weir-harness 1.2.3 → 2.1.0

package/src/edit-lock/negotiation.js

@@ -1,132 +0,0 @@
-import { randomUUID } from 'node:crypto'
-
-/** Request-bound holder negotiation (try_steal → holder reply).
- *
- * Requests live in memory on purpose: a manager restart advances every
- * session epoch and the incarnation, so a request from before a restart could
- * only ever be stale. Timeout, delivery failure, silence and an interrupted
- * holder all retain ownership; only a current reply from the exact bound
- * holder execution transfers, and the transfer itself is one durable manager
- * transaction. Waiting holds no manager queue slot.
- * @param {{
- *   control: {status: () => any, transfer: (holder: any, requester: any) => Promise<any>},
- *   executionFor: (agent: object) => import('./state.js').Execution,
- *   agentFor: (sessionId: string) => object | undefined,
- *   deliver: (agent: object, text: string, wake?: boolean) => void,
- *   onPending?: (agent: object, pending: number) => void,
- *   timeoutMs?: number, now?: () => number,
- * }} options */
-export function createNegotiation(options) {
-  const { control, executionFor, agentFor, deliver } = options
-  const timeoutMs = options.timeoutMs ?? 120_000
-  const now = options.now ?? Date.now
-  /** @typedef {{requestId: string, resourceId: string, generation: number,
-   * holder: {sessionId: string, executionEpoch: number}, requester: import('./state.js').Execution,
-   * state: 'pending'|'transferring'|'transferred'|'declined'|'expired'|'stale'|'failed', expiresAt: number,
-   * timer?: ReturnType<typeof setTimeout>}} Request */
-  /** @type {Map<string, Request>} */
-  const requests = new Map()
-  let closed = false
-
-  /** `wake` opens an idle turn, which a holder needs in order to answer at all;
-   * it is never used for interrupted holders or for outcome notices.
-   * @param {string} sessionId @param {string} text @param {boolean} [wake] */
-  function notify(sessionId, text, wake = false) {
-    const agent = agentFor(sessionId)
-    if (!agent) return
-    try { deliver(agent, text, wake) } catch { /* delivery failure never implies consent */ }
-  }
-  /** @param {string} sessionId */
-  function pendingFor(sessionId) {
-    return [...requests.values()].filter(request => request.holder.sessionId === sessionId && request.state === 'pending')
-  }
-  /** @param {string} sessionId */
-  function refresh(sessionId) {
-    const agent = agentFor(sessionId)
-    if (agent) options.onPending?.(agent, pendingFor(sessionId).length)
-  }
-  /** @param {Request} request @param {Request['state']} state @param {string} text */
-  function settle(request, state, text) {
-    if (request.state !== 'pending' && request.state !== 'transferring') return
-    request.state = state
-    if (request.timer) clearTimeout(request.timer)
-    notify(request.requester.sessionId, text)
-    refresh(request.holder.sessionId)
-  }
-  /** @param {string} resourceId */
-  function lockOf(resourceId) {
-    return control.status().locks.find(/** @param {any} lock */ lock => lock.resourceId === resourceId)
-  }
-
-  return Object.freeze({
-    /** Requester side; never waits for the holder.
-     * @param {object} agent @param {string} resourceId */
-    request(agent, resourceId) {
-      if (closed) throw new Error('negotiation closed')
-      const requester = executionFor(agent)
-      const lock = lockOf(resourceId)
-      if (!lock) throw new Error('file is not locked; acquire it instead')
-      if (lock.owner === requester.sessionId) throw new Error('file is already owned by this session')
-      const existing = [...requests.values()].find(request => request.state === 'pending'
-        && request.resourceId === resourceId && request.requester.sessionId === requester.sessionId)
-      if (existing) return { requestId: existing.requestId, state: 'pending', holder: lock.owner, holderStatus: lock.status }
-      const session = control.status().sessions.find(/** @param {any} item */ item => item.sessionId === lock.owner)
-      /** @type {Request} */
-      const request = { requestId: `steal-${randomUUID()}`, resourceId, generation: lock.generation,
-        holder: { sessionId: lock.owner, executionEpoch: session?.executionEpoch ?? 0 },
-        requester: { ...requester }, state: 'pending', expiresAt: now() + timeoutMs }
-      requests.set(request.requestId, request)
-      request.timer = setTimeout(() => settle(request, 'expired',
-        `Edit Lock request ${request.requestId} for ${resourceId} expired without a holder reply; ownership is unchanged. ` +
-        `If the holder cannot reply, the Edit Lock maintenance panel (Settings → Edit Lock maintenance) offers the administrative force release for the stuck lock.`), timeoutMs)
-      request.timer.unref?.()
-      // An interrupted holder is never woken; its request simply expires.
