPosition
+        && request.inputTokenCount === 1 && request.inputTokenIds[0] === cursor.pendingTokenId, 'Canonical decode parent mismatch');
+      tokenContextDigest = cursor.acceptedTokenDigest;
+    }
+    const expectedBytes = request.inputTokenCount * plan.hiddenSize * layout.elementStrideBytes;
+    assert(Number.isSafeInteger(expectedBytes) && byteLength === expectedBytes
+      && byteLength <= request.grant.claim.limits.maxActivationBytes && /^sha256:[a-f0-9]{64}$/.test(payloadDigest),
+    'Canonical activation byte bound mismatch');
+    return { schema: 'doppler.ordinary-activation/v1', attemptDigest: runtime.residentAttemptDigest(attempt),
+      sequence: request.sequence, baseCursorId: request.baseCursorId, proposalId: null,
+      sourceStageId: attempt.stages[0].stageId, destinationStageId: attempt.stages[1].stageId,
+      rows: { start: request.tokenPosition, end: request.tokenPosition + request.inputTokenCount }, tokenContextDigest,
+      layout: { dtype: layout.dtype, precision: layout.precision, components: layout.components,
+        elementStrideBytes: layout.elementStrideBytes, hiddenSize: plan.hiddenSize, byteOrder: 'little-endian' },
+      payloadBytes: byteLength, payloadDigest };
+  };
+  const validateHeader = (request, byteLength) => {
+    try {
+      hash(SCHEMA, request); exact(request, [...stepKeys, 'frame']);
+      const frame = request.frame;
+      exact(frame.metadata, ['identity', 'activation']);
+      assert(samePartitionIdentity(frame.metadata.identity, request.identity)
+        && equal(frame.metadata.identity, canonicalPartitionBinding(request.identity)), 'Canonical frame identity mismatch');
+      assert(request.phase === 'step' && request.operation === 'step' && frame.schema === layout.schema
+        && matchingPartitionActivation(frame, layout, true) && frame.step === request.step && frame.seqOffset === request.tokenPosition
+        && equal(frame.shape, [1, request.inputTokenCount, plan.hiddenSize]) && frame.byteLength === byteLength,
+      'Canonical tensor header mismatch');
+      return equal(frame.metadata.activation, activationHeader(request, byteLength, frame.metadata.activation.payloadDigest));
+    } catch { return false; }
+  };
+  return Object.freeze({
+    schema: SCHEMA, validateBinding: binding, validateHeader,
+    validateControl(request) {
+      try {
+        hash(SCHEMA, request); const attempt = binding(request);
+        if (request.operation === 'settle') {
+          exact(request, ['schema', 'operation', 'identity', 'canonicalAttempt', 'generationId', 'sequence', 'step', 'grant']);
+          return true;
+        }
+        if (request.operation === 'published') {
+          exact(request, [...stepKeys, 'publication', 'receipt', 'commits']);
+          return request.phase === 'published';
+        }
+        exact(request, stepKeys);
+        return ['reserve', 'admit'].includes(request.operation) && request.phase === 'admit'
+          && request.sequence === 0 && request.tokenPosition === 0 && request.baseCursor === null && request.baseCursorId === null
+          && request.inputTokenIds?.length === request.inputTokenCount
+          && runtime.tokenDigest(request.inputTokenIds, plan.vocabSize, request.grant.claim.limits.maxPromptTokens) === attempt.inputDigest;
+      } catch { return false; }
+    },
+    async fingerprint(request) {
+      const { payload = new Uint8Array(), ...metadata } = structuredClone(request);
+      assert(payload instanceof Uint8Array, 'Canonical payload bytes required');
+      return hash('reploid.canonical-partition-request-digest/v1', { metadata,
+        payloadBytes: payload.byteLength, payloadDigest: await sha256Hex(payload) });
+    },
+    async serializeActivation(request) {
+      const { activationTensor: source, ...metadata } = request;
+      hash(SCHEMA, metadata);
+      assert(source?.data?.byteLength <= request.grant.claim.limits.maxActivationBytes, 'Canonical activation exceeds grant');
+      const { activationTensor, ...control } = structuredClone(request);
+      request = control;
+      assert(activationTensor?.data?.byteLength <= request.grant.claim.limits.maxActivationBytes, 'Canonical activation exceeds grant');
+      const frame = { ...runtime.serializeActivationFrame({ ...activationTensor, metadata: {} }) };
+      const payload = new Uint8Array(frame.buffer);
+      frame.metadata = { identity: canonicalPartitionBinding(request.identity),
+        activation: activationHeader(request, payload.byteLength, await sha256Hex(payload)) };
