reploid 0.0.0-stage → 0.1.1

package/server/native-canonical-epochs.js

@@ -0,0 +1,90 @@
+/** Durable native process epochs and the existing resident owner's unsettled marker. */
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+const assert = (ok, message) => { if (!ok) throw Error('Native canonical epochs: ' + message); };
+const epoch = value => typeof value === 'string' && /^[a-f0-9]{32}$/.test(value);
+const text = value => typeof value === 'string' && value.length > 0 && value.length <= 256;
+const fresh = () => randomBytes(16).toString('hex');
+
+export async function openNativeCanonicalEpochs({ directory, participantId, meshId }) {
+  assert(text(directory) && text(participantId) && text(meshId), 'explicit directory and authenticated scope required');
+  const { DatabaseSync } = await import('node:sqlite');
+  await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+  const filename = path.join(await fs.realpath(directory), 'canonical-epochs.sqlite');
+  const file = await fs.open(filename, constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+  let existed;
+  try { const stat = await file.stat(); assert(stat.isFile(), 'store must be a regular file'); existed = stat.size > 0; }
+  finally { await file.close(); }
+  const db = new DatabaseSync(filename);
+  let closed = false, claimed;
+  const validate = value => {
+    assert(value?.schema === 'reploid.native-canonical-epochs/v1' && value.participantId === participantId && value.meshId === meshId
+      && Number.isSafeInteger(value.revision) && value.revision > 0 && epoch(value.participantEpoch) && epoch(value.coordinatorEpoch)
+      && (value.pendingOwner === null || epoch(value.pendingOwner))
+      && (value.settledOwner === null || epoch(value.settledOwner)), 'stored epoch record is corrupt or belongs to another scope');
+    return value;
+  };
+  const read = () => {
+    const row = db.prepare('SELECT record FROM epochs WHERE id = 1').get();
+    assert(row, 'epoch record missing'); return validate(JSON.parse(row.record));
+  };
+  const current = () => {
+    assert(!closed, 'owner closed'); const value = read();
+    assert(value.revision === claimed.revision && value.participantEpoch === claimed.participantEpoch
+      && value.coordinatorEpoch === claimed.coordinatorEpoch, 'process epoch replaced'); return value;
+  };
+  const transact = update => {
+    assert(!closed, 'owner closed'); db.prepare('BEGIN IMMEDIATE').run();
+    try {
+      const result = update(); db.prepare('COMMIT').run(); return result;
+    } catch (error) {
+      try { db.prepare('ROLLBACK').run(); }
+      catch (rollback) { throw new AggregateError([error, rollback], 'Native epoch transaction outcome unknown'); }
+      throw error;
+    }
+  };
+  const save = value => db.prepare('INSERT INTO epochs VALUES(1, ?) ON CONFLICT(id) DO UPDATE SET record=excluded.record').run(JSON.stringify(validate(value)));
+  try {
+    db.prepare('PRAGMA busy_timeout=1000').run(); db.prepare('PRAGMA synchronous=FULL').run();
+    claimed = transact(() => {
+      db.prepare('CREATE TABLE IF NOT EXISTS epochs (id INTEGER PRIMARY KEY CHECK(id=1), record TEXT NOT NULL)').run();
+      const row = db.prepare('SELECT record FROM epochs WHERE id = 1').get();
+      assert(row || !existed, 'existing store has no epoch record');
+      const prior = row ? validate(JSON.parse(row.record)) : null;
+      assert(!prior?.pendingOwner, 'prior resident ownership is unsettled; new admission refused');
+      const value = { schema: 'reploid.native-canonical-epochs/v1', participantId, meshId,
+        revision: (prior?.revision || 0) + 1, participantEpoch: fresh(), coordinatorEpoch: fresh(), pendingOwner: null, settledOwner: null };
+      save(value); return value;
+    });
+    current();
+    return Object.freeze({ participantEpoch: claimed.participantEpoch, coordinatorEpoch: claimed.coordinatorEpoch,
+      assertCurrent() { current(); },
+      begin(owner) {
+        assert(epoch(owner), 'invalid resident owner');
+        transact(() => { const value = current(); assert(value.pendingOwner === null, 'resident ownership already outstanding'); save({ ...value, pendingOwner: owner, settledOwner: null }); });
+      },
+      settle(owner) {
+        assert(epoch(owner), 'invalid resident owner');
+        const value = current();
+        if (value.pendingOwner === null && value.settledOwner === owner) {
+          // A failed COMMIT acknowledgement may have left the exact settlement
+          // durable. Confirm through a separate reader, never an open transaction.