-      if (session && !session.interrupted) {
-        refresh(lock.owner)
-        notify(lock.owner, `Edit Lock: session ${requester.sessionId} requests ownership of ${resourceId} (request ${request.requestId}). ` +
-          `Call edit_lock_reply with this request_id and decision "release" to hand the file over, or "keep" to retain it. No reply keeps your ownership.`, true)
-      }
-      return { requestId: request.requestId, state: 'pending', holder: lock.owner, holderStatus: lock.status }
-    },
-    /** Holder side; the reply binds request, generation, holder and epoch.
-     * @param {object} agent @param {string} requestId @param {'release'|'keep'} decision */
-    async reply(agent, requestId, decision) {
-      if (closed) throw new Error('negotiation closed')
-      const request = requests.get(requestId)
-      if (!request || request.state !== 'pending') throw new Error('request is not pending')
-      const holder = executionFor(agent)
-      if (holder.sessionId !== request.holder.sessionId || holder.executionEpoch !== request.holder.executionEpoch) {
-        throw new Error('reply is not from the bound holder execution')
-      }
-      if (now() >= request.expiresAt) {
-        settle(request, 'expired', `Edit Lock request ${requestId} expired; ownership is unchanged.`)
-        throw new Error('request expired')
-      }
-      const lock = lockOf(request.resourceId)
-      if (!lock || lock.owner !== holder.sessionId || lock.generation !== request.generation) {
-        settle(request, 'stale', `Edit Lock request ${requestId} is stale: ownership of ${request.resourceId} changed.`)
-        throw new Error('ownership changed since the request')
-      }
-      if (decision === 'keep') {
-        settle(request, 'declined', `Edit Lock request ${requestId} declined: the holder keeps ${request.resourceId}.`)
-        return { requestId, state: 'declined' }
-      }
-      if (decision !== 'release') throw new Error('decision must be "release" or "keep"')
-      request.state = 'transferring'
-      try {
-        const token = await control.transfer({ ...holder, resourceId: request.resourceId, generation: request.generation }, request.requester)
-        settle(request, 'transferred', `Edit Lock request ${requestId} granted: this session now owns ${request.resourceId} (generation ${token.generation}).`)
-        return { requestId, state: 'transferred', generation: token.generation }
-      } catch (error) {
-        settle(request, 'failed', `Edit Lock request ${requestId} failed; ownership is unchanged: ${/** @type {any} */ (error)?.message ?? error}`)
-        throw error
-      }
-    },
-    /** @param {string} sessionId */
-    pending(sessionId) { return pendingFor(sessionId).map(({ requestId, resourceId, requester, expiresAt }) => ({ requestId, resourceId, requester: requester.sessionId, expiresAt })) },
-    close() {
-      closed = true
-      for (const request of requests.values()) if (request.timer) clearTimeout(request.timer)
-    },
-  })
-}

package/src/edit-lock/operation-history.js

@@ -1,214 +0,0 @@
-import { isAbsolute, relative } from 'node:path'
-import { dispositionFor } from './derived-facts.js'
-
-/** Historical assertions only: no authentication, live permission or FS publication.
- * Digests MUST be computed by a future trusted publisher over canonical requests,
- * original arguments and actual payload bytes. Strings supplied here are not proof.