+      const { buffer, ...header } = frame;
+      assert(validateHeader({ ...request, frame: header }, payload.byteLength), 'Canonical serialized header mismatch');
+      runtime.validateOrdinaryActivation(frame.metadata.activation, payload,
+        { maxRows: request.grant.claim.limits.maxPromptTokens, maxBytes: request.grant.claim.limits.maxActivationBytes });
+      runtime.validateActivationFrameForPlan(frame, plan);
+      return frame;
+    },
+    validatePayload(request, payload) {
+      const { payload: _receivedBytes, ...metadata } = request;
+      request = metadata;
+      assert(validateHeader(request, payload.byteLength), 'Canonical activation header rejected');
+      const validated = runtime.validateOrdinaryActivation(request.frame.metadata.activation, payload,
+        { maxRows: request.grant.claim.limits.maxPromptTokens, maxBytes: request.grant.claim.limits.maxActivationBytes });
+      return runtime.validateActivationFrameForPlan({ ...request.frame, buffer: validated.bytes.buffer }, plan);
+    },
+    async verifyPublication(request, retained) {
+      try {
+        hash('reploid.canonical-publication-ack/v1', { request, retained });
+        request = structuredClone(request); retained = structuredClone(retained);
+        exact(request, [...stepKeys, 'publication', 'receipt', 'commits']);
+        assert(request.operation === 'published' && request.phase === 'published', 'Publication phase mismatch');
+        const attempt = binding(request), { publication, receipt, commits } = request;
+        assert(publication.sequence === request.sequence, 'Publication acknowledgment sequence mismatch');
+        if (publication.schema === 'doppler.admission-publication/v1') {
+          runtime.validateAdmissionPublication(publication, attempt, request.grant.claim.generation.policy, plan.vocabSize);
+          assert(equal(publication.result, retained) && Array.isArray(commits) && commits.length === 0, 'Admission publication mismatch');
+        } else {
+          runtime.validateExecutionPublication(publication, attempt, request.grant.claim.generation.policy, plan.vocabSize, request.baseCursor);
+          assert(Array.isArray(commits) && commits.length === attempt.stages.length, 'Publication evidence cardinality mismatch');
+          assert(new Set(commits.map(commit => commit.acknowledgment.stageId)).size === commits.length, 'Duplicate publication evidence');
+          for (const stage of attempt.stages) {
+            const commit = commits.find(item => item.acknowledgment.stageId === stage.stageId);
+            const acknowledgment = publication.acknowledgments.find(item => item.stageId === stage.stageId);
+            assert(commit && equal(commit.acknowledgment, acknowledgment)
+              && await verifyPartitionStageCommit({ runtime, attempt, stage, ...commit,
+                transition: retained.transition, sequence: request.sequence, baseCursorId: request.baseCursorId }),
+            'Publication stage evidence mismatch');
+          }
+          assert(equal(retained.commit, commits.find(item => item.acknowledgment.stageId === attempt.stages[1].stageId)), 'Publication differs from retained output-stage result');
+        }
+        exact(receipt, ['schema', 'conversationId', 'writerEpoch', 'index', 'coordinatorEpoch', 'attemptId', 'sequence', 'publicationDigest', 'receiptDigest']);
+        const { receiptDigest, ...body } = receipt;
+        return body.schema === PUBLICATION_RECEIPT_SCHEMA && body.conversationId === request.identity.threadId
+          && body.writerEpoch === attempt.publisherEpoch && body.coordinatorEpoch === attempt.coordinatorEpoch
+          && body.attemptId === attempt.attemptId && body.sequence === request.sequence
+          && body.publicationDigest === publication.publicationDigest && Number.isSafeInteger(body.index) && body.index >= 0
+          && receiptDigest === hash(body.schema, body);
+      } catch { return false; }
+    },
+  });
+}

package/packages/reploid/src/mesh/partitions/partition-canonical-execution.js

@@ -0,0 +1,168 @@
+import { createCanonicalPartitionContract } from './partition-canonical-contract.js';
+import { verifyPartitionStageCommit } from './partition-stage-commit.js';
+import { assertPartition as assert } from './partition-contract.js';
+
+/** One ordinary canonical attempt, inside the existing runner's allocation,
+ * FIFO lease and settlement owner. No scheduler, sampler or recovery loop. */
+export async function executeCanonicalPartition({ runtime, plan, deviceA, deviceB, policy, binding, authority,