+          const reader = new DatabaseSync(filename, { readOnly: true });
+          try {
+            const committed = validate(JSON.parse(reader.prepare('SELECT record FROM epochs WHERE id = 1').get()?.record));
+            assert(JSON.stringify(committed) === JSON.stringify(value), 'settlement outcome remains unknown');
+          } finally { reader.close(); }
+          return;
+        }
+        transact(() => { const latest = current(); assert(latest.pendingOwner === owner, 'resident settlement owner differs');
+          save({ ...latest, pendingOwner: null, settledOwner: owner }); });
+      },
+      close() { if (!closed) { db.close(); closed = true; } }
+    });
+  } catch (error) {
+    try { db.close(); } catch (cleanup) { throw new AggregateError([error, cleanup], 'Native epoch opening and cleanup failed'); }
+    throw error;
+  }
+}

package/server/native-change-log.js

@@ -0,0 +1,40 @@
+/**
+ * Change-only status lines for the native participant. A record is written when its
+ * content differs from the last one written for the same kind, or when `heartbeatMs` has
+ * passed since that kind was last written (then marked `heartbeat: true`). Time-like fields
+ * (`at`, `*At`, `lastSeen*`, `timestamp`, `*elapsedMs`, `*uptimeMs`) are ignored when deciding
+ * whether content changed, so an idle host writes only heartbeats.
+ */
+
+const VOLATILE_KEY = /^(at|timestamp)$|At$|^lastSeen|elapsedMs$|uptimeMs$/;
+
+/** Stable comparison key: sorted keys, volatile fields removed at every depth. */
+export function statusContentKey(value) {
+  const strip = item => {
+    if (Array.isArray(item)) return item.map(strip);
+    if (!item || typeof item !== 'object') return item;
+    return Object.fromEntries(Object.keys(item).sort().filter(key => !VOLATILE_KEY.test(key)).map(key => [key, strip(item[key])]));
+  };
+  return JSON.stringify(strip(value));
+}
+
+/**
+ * @param {object} options
+ * @param {number} options.heartbeatMs positive interval after which an unchanged kind is written again
+ * @param {(line: string) => void} options.write sink for one JSON line
+ * @param {() => number} [options.now]
+ * @returns {(kind: string, record: object) => boolean} writes when changed or due; returns whether it wrote
+ */
+export function createChangeOnlyLog({ heartbeatMs, write, now = Date.now }) {
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs <= 0) throw new Error('statusHeartbeatMs must be a positive integer in the partition policy');
+  if (typeof write !== 'function') throw new Error('A status log sink is required');
+  const last = new Map();
+  return (kind, record) => {
+    const key = statusContentKey(record), previous = last.get(kind), at = now();
+    const changed = !previous || previous.key !== key;
+    if (!changed && at - previous.writtenAt < heartbeatMs) return false;
+    write(JSON.stringify(changed ? record : { ...record, heartbeat: true }));
+    last.set(kind, { key, writtenAt: at });
+    return true;
+  };
+}

package/server/native-earning.js

@@ -0,0 +1,203 @@
+/**
+ * Native contributor earning: the composition a native participant passes as
+ * its `earning` port (native-participant.js). From an explicit
+ * reploid.native-earning/v1 file it signs this host in through the service's
+ * sign-in flow, registers the host's persistent participant identity as a
+ * native device, records the owner policy in force, asks the service for a
+ * stage-share or exact whole-model variant offer for the capacity this host
+ * serves, accepts it, and claims settled work under the offer that covered it.
+ * Durable state (session, outbox, claims and accepted offers) lives in one
+ * file beside the identity, so a restarted host neither loses nor doubles a
+ * claim. Whole-model execution records admission before dispatch and retains
+ * countersigned receipt references until the service settles and claims them.
+ * Off unless the file is given; the repository ships none.
+ *
+ * File: { schema: 'reploid.native-earning/v1',
+ *         client: { schema: 'reploid.earning-client/v1', enabled: true, baseUrl, providerId },
+ *         signIn?: { subject } }   // only for the service's local test flow
+ *
+ * Native sign-in supports the local test flow only: Supabase email links
+ * complete in a browser, and a native link flow is not implemented.