- * @typedef {{ kind: 'create', ancestor: string, suffix: string, policy: { kind: 'createIfAbsent' } } | { kind: 'update', resourceId: string, generation: number, policy: { kind: 'replaceIfVersion', version: string } }} Target
- * @typedef {{ tool: 'write'|'hash_edit'|'edit'|'lsp_rename', filePath: string, cwd: string, requestDigest: string, argsDigest: string, payloadDigest: string, target: Target }} Binding
- * @typedef {{ kind: 'resource', resourceId: string } | { kind: 'subtree', ancestor: string, basis: 'observed-ancestor'|'conservative-ancestor' } | { kind: 'domain', basis: 'containment-unproved' }} Fence
- * @typedef {{ kind: 'created'|'updated', resourceId: string, generation: number, version: string } | { kind: 'unknown' } | { kind: 'not-published', reason: 'cancelled-before-dispatch'|'rejected-before-dispatch' }} Outcome
- * @typedef {{ kind: 'abandoned-unknown'|'not-published-evidence', assertionId: string }} Closeout
- * @typedef {{ sessionId: string, operationId: string, origin: { executionEpoch: number, managerIncarnation: string }, binding: Binding, phase: 'prepared'|'publishing'|'created'|'updated'|'unknown'|'not-published', fence: Fence|null, outcome: Outcome|null, closeouts: Closeout[] }} Operation
- */
-
-/** @param {unknown} condition @param {string} message @returns {asserts condition} */
-function valid(condition, message) {
-  if (!condition) throw new Error(`invalid operation ${message}`)
-}
-/** @param {unknown} value @returns {value is string} */
-function id(value) { return typeof value === 'string' && value.length > 0 && !value.includes('\0') }
-/** @param {unknown} value @returns {value is number} */
-function positive(value) { return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 }
-/** @param {unknown} value @param {string[]} keys @returns {asserts value is Record<string, unknown>} */
-function shape(value, keys) {
-  valid(value !== null && typeof value === 'object' && !Array.isArray(value), 'object')
-  valid(Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null, 'prototype')
-  valid(Reflect.ownKeys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k)), 'schema keys')
-  for (const key of keys) {
-    const d = Object.getOwnPropertyDescriptor(value, key)
-    valid(d && 'value' in d && d.enumerable, 'data property')
-  }
-}
-/** @param {unknown} value @returns {asserts value is unknown[]} */
-function array(value) {
-  valid(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype, 'array')
-  valid(Reflect.ownKeys(value).length === value.length + 1, 'array keys')
-  for (let i = 0; i < value.length; i++) {
-    const d = Object.getOwnPropertyDescriptor(value, i)
-    valid(d && 'value' in d && d.enumerable, 'array data')
-  }
-}
-/** @param {Binding} binding */
-export function validateBinding(binding) {
-  shape(binding, ['tool', 'filePath', 'cwd', 'requestDigest', 'argsDigest', 'payloadDigest', 'target'])
-  valid(['write', 'hash_edit', 'edit', 'lsp_rename'].includes(binding.tool), 'tool')
-  valid(id(binding.filePath) && id(binding.cwd) && isAbsolute(binding.cwd), 'literal path/cwd')
-  for (const digest of [binding.requestDigest, binding.argsDigest, binding.payloadDigest]) {
-    valid(typeof digest === 'string' && /^[a-f0-9]{64}$/.test(digest), 'digest')
-  }
-  const target = binding.target
-  if (target.kind === 'create') {
-    shape(target, ['kind', 'ancestor', 'suffix', 'policy'])
-    valid(binding.tool === 'write', 'creation is write-only')
-    valid(id(target.ancestor) && isAbsolute(target.ancestor) && id(target.suffix) && !isAbsolute(target.suffix) && !target.suffix.split('/').includes('..'), 'create descriptor')
-    shape(target.policy, ['kind'])
-    valid(target.policy.kind === 'createIfAbsent', 'frozen create policy')
-  } else {
-    shape(target, ['kind', 'resourceId', 'generation', 'policy'])
-    valid(target.kind === 'update' && id(target.resourceId) && isAbsolute(target.resourceId) && positive(target.generation), 'update descriptor')
-    shape(target.policy, ['kind', 'version'])
-    valid(target.policy.kind === 'replaceIfVersion' && typeof target.policy.version === 'string', 'guarded update policy')
-  }
-}
-/** Store-internal validation; collections are never a second authority map.