+  canonical, tokenIds, signal, lease, permit, onDelta, receipt, ownDevice }) {
+  assert(runtime.hashLayerPartitionPlan(plan) === binding.planId, 'Canonical selected plan identity mismatch');
+  const publicationOwner = canonical.publication;
+  assert(publicationOwner?.requiresCommitEvidence === true
+    && ['admitAttempt', 'publish', 'reconcile', 'cancel'].every(name => typeof publicationOwner[name] === 'function'),
+  'Canonical execution requires durable authenticated publication');
+  const hash = (domain, value) => runtime.metadataDigest(domain, value);
+  const same = (a, b) => hash('reploid.canonical-execution-value/v1', a) === hash('reploid.canonical-execution-value/v1', b);
+  hash('reploid.canonical-execution-input/v1', { attempt: canonical.attempt, generation: canonical.generation,
+    deadlineAt: canonical.deadlineAt });
+  const { attempt: selected, generation: supplied, deadlineAt } = structuredClone({ attempt: canonical.attempt,
+    generation: canonical.generation, deadlineAt: canonical.deadlineAt });
+  const attempt = runtime.validateResidentAttemptIdentity(selected);
+  const generation = runtime.canonicalGenerationIdentity(supplied.policy, supplied.executionIdentity, plan.vocabSize);
+  assert(same(generation, supplied) && attempt.generationId === generation.generationId
+    && attempt.attemptId === binding.attemptId && attempt.requesterId === binding.requesterId
+    && attempt.routeKind === 'two-stage-layer' && attempt.stages.length === 2
+    && attempt.inputDigest === runtime.tokenDigest(tokenIds, plan.vocabSize, policy.maxPromptTokens),
+  'Canonical attempt or effective prompt mismatch');
+  assert(generation.policy.maxGeneratedTokens <= policy.maxTokens
+    && generation.policy.maxVisibleOutputUtf16 <= policy.maxOutputCharacters
+    && Number.isSafeInteger(deadlineAt) && deadlineAt > Date.now(), 'Canonical allocation or deadline mismatch');
+  for (const [index, device] of [deviceA, deviceB].entries()) {
+    assert(same(device.getCanonicalGeneration(), generation) && same(device.getCanonicalStage(), attempt.stages[index])
+      && device.id === attempt.stages[index].participantId, 'Canonical resident generation or stage changed');
+  }
+  const contract = createCanonicalPartitionContract({ runtime, plan, planId: binding.planId, modelIdentity: binding.modelIdentity });
+  const expectedAdmission = runtime.admitResidentPrompt(tokenIds, generation.policy, plan.vocabSize, generation.generationId);
+  let cursor = null, previous = null, continuationA = null, continuationB = null, admitted = false, cancellation = null;
+  let content = '', activationBytes = 0, input = [...tokenIds], position = 0, stopReason = null;
+  const tokens = [], steps = [], publications = [];
+  const cancel = () => {
+    if (!cancellation && admitted) cancellation = publicationOwner.cancel(attempt.attemptId, attempt.coordinatorEpoch)
+      .then(() => null, error => error);
+    return cancellation;
+  };
+  const wire = (sequence, phase = 'step') => ({ schema: contract.schema, operation: phase === 'admit' ? 'admit' : 'step', phase,
+    identity: binding, canonicalAttempt: attempt, generationId: generation.generationId, sequence, step: sequence,
+    tokenPosition: position, inputTokenCount: input.length, inputTokenIds: [...input], baseCursorId: cursor?.cursorId ?? null,
+    baseCursor: cursor, grant: authority.executionB, continuation: continuationB });
+  const authorize = async request => {
+    for (const [action, name] of [['mesh.execute_partition_a', 'executionA'], ['mesh.execute_partition_b', 'executionB'],
+      ['mesh.transfer_intermediate_activation', 'activation'], ['mesh.transfer_token_context', 'tokenContext'],
+      ['mesh.transfer_partition_output', 'output']]) {
+      await permit(action, authority[name], { step: request.step, sequence: request.sequence, phase: request.phase,
+        tokenPosition: request.tokenPosition, inputTokenCount: request.inputTokenCount,
+        maxTokens: generation.policy.maxGeneratedTokens, canonicalAttempt: attempt, generationId: generation.generationId });
+    }
+  };
+  const publish = async (request, body, commits) => {
+    const publication = { ...body, publicationDigest: hash(body.schema, body) };
+    await authorize(request);
+    const saved = await publicationOwner.publish(publication, { evidence: commits.map(c => c.evidence) });
+    publications.push({ publication, receipt: saved, commits });
+    // A transaction receipt is not an ephemeral peer acknowledgment. No next
+    // step or UI delivery occurs until the retained B result accepts this one.