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { sha256Hex } from './hashing.js';
+import { createNativeWholeEarning } from './native-whole-earning.js';
+
+import { hashDopplerEvidence } from '../shared/pool/executable-pack.js';
+import { EARNING_CLIENT_SCHEMA, createEarningClient, readEarningClientConfig } from '../apps/poolday/host/earning/client.js';
+import { createEarningContribution } from '../apps/poolday/host/earning/contribution.js';
+
+export const NATIVE_EARNING_SCHEMA = 'reploid.native-earning/v1';
+const STAGE_SHARE = 'demanded_inference';
+// An offer is renewed once this share of its duration has passed, so the next one is accepted before it ends.
+const RENEW_AT = 0.9;
+const SUBJECT = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+
+const fail = (message) => { throw new Error(message); };
+const toMs = (value) => (typeof value === 'number' ? value : Date.parse(value));
+const selectedModel = model => model.executionMode === 'whole-model'
+  ? { modelId: model.modelId, modelIdentity: model.modelIdentity, executionMode: 'whole-model', adapterIdentities: [...model.adapterIdentities] }
+  : { modelId: model.modelId, modelIdentity: model.modelIdentity, planId: model.planId };
+const modelKey = model => model.executionMode === 'whole-model' ? JSON.stringify(selectedModel(model))
+  : `${model.modelId}|${model.modelIdentity}|${model.planId}`;
+
+/** Read and check the native earning file: an absolute path to a regular JSON file. */
+export async function readNativeEarningFile(file) {
+  if (typeof file !== 'string' || !path.isAbsolute(file)) fail('--earning-config requires an absolute path');
+  const stat = await fs.stat(file).catch(() => null);
+  if (!stat?.isFile()) fail(`--earning-config must name a regular file: ${file}`);
+  let value;
+  try { value = JSON.parse(await fs.readFile(file, 'utf8')); } catch { fail(`--earning-config is not valid JSON: ${file}`); }
+  const keys = Object.keys(value ?? {});
+  if (value?.schema !== NATIVE_EARNING_SCHEMA || keys.some((key) => !['schema', 'client', 'signIn'].includes(key))) {
+    fail(`--earning-config must be ${NATIVE_EARNING_SCHEMA} with client and an optional signIn`);
+  }
+  if (value.client?.schema !== EARNING_CLIENT_SCHEMA || value.client.enabled !== true) fail(`--earning-config client must be an enabled ${EARNING_CLIENT_SCHEMA} configuration`);
+  const client = readEarningClientConfig(value.client);
+  if (value.signIn !== undefined && (Object.keys(value.signIn ?? {}).join() !== 'subject' || !SUBJECT.test(value.signIn.subject ?? ''))) {
+    fail('--earning-config signIn must be { subject } with a short lowercase name');
+  }
+  return Object.freeze({ client, signIn: value.signIn ? { subject: value.signIn.subject } : null });
+}
+
+/** Durable { get, set, delete } over one JSON file, written whole and renamed into place. */
+export function createNativeEarningStorage(file) {
+  let queue = Promise.resolve();
+  const load = async () => {
+    try { return JSON.parse(await fs.readFile(file, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return {}; throw error; }
+  };
+  const write = (change) => {
+    const run = queue.then(async () => {
+      const state = await load();
+      change(state);
+      await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+      const temporary = `${file}.${process.pid}.tmp`;
+      await fs.writeFile(temporary, JSON.stringify(state), { mode: 0o600 });
+      await fs.rename(temporary, file);
+    });
+    queue = run.catch(() => {});
+    return run;
+  };
+  return Object.freeze({
+    async get(key) { await queue; const state = await load(); return key in state ? structuredClone(state[key]) : null; },
+    set: (key, value) => write((state) => { state[key] = structuredClone(value); }),
+    delete: (key) => write((state) => { delete state[key]; })
+  });
+}
+
+/** The sign-in port for a native host: the service's local test flow for the configured subject. */
+export function createNativeSignIn({ config, subject, fetch = globalThis.fetch }) {
+  return async ({ providerId = config.providerId } = {}) => {
+    const settings = await fetch(`${config.baseUrl}/sign-in/${encodeURIComponent(providerId)}`).then((response) => (response.ok ? response.json() : null)).catch(() => null);
+    if (settings?.flow !== 'local_test_subject') {
+      fail(`Native sign-in supports the service's local test flow only; ${providerId} offers ${settings?.flow ?? 'no flow this host can use'}`);
+    }
+    if (!subject) fail('The local test flow needs signIn.subject in the native earning file');
