toolroll 0.9.81 → 0.9.82

package/dist/store.d.ts

@@ -37,6 +37,7 @@ import { type RetentionKind, type RetentionPeriods } from "./retention.js";
 import { type CheckoutCleanup } from "./storage.js";
 import { type LedgerChainReport } from "./ledger-chain.js";
 import { type ApprovalGate, type ApprovalRules, type ApproverKind, type Filer } from "./approval-policy.js";
+import { type ReportedAmount } from "./reported-usage.js";
 /** A lead reply stopped at its deadline, in the thread as plain words: what happened, what it means, one next step. The
  * proposals it made before then are kept; the cost line only when an unknown cost paused chat. */
 export declare function leadTimeoutNotice(keptProposals: boolean, unknownCost?: boolean): string;
@@ -110,6 +111,34 @@ export declare const RUN_LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_
  * tables only. A lifecycle row's `holder` binds it to one registration (a worker's registered_at) or one console
  * process; a row whose holder no longer matches says nothing. Timelines are bounded and pruned as they are written. */
 export declare const V137_SCHEMA = "\nCREATE TABLE IF NOT EXISTS service_lifecycle (\n  component   TEXT PRIMARY KEY,\n  state       TEXT NOT NULL CHECK (state IN ('started','draining','stopped')),\n  holder      TEXT NOT NULL,\n  pid         INTEGER,\n  changed_at  TEXT NOT NULL,\n  beat_at     TEXT NOT NULL,\n  drain_until TEXT\n);\nCREATE TABLE IF NOT EXISTS latency_timeline (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  kind            TEXT NOT NULL CHECK (kind IN ('console','release-check','deploy')),\n  subject         TEXT NOT NULL,\n  task_id         TEXT,\n  run_id          INTEGER,\n  started_at      TEXT NOT NULL,\n  total_ms        INTEGER NOT NULL,\n  milestones_json TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS latency_timeline_by_kind ON latency_timeline (kind, id);\nCREATE INDEX IF NOT EXISTS latency_timeline_by_run ON latency_timeline (run_id) WHERE run_id IS NOT NULL;\nCREATE INDEX IF NOT EXISTS latency_timeline_by_task ON latency_timeline (task_id) WHERE task_id IS NOT NULL;\nCREATE TABLE IF NOT EXISTS live_backup (\n  id            INTEGER PRIMARY KEY CHECK (id = 1),\n  enabled       INTEGER NOT NULL DEFAULT 1,\n  every_minutes INTEGER NOT NULL DEFAULT 5,\n  keep          INTEGER NOT NULL DEFAULT 24,\n  folder        TEXT,\n  holder        TEXT,\n  held_until    TEXT,\n  latest_file   TEXT,\n  latest_sha256 TEXT,\n  latest_at     TEXT,\n  latest_schema INTEGER,\n  latest_bytes  INTEGER,\n  tried_at      TEXT,\n  problem       TEXT\n);\n";
+/** v139 (docs/plans/evals-nightly.md, part A): GitHub's nightly as release debt. New tables only. `nightly_lane` keeps
+ * one stable id per required check (its workflow file and name when it was seeded); `nightly_lane_alias` a person's
+ * rename of one. `github_nightly_cursor` is how far listing has got, `github_nightly_watch` every counted run still
+ * read again for new attempts. `nightly_lane_job` records each completed lane job once; `nightly_lane_failure` each
+ * test failure, open until a later counted nightly run passes that lane (or a person retires it). `nightly_exemption`
+ * is one release candidate's own pull-request job that passed a lane after its failure. Each lane job and failure keeps
+ * its run's creation time: only a run created later clears a failure. Kept apart from
+ * `main_check_failure`, whose `run` is a Toolroll run. */