+    await deviceB.acknowledgeCanonicalPublication({ ...request, publication, receipt: saved, commits, signal });
+    previous = publication.publicationDigest;
+    return saved;
+  };
+  try {
+    signal.throwIfAborted();
+    const request = wire(0, 'admit');
+    contract.validateBinding(request);
+    await authorize(request);
+    const state = await publicationOwner.reconcile(); previous = state.head;
+    assert(Array.isArray(state.attempts) && !state.attempts.some(item => item.identity.attemptId === attempt.attemptId
+      && item.identity.coordinatorEpoch === attempt.coordinatorEpoch), 'Canonical attempt was already admitted; retries require a fresh identity');
+    await publicationOwner.admitAttempt({ identity: attempt, generationPolicy: generation.policy,
+      executionIdentity: generation.executionIdentity, vocabSize: plan.vocabSize, deadlineAt });
+    admitted = true; signal.addEventListener('abort', cancel, { once: true }); signal.throwIfAborted();
+    await authorize(request);
+    ownDevice(deviceA.id);
+    receipt.reservations.push(structuredClone(await deviceA.reserve(binding)));
+    ownDevice(deviceB.id);
+    const reserved = await deviceB.reserveCanonical({ ...request, signal });
+    receipt.reservations.push(structuredClone(reserved.reservation));
+    await lease(async () => {
+      await authorize(request);
+      const a = await deviceA.admitCanonicalPrompt({ identity: binding, tokenIds: [...tokenIds], generationId: generation.generationId, signal });
+      const b = await deviceB.admitCanonicalPrompt({ ...request, signal });
+      assert(same(a, expectedAdmission) && same(b, expectedAdmission), 'Canonical participant prompt admission differs');
+    });
+    if (!('kind' in expectedAdmission)) {
+      await publish(request, { schema: 'doppler.admission-publication/v1', attemptId: attempt.attemptId,
+        coordinatorEpoch: attempt.coordinatorEpoch, attemptDigest: runtime.residentAttemptDigest(attempt), sequence: 0,
+        expectedRevision: null, previousPublicationDigest: previous, result: expectedAdmission }, []);
+      stopReason = expectedAdmission.stopReason;
+    } else {
+      for (let sequence = 0; sequence < generation.policy.maxGeneratedTokens; sequence++) {
+        const queuedAt = performance.now();
+        const delivery = await lease(async () => {
+          const started = performance.now(), request = wire(sequence);
+          const leaseWaitMs = started - queuedAt;
+          await authorize(request);
+          const a = structuredClone(await deviceA.executeCanonicalGroup0({ identity: binding, canonicalAttempt: attempt,
+            tokenIds: [...input], continuation: continuationA, generationId: generation.generationId,
+            baseCursorId: request.baseCursorId, sequence, step: sequence, tokenPosition: position,
+            inputTokenCount: input.length, executionGrant: authority.executionA, signal }));
+          signal.throwIfAborted();
+          const frame = await contract.serializeActivation({ ...request, activationTensor: a.activationTensor });
+          assert(frame.byteLength <= policy.maxActivationBytes, 'Canonical activation exceeds allocation');
+          await authorize(request);
+          const b = structuredClone(await deviceB.executeCanonicalFrame({ ...request, frame, signal }));
+          signal.throwIfAborted();
+          assert(b && same(b.identity, binding) && b.step === sequence && b.tokenPosition === position
+            && await verifyPartitionStageCommit({ runtime, attempt, stage: attempt.stages[1], ...b.commit,
+              transition: b.transition, sequence, baseCursorId: request.baseCursorId }), 'Unauthenticated canonical output decision');
+          await authorize(request);
+          const committed = structuredClone(await deviceA.commitCanonicalTransition({ identity: binding, canonicalAttempt: attempt,
+            generationId: generation.generationId, sequence, baseCursorId: request.baseCursorId,
+            transition: b.transition, targetCommit: b.commit, signal }));
+          assert(same(committed.transition, b.transition) && await verifyPartitionStageCommit({ runtime, attempt,
+            stage: attempt.stages[0], ...committed.commit, transition: b.transition, sequence, baseCursorId: request.baseCursorId }),
+          'Canonical input stage did not commit the authenticated decision');
+          const transition = committed.transition;
+          assert(transition.acceptedTokenIds.length === 1 && typeof transition.delta === 'string'