+    const response = await fetch(`${config.baseUrl}/sign-in/${encodeURIComponent(providerId)}/assertions`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ subject })
+    });
+    const body = await response.json().catch(() => null);
+    if (!response.ok || typeof body?.assertion !== 'string') fail(body?.message || `The sign-in service answered ${response.status}`);
+    return body.assertion;
+  };
+}
+
+/**
+ * @param {object} options
+ * @param {object} options.settings readNativeEarningFile(...) result
+ * @param {object} options.identity this host's persistent participant identity
+ * @param {object} options.ownerAuthorization { policy, digest } of the owner policy in force
+ * @param {object} options.storage createNativeEarningStorage(...) or an equivalent durable store
+ */
+export async function openNativeEarning({ settings, identity, ownerAuthorization, storage, fetch = globalThis.fetch,
+  hashEvidence = hashDopplerEvidence, now = Date.now, signIn = null }) {
+  if (!ownerAuthorization?.digest || !ownerAuthorization.policy) fail('Native earning requires the owner policy in force');
+  const client = createEarningClient({ config: settings.client, identity, host: 'native', storage, fetch,
+    signIn: signIn ?? createNativeSignIn({ config: settings.client, subject: settings.signIn?.subject, fetch }) });
+  const session = await client.ensureSession();
+  const ownerPolicyDigest = ownerAuthorization.digest;
+  const base = createEarningContribution({ client, offers: {}, ownerPolicyDigest, hashEvidence });
+  await base.recordOwnerAuthorization(ownerAuthorization);
+  const contributions = new Map();
+  const contributionFor = (offerId) => {
+    if (!contributions.has(offerId)) contributions.set(offerId, createEarningContribution({ client, offers: { stageShare: offerId, wholeModel: offerId }, ownerPolicyDigest, hashEvidence }));
+    return contributions.get(offerId);
+  };
+  const readOffers = async () => (await storage.get('offers')) ?? [];
+  let offering = Promise.resolve();
+
+  /** An accepted, current stage-share offer for `model`, requested and accepted when none covers now. */
+  function ensureOffer(model) {
+    const run = offering.then(async () => {
+      const offers = await readOffers();
+      const current = offers.find((offer) => offer.key === modelKey(model)
+        && (model.executionMode !== 'whole-model' || offer.ownerPolicyDigest === ownerPolicyDigest && now() >= toMs(offer.startsAt))
+        && now() < toMs(offer.startsAt) + RENEW_AT * (toMs(offer.endsAt) - toMs(offer.startsAt)));
+      if (current) return current;
+      const offered = await client.send({ opId: `offer:${sha256Hex(modelKey(model))}:${now()}`, path: '/offers', durable: false,
+        body: { category: STAGE_SHARE, model: selectedModel(model) } });
+      if (model.executionMode === 'whole-model' && (offered.work?.participantId !== identity.peerId
+        || modelKey(offered.work.model) !== modelKey(model))) fail('Offered whole-model variant differs from this contributor');
+      const accepted = await base.acceptOffer(offered.offerId, ownerAuthorization);
+      const record = { offerId: offered.offerId, key: modelKey(model), acceptedAt: accepted.acceptedAt ?? new Date(now()).toISOString(),
+        startsAt: offered.duration.startsAt, endsAt: offered.duration.endsAt, ownerPolicyDigest };
+      if (model.executionMode === 'whole-model' && !(now() >= toMs(record.startsAt) && now() < toMs(record.endsAt))) {
+        fail('Accepted whole-model offer is outside its execution window');
+      }
+      await storage.set('offers', [...offers, record]);
+      return record;
+    });
+    offering = run.catch(() => {});
+    return run;
+  }
+
+  const whole = createNativeWholeEarning({ storage, participantId: identity.peerId, ownerPolicyDigest, contributionFor, now,
+    findOffer: async model => (await readOffers()).find(offer => offer.key === modelKey(model) && offer.ownerPolicyDigest === ownerPolicyDigest
+      && toMs(offer.acceptedAt) <= now() && toMs(offer.startsAt) <= now() && now() < toMs(offer.endsAt)) });
+
+  return Object.freeze({
+    client,
+    session,
+    participantId: identity.peerId,
+    ensureOffer,
+    prepareWholeModel: whole.prepare,
+    recordWholeModelReceipt: whole.record,
+    offers: readOffers,
+    /**
+     * The participant's earning port. `descriptor`, when the host passes its prepared stage, names the
+     * model and plan to be offered for before any route admits it; admission records also name their
+     * route's model, so a host that passes none still earns from later work.
+     */
+    async observe({ admissions = [], deliveries = [], descriptor = null, wholeModels = [] } = {}) {
+      // Previously accepted work can still claim even if renewing supply fails.
+      const claimedWholeModels = await whole.flush();
+      const served = descriptor?.planId ? [descriptor, ...wholeModels] : [...wholeModels];
+      for (const record of admissions) if (record?.identity?.route?.planId) served.push(record.identity.route);
+      const seen = new Set();
+      for (const model of served) {
+        if (seen.has(modelKey(model))) continue;
+        seen.add(modelKey(model));
+        await ensureOffer(model);
+      }
+      const offers = await readOffers();
+      // Each record is claimed under the accepted offer whose window covered its admission.
+      const groups = new Map();
+      for (const record of admissions) {
+        const at = toMs(record?.reservedAt);
+        const offer = offers.find((row) => row.key === modelKey(record?.identity?.route ?? {}) && toMs(row.acceptedAt) <= at && at <= toMs(row.endsAt));
+        if (!offer) continue;
+        groups.set(offer.offerId, [...(groups.get(offer.offerId) ?? []), record]);
+      }
+      // Signed receipts of every closed charged attempt are submitted, offer or not: they settle the requester's charge.
+      const { evidence, deliveries: delivered } = await base.observe({ admissions, deliveries });
+      const results = { evidence, stages: [], deliveries: delivered, wholeModels: claimedWholeModels };
+      for (const [offerId, records] of groups) results.stages.push(...await contributionFor(offerId).claimStageShares(records));
+      return results;
+    },
+    reconcile: () => client.reconcile()
+  });
+}
+
+export default openNativeEarning;

package/server/native-generation-journal.js

@@ -0,0 +1,46 @@
+/** Durable admission fences and bounded result replay. No prompt text is stored. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { constants } from 'node:fs';
+
+export async function openNativeGenerationJournal({ file, maxResults, maxResultBytes }) {
+  if (!path.isAbsolute(file) || !Number.isSafeInteger(maxResults) || maxResults < 1
+    || !Number.isSafeInteger(maxResultBytes) || maxResultBytes < 1) throw Error('Explicit generation journal limits required');
+  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  const handle = await fs.open(file, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+  try { if (!(await handle.stat()).isFile()) throw Error('Generation journal must be a regular file'); }
+  finally { await handle.close(); }
+  const { DatabaseSync } = await import('node:sqlite');
+  const db = new DatabaseSync(file);
+  db.exec('PRAGMA synchronous=FULL; CREATE TABLE IF NOT EXISTS generation (id TEXT PRIMARY KEY, binding TEXT NOT NULL, outcome TEXT, finished INTEGER NOT NULL DEFAULT 0)');
+  let closed = false;
+  const key = binding => JSON.stringify([binding.provider, binding.consumer, binding.requestId]);
+  return Object.freeze({
+    async get(binding) {
+      const row = db.prepare('SELECT binding, outcome FROM generation WHERE id = ?').get(key(binding));
+      return row ? { binding: JSON.parse(row.binding), outcome: row.outcome ? JSON.parse(row.outcome) : null } : null;
+    },
+    async unfinished() {
+      return db.prepare('SELECT binding FROM generation WHERE finished = 0 ORDER BY rowid ASC').all()
+        .map(row => JSON.parse(row.binding));
+    },
+    async claim(binding) {
+      return db.prepare('INSERT OR IGNORE INTO generation (id, binding) VALUES (?, ?)')
+        .run(key(binding), JSON.stringify(binding)).changes === 1;
+    },
+    async finish(binding, outcome) {
+      const serialized = JSON.stringify(outcome);
+      if (Buffer.byteLength(serialized) > maxResultBytes) throw Error('Generation recovery result exceeds retained byte limit');
+      db.exec('BEGIN IMMEDIATE');
+      try {
+        const changed = db.prepare('UPDATE generation SET outcome = ?, finished = 1 WHERE id = ? AND finished = 0').run(serialized, key(binding));
+        if (changed.changes !== 1) throw Error('Generation missing or already finished');
+        // Keep admission fences when pruning result bodies. A replay cannot execute again.
+        db.prepare('UPDATE generation SET outcome = NULL WHERE outcome IS NOT NULL AND rowid NOT IN '
+          + '(SELECT rowid FROM generation WHERE outcome IS NOT NULL ORDER BY rowid DESC LIMIT ?)').run(maxResults);
+        db.exec('COMMIT');
+      } catch (error) { db.exec('ROLLBACK'); throw error; }
+    },
+    close() { if (!closed) { closed = true; db.close(); } }
+  });
+}

package/server/native-model-config.js

@@ -0,0 +1,57 @@
+/** Operator-local model configuration; never public catalog or release authority. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { sha256Digest } from './hashing.js';
+import { resolveGenerationOptions } from '../shared/config/doppler-generation-contract.js';
+
+const requireValue = (condition, message) => { if (!condition) throw new Error(message); };
+
+export async function readNativeModelConfiguration(file, { modelId, modelDirectory, models = [],
+  loadRuntime = () => import('doppler-gpu/partitions') }) {
+  requireValue(path.isAbsolute(file), 'Native model configuration requires an absolute JSON path');
+  const configuration = JSON.parse(await fs.readFile(file, 'utf8'));
+  requireValue(configuration?.schema === 'reploid.native-model/v1'
+    && Object.keys(configuration).every(key => ['schema', 'model', 'partition', 'partitionRuntime'].includes(key)),
+  'Unknown native model configuration schema or field');
+  const catalogReference = typeof configuration.model === 'string';
+  const model = structuredClone(catalogReference ? models.find(row => row.id === configuration.model) : configuration.model);
+  requireValue(model?.id === modelId && model.provider === 'doppler' && typeof model.name === 'string'
+    && /^sha256:[a-f0-9]{64}$/.test(model.identity), 'Native model configuration requires an exact Doppler model identity');
+  model.generation = resolveGenerationOptions(model.generation);
+  const root = await fs.realpath(modelDirectory);
+  const manifestPath = await fs.realpath(path.join(root, 'manifest.json'));
+  requireValue(path.dirname(manifestPath) === root, 'Native model manifest escapes the approved directory');
+  const bytes = await fs.readFile(manifestPath);
+  requireValue(sha256Digest(bytes) === model.identity,
+    'Native model configuration differs from the actual manifest');
+  const manifest = JSON.parse(bytes);
+  requireValue(manifest.modelId === model.id, 'Native model configuration differs from the actual model id');
+  if (configuration.partitionRuntime !== undefined) model.partitionRuntime = structuredClone(configuration.partitionRuntime);
+  if (model.partitionRuntime?.runtimeConfig === 'model') {
+    requireValue(model.loadOptions?.runtimeConfig && typeof model.loadOptions.runtimeConfig === 'object',
+      'The model runtime reference requires explicit model.loadOptions.runtimeConfig');
+    model.partitionRuntime.runtimeConfig = structuredClone(model.loadOptions.runtimeConfig);
+  }
+  if (configuration.partition !== undefined) {
+    requireValue(catalogReference || model.partitionPlan === undefined && model.partitionPlanId === undefined,
+      'Choose one partition request rather than competing prepared plans');
+    requireValue(catalogReference || model.executionModes?.includes('partition'), 'Native model must explicitly allow partition execution');
+    const runtime = await loadRuntime();
+    requireValue(typeof runtime.createOrderedLayerPartitionPlanFromManifest === 'function'
+      && typeof runtime.hashLayerPartitionPlan === 'function',
+    'Installed Doppler lacks manifest-driven partition preparation; install the matching runtime');
+    model.partitionPlan = runtime.createOrderedLayerPartitionPlanFromManifest(manifest, configuration.partition);
+    model.partitionPlanId = runtime.hashLayerPartitionPlan(model.partitionPlan);
+    // An explicit ordered plan replaces the catalog's legacy two-stage cut.
+    // Keeping both makes downstream selection reject the otherwise valid plan.
+    delete model.partitionSplitLayer;
+    if (catalogReference) model.executionModes = [...new Set([...(model.executionModes || []), 'partition'])];
+    const budgets = model.partitionRuntime?.maxGpuBufferBytes;
+    requireValue(Array.isArray(budgets) && budgets.length === model.partitionPlan.stageCount
+      && budgets.every(value => Number.isSafeInteger(value) && value > 0),
+    'Declare one positive GPU buffer budget per partition stage');
+    requireValue(model.partitionRuntime.runtimeConfig && typeof model.partitionRuntime.runtimeConfig === 'object',
+      'Declare partition runtime configuration explicitly');
+  }
+  return model;
+}