- * @param {import('./store.js').AuthorityImage} state */
-export function validateOperations(state) {
-  array(state.operations)
-  const keys = new Set()
-  const generations = new Map(state.generations.map(g => [g.resourceId, g.generation]))
-  for (const op of state.operations) {
-    shape(op, ['sessionId', 'operationId', 'origin', 'binding', 'phase', 'fence', 'outcome', 'closeouts'])
-    valid(id(op.sessionId) && id(op.operationId), 'key')
-    const key = JSON.stringify([op.sessionId, op.operationId])
-    valid(!keys.has(key), 'duplicate key'); keys.add(key)
-    const session = state.sessions.find(s => s.sessionId === op.sessionId)
-    shape(op.origin, ['executionEpoch', 'managerIncarnation'])
-    valid(positive(op.origin.executionEpoch) && id(op.origin.managerIncarnation) && session && session.executionEpoch >= op.origin.executionEpoch, 'origin')
-    validateBinding(op.binding)
-    valid(['prepared', 'publishing', 'created', 'updated', 'unknown', 'not-published'].includes(op.phase), 'phase')
-    if (op.phase === 'prepared') valid(op.fence === null && op.outcome === null, 'prepared phase')
-    else if (op.phase === 'not-published') {
-      valid(op.fence === null, 'undispatched fence')
-      shape(op.outcome, ['kind', 'reason'])
-      valid(op.outcome.kind === 'not-published' && ['cancelled-before-dispatch', 'rejected-before-dispatch'].includes(op.outcome.reason), 'undispatched outcome')
-    }
-    else {
-      validateFence(op)
-      if (op.phase === 'publishing') valid(op.outcome === null, 'publishing outcome')
-      else if (op.phase === 'unknown') {
-        shape(op.outcome, ['kind'])
-        valid(op.outcome.kind === 'unknown', 'unknown outcome')
-      }
-      else {
-        shape(op.outcome, ['kind', 'resourceId', 'generation', 'version'])
-        valid(op.outcome.kind === 'created' || op.outcome.kind === 'updated', 'success outcome')
-        valid(op.outcome.kind === op.phase && id(op.outcome.resourceId) && isAbsolute(op.outcome.resourceId) && positive(op.outcome.generation) && typeof op.outcome.version === 'string', 'outcome')
-        // Lifetime references survive release/reownership; current locks are irrelevant.
-        valid((generations.get(op.outcome.resourceId) ?? 0) >= op.outcome.generation, 'success generation history')
-        valid(op.phase === (op.binding.target.kind === 'create' ? 'created' : 'updated'), 'outcome channel')
-        if (op.binding.target.kind === 'update') valid(op.outcome.resourceId === op.binding.target.resourceId && op.outcome.generation === op.binding.target.generation, 'update outcome binding')
-        if (op.phase === 'created' && op.fence?.kind === 'subtree') {
-          const suffix = relative(op.fence.ancestor, op.outcome.resourceId)
-          valid(suffix.length > 0 && suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'created containment')
-        }
-      }
-    }
-    if ((op.phase === 'publishing' || op.phase === 'unknown') && op.binding.target.kind === 'update' && !dispositionFor(state, op)) {
-      const target = op.binding.target
-      const lock = state.locks.find(l => l.resourceId === target.resourceId)
-      valid(lock && lock.owner === op.sessionId && lock.generation === target.generation, 'retained unresolved ownership')
-    }
-    array(op.closeouts)
-    valid(op.phase === 'unknown' || op.closeouts.length === 0, 'unknown-only closeout')
-    const assertions = new Set()
-    for (const closeout of op.closeouts) {
-      shape(closeout, ['kind', 'assertionId'])
-      valid(['abandoned-unknown', 'not-published-evidence'].includes(closeout.kind) && id(closeout.assertionId) && !assertions.has(closeout.assertionId), 'closeout assertion')
-      assertions.add(closeout.assertionId)
-    }
-  }
-}
-
-/** Containment here is a historical assertion, NOT filesystem/alias proof. The
- * future publisher must establish the observed ancestor and scope before dispatch.
- * @param {Operation} op */
-function validateFence(op) {
-  const fence = op.fence
-  valid(fence, 'durable fence required')
-  const target = op.binding.target
-  if (target.kind === 'update') {
-    shape(fence, ['kind', 'resourceId'])
-    valid(fence.kind === 'resource' && fence.resourceId === target.resourceId, 'resource fence')
-  } else if (fence.kind === 'subtree') {
-    shape(fence, ['kind', 'ancestor', 'basis'])
-    valid(id(fence.ancestor) && isAbsolute(fence.ancestor), 'subtree scope')
-    if (fence.basis === 'observed-ancestor') valid(fence.ancestor === target.ancestor, 'minimal ancestor')
-    else {
-      valid(fence.basis === 'conservative-ancestor', 'scope basis')
-      const suffix = relative(fence.ancestor, target.ancestor)
-      valid(suffix !== '..' && !suffix.startsWith('../') && !suffix.startsWith('..\\') && !isAbsolute(suffix), 'conservative containment')
-    }
-  } else {
-    shape(fence, ['kind', 'basis'])
-    valid(fence.kind === 'domain' && fence.basis === 'containment-unproved', 'domain fallback')
-  }
-}
-
-/** Structural comparison independent of object insertion order.