+            && content.length + transition.delta.length <= policy.maxOutputCharacters, 'Canonical ordinary result exceeds allocation');
+          const body = { schema: 'doppler.execution-publication/v2', attemptId: attempt.attemptId,
+            coordinatorEpoch: attempt.coordinatorEpoch, attemptDigest: runtime.residentAttemptDigest(attempt), sequence,
+            expectedRevision: cursor?.revision ?? null, previousPublicationDigest: previous, baseCursorId: request.baseCursorId,
+            decisionId: committed.commit.acknowledgment.decisionId, acceptedTokenIds: transition.acceptedTokenIds,
+            tokenRange: transition.tokenRange, successor: transition.successor,
+            delta: { text: transition.delta, outputDigest: transition.outputDigest }, stoppingOutcome: transition.successor.stopReason,
+            acknowledgments: [committed.commit.acknowledgment, b.commit.acknowledgment] };
+          const value = { ...body, publicationDigest: hash(body.schema, body) };
+          runtime.validateExecutionPublication(value, attempt, generation.policy, plan.vocabSize, cursor);
+          return { request, body, commits: [committed.commit, b.commit], transition,
+            continuationA: a.continuation, continuationB: b.continuation, bytes: frame.byteLength,
+            leaseWaitMs, elapsedMs: performance.now() - started };
+        });
+        // Durable storage and remote acknowledgment retain this attempt's parent
+        // barrier, but must not hold another conversation's numerical lease.
+        await publish(delivery.request, delivery.body, delivery.commits);
+        cursor = delivery.transition.successor;
+        continuationA = delivery.continuationA; continuationB = delivery.continuationB;
+        tokens.push(...delivery.transition.acceptedTokenIds); content += delivery.transition.delta;
+        activationBytes += delivery.bytes;
+        steps.push({ sequence, step: sequence, tokenPosition: position, inputTokenCount: input.length,
+          tokenId: delivery.transition.acceptedTokenIds[0], activationBytes: delivery.bytes, leaseWaitMs: delivery.leaseWaitMs,
+          elapsedMs: delivery.elapsedMs, outputDeliveryMs: 0 });
+        position = cursor.materializedTokenCount; input = [cursor.pendingTokenId]; stopReason = cursor.stopReason;
+        signal.throwIfAborted();
+        if (delivery.transition.delta) {
+          const started = performance.now();
+          try { await onDelta(delivery.transition.delta); } finally { steps.at(-1).outputDeliveryMs = performance.now() - started; }
+        }
+        signal.throwIfAborted();
+        if (cursor.terminal) break;
+      }
+      assert(cursor?.terminal, 'Canonical generation did not reach its declared stopping outcome');
+    }
+    return { content, tokenIds: tokens, logits: null, stopReason,
+      execution: { schema: 'reploid.mesh.canonical-partition-execution/v1', ...binding, canonicalAttempt: attempt,
+        placement: 'two-device-layer-partition', splitLayer: plan.splitLayer, activationBytes, steps, publications, settlement: receipt } };
+  } catch (error) {
+    const cancellationError = await cancel();
+    if (cancellationError) throw new AggregateError([error, cancellationError], 'Canonical execution and publication settlement failed');
+    throw error;
+  } finally { signal.removeEventListener('abort', cancel); }
+}

package/packages/reploid/src/mesh/partitions/partition-chat-canonical.js

@@ -0,0 +1,49 @@
+import { assertPartition as assert, canonicalPartitionJson } from './partition-contract.js';
+import { validateEntryPublicationContext } from './partition-entry-publication.js';
+
+/** Fixed two-stage chat composition. Actual residents supply generation/stages;
+ * Doppler and the existing grant owner supply attempt and disclosure identities. */
+export function createCanonicalChatBinding({ runtime, local, remote, authority, model, plan, planId, limits, coordinatorEpoch }) {
+  assert(/^[a-f0-9]{32}$/.test(coordinatorEpoch) && ['metadataDigest', 'canonicalGenerationIdentity',
+    'validateResidentAttemptIdentity', 'tokenDigest', 'hashLayerPartitionPlan'].every(name => typeof runtime[name] === 'function')
+    && ['canonicalScope', 'issueCanonical'].every(name => typeof authority[name] === 'function')
+    && [local, remote].every(device => ['getCanonicalStage', 'getCanonicalGeneration'].every(name => typeof device[name] === 'function')),
+  'Canonical chat requires declared runtime, grant and resident capabilities');
+  assert(runtime.hashLayerPartitionPlan(plan) === planId, 'Canonical chat plan mismatch');