+export declare const V139_SCHEMA = "\nCREATE TABLE IF NOT EXISTS nightly_lane (\n  repo          TEXT NOT NULL,\n  lane_id       TEXT NOT NULL,\n  workflow      TEXT NOT NULL,\n  display_name  TEXT NOT NULL,\n  seeded_at     TEXT NOT NULL,\n  retired_at    TEXT,\n  retired_by    TEXT,\n  retired_proof TEXT,\n  PRIMARY KEY (repo, lane_id)\n);\nCREATE TABLE IF NOT EXISTS nightly_lane_alias (\n  id      INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo    TEXT NOT NULL,\n  lane_id TEXT NOT NULL,\n  name    TEXT NOT NULL,\n  by      TEXT NOT NULL,\n  proof   TEXT NOT NULL,\n  at      TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS nightly_lane_alias_by_name ON nightly_lane_alias (repo, name, id);\nCREATE TABLE IF NOT EXISTS github_nightly_cursor (\n  repo          TEXT PRIMARY KEY,\n  page_cursor   TEXT NOT NULL,\n  last_ok_at    TEXT,\n  last_why      TEXT,\n  last_tried_at TEXT\n);\nCREATE TABLE IF NOT EXISTS github_nightly_watch (\n  repo            TEXT NOT NULL,\n  gh_run          INTEGER NOT NULL,\n  created_at      TEXT NOT NULL,\n  attempts_read   INTEGER NOT NULL DEFAULT 0 CHECK (attempts_read >= 0),\n  finished        INTEGER NOT NULL DEFAULT 0 CHECK (finished IN (0, 1)),\n  last_checked_at TEXT,\n  PRIMARY KEY (repo, gh_run)\n);\nCREATE TABLE IF NOT EXISTS nightly_lane_job (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo         TEXT NOT NULL,\n  lane_id      TEXT NOT NULL,\n  gh_run       INTEGER NOT NULL,\n  run_created_at TEXT NOT NULL,\n  attempt      INTEGER NOT NULL,\n  job_id       INTEGER NOT NULL,\n  sha          TEXT NOT NULL,\n  started_at   TEXT,\n  completed_at TEXT,\n  conclusion   TEXT,\n  cause        TEXT NOT NULL CHECK (cause IN ('passed','test-failure','runner-failure','not-run')),\n  read_at      TEXT NOT NULL,\n  UNIQUE (repo, gh_run, attempt, job_id)\n);\nCREATE INDEX IF NOT EXISTS nightly_lane_job_passes ON nightly_lane_job (repo, lane_id, started_at) WHERE cause = 'passed';\nCREATE TABLE IF NOT EXISTS nightly_lane_failure (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo           TEXT NOT NULL,\n  lane_id        TEXT NOT NULL,\n  gh_run         INTEGER NOT NULL,\n  run_created_at TEXT NOT NULL,\n  attempt        INTEGER NOT NULL,\n  job_id         INTEGER NOT NULL,\n  sha            TEXT NOT NULL,\n  completed_at   TEXT NOT NULL,\n  opened_at      TEXT NOT NULL,\n  cleared_at     TEXT,\n  cleared_by_job TEXT,\n  closed_why     TEXT,\n  UNIQUE (repo, gh_run, attempt, job_id)\n);\nCREATE INDEX IF NOT EXISTS nightly_lane_failure_open ON nightly_lane_failure (repo, id) WHERE cleared_at IS NULL;\nCREATE TABLE IF NOT EXISTS nightly_exemption (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  task         TEXT NOT NULL,\n  candidate    TEXT NOT NULL,\n  failure_id   INTEGER NOT NULL REFERENCES nightly_lane_failure(id),\n  pr           INTEGER NOT NULL,\n  gh_run       INTEGER NOT NULL,\n  attempt      INTEGER NOT NULL,\n  job_id       INTEGER NOT NULL,\n  started_at   TEXT NOT NULL,\n  completed_at TEXT NOT NULL,\n  read_at      TEXT NOT NULL,\n  UNIQUE (task, candidate, failure_id)\n);\n";
+/** v141 (docs/plans/evals-nightly.md, part C): the eval set's own records, written only by the installed plane's eval
+ * module (evals.ts). `eval_campaign` is one campaign (an eval set run or a reviewer run), sealed at admission, with the
+ * runner that owns it (so an interrupted one can be recovered); one canonical campaign runs at a time (settlement
+ * order). `eval_attempt` is one attempt of one case (unique per campaign, case, number and what it replaces: 0 for an
+ * original) and what it spent; `eval_invocation` each provider dispatch its world made, with what it was billed as
+ * (API dollars, subscription usage or unknown, never added together) and the model it reported. `eval_baseline_pin` and
+ * `eval_debt` are C2's (the owner's pinned baseline and regressed cases). New tables only; the columns are
+ * V141_ADDED_COLUMNS. No money limit (the owner, 2026-10-30): spending is recorded, not capped. */
+export declare const V141_SCHEMA = "\nCREATE TABLE IF NOT EXISTS eval_campaign (\n  id                TEXT PRIMARY KEY,\n  kind              TEXT NOT NULL DEFAULT 'eval' CHECK (kind IN ('eval','reviewer')),\n  canonical         INTEGER NOT NULL CHECK (canonical IN (0, 1)),\n  manifest_digest   TEXT NOT NULL,\n  build_digest      TEXT NOT NULL,\n  version           TEXT NOT NULL,\n  baseline_campaign TEXT,\n  k                 INTEGER NOT NULL CHECK (k >= 1),\n  sealed_json       TEXT NOT NULL,\n  started_by        TEXT NOT NULL,\n  started_proof     TEXT NOT NULL,\n  runner_host       TEXT NOT NULL,\n  runner_pid        INTEGER NOT NULL,\n  runner_started    TEXT,\n  admitted_at       TEXT NOT NULL,\n  finished_at       TEXT,\n  state             TEXT NOT NULL CHECK (state IN ('running','complete','incomplete')),\n  why               TEXT,\n  spending_unknown  INTEGER NOT NULL DEFAULT 0 CHECK (spending_unknown IN (0, 1)),\n  settled_at        TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS eval_campaign_one_canonical ON eval_campaign (canonical) WHERE state = 'running' AND canonical = 1;\nCREATE TABLE IF NOT EXISTS eval_attempt (\n  id                    INTEGER PRIMARY KEY AUTOINCREMENT,\n  campaign              TEXT NOT NULL REFERENCES eval_campaign(id),\n  case_id               TEXT NOT NULL,\n  case_version          TEXT NOT NULL,\n  n                     INTEGER NOT NULL CHECK (n >= 1),\n  replaces              INTEGER NOT NULL DEFAULT 0,\n  outcome               TEXT CHECK (outcome IN ('pass','fail','error','unevaluated')),\n  error_why             TEXT,\n  model_pinned          TEXT NOT NULL,\n  model_reported        TEXT,\n  dispatches            INTEGER,\n  api_microusd          INTEGER,\n  subscription_microusd INTEGER,\n  usage_unknown         INTEGER NOT NULL DEFAULT 0 CHECK (usage_unknown IN (0, 1)),\n  turns                 INTEGER,\n  tokens_in             INTEGER,\n  cache_read            INTEGER,\n  cache_write           INTEGER,\n  tokens_out            INTEGER,\n  tool_calls            INTEGER,\n  wall_ms               INTEGER,\n  world_dir             TEXT,\n  world_pgid            INTEGER,\n  world_processes_json  TEXT,\n  started_at            TEXT NOT NULL,\n  finished_at           TEXT,\n  UNIQUE (campaign, case_id, n, replaces)\n);\nCREATE TABLE IF NOT EXISTS eval_invocation (\n  id                    INTEGER PRIMARY KEY AUTOINCREMENT,\n  attempt               INTEGER NOT NULL REFERENCES eval_attempt(id),\n  kind                  TEXT NOT NULL,\n  world_ref             TEXT NOT NULL,\n  recorded              INTEGER NOT NULL CHECK (recorded IN (0, 1)),\n  amount                TEXT NOT NULL CHECK (amount IN ('api','subscription','unknown')),\n  api_microusd          INTEGER CHECK (api_microusd IS NULL OR api_microusd >= 0),\n  subscription_microusd INTEGER CHECK (subscription_microusd IS NULL OR subscription_microusd >= 0),\n  model_reported        TEXT,\n  UNIQUE (attempt, world_ref)\n);\nCREATE TABLE IF NOT EXISTS eval_baseline_pin (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  campaign            TEXT NOT NULL REFERENCES eval_campaign(id),\n  by                  TEXT NOT NULL,\n  proof               TEXT NOT NULL,\n  at                  TEXT NOT NULL,\n  accepted_worse_json TEXT\n);\nCREATE TABLE IF NOT EXISTS eval_debt (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  case_id             TEXT NOT NULL,\n  case_version        TEXT NOT NULL,\n  campaign            TEXT NOT NULL REFERENCES eval_campaign(id),\n  baseline_campaign   TEXT NOT NULL,\n  opened_at           TEXT NOT NULL,\n  cleared_at          TEXT,\n  cleared_by_campaign TEXT,\n  waived_by           TEXT,\n  waived_proof        TEXT,\n  waived_why          TEXT\n);\n";
+/** v141 (evals-nightly.md, Codex round 1 #4 and #10): how a run's billing was known — `evidence` (its own events, the
+ * key it was given, or its agent's admission) or `default` (this computer's usual billing, a guess) — and how a chat
+ * request was billed, as its own events said (null: they didn't). A guess or a silence is unknown money, never
+ * subscription usage. Saved rows read NULL: unknown. `run.cost_unknown` (PR #263 review): set once any turn of the run
+ * ended without its provider reporting a cost, and never cleared (recordRunCostUnknown); saved rows read 0, and their
+ * money is unknown all the same through their NULL billing basis. */
+export declare const V141_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export declare const LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS live_detail_setting (\n  repo       TEXT PRIMARY KEY,\n  commands   INTEGER NOT NULL CHECK (commands IN (0,1)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n-- Every run a steering note reached, kept as it happens (live-notes.ts): a\n-- note's own attached/mailed fields move to the next attempt, this does not.\nCREATE TABLE IF NOT EXISTS steer_note_run (\n  note INTEGER NOT NULL REFERENCES task_steer(id) ON DELETE CASCADE,\n  run  INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  how  TEXT NOT NULL CHECK (how IN ('attached','mailed','read')),\n  at   TEXT NOT NULL,\n  PRIMARY KEY (note, run, how)\n);\nCREATE INDEX IF NOT EXISTS steer_note_run_by_run ON steer_note_run (run, note);\n";
 export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
@@ -190,7 +219,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 138;
+export declare const SCHEMA_VERSION = 141;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -341,6 +370,12 @@ export declare const V138_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
     definition: string;
     saved: string;
 }>>>>;
+/** v140 (docs/plans/evals-nightly.md, B1): what the provider itself reported. Recorded from now on; a saved row reads
+ * NULL (not reported), never 0. A chat request's cache tokens are v129's columns. */
+export declare const V140_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -1264,6 +1299,8 @@ export type Run = {
     costUsd: number | null;
     /** v129: the agent's turns where its provider reports them (Claude's num_turns); null when unknown. */
     agentTurns?: number | null;
+    /** v140: the exact model the provider itself reported (reported-usage.ts; several joined by " + "); null when unknown. */
+    modelReported?: string | null;
     /** HEAD after the agent, as accepted — what a publication may push. */
     headRevision: string | null;
     /** The validated terminal handoff's conclusion. */
@@ -4171,6 +4208,13 @@ export declare class Store {
         /** v129: the request's cache read and write tokens, where its provider reports them (unknown stays NULL). */
         cacheReadTokens?: number | null;
         cacheWriteTokens?: number | null;
+        /** v140: what the provider itself reported for this request — its exact model, its own turn count and its
+         * reported cost in dollars (a subscription's is usage, not billed). Absent or null: not reported. */
+        modelReported?: string | null;
+        providerTurns?: number | null;
+        reportedCostUsd?: number | null;
+        /** v141: how the request's own events said it was billed (a subscription harness); absent or null: unknown. */
+        billingReported?: "subscription" | "api-key" | null;
     }, now: Date): boolean;
     /**
      * The crash sweep: turns past their deadline become failed('crashed'),
@@ -7913,3 +7957,67 @@ export declare function recordLiveBackup(store: Store, outcome: {
     ok: false;
     problem: string;
 }, now: Date): void;
+/** GitHub's nightly lane debt at a release's deploy or merge reservation and at its start (docs/plans/evals-nightly.md,
+ * part A2): the stored open failures less this exact task and candidate's fresh exemptions, read inside the caller's
+ * transaction (nightly-github.ts nightlyDebtHold). Null when nothing holds. */
+export declare function releaseNightlyProblem(store: Store, input: {
+    repo: string;
+    taskId: string;
+    candidate: string;
+    kind: "deploy" | "merge";
+    now: Date;
+}): string | null;
+/** v140 (docs/plans/evals-nightly.md, B1): the exact model a run's provider itself reported, written once its turn's
+ * envelope is read. A resumed turn that adds to the run's usage adds its model too: unknown if either turn's is, the
+ * model when they agree, every model named when they differ (reported-usage.ts combineReportedModels). */
+export declare function recordRunModelReported(store: Store, runId: number, model: string | null, accumulate: boolean): void;
+/** A run's accounting as recorded (the eval collector's read, docs/plans/evals-nightly.md part B): what its provider
+ * reported, its tokens normalized with their cache split (run-efficiency.ts usageOf), and its amount kept as API
+ * dollars, subscription usage or unknown (reported-usage.ts runAmountOf). Null when there is no such run. */
+export declare function runAccounting(store: Store, runId: number): {
+    provider: string;
+    model: string | null;
+    modelReported: string | null;
+    agentTurns: number | null;
+    usage: {
+        in: number | null;
+        out: number | null;
+        cacheRead: number | null;
+        cacheWrite: number | null;
+    };
+    amount: ReportedAmount;
+} | null;
+/** A chat request's accounting as recorded (lead steps and fleet chat turns): what its provider reported and its
+ * amount kept as API dollars, subscription usage or unknown (reported-usage.ts chatTurnAmountOf). Null when absent. */
+export declare function chatTurnAccounting(store: Store, id: number): {
+    provider: string;
+    model: string;
+    modelReported: string | null;
+    providerTurns: number | null;
+    reportedCostUsd: number | null;
+    tokensIn: number | null;
+    tokensOut: number | null;
+    cacheReadTokens: number | null;
+    cacheWriteTokens: number | null;
+    amount: ReportedAmount;
+} | null;
+/** v141 (evals-nightly.md, Codex round 1 #4): how a run's billing was known, beside the billing invoke.ts fixed —
+ * `evidence` (its own events, the key it was given, its agent's admission) or `default` (this computer's usual billing,
+ * a guess). Once any turn of the run was a guess the run's money stays unknown. */
+export declare function recordRunBillingBasis(store: Store, runId: number, basis: "evidence" | "default"): void;
+/** v141 (PR #263 review): a run whose provider didn't report what a turn cost is unknown money for good. Set when a
+ * turn's cost is unknown, never cleared: a later turn (a review resume) that reports its own cost, and recordUsage's
+ * COALESCE over the usage note, can't make the run's spending read as measured again. */
+export declare function recordRunCostUnknown(store: Store, runId: number, unknown: boolean): void;
+/** PR #263 security scan: the Store methods eval accounting pins by body (eval-hooks.ts PINNED_STORE_METHODS) made
+ * unwritable and unconfigurable on the prototype, from the class's own first static block, so no code runs between the
+ * class's definition and the seal. Each must still be the class's own plain method (a writable, configurable function),
+ * or loading refuses. The four references are recorded once, in a frozen module-private map, through the built-ins this
+ * module captured as it loaded; a second seal refuses. */
+export declare function sealStoreMoneyMethods(prototype: object): void;
+/** PR #263 security scan: each Store instance holds the sealed money methods as its own unwritable, unconfigurable
+ * properties (the constructor's last step), so shadowing one on an instance, by any means, throws. It uses only the
+ * built-ins captured as this module loaded, refuses when the globals were replaced since, and installs a method only
+ * when the prototype's value is the very reference recorded at the seal. `prototype` is Store's own unless a test
+ * says otherwise; either way nothing but the recorded references is ever installed. */
+export declare function lockStoreMoneyMethods(store: object, prototype?: object): void;