- * @param {unknown} value @returns {string} */
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`
-  if (value !== null && typeof value === 'object') {
-    const object = /** @type {Record<string, unknown>} */ (value)
-    return `{${Object.keys(object).sort().map(k => `${JSON.stringify(k)}:${canonical(object[k])}`).join(',')}}`
-  }
-  return JSON.stringify(value)
-}
-/** No current authority checks: authenticate the querying session outside this
- * historical seam. Original epoch/incarnation are NOT fields of a retry query.
- * A returned prepared/publishing record is never permission to redispatch.
- * @param {import('./store.js').AuthorityImage} state
- * @param {{sessionId: string, operationId: string, binding: Binding}} query
- * @returns {Operation|null} */
-export function lookupOperation(state, query) {
-  const op = state.operations.find(o => o.sessionId === query.sessionId && o.operationId === query.operationId)
-  if (!op) return null
-  if (canonical(op.binding) !== canonical(query.binding)) throw new Error('ID_REUSE: operation binding differs')
-  return structuredClone(op)
-}
-/** Always called by raw store.record too.
- * @param {import('./store.js').AuthorityImage} before
- * @param {import('./store.js').AuthorityImage} after */
-export function validateOperationTransitions(before, after) {
-  for (const next of after.operations) {
-    const old = lookupOperation(before, next)
-    if (!old) {
-      valid(next.phase === 'prepared', 'new history must be prepared')
-      valid(next.origin.managerIncarnation === after.managerIncarnation && next.origin.executionEpoch === after.sessions.find(s => s.sessionId === next.sessionId)?.executionEpoch, 'initial origin')
-    }
-  }
-  // One before/after ownership transition can credit only one new creation.
-  // Do not count unchanged successful history from earlier generations.
-  const createdResources = new Set()
-  for (const old of before.operations) {
-    const next = lookupOperation(after, old)
-    valid(next, 'history removal')
-    valid(canonical(next.origin) === canonical(old.origin), 'immutable origin')
-    const previousSession = before.sessions.find(s => s.sessionId === old.sessionId)
-    const session = after.sessions.find(s => s.sessionId === old.sessionId)
-    valid(previousSession && session, 'operation session')
-    if (canonical(old) !== canonical(next) && previousSession.interrupted) valid(session.interrupted && session.executionEpoch === previousSession.executionEpoch, 'operation transition cannot rearm session')
-    if (old.phase === 'prepared') valid(['prepared', 'publishing', 'not-published'].includes(next.phase), 'prepared transition')
-    else {
-      valid(canonical(old.fence) === canonical(next.fence), 'immutable fence')
-      if (old.phase === 'publishing') valid(['publishing', 'created', 'updated', 'unknown'].includes(next.phase), 'publishing transition')
-      else {
-        valid(old.phase === next.phase && canonical(old.outcome) === canonical(next.outcome), 'immutable terminal history')
-        valid(next.closeouts.length >= old.closeouts.length && old.closeouts.every((c, i) => canonical(c) === canonical(next.closeouts[i])), 'append-only closeout')
-      }
-    }
-    if (old.phase === 'publishing' && next.outcome && (next.outcome.kind === 'created' || next.outcome.kind === 'updated')) {
-      const outcome = next.outcome
-      const lock = after.locks.find(l => l.resourceId === outcome.resourceId)
-      valid(lock && lock.owner === next.sessionId && lock.generation === outcome.generation, 'atomic outcome ownership')
-      if (next.outcome.kind === 'created') {
-        valid(!before.locks.some(l => l.resourceId === outcome.resourceId), 'created requires new ownership')
-        valid(!createdResources.has(outcome.resourceId), 'duplicate created resource attribution')
-        createdResources.add(outcome.resourceId)
-      }
-      if (session.interrupted) valid(lock.status === 'user-interrupted' || lock.status === 'abnormal', 'retained interrupted classification')
-      if (session.executionEpoch !== old.origin.executionEpoch || after.managerIncarnation !== old.origin.managerIncarnation) valid(lock.status !== 'active', 'retained stale execution classification')
-    }
-  }
-}

package/src/edit-lock/peer-client.js

@@ -1,86 +0,0 @@
-import { asBindingFailure } from './binding-guidance.js'
-import { canonicalRequestData } from './request-data.js'
-import { PEER_KINDS } from './peer.js'
-
-/** Client for a pre-authenticated, single-session host channel. A disconnect or
- * abort rejects with UNKNOWN, not not-published; never retry under a new callId.
- * @param {import('node:stream').Duplex} stream
- * @param {{onEvent?: (event: any) => void, onClose?: () => void}} [hooks] */
-export function createEditLockPeerClient(stream, hooks = {}) {
-  const maxBytes = 8 * 1024 * 1024
-  /** @type {Map<string, {resolve:(value:any)=>void, reject:(error:Error)=>void, cleanup:()=>void}>} */
-  const pending = new Map()
-  let buffer = Buffer.alloc(0)
-  let closed = false
-  function close() {
-    if (closed) return
-    closed = true
-    stream.destroy()
-    for (const entry of pending.values()) {
-      entry.cleanup()
-      entry.reject(new Error('edit publication outcome UNKNOWN: channel closed; inspect original call history'))
-    }
-    pending.clear()
-    try { hooks.onClose?.() } catch { /* observer failure cannot reopen */ }
-  }
-  /** @param {Buffer} chunk */
-  function receive(chunk) {
-    if (closed) return
-    if (!Buffer.isBuffer(chunk) || buffer.length + chunk.length > maxBytes + 4) { close(); return }
-    buffer = Buffer.concat([buffer, chunk])
-    while (!closed && buffer.length >= 4) {
-      const size = buffer.readUInt32BE(0)
-      if (size === 0 || size > maxBytes) { close(); return }
-      if (buffer.length < size + 4) return
-      let message
-      try { message = JSON.parse(new TextDecoder('utf-8', {fatal:true}).decode(buffer.subarray(4,size+4))) }
-      catch { close(); return }
-      buffer = buffer.subarray(size+4)
-      if (message && typeof message === 'object' && Object.keys(message).join(',') === 'event') {
-        try { hooks.onEvent?.(message.event) } catch { /* notices never imply consent */ }
-        continue
-      }
-      const frameKeys = !message || typeof message !== 'object' ? '' : Object.keys(message).sort().join(',')
-      // The error frame carries the structured binding refusal as an additive
-      // optional field (change edit-lock-deepening, design D2).
-      if (!message || typeof message.callId !== 'string' || typeof message.ok !== 'boolean'
-        || (message.ok ? frameKeys !== 'callId,ok,outcome' : frameKeys !== 'callId,error,ok' && frameKeys !== 'bindingFailure,callId,error,ok')
-        || (!message.ok && typeof message.error !== 'string')) { close(); return }
-      const entry = pending.get(message.callId)
-      if (!entry) { close(); return }
-      pending.delete(message.callId)
-      entry.cleanup()
-      if (message.ok) entry.resolve(message.outcome)
-      else {
-        const failure = asBindingFailure(message.bindingFailure)
-        entry.reject(Object.assign(new Error(message.error), failure ? { bindingFailure: failure } : {}))
-      }
-    }
-  }
-  stream.on('data', receive)
-  stream.once('end', close)
-  stream.once('error', close)
-  stream.once('close', close)
-  return Object.freeze({
-    /** Cancellation closes the entire session channel (conservative revocation).
-     * Local rejection is NOT a manager revocation acknowledgment.
-     * @param {string} kind @param {string} callId @param {unknown} request @param {AbortSignal} signal */
-    request(kind, callId, request, signal) {
-      if (closed || signal.aborted) return Promise.reject(new Error('edit peer unavailable before dispatch'))
-      if (!(kind === 'open' || PEER_KINDS.includes(kind)) || typeof callId !== 'string' || !callId.trim() || callId.length > 512) return Promise.reject(new Error('invalid edit peer call'))
-      if (pending.has(callId) || pending.size >= 32) return Promise.reject(new Error('edit peer call admission rejected'))
-      const bytes = Buffer.from(canonicalRequestData({kind,callId,request}))
-      if (bytes.length > maxBytes || stream.writableLength + bytes.length + 4 > 2*maxBytes) return Promise.reject(new Error('edit peer frame admission rejected'))
-      const header = Buffer.alloc(4)
-      header.writeUInt32BE(bytes.length)
-      return new Promise((resolve,reject) => {
-        pending.set(callId, {resolve,reject,cleanup:() => signal.removeEventListener('abort',close)})
-        signal.addEventListener('abort',close,{once:true})
-        if (signal.aborted) { close(); return }
-        try { stream.write(Buffer.concat([header,bytes]), error => {if (error) close()}) }
-        catch { close() }
-      })
-    },
-    close,
-  })
-}

package/src/edit-lock/peer-transport.js

@@ -1,76 +0,0 @@
-import { asBindingFailure } from './binding-guidance.js'
-import { canonicalRequestData } from './request-data.js'
-
-/** Attach ONLY an authenticated, host-owned byte stream. Never accepts public
- * sockets or chooses a session from message fields. Length-prefixed JSON, 8 MiB
- * maximum; transport loss revokes the fixed peer and never elects a publisher.
- * @param {import('node:stream').Duplex} stream
- * @param {{receive: (input: unknown) => Promise<unknown>, disconnect: () => Promise<unknown>}} peer */
-export function serveEditLockPeer(stream, peer) {
-  const maxBytes = 8 * 1024 * 1024
-  let buffer = Buffer.alloc(0)
-  let ended = false
-  /** @type {Promise<unknown> | undefined} */
-  let closing
-  function close() {
-    if (closing) return closing
-    ended = true
-    stream.pause()
-    stream.destroy()
-    const disconnecting = Promise.resolve(peer.disconnect())
-    closing = disconnecting
-    // Event callbacks cannot propagate an async rejection. Keep the original
-    // rejected promise available to the owner, which MUST await close().
-    void disconnecting.catch(() => {})
-    return disconnecting
-  }
-  /** @param {unknown} response */
-  function send(response) {
-    if (ended) return
-    const bytes = Buffer.from(canonicalRequestData(response))
-    if (bytes.length > maxBytes || stream.writableLength + bytes.length + 4 > 2 * maxBytes) {
-      close()
-      return
-    }
-    const header = Buffer.alloc(4)
-    header.writeUInt32BE(bytes.length)
-    stream.write(Buffer.concat([header, bytes]), error => { if (error) close() })
-  }
-  /** @param {Buffer} chunk */
-  function receive(chunk) {
-    if (ended) return
-    // Bound allocation before concatenation; a cooperating client sends one
-    // bounded frame at a time. Oversized coalesced batches fail closed too.
-    if (!Buffer.isBuffer(chunk) || buffer.length + chunk.length > maxBytes + 4) { close(); return }
-    buffer = Buffer.concat([buffer, chunk])
-    while (!ended && buffer.length >= 4) {
-      const size = buffer.readUInt32BE(0)
-      if (size === 0 || size > maxBytes) { close(); return }
-      if (buffer.length < size + 4) return
-      let request
-      try { request = JSON.parse(new TextDecoder('utf-8', {fatal:true}).decode(buffer.subarray(4, size + 4))) }
-      catch { close(); return }
-      buffer = buffer.subarray(size + 4)
-      if (typeof request?.callId !== 'string' || request.callId.length > 512) { close(); return }
-      const callId = request.callId
-      void peer.receive(request).then(
-        outcome => { try { send({callId, ok:true, outcome:outcome ?? null}) } catch { close() } },
-        error => {
-          // The wire carries the structured binding refusal additively (change
-          // edit-lock-deepening, design D2); the text stays for display.
-          const failure = asBindingFailure(/** @type {any} */ (error)?.bindingFailure)
-          try { send({ callId, ok: false, error: String(/** @type {any} */ (error)?.message ?? error).slice(0, 4096), ...(failure ? { bindingFailure: failure } : {}) }) } catch { close() }
-        },
-      )
-    }
-  }
-  stream.on('data', receive)
-  stream.once('end', close)
-  stream.once('error', close)
-  stream.once('close', close)
-  return Object.freeze({close,
-    /** Server-initiated notice frame; carries text/counters, never authority.
-     * @param {unknown} event */
-    notify(event) { try { send({event}) } catch { close() } },
-  })
-}

package/src/edit-lock/peer.js

@@ -1,87 +0,0 @@
-import { canonicalRequestData } from './request-data.js'
-
-/** Model-facing tool kinds and trusted human-ingress kinds. The connecting
- * host process is the trusted ingress for the latter (same trust base). */
-export const PEER_KINDS = Object.freeze(['publish', 'batch', 'acquire', 'release', 'locks', 'trySteal', 'reply', 'pending',
-  'status', 'stop', 'resume', 'confirm', 'unlock', 'allLocks', 'classifyAbnormal', 'recoveryUsage', 'chargeRecovery', 'pause',
-  'hold', 'turnStarted', 'releaseHeld', 'settleExpired', 'retention', 'dispose', 'staleSweep', 'adminRecover'])
-
-/** Bind an already authenticated, host-owned channel to ONE registered agent.
- * No identity or lifecycle capability is accepted in a wire message. The caller
- * process is trusted to resolve policy; this is not remote attestation.
- * @param {ReturnType<typeof import('./lifecycle.js').createEditLockLifecycle>} lifecycle
- * @param {object} agent */
-export function createEditLockPeer(lifecycle, agent) {
-  const pending = new Set()
-  let closed = false
-  /** @type {Promise<unknown> | undefined} */
-  let closing
-  function disconnect() {
-    if (closing) return closing
-    closed = true
-    // stop synchronously fences the registry before waiting for any publication;
-    // Connection loss may be a crash: revoke and forget, never release. A
-    // clean client end sends 'dispose' first.
-    closing = lifecycle.forget ? lifecycle.forget(agent) : lifecycle.stop(agent)
-    const attempt = closing
-    void attempt.catch(() => { if (closing === attempt) closing = undefined })
-    return /** @type {Promise<void>} */ (closing)
-  }
-  return Object.freeze({
-    /** Transport must bound frame bytes before JSON parsing and call disconnect
-     * on EOF/error. Responses carry outcomes, never reusable write permissions.
-     * @param {unknown} input */
-    async receive(input) {
-      if (closed) throw new Error('edit peer disconnected')
-      const message = JSON.parse(canonicalRequestData(input))
-      if (!message || typeof message !== 'object' || Array.isArray(message)
-        || Object.keys(message).sort().join(',') !== 'callId,kind,request'
-        || !PEER_KINDS.includes(message.kind)
-        || typeof message.callId !== 'string' || !message.callId.trim()) throw new Error('invalid edit peer message')
-      if (pending.has(message.callId)) throw new Error('edit peer call already pending')
-      if (pending.size >= 32) throw new Error('edit peer admission limit')
-      pending.add(message.callId)
-      try {
-        const exec = {agent,callId:message.callId,signal:new AbortController().signal}
-        const request = /** @type {any} */ (message.request)
-        const service = /** @type {any} */ (lifecycle.service)
-        switch (message.kind) {
-          case 'publish': return await service.publish(exec, request)
-          case 'batch': return await service.publishBatch(exec, request)
-          case 'acquire': return await service.acquire(exec, request)
-          case 'release': return await service.release(exec, request)
-          case 'locks': return await service.locks(exec)
-          case 'trySteal': return await service.trySteal(exec, request)
-          case 'reply': return await service.reply(exec, request)
-          case 'pending': return await service.pendingRequests(exec)
-          case 'status': return lifecycle.status(agent)
-          case 'stop': await lifecycle.stop(agent); return lifecycle.status(agent)
-          case 'resume': return await lifecycle.resume(agent, `remote:${String(request?.requestId)}`)
-          case 'confirm': await lifecycle.confirm(agent, request?.resourceId); return lifecycle.status(agent)
-          case 'unlock': return await lifecycle.unlock(request?.resourceId, request?.generation)
-          case 'allLocks': return lifecycle.locks()
-          case 'classifyAbnormal': return await lifecycle.classifyAbnormal(agent, String(request?.reason ?? 'abnormal'))
-          case 'recoveryUsage': return lifecycle.recoveryUsage(agent)
-          case 'chargeRecovery': return await lifecycle.chargeRecovery(agent, request ?? {})
-          case 'pause': return await lifecycle.pause(agent, Number(request?.minutes))
-          case 'hold': return await lifecycle.hold(agent, Number(request?.ms), { singleMaxMs: Number(request?.singleMaxMs), cumulativeMaxMs: Number(request?.cumulativeMaxMs) })
-          case 'turnStarted': return await lifecycle.turnStarted(agent)
-          case 'releaseHeld': return await lifecycle.settleExpired(agent, true)
-          case 'settleExpired': return await lifecycle.settleExpired(agent, false, request?.idle === true)
-          case 'retention': return lifecycle.retention(agent)
-          case 'dispose': { closed = true; await lifecycle.dispose(agent); return { disposed: true } }
-          // The triggering session is the channel's own session: the publisher
-          // performs the scan itself (it shares the filesystem).
-          case 'staleSweep': return await lifecycle.sweepStale(agent.id)
-          // Online administrative recovery (design D4): the SAME transaction
-          // runs publisher-side; the trigger identity is the channel's own
-          // bound agent, never a payload field.
-          case 'adminRecover': return await lifecycle.adminRecoverOnline(request, agent.id)
-          default: throw new Error('invalid edit peer message')
-        }
-      } finally { pending.delete(message.callId) }
-    },
-    // Trusted channel lifecycle only, not a model-controlled request method.
-    disconnect,
-  })
-}