+  const same = (a, b) => canonicalPartitionJson(a) === canonicalPartitionJson(b);
+  const grantLimits = Object.fromEntries(['maxTokens', 'maxPromptTokens', 'maxActivationBytes', 'maxOutputCharacters']
+    .map(key => [key, limits[key]]));
+  const describe = () => {
+    const supplied = local.getCanonicalGeneration(), target = remote.getCanonicalGeneration();
+    const stages = [local.getCanonicalStage(), remote.getCanonicalStage()];
+    if (!supplied || !target || stages.some(stage => !stage)) return null;
+    const generation = runtime.canonicalGenerationIdentity(supplied.policy, supplied.executionIdentity, plan.vocabSize);
+    assert(same(generation, supplied) && same(generation, target), 'Canonical stages use different generation contracts');
+    assert(generation.policy.maxGeneratedTokens <= limits.maxTokens
+      && generation.policy.maxVisibleOutputUtf16 <= limits.maxOutputCharacters, 'Canonical generation exceeds chat allocation');
+    const routeId = runtime.metadataDigest('reploid.canonical-chat-route/v1', { meshId: authority.meshId,
+      modelId: model.id, modelIdentity: model.identity, planId, coordinatorEpoch, stages, generationId: generation.generationId });
+    return { coordinatorEpoch, routeId, stages, generation, vocabSize: plan.vocabSize };
+  };
+  const check = (context, binding, publication) => {
+    validateEntryPublicationContext(context, binding);
+    const current = describe();
+    assert(current && Object.keys(current).every(key => same(current[key], context[key])), 'Canonical chat placement or generation changed');
+    assert(context.deadlineAt > Date.now() && publication?.requiresCommitEvidence === true
+      && ['reconcile', 'admitAttempt', 'publish', 'cancel'].every(name => typeof publication[name] === 'function'),
+    'Canonical requester publication or deadline unavailable');
+    return structuredClone(context);
+  };
+  return Object.freeze({ describe, check,
+    attempt({ context, binding, publication, tokenIds }) {
+      context = check(context, binding, publication);
+      return runtime.validateResidentAttemptIdentity({ schema: 'doppler.resident-attempt/v2', attemptId: binding.attemptId,
+        requesterId: binding.requesterId, inputDigest: runtime.tokenDigest(tokenIds, plan.vocabSize, limits.maxPromptTokens),
+        authorizationScope: authority.canonicalScope({ identity: binding, limits: grantLimits,
+          disclosure: 'partition-activations-and-tokens', generationId: context.generation.generationId }),
+        routeId: context.routeId, generationId: context.generation.generationId, coordinatorEpoch, publisherEpoch: context.publisherEpoch,
+        routeKind: 'two-stage-layer', stages: context.stages });
+    },
+    grantLimits: Object.freeze(grantLimits),
+  });
+}

package/packages/reploid/src/mesh/partitions/partition-chat.js

@@ -0,0 +1,125 @@
+import { partitionAdapterIdentities, samePartitionAdapters } from './partition-contract.js';
+import { TEXT_GENERATION_CAPABILITY, requireGenerationCapability, boundedGeneration, tokenUsage } from './partition-generation-request.js';
+import { createOrderedPartitionChat } from './partition-ordered-chat.js';
+import { createCanonicalChatBinding } from './partition-chat-canonical.js';
+import { createLayerPartitionRunner } from './partition-runner.js';
+import { assertPartition as assert, canonicalPartitionJson, canonicalPartitionBinding, partitionFingerprint } from './partition-contract.js';
+
+/** Conversation adapter for a fixed, explicitly prepared local A and authenticated remote B. */
+export function createPartitionChat({ runtime, local, remote, authority, model, plan, planId, limits, grantTtlMs, canonical = null, ordered = null, authorizeRequester = null, now = Date.now }) {
+  if (ordered !== null) {
+    assert(canonical === null, 'Ordered chat does not enable canonical decoding; it publishes through the requester-owned writer');
+    return createOrderedPartitionChat({ runtime, authority, model, plan, planId, limits, grantTtlMs, ordered, authorizeRequester, now });
+  }
+  assert(local.index === 0 && local.id === authority.participantId && remote.id !== local.id,
+    'Partition chat requires the input owner at A and a distinct authenticated B');
+  assert(Number.isSafeInteger(grantTtlMs) && grantTtlMs > 0, 'Explicit partition grant lifetime required');
+  // Requesters select a prepared route; opening artifacts and execution policy
+  // remain with its contributor. Signed Capsule evidence can exceed the control
+  // frame budget and must not be copied into capability advertisements/history.
