Rulvar API reference / @rulvar/core
@rulvar/core
The Rulvar engine in one dependency-light package: the L0 contracts and SPI interfaces, the journal kernel behind the never-pay-twice invariant, the model router with the capability and price registry, the agent runtime, the tool system and MCP bus, the ctx primitives and run engine, the dynamic orchestrator, the in-memory and JSONL reference stores, and the typed event stream. Zero provider SDK dependencies: adapters plug in from their own packages. Key exports: createEngine, defineWorkflow, tool, mcp, orchestrate, InMemoryStore, JsonlFileStore.
Part of Rulvar, an embeddable TypeScript engine for durable, budget-bounded multi-agent LLM workflows, where a completed LLM call is never paid for twice. Full documentation: docs.rulvar.com.
Install
bash
pnpm add @rulvar/coreMost applications start with the umbrella instead: pnpm add @rulvar/rulvar bundles this engine with both first-class adapters and the recommended model defaults. The a la carte path pairs the core with exactly the pieces you need, for example pnpm add @rulvar/core @rulvar/anthropic @rulvar/store-sqlite.
Documentation
License
Namespaces
| Namespace | Description |
|---|---|
| StandardJSONSchemaV1 | - |
| StandardSchemaV1 | - |
Classes
| Class | Description |
|---|---|
| AdmissionController | - |
| AdmissionRejectedError | A structural admission rejection (maxDepth, maxChildrenPerNode, maxTotalSpawns) from the AdmissionController (M6-T06). The rejection verdict is embedded in the carrying spawn-admission decision entry and replays identically; the error surfaces the embedded AdmitRejectReason in data to the caller (a typed tool error for orchestrators) and MUST NOT tear down the run. Budget-code rejections throw BudgetExhaustedError instead, keeping the budget exhaustion semantics (https://docs.rulvar.com/guide/budgets). |
| AgentCallError | The rejection carrier of ctx.agent value-form calls: a real Error that structurally satisfies the typed AgentError and carries the full AgentResult for Settled mapping. Deliberately not a RulvarError: AgentError is not in the closed code registry. |
| BudgetExhaustedError | The run budget ceiling blocked further work. The budget guard denial is a decision entry; ctx primitives throw this as AgentError kind 'budget'; the run reports outcome 'exhausted', overriding 'error'. |
| ConfigError | Construction- and definition-time misconfiguration: duplicate adapterId, non-git host for worktree isolation, worker over a non-leasable store, failed schema projection. Never journaled; raised before any run effect. |
| DedupIndex | The DedupIndex: a pure fold over spawn roots, severing abandons, and node.link entries. Prices fold from journal facts (servedBy, usage) through the injected price function; on replay the embedded verdict values are authoritative and this fold serves integrity only. |
| DeterminismError | A workflow-origin bare-nondeterminism violation under determinism.mode: 'error' (RV-209): bare Date.now() or Math.random() called from workflow code inside a run. Thrown at the offending call site (and re-thrown at settle if the workflow swallowed it), so the run rejects instead of recording a value replay cannot reproduce. data carries the structured localization: category, frame, and the parsed file/line/column when the frame names one. Never journaled as its own entry; the run settles 'error' with this wire error. Exempt provenances (installed dependencies, Node runtime frames, allowlisted patterns) never raise it. |
| EffectLaneFold | - |
| EffectLaneRefusedError | The effect lane refused an operation, typed and fail closed (plan 45, rfcs/effects.md): a consumption whose verdict no longer holds, a dispatch the state table forbids (re-dispatch after a revocation), a budget the intent has exhausted, an intake the protocol rejects (an effect approval without a deadline), or a store without the capabilities the lane requires. Never retryable by the engine's wire machinery: the lane's own recovery rules (reload, find the operation id, re-verdict) are the only legal retry, and they live in the writer, not in RetryPolicy. |
| EffectLaneWriter | - |
| EscalationDecisionAbortedError | The rejection carrier of an aborted flavor B decision wait (v1.35.0 review P1): the parked awaitDecision observes the branch/run AbortSignal, releases its held activity, removes its waiter, and rejects with this class so cancel, host abort, the run deadline, and failed sibling aborts all settle the run in bounded time. Deliberately not a RulvarError: the abort is cancellation intent, not a registry failure class; the suspension entry stays OPEN, so a later resume parks the decision again and the durable deadline still applies. |
| EventBus | The per-run event bus. seq is strictly increasing in emission order; iterate() yields events from subscription onward; on() is the callback form over the same stream and the same seq values. |
| ExternalRegistry | Per-run registry of open external suspensions plus the run's activity counter: when every in-flight branch is blocked on suspensions (activity zero, waiters open), the run quiesces into outcome 'suspended'. |
| FailRunError | A declared fail-run policy engaged and closed the run as a failure (v1.35.0 review P2-1): budget.atCap: 'fail-run' after the journaled orchestrator cap decision, guards.fallback: 'fail-run' after the journaled guard verdict, or a violated orchestrate acceptance policy after the journaled acceptance decision (data.source 'orchestrator_acceptance', with the child status counts and degraded reasons in data). The run outcome is 'error' with this code; data.source names the policy ('orchestrator_budget_cap' or 'plan_guards') and data carries the decision entry reference, so the outcome is a pure roll forward of the journal on resume: no second decision, no model call, no spend. |
| FileModelKnowledgeStore | The SPI seam. commit performs CAS on the monotonic snapshot version, mirroring the fencing-epoch discipline of LeasableStore; concurrent maintenance commits serialize through CAS rejection and rebase. commit is UNREACHABLE from the runtime: runs hold ModelKnowledgeHandle. |
| FileTranscriptStore | File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints, persisted CompiledWorkflow sources) as one file per ref under dir, so compiled runs resume across processes. Refs follow the <runId>/<name> convention; nested segments become directories. |
| GitWorktreeProvider | The shipped git worktree lifecycle. A non-git host is a typed ConfigError at acquire. |
| InMemoryStore | Exact lookup capability: fetch one run's meta without materializing the whole catalog (the v1.25.0 scale review: resume, HTTP status, and CLI point lookups were O(all runs) through listRuns). Optional exactly like the lease capability: engines and shells detect it with hasMetaLookup and fall back to listRuns + find, so a conformant store written before this capability keeps working unoptimized. A missing run resolves undefined, never a rejection. |
| InMemoryTranscriptStore | In-memory TranscriptStore. Refs follow the <runId>/<name> convention so list(runId) can filter without a side index. |
| InProcessRunner | The mode (a) runner for human-authored closures. Determinism is enforced by convention, lint, and the ctx shims, NOT by a VM: only the sequence of keys must be stable. Bare-nondeterminism detection is ENGINE-owned since RV-209: the engine wraps its execute call in withDeterminismDetection (runner/determinism.ts), which classifies bare Date.now/Math.random callers, emits the structured determinism:warning event on the run's stream, and under determinism.mode: 'error' rejects the run with a typed DeterminismError. The runner itself is a pure executor, so the frozen ScriptRunner seam carries no detection surface; a standalone execute outside an engine runs without detection. |
| InvalidResolutionError | A resolution attempt against an already-closed suspension, rejected under the first-closing-wins fold; appends no entry (producers ship in M2). |
| JournalCompatibilityError | Refusal to open a journal whose hashVersion falls outside the engine's support window (producers ship in M2). The registry code is 'journal_compat'; the sub-codes live on subCode and in data. |
| JournalIntegrityError | A journal append was lost before the settle (RV3201): a persist inside the serialized append queue rejected, and the queue swallowed the rejection to keep later appends flowing, so the journal is now missing an entry the run believes it wrote. The first such failure latches inside the Replayer: every flush() from that moment rethrows it, and the engine settle path converts a would-be ok (or suspended) outcome into an error terminal, because an ok settle over a lost deterministic record would replay differently than the run executed. The latch is permanent for the segment; a resume constructs a fresh Replayer against whatever the store actually holds. |
| JournalMatcher | The matching engine over a loaded journal. Consumption is per logical operation (running/terminal pairs count once); candidates are consumed in journal order, first unconsumed match wins (this also resolves cross-version double matches deterministically). |
| JournalMissError | A replay-strict run encountered a call that would go live (@rulvar/testing; producers ship in M2). |
| JournalOrderViolation | A breach of the total per-run append order: an unfenced concurrent writer or a store violating contract A2 (https://docs.rulvar.com/guide/stores). |
| JournalSealedError | A journal append arrived after the run's settle sealed the segment (RV1904): once run_settle is durable, the journal is the terminal truth every cost and invoice fold reads, and a late append would silently split it into the four mutually inconsistent views the four-role benchmark recorded. The orchestrate exit barrier (RV1903) and the engine's settle drain terminate every straggler BEFORE the seal, so this error names a lifecycle bug, never a working path. |
| JsonlFileStore | Exact lookup capability: fetch one run's meta without materializing the whole catalog (the v1.25.0 scale review: resume, HTTP status, and CLI point lookups were O(all runs) through listRuns). Optional exactly like the lease capability: engines and shells detect it with hasMetaLookup and fall back to listRuns + find, so a conformant store written before this capability keeps working unoptimized. A missing run resolves undefined, never a rejection. |
| KeyedLimiter | - |
| KnowledgeCasError | commit() on a ModelKnowledgeStore against a snapshot version that is no longer current. Retryable by contract: re-read current(), rebase the ops, commit again, mirroring the lease fencing discipline. |
| LeaseHeldError | acquire() on a currently held lease. Retryable by contract: retry after the lease ttl elapses or the holder releases. |
| LineageIndex | The incremental lineage fold: attempts, escalation debits, stall streaks, single-live-attempt, and legacy canonization, computed from journal entries only. absorb is idempotent by seq cursor; every read accepts an optional uptoSeq pin so renders stay snapshot-stable. |
| MemoryAdmissionScheduler | - |
| ModelRetry | - |
| NonSerializableValueError | A value failed the journal append JSON-serializability check. Never journaled; thrown at the call site whose value failed the check. |
| NoProgressDetector | Counts consecutive progress-free turns. A turn with at least one tool call (or, later, an artifact delta) resets the streak; a turn with neither lengthens it; the detector trips when the streak reaches the threshold AND the loop would otherwise continue. |
| OrchestratorCapConfigError | Invalid orchestrator cap and finalize-reserve configuration, thrown before the first LLM call (DEF-7; producers ship in M6/M7). |
| ParallelSiteCounter | Allocates parallel site numbers per enclosing scope: a monotonic counter in execution order, not source position. Because every scope body is sequential by construction (I3), allocation order is deterministic and identical on every replay. |
| PlanInvariantError | PlanRunner plan-invariant rejection (producers ship in M7). |
| Replayer | Per-run journal kernel front end. Everything is per instance: no module state anywhere. |
| ReplayPlanHashMismatch | Raised at resume when the refolded plan state disagrees with the journaled planHash chain (producers ship in M7). |
| ResolutionArbiter | Per-run, per-target FIFO serializer of resolution/abandon attempts: classification against the in-memory fold -> durable append -> a single settle; losing attempts are ALSO appended and become journaled noops by fold classification. Winner effects run strictly after the critical section (the caller's job). Cross-process protection remains the LeasableStore fencing epoch. |
| ResolutionFold | The first-closing-wins fold over a loaded journal: one pass by seq, bit-identical on every store returning the same entries. Resolution values are validated at consumption against the schema pinned INSIDE the suspended entry payload (canonical bare JSON Schema); a schema-invalid offline resolution classifies invalid and does NOT close the target. Abandon coverage is the target seq plus the transitive child scope-prefix; the AbandonFold consumed by the replay predicate is a projection of THIS fold (not a separate pass). |
| RulvarError | Base class for all engine-raised errors. "Retryable" means the engine's own retry machinery (RetryPolicy under the journal) MAY retry; it never means a provider SDK autoretry, which is disabled. |
| RunBudget | The per-run budget account tree. All spend accounting is per instance; the journal remains the durable source (the root is seeded by the ledger fold on resume, M2; sub-account reserves are recovered from spawn-admission decision entries, M6). |
| SandboxError | A WorkerSandboxRunner resource-limit breach (M6-T02): crossing timeoutMs or memoryMb terminates the worker and the run completes with outcome 'error' carrying this error's WireError projection; data records { reason: 'timeout' |
| ScriptRejected | compileScript rejected planner-generated source. Never journaled as its own entry; surfaced as diagnostics to the plan() self-repair loop (producers ship in M6). |
| Semaphore | - |
| SettlementError | The segment computed its outcome but a settlement write failed with a NON-fencing store error, so nothing durable records that the run settled. handle.result rejects with this instead of resolving, because a caller acting on an unrecorded outcome is exactly the split view an authoritative store exists to prevent. stage names the write that failed: 'run-settle' is the journal decision entry (when it fails the terminal meta write is SKIPPED, so the projection can never run ahead of the journal), 'meta' is the terminal RunMeta projection (the journal settle IS durable; only the projection is behind, the same residue a crash between the two writes leaves). Every entry the run appended before settlement is already durable, so recovery is deterministic: resume the run and replay re-settles the same outcome without a provider call, or reconcile the store with rulvar runs audit [--repair]. A superseded segment's fencing rejection of the settle append (LeaseHeldError) is NOT this error: it rejects with the typed SupersededError (RV1009), while a meta-only lease bounce over an already durable settle stays swallowed (the journal records the outcome; only the projection belongs to the current holder). data records { runId, runStatus, stage }. |
| SpanRegistry | Spans form a tree per run; spanId values are engine-minted opaque strings, unique per run, pure telemetry, never identity. |
| SupersededError | The segment computed its outcome but its run_settle append bounced off the store's fence (LeaseHeldError): a successor segment holds the lease and owns settlement (RV1009). Nothing durable records THIS segment's outcome, so handle.result rejects with this error instead of resolving, and the segment's run:end refuses green with settled: false and settledReason: 'superseded': a green terminal that exists in no durable store is exactly the split view RV907 forbids, and before this error a superseded segment resolved ok silently. Not retryable: the successor owns the run; read the authoritative outcome from its settle or the store's run meta. A meta-only lease bounce over an already durable settle is NOT this error and stays swallowed: the journal records the outcome, and only the projection belongs to the current holder. data records { runId, runStatus }. |
| TerminationAccount | The single per-run TerminationAccount: debit ONLY. No credit operation exists by construction; reclaim never replenishes anything (DEF-5 interaction). Live: the engine debits the in-memory account, writes the carrying entry with the balance-after, then applies effects. Resume state is rebuilt by TerminationFold from the journal, never from live config. |
Interfaces
| Interface | Description |
|---|---|
| AbandonedSpendView | The abandoned-spend ledger fold. |
| AbandonFold | - |
| AcceptanceChildSummary | - |
| AcceptanceTailSpec | The declared inputs of the acceptance tail (RV4001); undeclared estimates are zero. |
| AcceptanceTailTerms | The resolved terms behind acceptanceTailRequiredUsd; journal-ready numbers. |
| AdmissionDecision | The full admission decision embedded in the carrying entry. |
| AdmissionLevelConfig | - |
| AdmissionLevelKeys | The three bucket levels (RFC section 4.1): the resolved effective tenant; tenant plus providerAccount; the full scope digest. Keys are the JCS serialization of the level's projected sub-scope, canonical bytes everywhere, so the shipped limiters' addressing split never leaks into this seam. A level with nothing to key (no resolved tenant, no provider account) is absent rather than a phantom global bucket: fail-closed matching happens in the scheduler, not here. |
| AdmissionRequest | - |
| AdmissionReservation | The four reservation measures (RFC section 4.3). |
| AdmissionScheduler | - |
| AdmissionScopeDimensions | Normalized scope dimensions, exactly the quota request's shape. |
| AdmissionState | The scheduler's WHOLE state as one plain-JSON document: the durable implementations (sqlite, postgres) persist exactly this shape and CAS it atomically per lifecycle call, which is the RFC's first shipped durable form (a single scheduler over durable state; the multi-replica story beyond deterministic ordering is deferred by section 10). Per-row schemas are an optimization the SPI does not require: atomic "state moved AND buckets moved" holds trivially when the whole document commits or none of it does. |
| AdmissionStatsBefore | Live pre-append snapshot embedded in the decision entry (DEF-2/DEF-3). |
| AdmissionTicket | - |
| AdmitLineage | The lineage block every non-reject verdict carries (DEF-3). |
| AdmitRunUnitInput | - |
| AdmitSpec | What the admission point needs to know about one spawn. |
| AgentIdentityInput | Spawn entries: ctx.agent and orchestrator spawn tools (kind 'agent'). |
| AgentInvocationRow | One logical agent span. |
| AgentOpts | Per-spawn options. The identity split is normative: agentType, model/routing/effort (the requested modelSpec), schema (schemaHash), and key enter the content key; everything else is policy or telemetry and never re-keys entries. Fields whose machinery lands later (tools, isolation, escalation, lineage, ladder, retry) arrive with their milestones. |
| AgentProfile | The canonical, complete AgentProfile shape; M1 honors description, model, routing, effort, limits, and estCost. A profile never carries a prompt or a schema. |
| AgentProfilePermissions | Profile-level permissions. inheritPermissions governs SUBAGENT inheritance (mode c orchestrators, M6+): children get their own config only unless explicitly opted in. It is carried as data here and consumed by the spawning layers. |
| AgentProfileTemplateOptions | Options shared by the implementation and review templates. |
| AgentResult | - |
| AgentResultMeta | The consumer-facing reuse mark on results. |
| AiSdkBridgeRegulatedPosture | The posture a bridgeAiSdk() adapter chose at construction. |
| AnchorGroundingFinding | One wrong line finding of anchorGroundingFindingsOf. |
| AnchorGroundingOptions | The options of anchorGroundingFindingsOf and the validator. |
| AnchorGroundingSuggestion | One suggested repair target inside the cited file. |
| AppliedPricingRow | One pinned row: the pricing that was APPLIED to this model's usage. |
| ApproachSignatureInputs | The identity inputs of the coarse signature (prompt prose excluded). |
| ApprovalDecision | The resolution value shape of a tool-approval suspension (M3-T03). |
| ApprovalExpiredDecision | The clock fact for grant expiry (RFC section 4.5, item 1): the fold never compares wall clocks, so an approval's expiresAt becomes effective only through this appended decision. Mirrors the shipped approval_revoked decision shape (targetRef addressing, no opId: idempotent by content, appendable by any observer with append rights, because it only materializes a crossing the approval's own recorded expiry already determines). |
| ApprovalIdentityInput | Tool-approval suspensions (kind 'approval'). |
| ApprovalRevocationOutcome | One recorded approval revocation's outcome (RV4008). |
| Artifact | Artifact: the normative shape of AgentResult.artifacts entries. |
| AuditRecord | One reviewable authority event, in journal order. |
| AuditRunsOptions | - |
| BaseAppend | Fields common to every append through the kernel. |
| BriefOpts | Options of ctx.brief (concrete shape fixed in M6-T10): the content to distill plus an optional instruction; the invocation resolves role 'summarize', so it needs defaults.routing.summarize, a profile, or the explicit model. |
| BudgetAccountView | Read-only projection of one account. |
| BudgetDefaults | - |
| BudgetExhaustionDiagnostics | Why a ceiling error ended the work: the first closed account walking from the debited scope toward the root, plus the root state, so the outward message can name WHICH ceiling actually crossed instead of blaming the run ceiling for every crossing. |
| BudgetHooks | Budget hooks bound by the three-layer budget. |
| BudgetReserve | Layer-1 reservation embedded in the carrying decision entry. |
| CacheHint | Provider-neutral declaration of intended prompt-cache boundaries. Transport-level cost optimization only: MUST NOT enter IdentityInput and MUST NOT change response semantics. |
| CachePolicy | The prompt-cache policy (RV2006): whether and how the agent loop compiles CacheHint onto every turn of its tool cycle. 'auto' (the default when no policy is declared anywhere) attaches breakpoints after tools, after system, and after the deepest message (sliding each turn) on adapters that declare ModelCaps.promptCaching: 'explicit'; adapters without the declaration, and providers whose caching is implicit server-side, never see a hint, so their wire traffic stays byte identical. 'off' is the opt-out. The hint is transport-level cost optimization only: it never enters identity, journals, or cassette keys. The third parity rerun priced the absence: every turn of a ~550k-token worker context re-paid the full input rate because nothing in the core ever populated the hint the adapter could compile. |
| CanonicalLadderSpec | LadderSpec after canonicalization: every rung's effort resolved to an explicit value. |
| CapacitySheet | The sheet: sections of labeled figures plus the named assumptions. |
| CapacitySheetFigure | One figure of the sheet: a number, its unit, and where it came from. |
| CapacitySheetSection | One titled section; observed figures never share one with declared. |
| CapacitySheetSpec | The closed input schema of the sheet (RV4304). |
| ChatRequest | The provider-neutral chat request. Sampling parameters (temperature, top_p, top_k) are deliberately absent from the first-class surface: both first-class providers reject them on current reasoning models; where a target legitimately supports them they travel through the adapter's providerOptions namespace, subject to caps scrubbing. |
| CheckpointState | The canonical-history snapshot at a turn boundary. |
| ChildArtifactPage | One page of a settled child's artifact CONTENT, returned by the opt-in read_child_artifact tool. Inline artifact data serializes to a string; an offloaded artifact (a TranscriptStore ref) is fetched and decoded as UTF-8; a patch artifact with only a changed file list carries that list in files and empty content. Paged and pure exactly like ChildResultPage. |
| ChildExecutionFacts | One child's execution facts, folded ONLY from replay-stable settled material (RV1503): the journaled per-dispatch reconciliation records and the journaled usage, which a resumed run restores verbatim. Dollars are deliberately absent: replay re-prices from the CURRENT price table, so a money figure here would drift across resumes while these counters cannot. |
| ChildIdentityInput | Nested workflow spawns: ctx.workflow (kind 'child'). |
| ChildrenAtFailure | The roster facts of a run that died before any acceptance verdict (RV2602): a fold over the children's own journaled terminals, so an exhausted or failed orchestration still names the work it paid for. |
| ChildResultPage | One page of a settled child's FULL output, returned by the opt-in get_child_result tool. The digest is a wake signal truncated to 400 characters; this is the whole evidence, paged so a large result can be read without overflowing the orchestrator's context in one call (v1.40.0 improvement plan, the narrow RV-201 slice). The content is a deterministic serialization of the child's output (the raw string when the output IS a string, else its JCS-independent JSON.stringify) for a settled ok child, or the child's errorMessage otherwise, so the orchestrator can read WHY a child failed as readily as what it produced; a limit child carrying a structured terminal partial serves { error, partial } instead (RV-210 close-out), so the collected work is pageable in full. Everything here is a pure read of already durable journal state, so a resume reproduces it with no new spend. |
| CitationAuditFinding | One judged (or mechanically decided) non-supported citation. |
| CitationAuditPlanOptions | The declared audit options, exactly OrchestrateCitationAudit. |
| CitationAuditRow | One sampled citation occurrence, before any verdict. |
| CitationAuditSectionMeta | The per-section slice of the audit meta. |
| CitationExcerptUnit | The bounded logical unit resolver v2 excerpts (RV4208). |
| CitationTarget | One resolved citation target: the source line the citation points at. |
| ClaimContradictionFinding | One judged contradiction: the pair plus the judge's one-sentence reason. |
| ClaimCoverageInput | The subset of the claim-consistency meta the grade derives from. |
| ClaimMapRow | One row of the composition's claim map. |
| ClaimPair | One draft assertion paired with the pool readings of its anchor. |
| ClaimPairOptions | - |
| ClaimPairsFold | What the fold produced, beside the pairs themselves. |
| ClaimPoolReading | One pool sentence read against a draft sentence, with its reporter. |
| ClaimValidationOptions | - |
| CollectedTurn | One collected model turn, assembled from the stream by the agent loop. |
| CollectOpts | - |
| CompactionConfig | Per-profile compaction config (AgentProfile). |
| CompiledPermissionChain | - |
| CompiledWorkflow | Source-backed workflow admissible to the worker sandbox; produced by compileScript (M6). Declared now so the ScriptRunner seam is shaped once; feeding a closure to the sandbox stays impossible by types. |
| ComponentDelta | One (model, component) line of the reconciliation. |
| Contradiction | One cited location two children read differently. |
| ContradictionClaim | One reading of a disputed key, with everyone who reported it. |
| ContradictionOptions | - |
| ContradictionSource | One child's serialized output as the pass reads it. |
| CostAttribution | Per-run cost attribution buckets consumed by CostReport (M1-T10/T11). |
| CostAttributionFacts | Cost-attribution facts a live run knows at settlement and a pure journal fold cannot re-derive: the innermost phase name at the call site, the agent profile, the primary invocation role, the budget account the call debited, and whether the dispatch spent the orchestrator finalize reserve. Policy, never identity, exactly like usageByModel: none of it enters the content key, and entries written before the field shipped fold under the documented fallback buckets (empty phase, 'unknown' agent type, role 'loop'). |
| CostReport | Full contract: https://docs.rulvar.com/guide/observability. |
| CreateEngineOptions | - |
| CriticalPath | The critical-path summary of one run (RV-211): the plan's post-fan-in gate ("synthesis takes at most 40% of wall time with four settled workers") computed as a pure fold over the same vocabulary, no heuristics beyond the role tags. Post-fan-in is the interval from the LAST settled non-coordination agent (any span whose primary role is neither 'orchestrate' nor 'synthesize') to run:end; the synthesis wall is the summed span wall of 'synthesize' spans. Wall numbers are LIVE fidelity: a replayed stream re-stamps emission times, so its intervals are degenerate, exactly like phase durations. Absent pieces (no run:end, no worker spans) leave the corresponding fields undefined rather than guessed at. |
| Ctx | The canonical Ctx interface, M1 members. |
| DataKeyProvider | The KMS seam. keyId is a stable routing id stamped into every envelope (a KMS key ARN or alias, or a local rotation label); the two methods are the exact shape of KMS GenerateDataKey and Decrypt. Both are called only inside createEnvelopeEncryption. |
| DecisionChainRow | One authority record of the chain, seq-ordered. |
| DeclaredLadder | One declared ladder of the run, named by its agentType. |
| DedupedClaims | - |
| DedupNote | Telemetry for a SpawnKey match admitted fresh. |
| DelimitedStatementOptions | How statementRowsFromDelimited splits cells; default ','. |
| DeterminismConfig | Host configuration for the guard (CreateEngineOptions.determinism). |
| DocumentedRates | One side of a documented-rates comparison: the five per-MTok rate fields a provider pricing page publishes plus the long-context tiers, every field optional because either side may legitimately not carry one. A seed Pricing row is assignable directly. |
| DonorCandidate | One donor candidate surfaced by the DedupIndex fold. |
| DonorRef | The rich donor descriptor embedded in reuse verdicts. |
| DroppedItem | One dropped result: its source, scope, entry ref, and wire error. |
| EffectAppendResult | - |
| EffectAttemptDecision | One dispatch attempt, appended BEFORE the network send (RFC section 3.1, item 3): at most one attempt may be open at a time, and attempts are sub-records of the ONE intent, never new intents. |
| EffectAttemptState | - |
| EffectBudgets | Recovery budgets recorded ON the intent (RFC section 3.1, item 2): every non-terminal state is bounded, and every exhaustion path lands in quarantined. reconcileBy is the overall deadline; crossing it in any non-terminal state quarantines with the state recorded. |
| EffectConsumeResult | - |
| EffectDeclarationState | - |
| EffectDeclaredDecision | The descriptive declared state (RFC section 3.1, item 1): the effect is described but not yet authorized; no provider interaction is legal. The bounded wait for authorization rides the licensing approval's own deadlineAt (refused at intake without one), so this record is descriptive, never load-bearing for consumption. |
| EffectDispositionDecision | A journaled human disposition of a quarantine or an incident. |
| EffectDispositionState | - |
| EffectEpochDecision | The epoch fact (RFC section 4.5): before the first effect intent of a run incarnation the engine appends the run's generation token (from RunMeta.genesis, which is meta and invisible to a journal-only fold) and the store-level restoration generation when the store exposes one. Every intent cites the epoch entry by seq; an intent citing a non-latest epoch folds void. |
| EffectEpochState | - |
| EffectIncidentDecision | A linked incident (RFC section 4.6, item 2): a fact that arrived after a terminal and genuinely matters. Durable, causally linked, surfaced, requiring disposition; never a mutation of the terminal. |
| EffectIncidentState | - |
| EffectIntentDecision | The single linearization append (RFC section 4.3): consuming the approval and recording the intent is THIS one entry. Whether it consumed is a pure function of the strict journal prefix before it; the fold computes the verdict, and a void intent derives the refused terminal. |
| EffectIntentSpec | - |
| EffectiveUsageLimits | - |
| EffectLaneStore | Effect lane capability (plan 45, rfcs/effects.md section 4.5, item 3): a store carrying a restoration generation OUTSIDE the journal bytes. The restore procedure bumps it atomically BEFORE the restored data becomes reachable, so a point-in-time-restored store comes up with effect dispatch disabled by construction: the effect lane writer validates the store's generation against the one recorded in the journal's latest effect_epoch decision and refuses every lane append until an operator appends a fresh epoch citing the bumped generation. One recorded deviation from the RFC's wording, with its reason: the RFC asks the store itself to reject an UNLEASED effect lane append, but stores are dumb byte stores that never parse payloads (obligation A4) and cannot recognize lane traffic; the unleased half is therefore enforced by the writer's construction (no lane append path exists without the lease) plus the conformance kit over the writer-store composition, while the superseded-lease half is exactly the shipped fencedWrites contract. |
| EffectLaneWriterOptions | - |
| EffectMachine | - |
| EffectOutcomeDecision | The classified result of one attempt. |
| EffectProbeDecision | A journaled provider probe (plan 45 train five): every lookup and every acceptance closure the recovery machinery performs is a durable row, so the intent's lookup budget (RFC section 3.1) is countable from the journal alone and survives a crash of the probing process. |
| EffectProbeState | One journaled provider probe (lookup budget accounting). |
| EffectReceiptDecision | A receipt observation, verified against the trust envelope BEFORE it is appended as 'verified' (RFC section 7): an unverifiable receipt appends as 'unverified' and routes the machine to unknown, never to confirmed and never to silent discard. |
| EffectReceiptState | - |
| EffectReconciliationCompleteDecision | The post-restore gate release (RFC section 4.5, item 3): after a restoration epoch's reconciliation sweep completes, this decision re-enables attempt dispatch for that epoch. An epoch born from a restore (its recorded restoration generation differs from its predecessor's) refuses to open attempts until this row exists. |
| EffectTerminalDecision | A terminal transition (RFC section 4.6): the first terminal append for an intent closes it; later would-be transitions fold as durable no-ops with a superseded-by reason. A terminal without intentRef is a standalone refused record (the writer's durable give-up when no intent ever landed); it requires logicalKey. |
| Engine | - |
| EngineAdmissionConfig | The createEngine admission configuration. |
| EngineDefaults | - |
| EngineQuotaConfig | createEngine quota config: the limiter plus its engine-scoped knobs. |
| EngineQuotaRuntime | The resolved engine-side quota runtime threaded into every run. |
| EntryBillingFold | What priceEntryBilling folds one terminal entry into. |
| EntryBillingUnit | One priced unit of priceEntryBilling (RV504). |
| EnvelopeEncryption | - |
| EnvelopeEncryptionOptions | - |
| EscalationDigest | The escalation block of a digest. |
| EscalationLimits | Lineage limits, monotonically consumed and never replenished (DEF-3). |
| EscalationOptions | - |
| EscalationReport | - |
| EscalationRequest | The model-facing request: the report minus the runtime-filled fields. |
| EvidenceContract | A declared evidence floor (RV303): preflight judges tool caps against it, and under enforce: 'refuse' the runtime refuses an ok settle below it (RV507); see AgentProfile.evidenceContract. |
| ExecutionScope | The bounded execution scope of one run (RV4007, the fifth comparison experiment's P0.4): WHO this run executes for, as the host names it. The library CARRIES the scope without loss (RunMeta, a genesis journal decision, the invoice header, the export bundle via its meta) and asserts identity on resume; it never interprets it. Tenancy semantics, entitlement, and isolation policy are host decisions: this is an attribution envelope, not IAM. |
| ExplorationSummary | The structured exploration summary (RV-210): the engine-side tool exploration counters for one agent invocation. Attached to the full AgentResult and to the live agent:end event whenever any exploration guard limit is configured; journaled inside the terminal error payload (and therefore restored on replay) only when the guard itself ended the invocation (abortClass 'exploration'). |
| ExtensionAppendInput | One append into an extension-owned sequential scope. |
| ExtensionDispatchSpec | A child dispatch under an explicit scope (plan/NodeId). |
| ExternalIdentityInput | External inputs: ctx.awaitExternal (kind 'external'). |
| ExtractNecessityInput | The inputs of the extract-necessity rule. |
| FailoverTarget | One resolved failover target (rich form). |
| FairQueueState | Persistent per-queue SFQ state. |
| FallbackField | The degenerate fallback field: one agent-level second attempt. |
| FileModelKnowledgeStoreOptions | - |
| FinishContract | What finishContract builds from a manifest. The whole bundle is DEEPLY frozen (cycle 74): the nested manifest objects, the sections array, the validators array, and each validator object, so a post construction mutation throws instead of silently diverging behavior from the journaled contract hash. |
| FinishContractCitations | The citation demands of a FinishContractManifest. |
| FinishContractGoldenReject | One per validator reject golden (cycle 74): a fixture the NAMED contract validator is proven to reject at construction time. selfTestFinishValidation holds the CONFIGURED validator of that name against it, so a same-name replacement weaker than the contract's own validator (a words minimum of one standing in for three thousand) is caught before any provider call instead of silently accepting what the journaled contract hash forbids. |
| FinishContractManifest | The single source of truth of a textual finish contract: what the prompt promises IS what the validators enforce. Declare only textual demands here (sections, length, citations); an object-shaped result belongs to requiredSectionsValidator's sibling requiredFieldsValidator and a host-provided selfTest accept fixture. |
| FinishContractSectionPattern | One counted per-section collection demand (RV2206). |
| FinishRepairHint | One structured repair hint on a failed verdict (RV3801): the exact edit whose application satisfies this validator, precise enough for the HOST to perform without a provider wire. The third comparison run died with its repair pool spent on a failure class whose remedy the evidence-grade verdict already prescribed word for word (write this run's id inside each offending sentence); a remedy that deterministic must not cost a model turn. A hint is advisory: the finish loop attempts the patch only when EVERY failure of the candidate carries hints, re-runs the FULL validator set over the patched document, and falls back to the ordinary model repair pool when the patch does not survive re-validation. |
| FinishSelfTestFailure | One self test failure. |
| FinishSelfTestFixtures | Golden fixtures of the construction self test. |
| FinishSelfTestReport | The self test verdict over one validator set. |
| FinishValidationChild | One child as the finish validators see it (the RV-202 provenance contract): a pure read of the durable state the orchestrator already tracks, identical live and on replay. |
| FinishValidationInput | What a FinishValidator judges. |
| FinishValidationSpec | The opt in deterministic validation of the orchestrator finish result (the v1.40.0 improvement plan's RV-204 slice). Every SCHEMA valid finish({ result }) call first passes the configured host validators; a rejection returns the failure reasons to the model as the call's error tool result and the turn continues (a repair turn: the model fixes the result and calls finish again), bounded by maxRepairs within the composition invocation (RV3602). A rejection past the bound fails the run with the typed FailRunError (code 'fail_run', data.source 'orchestrator_finish_validation'), BEFORE the acceptance settle, so acceptance never judges a finish the validators rejected. Every verdict journals as ONE decision entry keyed by the finish call id (decisionType 'orchestrator_finish_validation'), so a resume rolls the SAME verdicts forward without re-running validator code, and the whole exchange replays without new paid calls. The toolset never changes (the contract rides the orchestrator prompt), zero configuration adds zero journal entries, and the budget cap paths keep their posture: the reserved finalize dispatch is never validated, exactly as acceptance never judges it. Repair turns spend from the orchestrator's ordinary limits and ceilings (maxTurns, budget caps, the root budgetUsd); maxRepairs is the explicit bound, and a dedicated repair budget reserve is deliberately out of scope here. |
| FinishValidator | A deterministic host validator of the orchestrator finish result. validate must be pure, synchronous host code: no model calls, no clock, no filesystem, because a verdict must reproduce on replay and a throwing validator is a host defect that fails the run as ConfigError (never journaled, never granted a repair turn). |
| GateAudit | The ctx-side verdict for one dispatch, produced by the permission chain (M3-T03). For 'ask' the loop writes the turn checkpoint with the pending state FIRST, then suspend() journals the approval entry (or re-matches an existing one) and parks until a resolution closes it. |
| GitWorktreeProviderOptions | - |
| GraftBoot | Graft bootstrap payload. |
| IncrementalSynthesisResult | The deterministic reconciliation envelope an 'incremental' synthesis returns as the run result (RV-211 remainder): the coordination draft plus one section per settled child in spawn order, each carrying the child's terminal status and its note (the note invocation's finish output, or the child's raw digest summary when the note fell back). With dedupeClaims, repeated claim lines keep their first occurrence only and the repeatedClaims index lists each with its reporters. Everything here derives from journaled state, so a resume reproduces the envelope byte for byte with zero paid calls. |
| InvocationTable | The reduced table plus the per-role aggregate across every span. |
| InvoiceCardinality | Logical dispatches against provider HTTP requests (RV1210). One row is one DISPATCH, and a dispatch that absorbed provider-side continuations (RV905) is billed by the provider as several requests, so a per-request statement has MORE lines than this export has rows BY CONSTRUCTION. The counters state that difference instead of leaving a host to meet it as an unexplained count mismatch: a reconciliation that compares row count against statement line count should compare wireRequests, and wireIdsMissing says how many of those requests carry no join key at all. |
| InvoiceExport | The machine-readable invoice: rows plus the ledger totals. |
| InvoicePricingProvenance | Where the fold's rates came from (RV407): composed says the caller priced with the snapshot's composedPriceUsd (RV611), the engine's own composition, so pin-covered rows reproduce the settled numbers and anything past the last pin priced at the caller's current table; snapshot says the caller priced with the raw pinned rows alone (the pre-RV611 label); current-table says the live table priced it, the historical behavior for journals without a pin. Attached by the caller, who is the one that chose. |
| InvoiceRow | One billable provider call (or an unattributed usage remainder). |
| IsolatedExecContext | The per-call context handed to a ToolExecutorProvider. It carries the tool span (so provider telemetry nests under the run tree), the cancellation signal, and a stable idempotency key. |
| IsolatedExecRequest | One out-of-process tool dispatch. |
| IsolationProvider | - |
| JournaledChild | One child of one orchestration, as the journal holds it (RV2702). |
| JournaledChildRoster | One orchestration's children, folded from its journal (RV2702). |
| JournaledCriticalPath | The critical path of a logical run, folded from its journal (RV2803). |
| JournaledPostFanIn | The synthesis half of the RV710 decomposition, asked of a journal (RV3404). The live breakdown also itemizes the coordinator's model and tool time inside the window; a journal cannot: a terminal agent entry spans the WHOLE invocation, and the coordinator's per turn stamps died with the process that emitted them. So this block claims exactly what the stamps prove: how much of the window settled synthesize spans cover, the split of that cover when every span is labelled, and how much of the window NO settled synthesize span accounts for. unaccountedMs is a superset of the live residueMs by construction (the coordinator's own tail time lives in it here), which is why it refuses to share the name. |
| JournaledSynthesisCandidate | One finish candidate, folded from its journaled verdict (RV2902). |
| JournaledSynthesisCandidateReport | What synthesisCandidatesFromJournal folded, beside the candidates. |
| JournalOperation | One logical journaled operation: its dispatch entry plus its terminal, when present. |
| JournalPricingSnapshot | What journalPricingSnapshot rebuilds from a pinned run settle. |
| JournalSerializationContext | The run identity the store knows at the append/load boundary but a bare JournalEntry does not carry (the runId lives in the store key, not the entry). Passed to the journal hook so a hook can bind stored bytes to the run they belong to (RV-217 follow-up: the envelope encryption uses it as associated data, so a ciphertext cannot be transplanted into another run). Optional in the type so a host hook written against the original single-argument shape stays valid. |
| JournalSerializationHook | - |
| JournalStore | - |
| KbProposal | One orchestrator model-knowledge proposal (phase 3). A proposal is a run-ledger record, NOT a claim: it lives ONLY in the RunLedger section modelObservations, is never rendered into any prompt of any run before the human gate (absolute quarantine, the note included), and reaches the gate exclusively through LedgerExport. The engine assembles it from the tier-relative kb_propose payload: the subject model is resolved by the engine from the referenced lineage's declared ladder, never named by the orchestrator; evidence must resolve into the proposing run's own decision entries. |
| KeyDeriver | - |
| KeyRing | - |
| KnowledgeSnapshot | - |
| LadderSpec | The author-facing ladder declaration. This is the SINGLE declaration of the ladder family: other layers reference it and never redeclare (runtime semantics land in M7). |
| LeasableStore | - |
| Ledger | - |
| LineageCounters | - |
| LineageRef | The computed lineage record of one spawn-authorizing decision entry. |
| LineageStats | The pure lineage fold rendered in plan_view and WakeDigest, always pinned to a snapshot (uptoSeq), never a live read inside a turn. approaches groups settled history by approachSig; a group whose attempts have not settled yet is omitted (there is no outcome to learn from), while attemptsUsed still counts every authorized attempt. |
| LogicalRunTelemetry | One logical run's telemetry, folded across every segment (RV2510). |
| McpConfig | - |
| McpSourceRegulatedPosture | The posture an mcp() tool source chose at construction (RV1516/RV1808). |
| McpToolSource | The ToolSource returned by mcp: the frozen ToolSource seam plus the lifecycle the seam deliberately leaves to the host. close() releases everything the source created on first use: the SDK client, its transport, and, for stdio, the spawned child process, without which a one shot host process cannot exit naturally after a run, because the child and its pipes keep the event loop alive (v1.33.0 review P2). It is idempotent, resolves even when the connection never succeeded, and resets the source, so a later tools() call connects afresh. The engine never closes a source, because one source may serve many runs: the host owns the lifecycle and should close once its runs have settled (closing while a run is in flight fails that run's MCP tool calls). |
| MechanicalGateVerdict | The verdict of one mechanical acceptance gate evaluation. |
| MemoryAdmissionOptions | - |
| MemoryQuotaLimiter | The in-process reference QuotaLimiter returned by memoryQuotaLimiter. |
| MetaLookupStore | Exact lookup capability: fetch one run's meta without materializing the whole catalog (the v1.25.0 scale review: resume, HTTP status, and CLI point lookups were O(all runs) through listRuns). Optional exactly like the lease capability: engines and shells detect it with hasMetaLookup and fall back to listRuns + find, so a conformant store written before this capability keeps working unoptimized. A missing run resolves undefined, never a rejection. |
| ModelAdapterRegulatedPosture | The posture a first-party model adapter chose at construction (RV4204, the sixth comparison experiment): before it, only mcp() and the AI SDK bridge attested, so unrecognized >= 1 on nearly every real compile and a require-recognized floor was unsatisfiable by construction. The risk seams a model adapter actually owns are its egress (where the wire bytes go) and its caps-refresh pagination bound; both enter the hashed posture map, so a moved base URL or a dropped bound moves the fingerprint. |
| ModelChoice | - |
| ModelClaim | - |
| ModelEpochInputs | - |
| ModelKnowledgeStore | The SPI seam. commit performs CAS on the monotonic snapshot version, mirroring the fencing-epoch discipline of LeasableStore; concurrent maintenance commits serialize through CAS rejection and rebase. commit is UNREACHABLE from the runtime: runs hold ModelKnowledgeHandle. |
| Msg | - |
| NodeLinkValue | The node.link entry value: an ordinary content-keyed effect entry. |
| OpenWireIntent | One open provider wire intent (RV4006). |
| OrchestrateAcceptance | The opt-in child completion policy (the v1.40.0 improvement plan's completion contract): run status 'ok' alone never proves the children succeeded, because the model may call finish after any mix of child outcomes. When acceptance is set, the policy is evaluated exactly when the model's finish validates, the verdict is journaled as ONE decision entry (so a resume rolls the SAME verdict forward, immune to drift of the live options), and the workflow result becomes the acceptance envelope { result, completion, childStatusCounts, degradedReasons }. A violated policy fails the run with the typed FailRunError (code 'fail_run', data.source 'orchestrator_acceptance') instead of settling ok. A budget cap settle keeps its atCap policy and acceptance is not judged at the cap: under 'finish-with-partial' the capped terminal carries completion 'partial' in its envelope (RV906) precisely because the declared acceptance went unjudged, and under 'fail-run' the typed failure stands, so the cap can never impersonate an accepted finish. |
| OrchestrateCitationAudit | The citation entailment audit's knobs (RV4004). The sample derives from the audited document's own hash (replay-stable, no clock, no randomness; a repaired candidate re-samples afresh), the excerpts come from a resolver the host froze before the run (PURE, exactly the citedValueValidator contract: a live-filesystem resolver would make verdicts depend on when they ran), and the judge is a paid, journaled invocation like the claim judge. A sampled citation whose FIRST cited line does not resolve is unsupported mechanically, with no judge needed for that row: a citation nothing resolves is not provenance. |
| OrchestrateClaimConsistency | The claim-consistency pass's knobs (RV1501/RV1502). The pairing half is a PURE fold (pairDraftClaims) over the accepted draft and the same settled pool the contradiction pass judges, so it costs nothing and journals nothing. The judge half is ONE bounded structured-output invocation under role 'synthesize' (the routing key picks its model unless judge.model overrides), dispatched only when the fold produced at least one pair; its verdict is an ordinary journaled agent entry, so a resumed run replays it with zero paid calls and the derived findings are byte identical. |
| OrchestrateClaimConsistencyMeta | What the claim-consistency pass looked at, beside its findings. Rides the acceptance envelope as claimConsistencyMeta whenever the pass is configured, exactly like contradictionsMeta: [] plus this meta says "the fold paired pairs sentences and the judge cleared them", while an absent pair of fields says nothing looked. judgeInvoked false records that no pair existed to judge, and judgeFailed names a judge invocation that did not settle ok, in which case claimContradictions is absent: nothing was judged, and an empty list would claim the pool agreed. |
| OrchestrateContradictions | The bounded contradiction pass's knobs (RV1302). The pass itself is a PURE fold over the settled children the journal replays verbatim, so it costs no model call, no clock, and no wall time worth measuring in the post-fan-in window, and it journals nothing: a resume re-derives the identical finding (the dedupeClaims, policyFacts, and evidenceIndex precedent). The evidence pool it judges is the one evidenceIndex indexes: ok children plus salvage-accepted ones, so a dead child's error text can never contradict a real finding. |
| OrchestrateContradictionsMeta | What the contradiction pass looked at, beside its findings (RV1404). Rides the acceptance envelope as contradictionsMeta whenever the pass is configured, exactly like contradictions itself: [] plus this meta says "the pass judged poolChildren accepted children and the pool agreed", while an absent pair says nothing looked. The truncated flag makes the max bound honest: without it, a capped list is indistinguishable from a complete one. |
| OrchestrateDeterministicPatches | The deterministic-repair aggregate of the shipped run (RV3904, the fourth comparison experiment): the patches themselves stay on the journaled finish-validation decisions (RV3801, byte-exact with before/after hashes per decision); the acceptance envelope carries the aggregate, so "was the shipped document machine-patched, and from what bytes" is an envelope read instead of a journal walk. Present exactly when at least one ACCEPTED deterministic repair exists; every other envelope stays byte identical. |
| OrchestrateDraftToFinal | How the shipped artifact relates to the draft the run composed it from (RV2509), present on the acceptance envelope whenever a synthesis was configured. Two hashes and the answer they imply: a semantic verdict rendered over the draft describes the final only when rewritten is false, and until this shipped a consumer had no way to ask. |
| OrchestrateOptions | - |
| OrchestrateSemanticAcceptance | The atomic production posture (RV4201, the sixth comparison experiment). The experiment's run was configured knob by knob: report findings postures, a standing waiver, no repair round, and every one of those choices was individually legal while their SUM quietly meant "observe and ship anyway"; the run then settled accepted over a partial grade, a judged contradiction, and five unsupported citations. This declaration is the one object that says the opposite, in full, and intake REFUSES any underlying field that contradicts it (nothing is filled: a signature has no blanks, so the host writes the machinery the declaration binds). Under it a run can settle accepted only when the FINAL document's claim coverage graded 'full', zero judged contradictions and zero unsupported (unresolved included) sampled citations survived the one bounded round where the posture arms it, and no waiver stood, except the pinned-hash form, which licenses exactly one reviewed document. compileRegulatedProfile fills and enforces this declaration for regulated runs (RV4201); plain orchestrations opt in by declaring it. |
| OrchestrateSynthesis | The synthesis invocation's own knobs (RV-211). Everything else about the invocation is deterministic: the prompt derives from the journaled draft and the settled child digest, the toolset is the single finish tool (a distinct toolsetHash, exactly like the reserved cap finalizer), the invocation journals as an ordinary agent entry (a resume replays it with zero paid calls), and its telemetry is a full agent span with role 'synthesize' phase pairs, so CostReport.byRole.synthesize and reduceCriticalPath attribute it without heuristics. Failure posture: with finishValidation configured a failed synthesis fails the run typed (the validated path is mandatory); without validators the run falls back to the coordination draft under a journaled 'orchestrator_synthesis_fallback' decision and a warn log, never silently. |
| OrchestratorBudgetSpec | Budget contract: https://docs.rulvar.com/guide/budgets; the cap machinery (reserves, freeze) completes in M7 (DEF-7). |
| OrchestratorExtension | The extension contract. PlanRunner implements it in @rulvar/plan; the mode (c) orchestrator hosts it. Everything is optional except the toolset: an extension that adds no tools has no reason to exist. |
| OrchestratorExtensionIO | The per-run IO the extension closes over (engine-owned effects). |
| OrchestratorRuntime | The engine seam the spawn tools close over (never on ToolContext). |
| OutputContractManifest | One declaration for the shape a host both PROMPTS for and GATES on (RV3308). The 2026-08-12 comparison run drifted exactly here: the harness prompt named one heading while its finish contract named an older one, the host accepted its own contract, and the common audit refused the answer. A manifest is read twice, by manifestValidators to build the gate and by renderContractRequirements to build the prompt block, so the two surfaces cannot disagree by construction. |
| PendingExternal | Suspensions still open at settle time; producers arrive with M2. |
| PendingToolTurn | Mid-turn suspension state (M3-T03): the turn's already-executed tool results plus the call awaiting an approval resolution, so resume continues the SAME turn without re-running executed tools. |
| PermissionConfig | Host-side permission configuration (engine defaults.permissions). |
| PhaseRow | One phase activation of one agent span. |
| PhaseTarget | One serving target of a phase: the primary or a failover fallback. |
| PilotAgentProfileResult | What pilotAgentProfile returns: the pinned profile plus its accessors. |
| PinnedPricingSegment | One pin's coverage (RV611): the run-settle that recorded it, the seq range it settled FIRST, and exactly the version and rows it pinned. The whole array is the per-segment provenance a single last-pin version used to hide: an invoice folded over a rotation can now say every table version that priced it, with the boundary seqs. |
| PipelineCollected | Pipeline results plus the dropped evidence, returned by onItemError: 'collect'. |
| PipelineOpts | - |
| PostFanInBreakdown | Where the post-fan-in interval actually went (RV710): the eleventh comparison experiment measured 45.5 percent of wall sitting after fan-in with zero synthesis share and nothing to name it. The decomposition is a pure fold over the SAME vocabulary, no new event types: model activations and tool executions of coordination spans (spans whose agent:start role is 'orchestrate') are reconstructed from their end events' (ts, durationMs) and clipped to the [last worker settle, run:end] window, and completed 'synthesize' spans are clipped the same way. The coordinator's draft and repair thinking lands in the model bucket; child-result pagination and the finish exchanges (host validators run inside the finish tool's measured window) land in the tool buckets under their own names; the residue is what no recorded interval covers: scheduling gaps, journal writes, park-to-wake latency. Live fidelity only, exactly like the wall numbers around it: a replayed stream re-stamps emission times and carries durationMs 0, so its decomposition is degenerate. Buckets are clipped SUMS (two concurrent coordination spans, or duration-clock skew against emission stamps, can overlap-count); coveredMs is the exact interval union, so residueMs is never understated by an overlap. End events whose span never started in the stream (a consumer attached mid-stream) cannot be attributed and are skipped, never guessed at. |
| PostIntentCloser | The first revocation or expiry decision AFTER the intent position. |
| PreflightAdmissionRow | One wave entry of the admission projection. |
| PreflightFinding | One linter verdict; spawn names the wave entry it is about. |
| PreflightInput | The full input: engine surface, run surface, and the declared wave. |
| PreflightOrchestratorSpec | The OrchestrateOptions slice the estimator consumes. |
| PreflightReport | The machine-readable preflight report; JSON-serializable throughout. |
| PreflightSpawnReport | The effective picture of one declared spawn shape. |
| PreflightSpawnSpec | One intended spawn of the wave under estimation: the same layers the engine reads at ctx.agent time (call limits over profile limits over engine defaults; call estCost over profile estCost over the priced estimate over the flat default), plus the two stand-ins a static estimate needs: estInputTokens replaces the adapter countTokens the runtime would call over the real prompt, and count declares how many spawns of this shape the first wave holds. |
| PreflightToolCeiling | Per-tool executed-call ceiling and the limiter that provides it. |
| PricedComponent | One billing component of a priced usage: its token base and dollars. |
| PricedComponents | The four components a provider statement itemizes (RV812): uncached input, output, cached input, cache writes, each with its token base and dollars. Decomposed with EXACTLY the arithmetic of priceUsdOf, which is defined as the sum of these four terms in this order, so a statement reconciliation and the settled fold can never disagree about what a usage costs. |
| PricedUsage | A priced slice, plus the total and the gaps the price table did not cover. |
| PriceTable | - |
| Pricing | Per-model pricing in USD per million tokens. The registry's versioned price table wins over adapter- reported caps.pricing, which is a fallback only. |
| PricingTier | One long-context price tier. When the full prompt (canonical inputTokens, cache included) is strictly above aboveInputTokens, the ENTIRE request is re-priced with these multipliers, not only the tokens past the threshold (how providers state their long-context rules). inputMultiplier scales every input-side rate: input, cache read, and cache write. outputMultiplier scales the output rate. Provider pricing pages state multipliers for "input" without saying whether cache rates scale; scaling them with input is the conservative reading for budget enforcement (it never underestimates spend). With several tiers, the highest threshold below the prompt size wins, independent of array order. |
| ProgressReport | One progress report: what the agent has established so far. Captured as AgentResult.partial (normalized: absent arrays become empty) when the invocation terminates with status 'limit'. |
| ProviderAdapter | - |
| ProviderCallRecord | One live provider dispatch of an agent invocation (P1.3, the durable reconciliation ledger): every wire call the engine actually made, successful or not, with the usage it consumed and the provider's response id when the adapter surfaced one. Quota-denied attempts and abort short circuits that never reached the adapter mint no record: the ledger enumerates exactly the calls a provider could bill. Records are minted from the same sanitized usage the phase slices accumulate, so per-model sums over an entry's records reconcile with usageByModel (and with usage) by construction on a fully live invocation. |
| QualityFloors | - |
| QuotaCounters | Current-window counters of one rule bucket. |
| QuotaEstimate | The pre-dispatch estimate a reservation is admitted under. Token estimates are heuristic (the engine uses its deterministic four-characters-per-token prompt estimate plus the request's output cap when one is set); reconcile() settles the difference against actual usage inside the same accounting window. |
| QuotaLimiter | The shared rate/quota limiter seam; see the module contract above. |
| QuotaReservationRequest | One admission request, dimensioned for tenant/model/provider rules. |
| QuotaRule | One shared-quota rule. The dimension fields select which requests the rule governs (an absent dimension matches every value); EVERY matching rule must admit a request, and a grant consumes capacity from each of them. The counters are rule-scoped: one rule matching two models pools them under one cap; write one rule per model for per-model buckets. |
| QuotaWindowSnapshot | One rule's live counters, exposed by snapshot() for telemetry. |
| RandIdentityInput | Deterministic shims: ctx.now / ctx.random / ctx.uuid (kind 'rand'). |
| RateLimitObservation | One 429's provider-normalized limits, per (provider, model). |
| ReconcileOptions | - |
| ReconcileResult | - |
| ReconcileStatementOptions | - |
| RefEntryAppender | The append surface the arbiter drives (implemented by the Replayer). |
| RefusalInfo | - |
| RegulatedProfile | What compileRegulatedProfile returns: apply verbatim. |
| RejectedFinishCandidate | One finish candidate the declared contract did NOT accept (RV2507). The 1.226.0 comparison run rejected three syntheses; nothing on its terminal said so, nothing said whether the three differed from each other, and the only way to read them was an external script that re-parsed the whole agent transcript. The row is the artifact that dig produced, made first class. |
| RepairLedger | The workflow-wide repair aggregate (RV4002). |
| RepairLedgerRound | One counted repair, folded from its journaled verdict or dispatch (RV4002/RV4105). |
| RepeatedClaim | One claim reported more than once across the input rows. |
| RepositoryResearchToolset | - |
| RepositoryResearchToolsetOptions | - |
| ResearchAgentProfileOptions | Options of researchAgentProfile: the toolset knobs plus template overrides. |
| ResearchAgentProfileResult | What researchAgentProfile returns: the profile plus the evidence accessor. |
| ResearchEvidenceEntry | One verified evidence entry recorded by record_evidence. |
| ResolutionLayer | One layer's contribution to the resolution merge. |
| ResolvedInvocation | The resolved, scrubbed result of one invocation's resolution. |
| ResolvedToolset | The spawn's frozen toolset snapshot plus its identity hashes. |
| ResumeHandle | - |
| ResumeOptions | - |
| ResumePreview | Resume-time hit/miss/orphan accounting. |
| ResumeReport | - |
| RetryPolicy | - |
| ReuseConfig | The reuse block of AdmissionConfig. |
| RunAgentOptions | - |
| RunEventSink | Span-aware event sink: bodies are stamped into the WorkflowEvent envelope by the per-run EventBus (M1-T10); spanId defaults to the run root span when omitted. |
| RunExport | The portable bundle exportRun produces and importRun consumes (RV-217). |
| RunFactPairOptions | - |
| RunFactPairsFold | - |
| RunFactsSheet | The run's own recorded execution facts, prepared by the caller (deterministic sentences plus the trigger vocabularies). |
| RunHandle | - |
| RunInternals | Everything one run's ctx needs; created per run by the engine (M1-T11). |
| RunOptions | - |
| RunProfile | - |
| RunStateAudit | - |
| RuntimeEventSink | Minimal internal event sink; the typed WorkflowEvent envelope wraps it in M1-T10. |
| SandboxBridge | - |
| SandboxBridgeOptions | - |
| ScopeNormalizeTable | The declarative scope value normalization table (RV4302, deferred from RV4205): without it, Region and region values produce two digests for one identity, splitting quota buckets and FinOps joins. Versioned so a future vocabulary is a new declared shape, never a silent reinterpretation; JCS-serializable by construction, so the genesis decision journals it verbatim and resume compares canonical bytes. Applied strictly AFTER the existing per-field validation, with the result re-validated by the same rule. |
| ScopePolicy | What an UNKNOWN scope field does (RV4205). 'drop' (the default, the RV4007/RV4107 posture byte for byte) silently discards it from the normalized copy, which keeps junk fields from moving the recorded identity; 'reject' refuses it typed by name, because a dimension the engine cannot record is a dimension nothing downstream can bind to routing, quota, or audit, and a host that declared it meant it. compileRegulatedProfile enforces 'reject'. normalize (RV4302) canonicalizes VALUES before the identity exists anywhere: the table is journaled in the genesis execution_scope decision and mirrored in RunMeta, and resume reads the RECORDED table, never a re-supplied one (a conflicting resupply refuses typed, the args-binding rule). |
| ScriptRunner | - |
| ScrubNote | A scrub performed by the router; surfaced as a warning-level event by the engine. |
| SecretMasker | A compiled masking policy: text and deep-JSON forms of one pattern set. |
| SectionalRoundPlan | The sectional round's owning sections and marker roster (RV3803). |
| SectionPatternEntry | One counted per-section pattern demand of sectionPatternCountValidator (RV2206). |
| SemanticPassesSummary | The three semantic passes' explicit summaries (RV1906). |
| SemanticPassSummary | One semantic pass's explicit summary (RV1906): ran: true means the pass executed (its findings and meta fields carry the details); ran: false names WHY in reason ('not-configured', 'run-rejected', 'valid-draft', 'not-run'), so an absent findings field can never be read as a clean pass. The four-role benchmark's artifacts carried contradictions: null and claimConsistencyMeta: null, and the judge had to annotate by hand that null meant NOT RUN. |
| SemanticRoundArming | What the declared posture arms (RV4304): the one derivation. |
| SemanticRoundPosture | The declared semantic posture the round arithmetic reads (RV4304): the SAME four declarations the acceptance tail already took, named as one shape so money and wires derive from one arming function. |
| SemanticTerminalVerdict | The one-word semantic verdict plus the facts it was folded from. |
| SemanticVerdictInput | The envelope facts the fold reads; every field optional and untrusted. |
| SerializationHook | createEngine({ serialization }): absent means identity, no wrapping. |
| ShellPatternRules | - |
| ShellSegment | Argv-parsing shell matcher (M5-T06): shell allow/ask/deny is matched through a real argv parser, never a string prefix. The composition rule is the entire point: for a compound command the verdict is the strictest across segments, and any unmatched segment yields ask, never a silent allow: npm test; rm -rf / MUST yield ask (or deny when rm patterns are denied) even when npm test is allow-listed. |
| SinglePhaseAppend | Fields common to every append through the kernel. |
| SlidingWindowState | A sliding window as a ring of sub-window counters (section 4.2, 1). |
| SpanMinter | Mints span ids in the run > phase > agent > tool > child hierarchy. |
| SpawnAdmissionValue | The journaled spawn-admission payload the runtime writes and recovers. |
| SpawnAgentParams | The spawn parameters as validated JSON (a TaskSpec subset). |
| SpawnLineage | The value-part lineage block embedded in decision entries: the computed LineageRef plus the normalized tag (the request part holds the RAW proposal; the value part holds what was COMPUTED and is reused byte-exact on replay). |
| SpawnLineageOpt | The spawn-options lineage block (ctx.agent, ctx.workflow, spawn_agent, add_task). |
| SpawnRecord | One spawned child tracked by the orchestrator runtime. |
| StandaloneQuarantine | A sweep-recorded quarantine with no machine to attach to (kill 25). |
| StandaloneRefusal | - |
| StandardJSONSchemaV1 | The Standard JSON Schema interface. |
| StandardSchemaV1 | The Standard Schema interface. |
| StatementCategoryRow | One per-model per-component total: the Spend categories shape. |
| StatementColumnMap | Column mapping for statementFromRows: each field names the KEY in the caller's raw rows that carries the value. Provider export formats change without notice and differ per tenant surface (CSV headers, JSON field names, locale-shaped numbers), so this module deliberately ships NO per-provider schema knowledge: the caller states the mapping in one place and the normalizer applies one fail-closed validation to whatever the export actually contained, naming the row and the column of anything that cannot be evidence. |
| StatementCoverage | - |
| StatementReconciliation | - |
| StatementRequestRow | One normalized per-request row of a usage/billing export. usd is the row's billed dollars where the export carries amounts; componentsUsd its per-component split where it carries one; usage the provider-reported token counts where it carries those. A row must carry at least one of the three, and every row needs the provider's response id, the join key. |
| StepIdentityInput | Journaled effectful steps: ctx.step (kind 'step'). |
| StreamHooks | Live-only hooks the engine passes to a stream dispatch (RV1013). Never journaled, never part of request identity: like transport retries, they exist only on the live wire path. |
| SuspendedAppend | Fields common to every append through the kernel. |
| SynthesisCandidateFailure | One failed validator on a journaled finish verdict, verbatim. |
| TaskDigest | The per-child digest handed to the orchestrator. |
| TerminalEnvelope | One run terminal, the same on every surface (RV1105). |
| TerminalPatch | - |
| TerminationAccountSnapshot | - |
| TerminationDeniedValue | The value payload of a termination.denied entry. |
| TerminationInitValue | The value payload of a termination.init entry. |
| TerminationLimits | The frozen limits vector written into termination.init. |
| TokenBucketState | Token bucket state (section 4.2, item 2). |
| ToolAuthority | The authority projection of one tool (RV1802): what the tool may DO and under what gate, beside WHAT the model sees. The contract hash pins the model-facing tuple; risk, needsApproval, executor, and the executorSpec digest are the declarations that never enter toolsetHash by design, yet every one of them changes what the ask rules and the approval flow will do. Execute bodies stay deliberately unhashable: version remains the lever for behavior drift under an unchanged contract. |
| ToolBudgetSummary | The tool budget pressure snapshot (RV304, the seventh comparison experiment): how close one agent invocation came to its tool budget, visible BEFORE the terminal 'limit' a starved worker would settle with. Attached to the full AgentResult and to the live agent:end event whenever maxToolCalls, toolUnits, or toolBudgetExtension is configured. The durable subset: since RV3002 the terminal entry journals used and the effective cap at settle, so a replayed result restores them unconditionally on new journals; an extension grant and the finalization-window entry journal as decision entries the moment they fire (RV509) and merge into the restored summary as extensionsGranted and finalizationWindowEntered. A journal written before the entry field shipped keeps the RV509 behavior byte for byte: used from the terminal checkpoint plus the decision-backed fields, present exactly when the invocation journaled at least one decision. Every other field (unitsUsed/unitsMax, noticesFired, finalizationReserveUsed, limiter) is live-only fidelity, exactly like transportRetries, and stays absent on replay. |
| ToolCalibrationExclusion | A dispatch named but excluded from the rate: one side is NOT RECORDED. |
| ToolCalibrationReport | The observed calls-per-evidence-entry calibration of one journal (RV3003). |
| ToolCalibrationRow | One dispatch carrying BOTH sides of the calibration pair (RV3003). |
| ToolCallRequest | One model-issued tool call as the loop dispatches it. |
| ToolContext | The context handed to execute (and to permission hooks and canUseTool). Deliberately exposes NO spawn primitives: tools are leaves of the call-and-return tree (invariant I3); all spawning flows through Ctx primitives. |
| ToolContextSeed | - |
| ToolContract | The identity-bearing tool contract: exactly what the model sees and exactly what toolsetHash hashes. Never contains execute or any closure. |
| ToolDef | A defined tool. The identity projection is the ToolContract { name, description, parameters, version }: exactly what the model sees and exactly what toolsetHash hashes; execute and every other non-contract field are excluded by construction. |
| ToolExecutorProvider | The isolated tool executor seam. A provider runs one dispatch to its JSON result. A thrown error becomes the call's error tool result, never a run abort: an executor failure (non-zero exit, timeout kill, unparseable output, infrastructure error) is surfaced to the model exactly like any other tool error, so the loop can react and the run stays durable. |
| ToolExecutorRegulatedPosture | The posture an isolated tool executor chose at construction (RV4204). The executor is the one construction that dispatches HOST-SIDE effects, and the regulated floor requires its ledger: an effect no ledger records is an effect nobody can reconcile, the billingReceipts doctrine applied to tools. |
| ToolInit | - |
| ToolRuntime | The spawn's frozen toolset plus the per-call context factory, prepared by the ctx layer (M3-T01). The contracts are the canonical identity projection already hashed into the spawn's content key; the loop sends exactly them to the model. |
| ToolsetAttestation | A recorded toolset pin (RV1514): the aggregate toolsetHash a spawn must resolve to, plus optional per-tool contract hashes that turn a mismatch refusal into a named diff (changed / missing / unexpected). Record one with attestToolset; declare it as AgentProfile.toolsetAttestation. Provider-side drift of an imported tool's description or schema re-keys new spawns silently by design; an attested profile turns exactly that drift into a typed refusal at spawn time, before any provider call. |
| ToolSource | The ToolSource seam: tools() yields the source's current ToolDefs. The toolset snapshot for a given agent spawn is captured at spawn time and hashed into the spawn's identity via toolsetHash; a mid-run change MUST NOT mutate an in-flight agent's toolset. |
| ToolSourceSession | Session handle passed to ToolSource.tools (minimal in v1; audited at M9). |
| TranscriptSerializationHook | - |
| TranscriptStore | - |
| UsageLimits | - |
| UsageSlice | One (invocation role, serving model) slice of an agent call's usage. role is the phase that PAID the slice (v1.19.0 review P1-2: the loop, extract, finalize, and summarize phases of one agent call must land in their own CostReport.byRole buckets even when a single model serves several of them). Absent on slices written before roles shipped: readers fall back to the entry's primary costAttribution.role, exactly like the other documented fallbacks. Policy, never identity. |
| VerifiedRecommendation | One compiled start-tier recommendation of the verified layer. |
| WakeBudgetBlock | Passive budget visibility in every digest (DEF-7). |
| WakeDigest | The FINAL normative WakeDigest: one coordinated schema change inside the hashVersion-2 profile (XF-12). The digest render enters the content key of orchestrator turns. In runs without the PlanRunner extension the termination, budget, and reuse blocks are all-zero and planHash is empty, mirroring the CostReport convention. |
| WireCapacityEstimate | What one orchestration plan costs in wires, base and worst case (RV4005). |
| WireCapacitySpec | The declared wire counts of one orchestration plan (RV4005). Since RV4206 the intake is CLOSED: an unknown key is a typed ConfigError instead of a silent zero. The sixth comparison experiment's harness passed repairRound and transportRetries (plausible names this spec never had) and childWires: 4 for four children of ten turns each; every unknown key was ignored and the estimate answered confidently for a plan nobody had declared. |
| Workflow | Closure-form workflow value; in-process only. |
| WorkflowCallOpts | Options of ctx.workflow; key replaces args in the child identity. |
Type Aliases
| Type Alias | Description |
|---|---|
| AbandonAttempt | - |
| AbandonPayload | Payload of abandon ref-entries (DEF-4/DEF-5). |
| AbortClass | The consumer-visible engine-decided abort classes (FR-424). 'no-progress' is the detector below; 'output-truncated' is a schema-less turn that ended at its output token allowance (finish reason 'max-tokens') without visible output (v1.9.0 follow-up review); 'exploration' is the tripped no-new-evidence exploration guard (RV-210), carrying its structured summary in the terminal error payload. All stamp memoizeOutcome on the terminal: the work is paid, so every resume replays the abort instead of re-paying the same bounded failure. |
| AdaptiveEvents | Adaptive orchestration, resolutions, and accounting: emitted only by runs where the corresponding machinery is active (applicability per mode: https://docs.rulvar.com/guide/adaptive-orchestration). The types land as one closed catalog with M7-T03; emitters arrive with their tasks. |
| AdmissionRecovery | The recovery answer for a resumed unit (RFC section 4, item 5). |
| AdmissionTicketDecision | - |
| AdmissionTicketState | - |
| AdmitRejectReason | The merged reject-code set. |
| AdmitVerdict | The unified admission verdict (XF-11). One union, closed now; every debit is atomic with its carrying decision entry and embeds the balance-after (DEF-2). |
| AgentError | The structured error value carried on AgentResult.error and journaled inside the agent terminal entry. Deliberately NOT a RulvarError subclass. |
| AgentEvents | Agent lifecycle. One logical agent dispatch emits EXACTLY ONE agent:start/agent:end pair on its span (the start carries the primary role), and each model invocation phase inside the span (loop, then possibly summarize activations, finalize, extract) emits its own agent:phase:start/agent:phase:end pair, so durations, per-phase usage, and attempts are derivable without heuristics (the RV-207 event-model contract; before it, every phase emitted an unpaired extra agent:start and consumers pairing starts with the single end computed the LAST phase's duration as the agent's). reduceInvocationTable is the official reducer over this vocabulary. |
| AgentStatus | - |
| AttemptOutcomeClass | Attempt outcome classes entering LineageStats. |
| AuditCategory | - |
| BillingComponent | The four billing components a provider statement itemizes. |
| Bytes | L0 byte-blob alias consumed by TranscriptStore and IsolationProvider. |
| CacheTtl | - |
| CanonicalId | Engine-minted ULID identifying a tool call across providers. The library, not the provider, mints tool-call ids; each adapter keeps a bijective map between canonical ids and wire ids (toolu_* / call_*) in both directions. |
| CanonicalIdentity | The projected, JCS-serializable identity under one profile. |
| CanonicalModelSpec | Identity-facing canonical form of a RESOLVED model request; the value that enters AgentIdentityInput.modelSpec. providerOptions and fallbacks NEVER enter this form: they are delivery options, excluded from identity exactly like label, phase, onError, retry, and replay. effort is absent exactly when no layer of the chain and no role effort default resolves one. |
| CanUseTool | - |
| CapacitySheetUnit | The unit vocabulary of a sheet figure; closed on purpose. |
| ChatEvent | The single canonical stream-event vocabulary yielded by ProviderAdapter.stream. Adapters MUST emit exactly one terminal event per stream (finish or error). |
| ClaimClass | - |
| ClaimCoverageGrade | The claim-coverage grade (RV1702): one closed vocabulary a consumer reads INSTEAD of inferring semantic health from an empty findings array. The eighteenth comparison benchmark's run reported completion: 'complete' with contradictions: [] while the judge had seen 40 of 144 citing sentences and said so only in counts a reader had to interpret; three material falsehoods rode that gap. The grade names the verification posture outright: |
| ClaimGrade | The evidentiary grades of a composed claim (P2.1's vocabulary). |
| ClaimOp | - |
| ClaimStatus | - |
| CoreEvents | Run lifecycle and core telemetry (M1 subset). |
| CostBasis | How an event's costUsd was folded (RV702). 'per-call': the sum of each provider request priced individually, the same basis the settled CostReport and invoice use (RV504), so a nonlinear long-context tier fires per REQUEST. 'aggregate-estimate': the aggregate usage priced in one call, which a tier can inflate past what any single request cost; emitted only when per-request records cannot cover the number (a checkpoint written before the reconciliation ledger shipped, or a terminal entry whose records do not cover its usage). An absent field on an event stream recorded before RV702 means the aggregate basis. |
| DebitResult | - |
| DerivedKey | A derived key, or the guaranteed non-match marker. |
| DeriverRegistry | - |
| DeterminismEvents | Bare-nondeterminism detection (RV-209). Emitted LIVE by the segment that observed the call, at most once per (category, provenance) per execution segment; never journaled and never re-emitted with the replayed flag. Because replay re-executes the workflow body, a violation that survives in the code fires again on every replay of the run, so the event appears organically in both live and replayed streams. Exempt provenances (installed dependencies under node_modules and Node runtime frames) never emit: they are classified and silenced, which is what keeps an SDK's internal Math.random() from branding the run nondeterministic. |
| DeterminismMode | Detection modes. 'off': never detect. 'warn' (the default, and the pre-RV-209 behavior): detect outside production (NODE_ENV !== 'production'), emit one determinism:warning event and one process warning per category per segment, never reject. 'error': detect in EVERY environment including production, and reject the run at the first workflow-origin call with a typed DeterminismError (the strict gate for replay-verified pipelines). |
| DispositionRule | Per-effective-status disposition rules; DATA on the profile, consumed only by the single canonical replayDisposition function (there is NO replayAction method). |
| DispositionTable | - |
| EffectCapabilityRow | Provider capability rows (RFC section 6); contract vocabulary. |
| EffectClass | Effect classes (RFC section 3); compensation semantics differ. |
| EffectLaneAdmissionVerdict | - |
| EffectLaneClassification | Fold classification of one lane entry; NEVER persisted. |
| EffectLaneDecision | - |
| EffectLaneDecisionType | The lane's decisionType discriminators, exactly. |
| EffectLaneJson | Narrow Json helper for payload builders in the writer train. |
| EffectLaneRead | The read verdict of one journal entry against the lane vocabulary. |
| EffectLookupQualification | What earns a provider the lookup row (RFC section 6): either a negative that provably CLOSES acceptance, or a provider-enforced unique natural key on create. Recorded on the intent so recovery policy is derivable from the journal alone. |
| EffectMachineState | - |
| EffectTerminalState | The five appendable terminal states (RFC section 4.6). |
| EffectVoidReason | Why a consumption fold refused an intent (RFC section 4.3). |
| Effort | Canonical effort: exactly five levels, a string-literal union, never a TS enum. OpenAI 'none' has no canonical equivalent and is reachable only via providerOptions. |
| EntryKind | The single kinds registry v2. Readers MUST tolerate unknown kinds; stores pass them through byte-for-byte (obligation A4). |
| EntryRef | The canonical EntryRef between entries is seq. |
| EntryStatus | The stored status vocabulary, exactly. 'skipped' is DELIBERATELY absent: it is a derived fold status, never persisted. |
| ErrorClass | - |
| ErrorCode | The closed error-code registry. 'agent' is carried by the AgentError value projection, not by a RulvarError subclass. |
| ErrorPolicy | - |
| EscalatedResult | - |
| EscalationDecision | - |
| EscalationKind | Closed in v1. |
| EvidenceRef | entryRef is the journal entry seq (canonical EntryRef; XF ruling). |
| ExecKeyDerivation | Which exec idempotency key derivation a run uses (RV403), resolved at engine boot from RunMeta.execKeyDerivation. Version 1 is the original genesis-free five-part key, the only derivation runs recorded without the meta field can ever use; version 2 additionally binds the run's generation token, so it must carry it. |
| ExecutionScopeField | One of the named scope dimensions (RV4007/RV4205/RV4408). |
| ExecutorRegistry | The engine's executor registry: at most one provider per non-inprocess tag. A tool whose executor tag is absent here fails typed at spawn time, before any provider or model call. |
| FailoverTrigger | Transport-level failover triggers; budget is explicitly excluded. |
| FallbackTrigger | The degenerate fallback triggers. |
| FencedCodeMode | Whether fenced code participates in textual validation (cycle 74): 'counted' is the historical behavior; 'excluded' removes fenced code blocks (see stripFencedBlocks) before matching, counting, or slicing, so code samples can neither satisfy a section marker nor inflate word and citation counts. |
| FinalizationWindowBudget | The budget dimension a finalization window statement names (RV302; 'turns' since RV1405). |
| FinishInfo | Typed finish outcomes. A refusal MUST surface as a typed finish outcome carrying the provider stop details; it MUST NOT be projected to a null output silently. |
| FinishValidationVerdict | The verdict of one validator over one finish attempt. |
| Gate | Ladder acceptance gates. Spot-check sibling selection is strictly via ctx.random, never Math.random. |
| GateRecord | The write gate. The human variant carries the MANDATORY attribution attestation (ruledOut over the checklist prompt, tools, difficulty, transient-provider; recommended contrast evidence): rubber-stamping "evidence exists" is constructively impossible. The eval-confirmed variant is reserved for v2, outside the committed roadmap. |
| HashVersion | Versions the ENTIRE identity and replay pipeline as one unit: canonical JSON algorithm, identity field sets, hash function, schema/toolset hash derivation, scope grammar and ordinal rules, replay predicate, fold defaults, and the kind/status vocabularies. |
| HookVerdict | - |
| IdentityInput | - |
| InvocationRole | The seven invocation roles. 'synthesize' is the orchestrator's post-fan-in synthesis invocation (RV-211): it fires only when OrchestrateOptions.synthesis is configured, and the routing key picks its model like any other role without ever summoning it. |
| InvoiceReconciliation | How far a row's identity goes toward provider-side reconciliation. provider-id-present asserts exactly what it names: the adapter surfaced the provider's response id for this call, the join key a host needs to line the row up against a provider statement. It does NOT assert any statement, amount, or usage match: the library never sees provider billing data, so those deeper reconciliation tiers are host-side joins keyed on responseId, not verdicts this export can make. |
| IsolatedExecutorTag | The non-inprocess executor tags a provider can be registered under. |
| IsolationSpec | The canonical identity encoding of spawn isolation: this exact value domain enters spawn identity. 'readonly' is a determinism and blast-radius declaration, not containment. |
| Issue | The vendored Standard Schema issue shape: validation issues carried on AgentError and surfaced to the model during bounded schema re-prompts. |
| JournalCompatSubCode | Sub-code detail of JournalCompatibilityError. |
| JournalEntry | Final entry form (hashVersion 2). All journaled values MUST be JSON-serializable; a violation raises a typed NonSerializableValueError at the call site. append is serialized by a per-run queue. |
| Json | L0 JSON value domain. |
| JsonSchema | A JSON Schema document (draft 2020-12) as plain JSON data. Canonical serialization and hashing rules live with the KeyDeriver. |
| KbProposalTrigger | The closed trigger vocabulary of kb_propose (phase 3). |
| Lease | Lease token for queue-mode ownership; epoch is the fencing token. |
| LineageRelation | The closed relation vocabulary of the minting and inheritance table. |
| LogicalTaskId | Logical-task identity across rebirths (DEF-3); engine-minted ULID. |
| MatchResult | - |
| MechanicalGateProfile | A mechanical acceptance gate: an engine-registered NAMED pure function over AgentResult.artifacts. The registry is per engine like every other registry; the ladder driver journals each evaluation as a decision entry, so the ladder fold consumes only journaled verdicts, never live re-evaluation. |
| ModelCaps | Capability facts the router consumes for tier selection and scrubbing. |
| ModelKnowledgeHandle | The runtime handle: with propose() deleted from the design and commit absent from this shape, a run has no write path into the cross-run medium at all. |
| ModelListConstraint | An explicit allowlist and denylist; deny wins over allow. |
| ModelRef | Strictly 'adapterId:model', no query parameters. |
| ModelSpec | What authors write wherever a model is configurable: a call override, an agent profile, a workflow default, or an engine default. |
| NodeId | Plan-node identity; engine-minted ULID. |
| OnEscalation | Escalation hook: decides for value-form calls. |
| OperationDisposition | - |
| OrchestrateSynthesisSkipReason | The machine-readable reason a CONFIGURED synthesis step was skipped (the 1.65.0 experiment review, item 11.4): telemetry that shows zero synthesize spend must say why instead of leaving the host to infer it from the acceptance decision. 'synthesis_skipped_by_acceptance': the acceptance policy rejected the finish, and a rejected run never pays for the post-fan-in composing step (in 'incremental' mode the settled notes were already paid during the run; the skipped step is the free deterministic reconciliation). 'synthesis_skipped_by_budget_cap': the orchestrator budget cap froze the plan, and a capped run settles through the reserved finalizer, never synthesis. 'synthesis_skipped_by_valid_draft' (RV510): the opt-in synthesis.skipWhenDraftValid gate ran the coordination draft through the full declared finish contract and every validator passed, so the synthesis invocation had nothing to add and never started; unlike the other two reasons the run still settles ok with the draft as its result. The reason is frozen into the journaled decision that caused the skip (the acceptance decision, the budget-cap decision, or the 'orchestrator_synthesis_skip' decision), spread into the typed FailRunError data on the failing paths and into the acceptance envelope on the valid-draft path, and announced by an info 'orchestrator synthesis skipped' log event; it is absent everywhere when synthesis is not configured or actually ran, so existing runs stay byte identical. |
| Out | Inferred output type per form: the Standard Schema output type; the type-guard target of validate(); unknown for a bare JSON Schema. |
| Part | The canonical part union. provider-raw parts carry opaque provider blocks that must survive round trips (thinking blocks with signatures, reasoning items including encrypted_content). Retention is unconditional; dropping happens only in projection, never in retention. |
| PermissionGate | - |
| PermissionHook | - |
| PermissionPreset | - |
| PermissionRule | - |
| PermissionVerdict | - |
| PersistedTerminalRefusal | Why no persisted terminal could be served. unsettled: the journal carries no run settle, so nothing durable records a terminal (a run still in flight elsewhere, a segment fenced out by a successor (RV1009), or a settlement write that failed). not-terminal: the journaled settle is not the journal's last word, either because it records a status that is not terminal (a run whose latest segment is still running) or because entries continued PAST it (RV1407: a detached resolution awaiting its resume, or a successor segment over a stale settle), which is exactly the evidence auditRun derives a non-terminal status from. unknown-workflow: nothing names the workflow the terminal belongs to, and an envelope that invented one would be a lie on its most-read field. malformed-envelope (RV3903): the rebuilt envelope failed the runtime contract gate (parseTerminalEnvelope), which means the journal bytes this fold read produced values the terminal contract forbids (NaN money, a negative counter, an unknown status literal); the reconstruction is withheld typed instead of served green, and the message names the field and the defect. |
| PersistedTerminalResult | The reconstruction verdict: an envelope, or a typed refusal. |
| PilotAgentProfileOptions | Options of pilotAgentProfile: the research template's, verbatim. |
| ProviderStatement | A normalized provider export: never a headline total. |
| QuotaDecision | The admission verdict. retryAfterMs on a denial is the provider-shaped hint the retry engine honors verbatim: the time until the limiter expects capacity (0 = retry immediately, e.g. a request whose estimate can never fit its cap, so exhaustion and failover happen without waiting; absent = the caller's backoff policy applies). |
| RandPayload | Rand-entry payload. |
| RefEntryClassification | Fold classification of one ref-entry; NEVER persisted. |
| RegulatedPostureDescriptor | What describeRegulatedPosture() returns: one of the known shapes. |
| ReplayDisposition | - |
| ReplayMode | - |
| ResolutionAttempt | - |
| ResolutionBy | The journaled by-source of a resolution. |
| ResolutionOutcome | - |
| ResolutionPayload | Payload of resolution ref-entries (DEF-4). |
| RetryClass | - |
| RiskRuleValue | Declarative rule tables (no closures). 'undeclared' in risk position matches every tool WITHOUT declared risk: presets treat the undeclared state conservatively. Argv rules match through the real shell matcher; domain rules are ADVISORY for every tool in the current release: they never change a verdict, and matches surface in the tool:end audit fields (enforcement will live in a first-party fetch tool when one ships). |
| Role | - |
| RulvarErrorCode | An alias for the registry type; both names are public. |
| RunAuditVerdict | - |
| RunFilter | - |
| RunMeta | Run-level metadata written by the ENGINE via putMeta as a separate record, so listRuns never parses payloads. The hashVersion range fields are advisory only; the journal is authoritative. |
| RunOutcome | - |
| RunStatus | Adds 'running' for in-flight inspection. |
| SandboxHostToWorker | Host-to-worker protocol messages (JSON only). |
| SandboxMethod | Methods a sandbox script may proxy to the host ctx. |
| SandboxWorkerToHost | Worker-to-host protocol messages (JSON only). |
| SchemaPair | Form 2 of SchemaSpec: an explicit JSON Schema plus a runtime type guard. |
| SchemaSpec | The L0 schema contract with exactly three accepted forms: a Standard Schema (Zod, ArkType, Valibot, ...), a { jsonSchema, validate } pair, or a bare JSON Schema literal. |
| SchemaValidationResult | Result of validating a value against a SchemaSpec. |
| ScopeNormalizeOp | One value-normalization operation of the declarative table (RV4302): a CLOSED vocabulary on purpose. A host callback would not be replay stable (it is not journalable, and it may read locale or time), so the policy is data: each operation is a named pure function of the string alone, all three idempotent, applied in the declared order. |
| ScopeSegment | A parsed scope-path segment. |
| SectionMatchMode | How section markers must appear in the judged text (cycle 74): 'anywhere' is the historical substring test; 'line' demands the marker as its own line (surrounding whitespace ignored), so a mid sentence mention or a quoted marker no longer satisfies a heading requirement. |
| Settled | The discriminated union over AgentStatus carrying the underlying AgentResult where one exists. |
| ShellVerdict | - |
| SpawnKey | Kernel contentHash of a spawn root entry. |
| SpawnOrigin | Every spawn origin routed through the single admission point. |
| Spend | - |
| Stage | - |
| StructuredOutputTier | - |
| SuspensionState | - |
| TaskClass | Task-class vocabulary aligned with the role quality floors vocabulary (https://docs.rulvar.com/guide/model-routing). Scopeless global statements are inexpressible: every claim binds a taskClass. |
| TaskSpec | Minimal TaskSpec stand-in: the full typed TaskSpec is owned by the PlanRunner surface and ships with M7; script modes carry proposals opaquely until then. |
| TelemetryScope | Whether a terminal figure counts THIS segment's work or the whole logical run (RV2510). |
| TerminalOutcomeFacts | The outcome facts the assembler reads; a structural subset of RunOutcome. |
| TerminalTelemetryScopes | The scope table's type, and the gate that keeps it complete (RV2701). |
| TerminationDeniedWriter | Injected appender for termination.denied entries (engine-owned I/O). |
| TerminationResource | The countable resource vocabulary. |
| ToolChoice | - |
| ToolEvents | Tool lifecycle (emitters arrive with the tool system, M3). |
| ToolExecutor | Where execute runs. A declared capability consumed by dispatch and policy. 'inprocess' runs the tool's execute closure in the engine process (full host capabilities, an execution convenience). A non-inprocess tag routes dispatch through the engine's registered ToolExecutorProvider (RV-216) instead, so the tool's work runs out of process under host-owned isolation; the shipped reference adapters live in @rulvar/executor. The tag never enters toolsetHash; it enters the authority attestation instead (RV1802). |
| ToolRisk | Declarative risk metadata on the tool contract. Policy input, not identity: it does NOT enter toolsetHash. |
| ToolsOption | The per-spawn tools option value domain. |
| TriggerClass | - |
| TtlState | The TTL state a maintenance view renders per claim. |
| Usage | Usage under the Usage invariant: inputTokens is the FULL prompt size including cache reads and cache writes. Adapters MUST normalize provider-reported usage to satisfy this invariant, and the core verifies it at the adapter boundary. |
| WakeTrigger | The closed v1 trigger vocabulary. |
| WireError | JSON-serializable error projection stored in journal entries (JournalEntry.error) and sent across process boundaries (worker sandbox RPC, HTTP server). Raw Error objects never enter the journal. |
| WorkflowEvent | The envelope: seq is an independent per-run telemetry counter, strictly increasing in emission order and DISTINCT from JournalEntry.seq (never compare or join the two; entryRef fields carry journal seqs explicitly). ts is wall clock, telemetry only. replayed is true only on re-emitted journal-backed lifecycle events; stream deltas are never re-emitted. |
| WorkflowEventBody | - |
| WorkflowRegistry | The per-engine workflow registry (M5-T01): an explicit, first-class value; no module-level registry exists. Shells resolve by-name runs against it; ctx.workflow's string form (M6) and the queue worker (M8) resolve against it too. CompiledWorkflow values join the union when they first exist (M6). |
Variables
| Variable | Description |
|---|---|
| ANCHOR_GROUNDING_GRACE_LINES | Grace lines read below a non json unit (a comment documents what follows). |
| ANCHOR_GROUNDING_JSON_LEAF_SLACK | Slack around a leaf json line (the adjacent property is the same fact). |
| AWAIT_SCHEMA | await_any and await_all share one parameter shape. |
| BUDGET_ABORT_REASON | Reason marker distinguishing a budget-ceiling abort from host cancellation. |
| CANCEL_AGENT_SCHEMA | The cancel_agent parameter schema. |
| CHECKPOINT_FORMAT_V1 | Leading format byte of the v1 checkpoint blob. |
| CITATION_JUDGE_LABEL | The label the citation entailment audit judge dispatches under (RV4004; named here since RV4206 so the reducers and the orchestrator share one constant, the CLAIM_JUDGE_LABEL precedent): the audit judge rides role 'synthesize' exactly like the claim judge, and until RV4206 no reducer knew its name, so its wall folded into final composition on both surfaces. |
| CITATION_JUDGE_SCHEMA | The audit judge's structured verdict schema (mirrors the claim judge). |
| CITATION_UNIT_JUDGE_EXTENSION_FACTOR | The judge-side extension factor over the default unit caps (RV4707, the seventh candidate's census rejudge): rows 81 and 105 of that census carried honest support 3..7 lines past the 20-line clip, and the judge honestly ruled unsupported over the incomplete window. A row whose DEFAULT unit truncates is re-resolved for the judge at this factor times the line and char bounds, still bounded; the linter side keeps the default unit with its own grace tail. |
| CITATION_VERDICT_EST_BASE_TOKENS | The bijection's fixed frame beside the rows (RV4706): array, envelope, preamble. |
| CITATION_VERDICT_EST_TOKENS_PER_ROW | The verdict bijection's output floor per judged row (RV4706): one { row, verdict, reason } object with a one-sentence reason. The census rejudges of the seventh and eighth comparison experiments (145 and 215 rows) both overflowed a 9000-token judge cap and fit 32000, which brackets the per-row envelope this floor prices. |
| CLAIM_JUDGE_LABEL | The label the claim-consistency judge invocation dispatches under (RV1502; named here since RV1604 so the critical-path reducer and the orchestrator share one constant): the judge rides role 'synthesize', and this label is what tells its wall apart from a real final composition in reduceCriticalPath. |
| CLAIM_MAP_MAX_ANCHORS_PER_CLAIM | - |
| CLAIM_MAP_MAX_CLAIM_CHARS | - |
| CLAIM_MAP_MAX_CLAIMS | The map bounds; enforced by the finish schema, restated here for readers. |
| CLAIM_MAP_ROWS_SCHEMA | The claimMap rows' JSON schema fragment (RV4305): shape and bounds only. The RELATIONAL rules (anchor bidirectionality, one non-source row per anchor, per-grade required blocks) are validateClaimMapStructure's, because a JSON schema cannot read the document the map describes. |
| CLAIM_STATEMENT_MAX_CHARS | The committed data model bound: statement <= 200 chars. |
| CLAIM_TTL_DAYS | The asymmetric TTL table: a false negative is costlier through lock-in, so weaknesses expire sooner than strengths. |
| COMPACTION_SUMMARY_PREFIX | Deterministic marker opening every compaction summary message. |
| CURRENT_HASH_VERSION | 1 = round 1; 2 = current. |
| DECISION_CHAIN_KINDS | The authority-bearing kinds the chain folds, in the registry's order. |
| DEFAULT_ANCHOR_PATTERN | The default anchor shape: the finish validators' citation pattern extended with an optional -end line range, because composed dossiers routinely cite spans (src/exec.ts:256-296) where the single-line pattern would silently read only the first line. |
| DEFAULT_ARTIFACT_PATTERN | The default artifact reference: a run id (ULID-shaped, the ids the engine mints) or a path:line citation. |
| DEFAULT_CHILD_BUDGET_FRACTION | - |
| DEFAULT_CHILD_RESULT_PAGE_CHARS | Default and hard-max characters per child-result / artifact page. |
| DEFAULT_CITATION_EXCERPT_WINDOW | - |
| DEFAULT_CITATION_MAX_SAMPLED | - |
| DEFAULT_CITATION_PATTERN | The default citation shape: a path with an extension, a colon, a line number. |
| DEFAULT_CITATION_SAMPLE | The golden citation sample used with DEFAULT_CITATION_PATTERN. |
| DEFAULT_CITATION_SAMPLE_PER_SECTION | - |
| DEFAULT_CLAIM_JUDGE_MAX_TURNS | Default maxTurns of the claim-consistency judge invocation (RV1502): one structured-output turn plus headroom for schema repair exchanges. |
| DEFAULT_COMPACTION_THRESHOLD | Compaction threshold default, 0.8 of contextWindow. |
| DEFAULT_ESCALATION_LIMITS | - |
| DEFAULT_EVIDENCE_CALLS_PER_ENTRY | Default estimated executed calls per recorded evidence entry (RV303). |
| DEFAULT_EVIDENCE_GRADE_PHRASES | The default evidence-grade phrases (RV1212, the sixteenth comparison experiment P2-3). Each asserts the STRONGEST kind of provenance a report can claim: that something was watched running, that a provider charged for it, or that it holds up in production. The sixteenth run's own answer used exactly this register about a runtime the live run never observed, which is the failure mode the lint exists to catch. |
| DEFAULT_EVIDENCE_MIN_SHARE | The default preserved share, the improvement plan's RV-202 gate. |
| DEFAULT_EVIDENCE_OVERHEAD_CALLS | Default estimated non-evidence overhead calls of a research spawn (RV303). |
| DEFAULT_FINISH_MAX_REPAIRS | How many rejected finishes are repaired by default: the plan's repair once. |
| DEFAULT_FLAT_RESERVE_USD | Last resort of the admission reserve formula. |
| DEFAULT_MAX_CHILDREN_PER_NODE | - |
| DEFAULT_MAX_CLAIM_PAIRS | - |
| DEFAULT_MAX_CONTRADICTIONS | - |
| DEFAULT_MAX_DEPTH | - |
| DEFAULT_MAX_EXCERPT_CHARS | - |
| DEFAULT_MAX_OSCILLATIONS_PER_KEY | - |
| DEFAULT_MAX_PAIR_EXCERPT_CHARS | - |
| DEFAULT_MAX_PINNED_WORKTREES | Appendix A: the shared pin cap (park/unpark and retainWorktree). |
| DEFAULT_MAX_POOL_PER_PAIR | - |
| DEFAULT_MAX_QUOTA_DENIALS | The default EngineQuotaConfig.maxDenials: generous next to the transport default of 3 tries because a denial is a WAIT, not a failure signal, yet finite because nothing else bounds the pre-wire loop (the per-agent timeout is checked between turns, not inside a dispatch). |
| DEFAULT_MAX_REVISIONS_PER_RUN | Appendix A committed defaults for the countable resources. |
| DEFAULT_MAX_RUN_FACT_PAIRS | - |
| DEFAULT_MAX_TOTAL_SPAWNS | - |
| DEFAULT_MAX_TURNS | - |
| DEFAULT_MODEL_RETRY_ATTEMPTS | Bounded semantic retries per tool call chain. |
| DEFAULT_NO_PROGRESS_TURNS | The committed no-progress detector N. |
| DEFAULT_PER_RUN_CONCURRENCY | FIFO semaphore; default per-run width is 12. |
| DEFAULT_RETRY_POLICY | Appendix A committed defaults (M4 entry gate, PR #26). |
| DEFAULT_STREAM_IDLE_TIMEOUT_MS | - |
| DEFAULT_SYNTHESIS_MAX_TURNS | Default maxTurns of the synthesize invocation (RV-211): the finish call plus headroom for one validator repair exchange. |
| DEFAULT_SYNTHESIS_NOTE_MAX_TURNS | Default maxTurns of ONE incremental synthesis note (RV-211 remainder): a note summarizes a single settled child into a bounded finish call, so it needs less headroom than the full synthesis invocation. |
| DEFAULT_TERMINAL_OUTPUT_FLOOR_CHARS | The default character floor a limit child's string terminal output must clear, after trim, to be salvageable as validated output (RV4704): see OrchestrateAcceptance.minTerminalOutputChars. |
| deriverV1 | The frozen v1 (round 1) profile: the projection removes effort from the requested modelSpec (the v1 predicate is effort-insensitive by construction); features outside the v1 domain are incomparable. |
| deriverV2 | The current (hashVersion 2) frozen profile. |
| DIGEST_DRAFT_MAX_WORDS | The word ceiling of a 'digest' coordination draft (RV4210): the digest is a structural evidence map the composing invocation writes prose FROM, and the ceiling is the teeth that keep it from decaying back into the full prose draft it exists to replace. The sixth comparison run's contract-policy draft cost 344.8 seconds of model output and was then rewritten whole by the composition. |
| EFFECT_LANE_DECISION_TYPES | - |
| EFFECT_TERMINAL_STATES | - |
| EMIT_RESULT_TOOL | The synthesized forced-tool contract name. |
| EMPTY_AUTHORITY_HASH | The authorityHash of an empty toolset. |
| EMPTY_SCHEMA_HASH | The schemaHash used when no structured-output schema is declared: the hash of the canonical true schema. |
| EMPTY_TOOLSET_HASH | The toolsetHash of an empty toolset: the hash of the canonical empty contract array. |
| ESCALATE_TOOL_NAME | - |
| ESCALATION_REPORT_SCHEMA | The full-report schema applied BEFORE append. |
| ESCALATION_REQUEST_SCHEMA | The escalate tool's exact request schema. costToDate and salvage MUST NOT appear here: additionalProperties false rejects model-authored values for them at argument validation. |
| EVENT_SEGMENT_STRIDE | The distance between the telemetry counter bases of two consecutive execution segments of one run: segment k of a run starts its event seq and span counter at k * EVENT_SEGMENT_STRIDE. A single segment would need over four billion events to reach the next base, so seq stays strictly increasing and spanId unique across suspend/resume and process recreation while remaining an ordinary safe-integer number (v1.22.0 review P1-2). Informational for consumers: treat seq as ordered and spanId as opaque, never parse segment structure out of either. |
| EXPOSURE_WAIT_SWEEP_MS | Cadence of the parked-waiter sweep (RV2003). The interval's first job is REFERENCE: a parked exposure wait used to hold nothing on the event loop, so a process whose only remaining work was the wait exited silently mid-run (the third parity rerun's terminal shape, Warning: Detected unsettled top-level await). While any waiter is parked, a ref'd timer keeps the loop alive; each tick additionally sweeps for the drained state (no holder of any kind left), waking every waiter 'drained' so a wake lost to a future leak can never strand them. |
| FINAL_COMPOSITION_LABEL | The label the final synthesis (composition) invocation dispatches under (RV2901). The engine labelling its OWN dispatches is what lets criticalPathFromJournal split the synthesize bucket offline: the split demands a label on EVERY synthesize span, and the comparison run that shipped the journal fold still refused it because this one dispatch stayed anonymous while the claim judge was labelled. |
| FINALIZE_SYNTHESIS_INSTRUCTION | The deterministic synthesis instruction appended (as a user message) to the finalize REQUEST only, never to the durable transcript. A transcript that simply ends at an assistant message reads to a real model as a fresh conversation opening, so an uninstructed synthesis call can replace the loop's correct answer with a greeting (v1.18.0 review P1-1); the extract arm has carried its own instruction since M4, and this is its finalize twin. The wording is part of the wire request: keep it stable. |
| FINISH_CLAIM_MAP_SCHEMA | The finish schema under the claim map opt-in (RV4305): synthesis.claimMap: true makes the map a REQUIRED companion of the composed result, so a composition cannot ship without declaring what it claims and on what evidence. Swapped in only for the synthesis invocation under the opt-in, so the default toolset hash never moves; under the opt-in it moves BY DESIGN (the sectional precedent): the contract of the finish call changed. |
| FINISH_LESSON_CAP_CHARS | Character cap of the HOST VALIDATION LESSONS prompt block (RV3603): the bounded repair round's prompt folds the run's journaled finish validation failures so the round does not relearn a lesson the run already bought, and a pathological history must not flood the composition context. Rows keep journal order; the tail is dropped and the block names how many rows it dropped. |
| FINISH_SCHEMA | finish; result validates against the declared output schema. |
| FINISH_SECTIONAL_SCHEMA | The finish schema under sectional repair (RV808b): result OR sections, host-enforced as exactly one (a JSON schema union would cost the model a worse error surface than the typed host refusal). sections maps a DECLARED marker line to the new section body; the host splices it into the retained rejected attempt and validates the reconstructed document whole. Swapped in only under the finishValidation.sectionalRepair opt-in, so the default toolset hash never moves. |
| FINISH_TOOL_NAME | - |
| FUTURE_RATES_TOLERANCE_MS | How far a ratesVerifiedAt may sit in the future before strict pricing refuses it (RV1804): one day absorbs date-only strings authored ahead of UTC and ordinary clock skew, while a typo'd year (the hazard the clamp exists for) is months out and refuses. |
| GET_CHILD_RESULT_SCHEMA | - |
| GET_CHILD_RESULT_TOOL_NAME | - |
| GET_SETTLED_CHILD_RESULTS_SCHEMA | get_settled_child_results (RV1807): the bulk settled-set read. |
| GET_SETTLED_CHILD_RESULTS_TOOL_NAME | - |
| IMPLEMENTATION_PROFILE_LIMITS | The implementation template's stop conditions. |
| IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX | The message prefix of an in-flight exposure refusal (RV711): the single producer is reserveTurnExposure below, and the ctx layer's uniform budget rethrow keys on it to carry the refusal through with its own honest arithmetic instead of claiming a ceiling crossed (no account closes on a transient refusal). |
| INBOX_PROPOSAL_TTL_DAYS | Inbox proposals expire after 14 days (reserved for M12 phase 3). |
| JOURNAL_ENVELOPE_MARKER | The journal envelope marker; a stored entry's whole value is this. |
| KB_ACTIVE_CLAIMS_CAP | Appendix A: KB active-claims cap, default 8 per (model, taskClass). |
| KB_CARD_RENDER_BUDGET_CHARS | The KB card render budget (characters). |
| LARGE_VALUE_WARN_BYTES | Large-value soft warn threshold (committed for M2). |
| LEGACY_LTID_PREFIX | Deterministic LTIDs canonized onto legacy journals. |
| LEGACY_SIGNATURE_INPUTS | The deterministic signature inputs assigned to legacy spawns (journals written before lineage existed) and to attempts whose producers did not record signature inputs: stable constants, never wall-clock, so replay canonizes identically on every engine. |
| LINEAGE_SIG_VERSION | approachSig/approachSigCoarse derivation version. |
| MASKED_SECRET | The replacement marker; deterministic and greppable. |
| MAX_ANCHOR_GROUNDING_FINDINGS | Findings the verdict carries at most; the rest wait for the next pass. |
| MAX_ANCHOR_GROUNDING_SCAN_LINES | How deep the suggestion scan reads a file before giving up. |
| MAX_ANCHOR_GROUNDING_SUGGESTIONS | Suggested lines per finding at most. |
| MAX_CHILD_RESULT_PAGE_CHARS | - |
| MAX_CITATION_EXCERPT_CHARS | - |
| MAX_CITATION_EXCERPT_LINES | Excerpt bounds, the claim-pass excerpt discipline (resolver v1). |
| MAX_CITATION_UNIT_EXCERPT_CHARS | - |
| MAX_CITATION_UNIT_EXCERPT_LINES | Resolver v2's unit bounds (RV4401). A unit excerpt exists to carry the WHOLE bounded logical unit, so its caps must fit the package's typical docstrings and guide sections: the seventh comparison experiment's one section false negative was a section cut mid-unit by the v1-sized char cap, with the supporting line right past the cut. Resolver v1 keeps its own smaller bounds byte for byte. |
| MAX_CRITICAL_UNCOVERED | Bound on the reported uncovered-critical anchor list (RV1603). |
| MAX_DEPTH_CEILING | - |
| MAX_GROUNDING_WINDOW_CHARS | The whole grounding block's character budget inside one prompt. |
| MAX_GROUNDING_WINDOW_FINDINGS | Judged anchors a repair round carries grounding windows for at most. |
| MAX_RUN_FACTS_SHEET_CHARS | The sheet excerpt bound: one sheet rides EVERY run-facts pair. |
| MAX_RUN_ID_LENGTH | The runId length ceiling (RV1012): a runId is a filesystem name component and a correlation key, so the cap keeps it comfortably under filesystem name limits with room for store suffixes, and starves length-based smuggling through the unmasked id channel. |
| MAX_TIMER_DELAY_MS | The Node timer ceiling: setTimeout clamps any longer delay to 1 ms, so a naive far-future timer fires immediately (v1.34.0 review P2-2). Relative timer options are validated against this bound; absolute deadlines use the sliced timer in long-timer.ts instead. |
| MAX_UNCOVERED_SENTENCES | Bound on the reported uncovered citing-sentence list (RV4202). |
| ORCHESTRATE_WORKFLOW_NAME | - |
| PARALLEL_AGENTS_SCHEMA | parallel_agents wraps the spawn_agent params. |
| PROGRESS_REPORT_TOOL_NAME | The stock progress tool name the engine scans terminals for. |
| QUOTA_WINDOW_MS | The fixed accounting window every PerMinute cap counts over. |
| READ_CHILD_ARTIFACT_SCHEMA | - |
| READ_CHILD_ARTIFACT_TOOL_NAME | - |
| RESEARCH_PROFILE_LIMITS | The research template's stop conditions: a weighted unit budget over the research tools (bookkeeping tools are free), per-tool caps, both repetition guards, and soft budget notices. Exported so hosts and tests can read the exact defaults they are overriding. |
| REVIEW_PROFILE_LIMITS | The review template's stop conditions. |
| ROLE_EFFORT_DEFAULTS | Role effort defaults: orchestrate and plan default to high; summarize and extract default to low. loop and finalize have NO role default: when the chain resolves nothing, the wire omits effort and identity records the spec with the effort member absent. |
| ROOT_ACCOUNT | The run-root account scope. |
| ROOT_SCOPE | The root sequential body of the run is the empty path. |
| RUN_FACTS_ANCHOR | The synthetic anchor and nodeId of run-facts pairs (RV1603). |
| RUN_PROFILES | The shipped presets (fast / standard / deep / ultra "and similar"). Data only; a review-time assertion checks the engine has zero behavioral branches keyed on these names. |
| RUN_SETTLE_DECISION_TYPE | The decisionType of the journaled run settle entry. |
| SANDBOX_AGENT_OPT_KEYS | The sanctioned JSON subset of AgentOpts a sandbox script may pass: the planner-dialect allowlist. Exported as the single source both for the runtime validator below and for the planner API card, so the two can never drift (v1.22.0 review P2-4: the hand-maintained card had silently fallen three options behind). |
| SPAWN_ADMISSION_DECISION_TYPE | The decisionType of the journaled spawn admission (RV2702): the entry that names every child an orchestration judged, which is what makes an offline roster a read rather than a guess. |
| SPAWN_AGENT_SCHEMA | The spawn_agent parameter schema (normative). |
| SYNTHESIS_NOTE_LABEL | The label an incremental synthesis note dispatches under (RV2901). Notes ride role 'synthesize' and are composition-side work, so both reducers count them toward the composition half of the split; the label exists so a journal reader can tell WHICH composition spans were notes without guessing from their size. |
| TERMINAL_TELEMETRY_SCOPE | The scope of every field the engine writes onto a terminal (RV2510), as one exported table rather than as sentences scattered through field docs. |
| TOOL_NAME_PATTERN | First-party provider tool-name constraint intersection. |
| WAIT_FOR_EVENTS_SCHEMA | The wait_for_events parameter schema (normative). |
| WAIT_FOR_EVENTS_TOOL_NAME | - |
| WAKE_SUMMARY_RENDER_BUDGET_CHARS | The committed WakeDigest render budget (Appendix A: 400 chars per outputSummary row, the character measure; committed at M10 entry by adopting the implemented distillation cap unchanged, the value frozen into every cassette since M6). One value serves both stages: the deterministic distillation cap here and the digest render default in orchestrate (renderBudgetChars). |
Functions
| Function | Description |
|---|---|
| acceptanceJudgePasses | Worst-case claim judge dispatches of a declared posture (RV3402/RV4001): 'both' dispatches the judge at the draft AND the final, and an armed repair round (onFound: 'repair', which intake refuses at stage 'draft') rejudges the repaired composition once more. Absent declarations read as the historical one pass. |
| acceptanceTailRequiredUsd | The ONE acceptance-tail formula (RV4001, the fifth comparison experiment): what the effective cap must cover, at exact fill or better, so the acceptance machinery the host declared is funded and not started on luck. The RV3907 runtime gate landed WITHOUT a preflight twin: preflight kept its own advisory arithmetic on different terms, passed the experiment's plan green at a $4.54 cap, and the runtime then refused the same plan typed at $4.82 before the first wire; worse, the runtime undercounted the judge passes of stage: 'both' (one where the worst case dispatches two) while preflight counted them right, so the two calculators disagreed in BOTH directions. The gate and the preflight acceptanceReserve report block now both call this function, exactly the dispatchProjectionReserveUsd precedent: one formula, so the linter and the runtime cannot drift. Undeclared estimates contribute zero: the tail binds exactly what the host declared. The armed repair round (onFound: 'repair', never at stage 'draft', which intake refuses) adds one judge pass and one composition priced at the declared synthesis.estCost. |
| accountSpendFromJournal | The per-account settled fold (RV1505, closing the DEF-7 remainder): each budget account's INCLUSIVE spend from the same entries, skips, and per-request pricing the net CostReport folds, with the account tree read from the journaled spawn-admission decisions (childScope -> parentAccountScope). A scope with no journaled edge folds under the root, which is where its spend already lands. Two consumers: hosts and audits hold any account's accumulated spend against its cap after the fact, and the engine seeds these rows into every re-opened account on resume (RunBudget seed.accounts), so a resumed segment admits against the same history a continuous run would have accumulated; the seed is safe for continuations because reruns of journaled invocations re-admit as recovered rather than re-clearing projected admission. Unpriced slices contribute zero, exactly like the net total, and an admission-edge cycle (a corrupt journal) terminates the walk instead of spinning. |
| admissionLevelKeys | - |
| admissionReserveUsd | The admission reserve for a spawn: opts.estCost, else profile.estCost, else price(countTokens(input) + one turn's worth of output), else the engine flat default. The output term is caps.maxOutputTokens clamped to limits.maxOutputTokensPerTurn when the spawn carries one, so a host can bound reserves without hand-written estimates. The priced path uses the SAME price function as settlement (priceUsdOf), so long-context tiers apply to estimates too. |
| admitRunUnit | Admits one run unit: resolves when the ticket is granted (or when the run signal aborts, after cancelling the ticket best effort), throws the typed AdmissionRejectedError on the terminal denied verdict, and returns the settle teardown (clear the renew timer, release). |
| affordableOutputTokens | The output tokens remainingUsd still buys from one pricing row after paying for an estimated prompt of estimatedInputTokens, priced with the same tier rules as settlement (the tier is selected by the estimated prompt). Floored to whole tokens; zero or negative means not even one output token fits, so the turn must not be dispatched. Undefined when the row prices output at zero (a free model needs no output bound). |
| agentErrorFromWire | Reads an AgentError back from its WireError projection. Throws a ConfigError when the wire code is not 'agent'. |
| agentErrorToWire | Projects an AgentError to its WireError form: code 'agent', with kind, retryAfterMs, and issues carried in data. Issue paths are flattened to JSON-safe segments. |
| agentResultWire | Projects a settled AgentResult's error to its wire form, carrying the engine-decided abort class in data. AgentError itself has no data field, so without this every projection past the terminal entry (the run-level outcome.error, thrown AgentCallError wires, dropped items) would keep only the message text and lose the typed class (v1.9.0 follow-up review). |
| agentScope | Orchestrator handle spawns nest under the orchestrator's own spawn entry: agent:<seq>. |
| agentTypeBucket | The byAgentType bucket of one attributed slice (RV4206, the RV3905 vacuum-fill precedent carried to the agent-type table). A declared agentType always wins, verbatim. The vacuum, an absent or empty agentType, is FILLED from facts the journal already records instead of stamping new bytes: role 'orchestrate' names the bucket 'orchestrator' (the coordination loop and the forced-finish wake), and role 'synthesize' names it by the dispatch label through the ONE synthesizeSpanClassOf classifier: 'synthesizer' for compositions and notes, 'claim-judge' and 'citation-judge' for the two judges, with an unknown label keeping the honest 'unknown'. Because the derivation reads only recorded facts, the live report, the journal fold, and every ARCHIVED journal report the same named buckets: the sixth comparison run's report read byAgentType 100% 'unknown' over a run whose every dispatch had a nameable stage, and that same journal now folds to named rows retroactively. Both accumulation sites and the journal fold call this one function, the RV3302 no-drift doctrine. |
| anchorGroundingFindingsOf | The pure engine behind anchorGroundingValidator: every wrong line finding of text against the snapshot, in document order. The validator renders these as reasons; a harness reads them directly. |
| anchorGroundingValidator | The wrong line lint as a finish validator. Each finding is one reason naming the anchor, the resolved window, the asserted tokens it never carries, and the exact lines that do, so the repair turn moves the anchor instead of guessing. Default name 'anchor-grounding'; see the module comment for the doctrine. |
| applyClaimOps | Applies one op batch to a claims array, mechanically (M10-T01). The editorial validators (attestation, caps, statement bounds) layer on top in M10-T02; referential integrity is enforced here because a dangling supersede or archive would corrupt the append-only chain. |
| applyFinishRepairHints | Applies insert-run-id repair hints to a judged text (RV3801): each [start, end) window is replaced by insertRunIdIntoSentence(window, insert), right to left so earlier offsets stay valid, every other byte identical. Fail closed: undefined (never a partial patch) when the set is empty, any window is out of bounds or empty, or two windows overlap; the caller treats a refused patch exactly like an absent one and proceeds to the model repair pool. |
| applyStructuredOutputTier | Applies the selected tier to an outgoing request. Native rides ChatRequest.schema; forced-tool synthesizes a single emit_result tool with toolChoice pinned to it; prompt injects the schema into the last user message. |
| approachSigCoarse | approachSigCoarse = sha256(JCS({ sigVersion, agentType, toolsetHash, schemaHash, isolation })). Feeds the stall detector and the oscillation guard, which keys ACROSS LTID boundaries. |
| approachSigOf | approachSig = sha256(JCS({ sigVersion, coarse, approachTag })); keys lessons. |
| approvalLicensedKey | The effect logical key an approval licenses (RFC section 4.3, item 4), read from the approval suspension's own payload: recorded on the approval request, so the fold can refuse an intent whose key differs from the key the approval named. Fail closed: an approval that names no key licenses no effect. |
| archiveDeprecatedModelOps | Deprecation maintenance (deprecations archive claims, never delete them, so historical runs keep their audit trail): archive ops for every non-terminal claim of the deprecated models. The caller commits them under its own gate-free archive ops. |
| assertFencedWrites | Deployment-time assertion for queue hosts that require the full fence: throws a typed ConfigError naming each store that does NOT declare fencedWrites. A host that tolerates advisory meta or transcript writes simply never calls this. The shipped pair that satisfies it with transcripts present is @rulvar/store-sqlite: the store as the journal plus its transcripts() twin. |
| assertSafeRunId | Throws a ConfigError unless runId is a filesystem-safe token: a non-empty string over [A-Za-z0-9._-] that is neither '.' nor '..' (the dot pair passes the alphabet on its own, so it is refused explicitly), no longer than MAX_RUN_ID_LENGTH. |
| atCompactionThreshold | The summarize trigger: the compaction threshold on the context window (default 0.8). Pure predicate; the compaction pipeline that acts on it is M4-T03. |
| attestToolset | Records the attestation of a resolution: the pin a profile declares. |
| attributionBucket | The named fallback bucket of the attribution folds (RV3604): an absent phase, an EMPTY phase and an empty agentType all fold under 'unknown' instead of minting a '' key. The third comparison run's report read byPhase {"": 5.58} for the whole run and a '' bucket beside the named agent types: the empty string passed the ?? fallback, and a '' key is unaddressable in every downstream table. Both builders and both live accumulation sites apply this one rule, so the live report and the journal fold cannot disagree on the key. |
| auditRun | Audits one run: loads the meta row and the journal, derives the state the journal supports, and names the divergence. Read only. |
| auditRuns | Audits every run the catalog lists. Loads EVERY journal it audits: this is operator tooling for finding stranded runs, not a hot path. |
| bucketAdmits | - |
| bucketAdvance | - |
| bucketConsume | - |
| bucketRefund | - |
| buildAbandonFold | Builds the AbandonFold in ONE pass at load, in append order, pinned for the entire resume (DEF-1 ordering rule 4). Coverage is the target seq itself plus, transitively, every entry under the target's child scope-prefix. Repeated abandons over an already-covered target fold to noop. |
| buildAdapterRegistry | Per-engine adapter registry: strictly per engine, no global mutable registry exists. A duplicate adapterId is a typed ConfigError. |
| buildCostReport | Folds the per-run attribution buckets into the normative CostReport. Live attribution buckets never see abandoned subtrees, so a host that tracked abandoned spend itself passes it as abandoned; omitted, the report shows a gross equal to the net. Non-finite numbers anywhere in the inputs are a typed refusal (RV705): this exported builder is the same public surface as costReportFromJournal and holds the same RV610 doctrine, instead of letting an Infinity or NaN serialize into null downstream. |
| buildDeriverRegistry | Builds the per-engine deriver registry: the shipped v1/v2 profiles plus EngineOptions.extraDerivers, the ONLY window extender. A malformed extra deriver is a ConfigError before any run effect. |
| buildOrchestratorTools | Builds the mode (c) toolset over the per-call runtime. profileCardText rides the spawn tools' descriptions so both modes speak one agent vocabulary (M6-T04). |
| buildTerminationInitValue | Builds the termination.init value payload. |
| buildToolContext | Builds the per-call ToolContext; one fresh span per tool call. |
| candidateHashOf | THE candidate hash recipe (RV4207), written down where the fold that reads it lives: sha256 (hex) over the JCS canonical serialization of the candidate VALUE, null for an absent one. This is the recipe behind every candidateHash a finish-validation decision journals, the claim judge's judgedHash, the citation audit's auditedHash, and draftToFinal's pair, so one function answers "which document" across every surface. Two facts an auditor needs spelled out: a STRING document hashes as its JSON encoding (the quotes and escapes included), not as raw text bytes; and exporting the text to a file with a trailing newline changes the FILE's sha256 while this hash is unchanged, verify against the exact value, never the file. The sixth comparison experiment's auditor re-derived all of this from source because no exported function said it. |
| canonicalClaimMap | The canonical form of an accepted map (RV4305): rows sorted by id (a stable, content-independent order), serialized by the JCS recipe every other canonical byte surface in this codebase uses. The journal decision records this form, and the hash names it. |
| canonicalIsolationTag | The isolation string entering approachSigCoarse. |
| canonicalizeLadder | Canonicalizes a declared LadderSpec: validates the shape once (FR-119 judge declaration included) and resolves every rung's effort to an explicit value. chainEffort is the effort the resolution chain would contribute at the declaring layer; a rung that resolves no effort at all is a ConfigError (the canonical form has no absent-effort member by declaration). |
| canonicalizeSchema | Canonical schema derivation: local fragment-only $ref inlined (recursion is a ConfigError), remote and dynamic references forbidden, annotation keywords stripped (format retained), reference infrastructure ($defs, definitions, $anchor) removed once inlined. The result feeds JCS serialization and sha256. |
| canRideLoopTurn | True when the given structured-output tier can ride the last loop turn. native and prompt coexist with tool availability; forced-tool pins toolChoice to the synthesized emit_result contract and therefore cannot ride while the agent's tools must remain available. For an agent with no tools every tier rides (the M1 behavior, unchanged). |
| capacitySheet | Builds the capacity sheet from the closed spec (RV4304). Pure and deterministic; throws typed on junk. See the module doc for the provenance rules it enforces. |
| capIssues | The commit-time cap (Appendix A): active claims per (model, taskClass) after the batch applies. Supersede chains keep only the head active by construction (applyClaimOps flips the prior to 'superseded'), so a supersede never grows the count. |
| capsHashOf | Deterministic hash of a caps declaration (JCS + sha256). |
| checkFloors | Enforces the floors for one resolved invocation. taskClass is the profile-declared class; when absent (unclassified) only byRole floors apply. Throws a typed ConfigError on violation. |
| checkpointRefFor | Deterministic checkpoint blob ref for an agent dispatch (running seq). |
| childCoveragePrefix | The child scope-prefix an abandon over target covers transitively. Agent spawns nest under agent:<seq>; a child workflow's subtree runs under the wf:<name>:<ordinal> scope recorded in its dispatch payload (M6-T06). A child entry without the payload (foreign journals) degrades to the agent:<seq> convention, which covers nothing real and keeps the fold total. |
| childRostersFromJournal | Every orchestration's children, folded from a run's journal (RV2702). |
| citationExcerptOf | Resolves one sampled citation's excerpt through the host's pure snapshot resolver. The FIRST cited line failing to resolve returns undefined (an unsupported citation by doctrine); later lines simply end the excerpt (a range past the file's end reads as far as the snapshot goes). |
| citationGroundingLines | The grounding windows a citation repair round rides (RV4601): the resolved unit of each judged anchor, so the composer repairs a citation against the bytes the judge actually read instead of guessing at a file it has never seen (the seventh comparison experiment's candidate moved anchors blind). