taskflow-mcp-core 0.3.0-beta.1.1 → 1.0.0

package/dist/control/schema/commands.js

@@ -0,0 +1,147 @@
+/**
+ * Command + event wire types (🟥 NEW) — the authoritative narrative.
+ *
+ * Decisions: P12 (immutable CommandRecord committed atomically with its
+ * ControlEvents; `(controlDomainId, commandId)` unique), P11 (commitSeq never
+ * renumbered; CompactionCheckpointEvent as the only authoritative cursor
+ * floor; cursor leases).
+ */
+import { createHash } from "node:crypto";
+import { Type } from "typebox";
+import { canonicalJson } from "taskflow-core/flowir/hash";
+import { StringEnum } from "taskflow-core/typebox-helpers";
+import { CONTROL_WIRE_SCHEMA_VERSION, Sha256HexSchema, UuidSchema, } from "./common.js";
+import { ArtifactRefSchema, ReceiptSchema } from "./evidence.js";
+import { ApprovalRequestSchema } from "./approval.js";
+import { RunSnapshotSchema } from "./run.js";
+// ---------------------------------------------------------------------------
+// Command kinds (closed union; P15/P16 kinds, plus the base run command)
+// ---------------------------------------------------------------------------
+export const CommandKindSchema = StringEnum([
+    "run.submit",
+    "run.cancel",
+    "approval.decide",
+    "coordinator.setMaxActiveRuns",
+    "coordinator.forceRelease",
+]);
+export const CommandStatusSchema = StringEnum(["accepted", "completed", "failed"]);
+// ---------------------------------------------------------------------------
+// CommandRecord (P12 / RFC §9.2) — immutable authority record
+// ---------------------------------------------------------------------------
+export const CommandRecordSchema = Type.Object({
+    commandId: UuidSchema,
+    kind: CommandKindSchema,
+    requestHash: Sha256HexSchema,
+    callerPrincipal: Type.String({ minLength: 1 }),
+    authorizationContextHash: Sha256HexSchema,
+    projectId: UuidSchema,
+    controlDomainId: UuidSchema,
+    status: CommandStatusSchema,
+    firstCommitSeq: Type.Integer({ minimum: 1 }),
+    lastCommitSeq: Type.Integer({ minimum: 1 }),
+    responseArtifactRef: Type.Optional(ArtifactRefSchema),
+    recordedAt: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// ControlEvent payload — closed union of S2-known narrative kinds
+// (P11 compaction.checkpoint; RFC §8.4 reconcile.*; §16 dispatch.*;
+//  §17 approval.*; run terminal). Additive extension bumps schemaVersion.
+// ---------------------------------------------------------------------------
+export const LegacyControlEventPayloadSchema = Type.Union([
+    Type.Object({ kind: Type.Literal("command.recorded"), commandId: UuidSchema }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("reconcile.started"),
+        attempt: Type.Integer({ minimum: 1 }),
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("reconcile.settled"),
+        outcome: StringEnum(["running", "terminal", "exhausted"]),
+        terminalStatus: Type.Optional(StringEnum(["completed", "failed", "blocked", "cancelled"])),
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("dispatch.acknowledged"),
+        providerJobHandle: Type.Optional(Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("dispatch.rejected"), reason: Type.String({ minLength: 1 }) }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("dispatch.ambiguous") }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("run.terminal"),
+        status: StringEnum(["completed", "failed", "blocked", "cancelled"]),
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("approval.pending"),
+        approvalRequestId: UuidSchema,
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("approval.settled"),
+        decision: StringEnum(["approved", "rejected", "expired", "cancelled"]),
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("compaction.checkpoint"),
+        throughCommitSeq: Type.Integer({ minimum: 1 }),
+    }, { additionalProperties: false }),
+]);
+/** V2 carries complete approval and lifecycle facts. V1 remains read-only. */
+const LifecycleEventPayloadSchema = Type.Union([
+    Type.Object({ kind: Type.Literal("approval.pending"), approvalRequestId: UuidSchema, request: ApprovalRequestSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("approval.settled"), approvalRequestId: UuidSchema, decision: StringEnum(["approved", "rejected", "edited", "expired", "cancelled"]) }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("run.snapshot"), run: RunSnapshotSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("approval.release.queued"), approvalRequestId: UuidSchema, intentId: UuidSchema, reservationId: UuidSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("approval.release.completed"), approvalRequestId: UuidSchema, intentId: UuidSchema, reservationId: UuidSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("approval.readmission.queued"), approvalRequestId: UuidSchema, intentId: UuidSchema, reservationId: UuidSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("approval.readmission.completed"), approvalRequestId: UuidSchema, intentId: UuidSchema, reservationId: UuidSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("receipt.issued"), receipt: ReceiptSchema }, { additionalProperties: false }),
+    Type.Object({ kind: Type.Literal("artifact.recorded"), runId: UuidSchema, commandKind: CommandKindSchema, artifact: ArtifactRefSchema }, { additionalProperties: false }),
+]);
+// Preserve the literal tuple for TypeBox static inference: a variadic filtered
+// array before new cases can otherwise erase the lifecycle discriminants.
+export const ControlEventPayloadSchema = Type.Union([
+    ...LegacyControlEventPayloadSchema.anyOf.filter((schema) => !["approval.pending", "approval.settled"].includes(schema.properties.kind.const)),
+    ...LifecycleEventPayloadSchema.anyOf,
+]);
+// ---------------------------------------------------------------------------
+// ControlEvent (P12 / RFC §10) — ledger envelope
+// ---------------------------------------------------------------------------
+const CurrentControlEventSchema = Type.Object({
+    eventId: UuidSchema,
+    schemaVersion: Type.Literal(CONTROL_WIRE_SCHEMA_VERSION),
+    controlDomainId: UuidSchema,
+    streamId: Type.String({ minLength: 1 }),
+    streamSeq: Type.Integer({ minimum: 1 }),
+    commitSeq: Type.Integer({ minimum: 1 }),
+    commandId: Type.Optional(UuidSchema),
+    commandEventIndex: Type.Optional(Type.Integer({ minimum: 0 })),
+    causationId: UuidSchema,
+    correlationId: UuidSchema,
+    projectId: UuidSchema,
+    recordedAt: Type.Integer({ minimum: 0 }),
+    payload: ControlEventPayloadSchema,
+}, { additionalProperties: false });
+export const ControlEventSchema = Type.Union([
+    CurrentControlEventSchema,
+    Type.Object({ ...CurrentControlEventSchema.properties, schemaVersion: Type.Literal(1), payload: LegacyControlEventPayloadSchema }, { additionalProperties: false }),
+]);
+// ---------------------------------------------------------------------------
+// CompactionCheckpointEvent (P11) — journal-internal cursor floor
+// ---------------------------------------------------------------------------
+export const CompactionCheckpointEventSchema = Type.Object({
+    kind: Type.Literal("compaction.checkpoint"),
+    throughCommitSeq: Type.Integer({ minimum: 1 }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// CursorState (P11) — cursor/subscription lease
+// ---------------------------------------------------------------------------
+export const CursorStateSchema = Type.Object({
+    minAvailableCommitSeq: Type.Integer({ minimum: 1 }),
+    cursorId: UuidSchema,
+    leaseExpiresAt: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// Convenience: P12 idempotency / cross-principal markers used by the hello
+// and command layers. Not a separate wire doc — checked against CommandRecord.
+// ---------------------------------------------------------------------------
+/** Canonical request hash over the command body (P12 §9.4). */
+export function commandRequestHash(body) {
+    return createHash("sha256").update(canonicalJson(body), "utf8").digest("hex");
+}
+//# sourceMappingURL=commands.js.map

package/dist/control/schema/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAe,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EACN,2BAA2B,EAC3B,eAAe,EACf,UAAU,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAoB,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC3C,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,8BAA8B;IAC9B,0BAA0B;CAC1B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGnF,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAC7C;IACC,SAAS,EAAE,UAAU;IACrB,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,wBAAwB,EAAE,eAAe;IACzC,SAAS,EAAE,UAAU;IACrB,eAAe,EAAE,UAAU;IAC3B,MAAM,EAAE,mBAAmB;IAC3B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC5C,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3C,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACrD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACxC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAgBF,8EAA8E;AAC9E,kEAAkE;AAClE,oEAAoE;AACpE,0EAA0E;AAC1E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,KAAK,CAAC;IACzD,IAAI,CAAC,MAAM,CACV,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EACjE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;KACrC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACvC,OAAO,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;KAC1F,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC3C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;KAC/D,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAClF,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAC5C,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAClC,MAAM,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;KACnE,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtC,iBAAiB,EAAE,UAAU;KAC7B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtC,QAAQ,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;KACtE,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACV;QACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC3C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;KAC9C,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B;CACD,CAAC,CAAC;AACH,8EAA8E;AAC9E,MAAM,2BAA2B,GAAG,IAAI,CAAC,KAAK,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACvJ,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACzM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAC/K,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAClL,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACnL,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACtL,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;CACzK,CAAC,CAAC;AACH,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC,KAAK,CAAC;IACnD,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IACvJ,GAAG,2BAA2B,CAAC,KAAK;CACpC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,yBAAyB,GAAG,IAAI,CAAC,MAAM,CAC5C;IACC,OAAO,EAAE,UAAU;IACnB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACxD,eAAe,EAAE,UAAU;IAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IACpC,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,UAAU;IACzB,SAAS,EAAE,UAAU;IACrB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,yBAAyB;CAClC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AACF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5C,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,yBAAyB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;CACnK,CAAC,CAAC;AAiBH,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,MAAM,CACzD;IACC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC9C,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAGF,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAC3C;IACC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnD,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC5C,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAOF,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAE9E,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC"}

package/dist/control/schema/common.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared 0.3-C wire conventions: schema version, scalar formats, and the
+ * closed-enum helper. Follows the TE convention (`taskflow-core/typebox-helpers`
+ * StringEnum) so providers that do not support anyOf/const keep working.
+ */
+import { Type } from "typebox";
+import { StringEnum } from "taskflow-core/typebox-helpers";
+/**
+ * Single wire schema version for the 0.3-C control plane. Every top-level wire
+ * document that carries `schemaVersion` uses this constant; additive evolution
+ * bumps it (wire-freeze rule 4: freeze allows only additive changes + bump).
+ */
+export declare const CONTROL_WIRE_SCHEMA_VERSION = 2;
+/** Historical journal envelopes remain readable without rewriting their bytes. */
+export declare const LEGACY_CONTROL_WIRE_SCHEMA_VERSION = 1;
+/** UUID v4 scalar convention (ControlDomainId, projectId, eventId, ...). */
+export declare const UuidSchema: Type.TString;
+/** 64-lowercase-hex SHA-256 digest (the only hash family, P6). */
+export declare const Sha256HexSchema: Type.TString;
+/** Canonical (key-sorted, undefined-dropped) hash over a wire document. */
+export declare const CanonicalHashRefSchema: Type.TString;
+export type ControlWireSchemaVersion = typeof CONTROL_WIRE_SCHEMA_VERSION;
+export { StringEnum };
+//# sourceMappingURL=common.d.ts.map

package/dist/control/schema/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/common.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,kFAAkF;AAClF,eAAO,MAAM,kCAAkC,IAAI,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,UAAU,cAKrB,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,eAAe,cAK1B,CAAC;AAEH,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,cAKjC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/control/schema/common.js

@@ -0,0 +1,38 @@
+/**
+ * Shared 0.3-C wire conventions: schema version, scalar formats, and the
+ * closed-enum helper. Follows the TE convention (`taskflow-core/typebox-helpers`
+ * StringEnum) so providers that do not support anyOf/const keep working.
+ */
+import { Type } from "typebox";
+import { StringEnum } from "taskflow-core/typebox-helpers";
+/**
+ * Single wire schema version for the 0.3-C control plane. Every top-level wire
+ * document that carries `schemaVersion` uses this constant; additive evolution
+ * bumps it (wire-freeze rule 4: freeze allows only additive changes + bump).
+ */
+export const CONTROL_WIRE_SCHEMA_VERSION = 2;
+/** Historical journal envelopes remain readable without rewriting their bytes. */
+export const LEGACY_CONTROL_WIRE_SCHEMA_VERSION = 1;
+/** UUID v4 scalar convention (ControlDomainId, projectId, eventId, ...). */
+export const UuidSchema = Type.String({
+    minLength: 36,
+    maxLength: 36,
+    pattern: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+    description: "UUID v4 scalar",
+});
+/** 64-lowercase-hex SHA-256 digest (the only hash family, P6). */
+export const Sha256HexSchema = Type.String({
+    minLength: 64,
+    maxLength: 64,
+    pattern: "^[0-9a-f]{64}$",
+    description: "SHA-256 digest as 64 lowercase hex chars",
+});
+/** Canonical (key-sorted, undefined-dropped) hash over a wire document. */
+export const CanonicalHashRefSchema = Type.String({
+    minLength: 66,
+    maxLength: 96,
+    pattern: "^[a-z0-9]+:[0-9a-f]{64}$",
+    description: "Domain-separated content hash, e.g. ir:<64-hex> or plan:<64-hex>",
+});
+export { StringEnum };
+//# sourceMappingURL=common.js.map

package/dist/control/schema/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/common.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,+EAA+E;IACxF,WAAW,EAAE,gBAAgB;CAC7B,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,gBAAgB;IACzB,WAAW,EAAE,0CAA0C;CACvD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,0BAA0B;IACnC,WAAW,EAAE,kEAAkE;CAC/E,CAAC,CAAC;AAIH,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/control/schema/coordinator.d.ts

@@ -0,0 +1,98 @@
+/**
+ * UserCoordinatorStore wire types (🟥 NEW) — singleton lease + global
+ * concurrency reservations + narrow coordinator commands.
+ *
+ * Decisions: P16 — slots ≡ 1 per admitted run; capacity formula
+ * count(reserved|committed|orphan-suspect) ≤ maxActiveRuns; committed never
+ * TTL-released (D37 normalRelease/forceRelease only); D2 admission uniqueness;
+ * D3 legacy residue fail-closed; D4 idempotent release.
+ */
+import { Type } from "typebox";
+export declare const CoordinatorLeaseSchema: Type.TObject<{
+    holderId: Type.TString;
+    fencingEpoch: Type.TInteger;
+    endpoint: Type.TString;
+    expiresAt: Type.TInteger;
+}>;
+export type CoordinatorLease = {
+    holderId: string;
+    fencingEpoch: number;
+    endpoint: string;
+    expiresAt: number;
+};
+export declare const ReservationStateSchema: import("typebox").TUnsafe<string>;
+export type ReservationState = "reserved" | "committed" | "released" | "expired" | "orphan-suspect";
+export declare const ConcurrencyReservationSchema: Type.TObject<{
+    reservationId: Type.TString;
+    state: import("typebox").TUnsafe<string>;
+    slots: Type.TLiteral<1>;
+    projectId: Type.TString;
+    projectControlDomainId: Type.TString;
+    runId: Type.TString;
+    projectAdmitCommitSeq: Type.TOptional<Type.TInteger>;
+    attemptId: Type.TOptional<Type.TString>;
+    providerJobHandle: Type.TOptional<Type.TString>;
+    coordinatorEpoch: Type.TInteger;
+    reservedExpiresAt: Type.TOptional<Type.TInteger>;
+    renewedAt: Type.TOptional<Type.TInteger>;
+}>;
+export type ConcurrencyReservation = {
+    reservationId: string;
+    state: ReservationState;
+    slots: 1;
+    projectId: string;
+    projectControlDomainId: string;
+    runId: string;
+    projectAdmitCommitSeq?: number;
+    attemptId?: string;
+    providerJobHandle?: string;
+    coordinatorEpoch: number;
+    reservedExpiresAt?: number;
+    renewedAt?: number;
+};
+/**
+ * P16 D2/D3 invariants, enforced at the store boundary (fail closed):
+ * - committed/orphan-suspect rows MUST carry projectAdmitCommitSeq (D3 residue
+ *   that keeps a TTL field on a committed row is a separate check).
+ * - a reservation with a stale state/identity mismatch is rejected.
+ * TypeBox alone cannot express the state-conditional requirement, so the
+ * store layer asserts it here.
+ */
+export declare function assertReservationInvariants(reservation: ConcurrencyReservation): void;
+export declare const CoordinatorCommandKindSchema: import("typebox").TUnsafe<string>;
+export type CoordinatorCommandKind = "setMaxActiveRuns" | "forceRelease";
+export declare const CoordinatorCommandStatusSchema: import("typebox").TUnsafe<string>;
+export type CoordinatorCommandStatus = "accepted" | "completed" | "failed";
+export declare const CoordinatorCommandRecordSchema: Type.TObject<{
+    commandId: Type.TString;
+    kind: import("typebox").TUnsafe<string>;
+    requestHash: Type.TString;
+    callerPrincipal: Type.TString;
+    firstCommitSeq: Type.TInteger;
+    lastCommitSeq: Type.TInteger;
+    status: import("typebox").TUnsafe<string>;
+}>;
+export type CoordinatorCommandRecord = {
+    commandId: string;
+    kind: CoordinatorCommandKind;
+    requestHash: string;
+    callerPrincipal: string;
+    firstCommitSeq: number;
+    lastCommitSeq: number;
+    status: CoordinatorCommandStatus;
+};
+export declare const CapacitySnapshotSchema: Type.TObject<{
+    maxActiveRuns: Type.TInteger;
+    active: Type.TInteger;
+    reserved: Type.TInteger;
+    committed: Type.TInteger;
+    orphanSuspect: Type.TInteger;
+}>;
+export type CapacitySnapshot = {
+    maxActiveRuns: number;
+    active: number;
+    reserved: number;
+    committed: number;
+    orphanSuspect: number;
+};
+//# sourceMappingURL=coordinator.d.ts.map

package/dist/control/schema/coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQ/B,eAAO,MAAM,sBAAsB;;;;;EAQlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CAClB,CAAC;AAMF,eAAO,MAAM,sBAAsB,mCAAiF,CAAC;AACrH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEpG,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;EAkBxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,sBAAsB,GAAG,IAAI,CAYrF;AAMD,eAAO,MAAM,4BAA4B,mCAAmD,CAAC;AAC7F,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEzE,eAAO,MAAM,8BAA8B,mCAAkD,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3E,eAAO,MAAM,8BAA8B;;;;;;;;EAW1C,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,wBAAwB,CAAC;CACjC,CAAC;AAMF,eAAO,MAAM,sBAAsB;;;;;;EASlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/control/schema/coordinator.js

@@ -0,0 +1,87 @@
+/**
+ * UserCoordinatorStore wire types (🟥 NEW) — singleton lease + global
+ * concurrency reservations + narrow coordinator commands.
+ *
+ * Decisions: P16 — slots ≡ 1 per admitted run; capacity formula
+ * count(reserved|committed|orphan-suspect) ≤ maxActiveRuns; committed never
+ * TTL-released (D37 normalRelease/forceRelease only); D2 admission uniqueness;
+ * D3 legacy residue fail-closed; D4 idempotent release.
+ */
+import { Type } from "typebox";
+import { StringEnum } from "taskflow-core/typebox-helpers";
+import { Sha256HexSchema, UuidSchema } from "./common.js";
+// ---------------------------------------------------------------------------
+// CoordinatorLease (P16 / D32)
+// ---------------------------------------------------------------------------
+export const CoordinatorLeaseSchema = Type.Object({
+    holderId: Type.String({ minLength: 1 }),
+    fencingEpoch: Type.Integer({ minimum: 0 }),
+    endpoint: Type.String({ minLength: 1 }),
+    expiresAt: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// ConcurrencyReservation (P16)
+// ---------------------------------------------------------------------------
+export const ReservationStateSchema = StringEnum(["reserved", "committed", "released", "expired", "orphan-suspect"]);
+export const ConcurrencyReservationSchema = Type.Object({
+    reservationId: UuidSchema,
+    state: ReservationStateSchema,
+    slots: Type.Literal(1),
+    projectId: UuidSchema,
+    projectControlDomainId: UuidSchema,
+    runId: UuidSchema,
+    // Required once admitted (state ∈ {committed, orphan-suspect}); absent
+    // during the pre-admit reserved window (P16 crash matrix).
+    projectAdmitCommitSeq: Type.Optional(Type.Integer({ minimum: 1 })),
+    attemptId: Type.Optional(UuidSchema),
+    providerJobHandle: Type.Optional(Type.String({ minLength: 1 })),
+    coordinatorEpoch: Type.Integer({ minimum: 0 }),
+    reservedExpiresAt: Type.Optional(Type.Integer({ minimum: 0 })),
+    renewedAt: Type.Optional(Type.Integer({ minimum: 0 })),
+}, { additionalProperties: false });
+/**
+ * P16 D2/D3 invariants, enforced at the store boundary (fail closed):
+ * - committed/orphan-suspect rows MUST carry projectAdmitCommitSeq (D3 residue
+ *   that keeps a TTL field on a committed row is a separate check).
+ * - a reservation with a stale state/identity mismatch is rejected.
+ * TypeBox alone cannot express the state-conditional requirement, so the
+ * store layer asserts it here.
+ */
+export function assertReservationInvariants(reservation) {
+    if (reservation.state === "committed" || reservation.state === "orphan-suspect") {
+        if (reservation.projectAdmitCommitSeq === undefined) {
+            throw new Error("TF_ADMISSION_BINDING_CONFLICT: committed/orphan-suspect reservation requires projectAdmitCommitSeq");
+        }
+        if (reservation.reservedExpiresAt !== undefined) {
+            throw new Error("TF_ADMISSION_BINDING_CONFLICT: committed/orphan-suspect reservation must not retain reservedExpiresAt (P16 D3)");
+        }
+    }
+    if (reservation.slots !== 1) {
+        throw new Error("TF_ADMISSION_BINDING_CONFLICT: 0.3 slots are fixed at 1 (P16)");
+    }
+}
+// ---------------------------------------------------------------------------
+// CoordinatorCommandRecord (P16 / D6) — narrow command authority
+// ---------------------------------------------------------------------------
+export const CoordinatorCommandKindSchema = StringEnum(["setMaxActiveRuns", "forceRelease"]);
+export const CoordinatorCommandStatusSchema = StringEnum(["accepted", "completed", "failed"]);
+export const CoordinatorCommandRecordSchema = Type.Object({
+    commandId: UuidSchema,
+    kind: CoordinatorCommandKindSchema,
+    requestHash: Sha256HexSchema,
+    callerPrincipal: Type.String({ minLength: 1 }),
+    firstCommitSeq: Type.Integer({ minimum: 1 }),
+    lastCommitSeq: Type.Integer({ minimum: 1 }),
+    status: CoordinatorCommandStatusSchema,
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// CapacitySnapshot (P16) — metering/statistics
+// ---------------------------------------------------------------------------
+export const CapacitySnapshotSchema = Type.Object({
+    maxActiveRuns: Type.Integer({ minimum: 1 }),
+    active: Type.Integer({ minimum: 0 }),
+    reserved: Type.Integer({ minimum: 0 }),
+    committed: Type.Integer({ minimum: 0 }),
+    orphanSuspect: Type.Integer({ minimum: 0 }),
+}, { additionalProperties: false });
+//# sourceMappingURL=coordinator.js.map

package/dist/control/schema/coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAChD;IACC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACvC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAQF,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAGrH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC,MAAM,CACtD;IACC,aAAa,EAAE,UAAU;IACzB,KAAK,EAAE,sBAAsB;IAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,UAAU;IACrB,sBAAsB,EAAE,UAAU;IAClC,KAAK,EAAE,UAAU;IACjB,uEAAuE;IACvE,2DAA2D;IAC3D,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IACpC,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAgBF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmC;IAC9E,IAAI,WAAW,CAAC,KAAK,KAAK,WAAW,IAAI,WAAW,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;QACjF,IAAI,WAAW,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,WAAW,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACnI,CAAC;IACF,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAG7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC,MAAM,CACxD;IACC,SAAS,EAAE,UAAU;IACrB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC5C,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3C,MAAM,EAAE,8BAA8B;CACtC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAWF,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAChD;IACC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC3C,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC"}

package/dist/control/schema/evidence.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Evidence wire types (🟥 NEW): ArtifactRef, Receipt, ReceiptAssurance.
+ *
+ * Decisions: P6 (digest is not a bearer token; ledger reachability authorizes
+ * read), P11 (Receipt survives compaction; manifests issued at receipt time
+ * remain valid), P14 (receipts dir under the store), P8 (assurance.enforcement
+ * records the promise; observedRevocationLatencyMs optional).
+ */
+import { Type } from "typebox";
+import { CONTROL_WIRE_SCHEMA_VERSION } from "./common.ts";
+import type { ConfidentialityLabel, IntegrityLabel } from "taskflow-core/effects/types";
+import { type EnforcementCapabilities } from "./policy.ts";
+export declare const ArtifactRefSchema: Type.TObject<{
+    digest: Type.TString;
+    size: Type.TInteger;
+    mediaType: Type.TString;
+    storageClass: Type.TString;
+    redactionClass: Type.TString;
+}>;
+export type ArtifactRef = {
+    digest: string;
+    size: number;
+    mediaType: string;
+    storageClass: string;
+    redactionClass: string;
+};
+export declare const ProviderOutcomeSchema: import("typebox").TUnsafe<string>;
+export type ProviderOutcome = "completed" | "failed" | "ambiguous" | "operator-intervened";
+export declare const ArtifactIntegritySchema: import("typebox").TUnsafe<string>;
+export type ArtifactIntegrity = "verified" | "unknown";
+export declare const ReceiptAssuranceSchema: Type.TObject<{
+    journalContinuity: Type.TBoolean;
+    providerOutcome: import("typebox").TUnsafe<string>;
+    artifactIntegrity: import("typebox").TUnsafe<string>;
+    provenance: Type.TObject<{
+        confidentiality: import("typebox").TUnsafe<string>;
+        integrity: import("typebox").TUnsafe<string>;
+    }>;
+    enforcement: Type.TObject<{
+        capabilities: Type.TObject<{
+            resolution: import("typebox").TUnsafe<string>;
+            mutationMediation: import("typebox").TUnsafe<string>;
+            processIsolation: import("typebox").TUnsafe<string>;
+            revocation: Type.TUnion<[Type.TLiteral<"admission-only">, Type.TLiteral<"per-mutation">, Type.TObject<{
+                mode: Type.TLiteral<"bounded-latency">;
+                maxLatencyMs: Type.TInteger;
+            }>]>;
+            baselinePolicyId: Type.TString;
+            hostProbeSha256: Type.TString;
+        }>;
+        observedRevocationLatencyMs: Type.TOptional<Type.TInteger>;
+    }>;
+}>;
+export type ReceiptAssurance = {
+    journalContinuity: boolean;
+    providerOutcome: ProviderOutcome;
+    artifactIntegrity: ArtifactIntegrity;
+    provenance: {
+        confidentiality: ConfidentialityLabel;
+        integrity: IntegrityLabel;
+    };
+    enforcement: {
+        capabilities: EnforcementCapabilities;
+        observedRevocationLatencyMs?: number;
+    };
+};
+export declare const BuildInfoWireSchema: Type.TObject<{
+    packageVersion: Type.TString;
+    gitCommit: Type.TString;
+    schemaVersion: Type.TInteger;
+    buildTime: Type.TOptional<Type.TInteger>;
+}>;
+export type BuildInfoWire = {
+    packageVersion: string;
+    gitCommit: string;
+    schemaVersion: number;
+    buildTime?: number;
+};
+export declare const ReceiptSchema: Type.TObject<{
+    schemaVersion: Type.TLiteral<2>;
+    controlDomainId: Type.TString;
+    runId: Type.TString;
+    boundPlanHash: Type.TOptional<Type.TString>;
+    boundFragmentHash: Type.TOptional<Type.TString>;
+    eventManifest: Type.TArray<Type.TString>;
+    manifestRoot: Type.TString;
+    startCommitSeq: Type.TInteger;
+    endCommitSeq: Type.TInteger;
+    artifactRefs: Type.TArray<Type.TObject<{
+        digest: Type.TString;
+        size: Type.TInteger;
+        mediaType: Type.TString;
+        storageClass: Type.TString;
+        redactionClass: Type.TString;
+    }>>;
+    assurance: Type.TObject<{
+        journalContinuity: Type.TBoolean;
+        providerOutcome: import("typebox").TUnsafe<string>;
+        artifactIntegrity: import("typebox").TUnsafe<string>;
+        provenance: Type.TObject<{
+            confidentiality: import("typebox").TUnsafe<string>;
+            integrity: import("typebox").TUnsafe<string>;
+        }>;
+        enforcement: Type.TObject<{
+            capabilities: Type.TObject<{
+                resolution: import("typebox").TUnsafe<string>;
+                mutationMediation: import("typebox").TUnsafe<string>;
+                processIsolation: import("typebox").TUnsafe<string>;
+                revocation: Type.TUnion<[Type.TLiteral<"admission-only">, Type.TLiteral<"per-mutation">, Type.TObject<{
+                    mode: Type.TLiteral<"bounded-latency">;
+                    maxLatencyMs: Type.TInteger;
+                }>]>;
+                baselinePolicyId: Type.TString;
+                hostProbeSha256: Type.TString;
+            }>;
+            observedRevocationLatencyMs: Type.TOptional<Type.TInteger>;
+        }>;
+    }>;
+    buildInfo: Type.TObject<{
+        packageVersion: Type.TString;
+        gitCommit: Type.TString;
+        schemaVersion: Type.TInteger;
+        buildTime: Type.TOptional<Type.TInteger>;
+    }>;
+}>;
+export type Receipt = {
+    schemaVersion: typeof CONTROL_WIRE_SCHEMA_VERSION;
+    controlDomainId: string;
+    runId: string;
+    boundPlanHash?: string;
+    boundFragmentHash?: string;
+    eventManifest: string[];
+    manifestRoot: string;
+    startCommitSeq: number;
+    endCommitSeq: number;
+    artifactRefs: ArtifactRef[];
+    assurance: ReceiptAssurance;
+    buildInfo: BuildInfoWire;
+};
+//# sourceMappingURL=evidence.d.ts.map

package/dist/control/schema/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../../taskflow-control/src/schema/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,2BAA2B,EAA+B,MAAM,aAAa,CAAC;AACvF,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAiC,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAM1F,eAAO,MAAM,iBAAiB;;;;;;EAS7B,CAAC;AACF,MAAM,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACvB,CAAC;AAMF,eAAO,MAAM,qBAAqB,mCAA0E,CAAC;AAC7G,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,qBAAqB,CAAC;AAE3F,eAAO,MAAM,uBAAuB,mCAAsC,CAAC;AAC3E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEvD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;EAqBlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,UAAU,EAAE;QAAE,eAAe,EAAE,oBAAoB,CAAC;QAAC,SAAS,EAAE,cAAc,CAAA;KAAE,CAAC;IACjF,WAAW,EAAE;QACZ,YAAY,EAAE,uBAAuB,CAAC;QACtC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACrC,CAAC;CACF,CAAC;AAMF,eAAO,MAAM,mBAAmB;;;;;EAQ/B,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBzB,CAAC;AACF,MAAM,MAAM,OAAO,GAAG;IACrB,aAAa,EAAE,OAAO,2BAA2B,CAAC;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,aAAa,CAAC;CACzB,CAAC"}

package/dist/control/schema/evidence.js

@@ -0,0 +1,64 @@
+/**
+ * Evidence wire types (🟥 NEW): ArtifactRef, Receipt, ReceiptAssurance.
+ *
+ * Decisions: P6 (digest is not a bearer token; ledger reachability authorizes
+ * read), P11 (Receipt survives compaction; manifests issued at receipt time
+ * remain valid), P14 (receipts dir under the store), P8 (assurance.enforcement
+ * records the promise; observedRevocationLatencyMs optional).
+ */
+import { Type } from "typebox";
+import { StringEnum } from "taskflow-core/typebox-helpers";
+import { CONTROL_WIRE_SCHEMA_VERSION, Sha256HexSchema, UuidSchema } from "./common.js";
+import { EnforcementCapabilitiesSchema } from "./policy.js";
+// ---------------------------------------------------------------------------
+// ArtifactRef (P6 / RFC §12)
+// ---------------------------------------------------------------------------
+export const ArtifactRefSchema = Type.Object({
+    digest: Sha256HexSchema,
+    size: Type.Integer({ minimum: 0 }),
+    mediaType: Type.String({ minLength: 1 }),
+    storageClass: Type.String({ minLength: 1 }),
+    redactionClass: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// ReceiptAssurance (P8/P11)
+// ---------------------------------------------------------------------------
+export const ProviderOutcomeSchema = StringEnum(["completed", "failed", "ambiguous", "operator-intervened"]);
+export const ArtifactIntegritySchema = StringEnum(["verified", "unknown"]);
+export const ReceiptAssuranceSchema = Type.Object({
+    journalContinuity: Type.Boolean(),
+    providerOutcome: ProviderOutcomeSchema,
+    artifactIntegrity: ArtifactIntegritySchema,
+    provenance: Type.Object({
+        confidentiality: StringEnum(["public", "internal", "secret"]),
+        integrity: StringEnum(["untrusted", "project", "verified"]),
+    }, { additionalProperties: false }),
+    enforcement: Type.Object({
+        capabilities: EnforcementCapabilitiesSchema,
+        observedRevocationLatencyMs: Type.Optional(Type.Integer({ minimum: 0 })),
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+// ---------------------------------------------------------------------------
+// Receipt (P11/P14) — issued once, immutable
+// ---------------------------------------------------------------------------
+export const BuildInfoWireSchema = Type.Object({
+    packageVersion: Type.String({ minLength: 1 }),
+    gitCommit: Type.String({ minLength: 1 }),
+    schemaVersion: Type.Integer({ minimum: 0 }),
+    buildTime: Type.Optional(Type.Integer({ minimum: 0 })),
+}, { additionalProperties: false });
+export const ReceiptSchema = Type.Object({
+    schemaVersion: Type.Literal(CONTROL_WIRE_SCHEMA_VERSION),
+    controlDomainId: UuidSchema,
+    runId: UuidSchema,
+    boundPlanHash: Type.Optional(Type.String({ minLength: 1 })),
+    boundFragmentHash: Type.Optional(Type.String({ minLength: 1 })),
+    eventManifest: Type.Array(UuidSchema),
+    manifestRoot: Sha256HexSchema,
+    startCommitSeq: Type.Integer({ minimum: 1 }),
+    endCommitSeq: Type.Integer({ minimum: 1 }),
+    artifactRefs: Type.Array(ArtifactRefSchema),
+    assurance: ReceiptAssuranceSchema,
+    buildInfo: BuildInfoWireSchema,
+}, { additionalProperties: false });
+//# sourceMappingURL=evidence.js.map