+  assert(canonicalPartitionJson(plan.adapterIdentities || []) === canonicalPartitionJson(partitionAdapterIdentities(model)), 'Partition plan adapter binding mismatch');
+  const selection = { id: model.id, name: model.name, identity: model.identity,
+    adapters: structuredClone(model.adapters || []), selectionId: model.id + '/partition/' + planId,
+    partition: { planId, participantA: local.id, participantB: remote.id } };
+  for (const key of ['provider', 'contextLength', 'quantization', 'size', 'recommended']) {
+    if (model[key] !== undefined) selection[key] = structuredClone(model[key]);
+  }
+  const policy = structuredClone(limits);
+  const canonicalBinding = canonical === null ? null : createCanonicalChatBinding({ runtime, local, remote, authority,
+    model, plan, planId, limits: policy, coordinatorEpoch: canonical.coordinatorEpoch });
+  const listeners = new Set();
+  let closed = false;
+  const models = () => {
+    const description = canonicalBinding?.describe() ?? null;
+    return [{ ...structuredClone(selection), ...(canonicalBinding ? {} : {textGeneration: TEXT_GENERATION_CAPABILITY}), ...(description ? { canonical: description } : {}),
+    availability: closed || canonicalBinding && !description ? 'unavailable' : local.getState().ready && remote.getState().ready ? 'ready'
+      : local.getState().phase === 'loading' ? 'loading' : 'unavailable',
+    providerIds: [local.id, remote.id], placement: 'two-device-layer-partition' }];
+  };
+  const notify = () => { for (const listener of listeners) { try { listener(models()); } catch {} } };
+  const unsubscribers = [local.subscribe(notify), remote.subscribe(notify)];
+  const runner = createLayerPartitionRunner({ runtime, plan, deviceA: local, deviceB: remote, limits: policy, canonical: canonicalBinding !== null,
+    authorize: request => (local.canAccept ? local.canAccept(request) : local.getState().ready)
+      ? authority.verify(request.grant, canonicalBinding ? { identity: canonicalPartitionBinding(request), action: request.action,
+        canonicalAttempt: request.canonicalAttempt, generationId: request.generationId, phase: request.phase,
+        step: request.step, inputTokenCount: request.inputTokenCount } : { ...request, identity: request }) : Promise.resolve(false) });
+  return Object.freeze({
+    getModels: models,
+    getState: () => runner.getState(),
+    subscribe(listener) { listeners.add(listener); listener(models()); return () => listeners.delete(listener); },
+    async refresh(options) { await remote.refresh(options); notify(); return models(); },
+    async generate(request, controls) {
+      // Keep caller-owned request metadata stable through approval and tokenization.
+      request = structuredClone(request);
+      const requested = requireGenerationCapability(models()[0], request.generationRequest, !!canonicalBinding);
+      assert(!requested || requested.maxOutputTokens <= policy.maxTokens, 'Caller token limit exceeds route budget');
+      const delegated = request.participantId !== local.id;
+      assert(!!canonicalBinding === (request.canonical !== undefined), 'Explicit canonical chat context required');
+      assert(!closed && request.meshId === authority.meshId && request.model.id === selection.id
+        && request.model.identity === selection.identity && samePartitionAdapters(request.model, selection)
+        && request.model.partition && canonicalPartitionJson(request.model.partition) === canonicalPartitionJson(selection.partition), 'Partition chat selection mismatch');
+      if (delegated) assert(typeof authorizeRequester === 'function'
+        && await authorizeRequester(request, controls.signal) === true
+        && Number.isSafeInteger(request.placementGeneration) && request.placementGeneration >= 0,
+      'Remote input owner must authorize this execution placement');
+      assert(request.permissions?.sharingScope && request.permissions.sharingScope !== 'local', 'Partition disclosure is disabled');
+      controls.signal.throwIfAborted();
+      await remote.refresh({ signal: controls.signal });
+      assert(models()[0].availability === 'ready', 'No ready contributors for this partition plan');
+      const identity = { ...selection.partition, modelId: selection.id, modelIdentity: selection.identity,
+        threadId: request.threadId, attemptId: request.attemptId,
+        ...(delegated || canonicalBinding ? { requesterId: request.participantId, placementGeneration: request.placementGeneration ?? 0 } : {}) };
+      const context = canonicalBinding?.check(request.canonical, identity, controls.publication);
+      const approved = await controls.requestApproval({ id: crypto.randomUUID(), threadId: request.threadId,
+        attemptId: request.attemptId, peerId: remote.id, recipientIdentity: remote.id,
+        modelId: selection.id, modelIdentity: selection.identity, adapterIdentities: partitionAdapterIdentities(selection),
+        operation: 'generate-partition', disclosure: 'partition-activations-and-tokens', ...selection.partition,
+        expiresAt: now() + grantTtlMs,
+        input: { messages: structuredClone(request.messages), ...(requested ? {generationRequest: requested} : {}),
+          disclosure: 'Intermediate model activations and prompt token context are disclosed to the selected participant for sampling.' } });
+      controls.signal.throwIfAborted();
+      assert(approved === true, 'Partition disclosure was declined');
+      assert(!closed, 'Partition chat closed during approval');
+      let grant = null;
+      let sequence = 0;
+      try {
+        const input = await local.tokenize({ messages: request.messages, identity, signal: controls.signal });
+        controls.signal.throwIfAborted();
+        assert(!closed, 'Partition chat closed during tokenization');
+        assert(input.modelIdentity === selection.identity, 'Doppler tokenization model mismatch');
+        if (!canonicalBinding) assert(input.generation
+          && Number.isSafeInteger(input.generation.maxTokens) && input.generation.maxTokens > 0
+          && input.generation.maxTokens <= policy.maxTokens, 'Doppler tokenization or generation contract mismatch');
+        const generation = boundedGeneration(input.generation, requested);
+        if (requested) {
+          await controls.onUsage?.({threadId: request.threadId, attemptId: request.attemptId, ...tokenUsage(input.tokenIds.length, 0, requested)});
+          controls.signal.throwIfAborted();
+        }
+        const attempt = canonicalBinding?.attempt({ context, binding: identity, publication: controls.publication, tokenIds: input.tokenIds });
+        grant = canonicalBinding
+          ? await authority.issueCanonical(identity, canonicalBinding.grantLimits, { approved: true, ttlMs: grantTtlMs,
+            disclosure: 'partition-activations-and-tokens', generation: context.generation, canonicalAttempt: attempt, vocabSize: plan.vocabSize })
+          : await authority.issue(identity, policy, { approved: true, ttlMs: grantTtlMs,
+            disclosure: 'partition-activations-and-tokens', generationDigest: await partitionFingerprint(generation) });
+        controls.onState({ threadId: request.threadId, attemptId: request.attemptId, status: 'executing',
+          execution: { placement: 'two-device-layer-partition', ...selection.partition } });
+        const run = { tokenIds: input.tokenIds, identity,
+          grants: { executionA: grant, executionB: grant, activation: grant, tokenContext: grant, output: grant }, signal: controls.signal,
+          onDelta: text => controls.onDelta({ threadId: request.threadId, attemptId: request.attemptId, sequence: sequence++, text }) };
+        const result = canonicalBinding
+          ? await runner.executeCanonical({ ...run, canonical: { attempt, generation: context.generation,
+            publication: controls.publication, deadlineAt: context.deadlineAt } })
+          : await runner.execute({ ...run, generation, maxTokens: generation.maxTokens });
+        return { threadId: request.threadId, attemptId: request.attemptId, modelId: result.execution.modelId,
+          modelIdentity: result.execution.modelIdentity, adapterIdentities: partitionAdapterIdentities(selection), content: result.content,
+          ...(requested ? {usage: tokenUsage(input.tokenIds.length, result.tokenIds.length, requested)} : {}),
+          execution: { ...result.execution, provider: 'peer', transport: remote.getState().receipt } };
+      } finally {
+        if (grant) authority.revoke(grant);
+        // Also settles tokenization failure before the runner acquired an attempt.
+        await local.closeAttempt({ identity });
+      }
+    },
+    async close() { closed = true; unsubscribers.forEach(unsubscribe => unsubscribe()); await runner.close(); listeners.clear(); }
+  });
+}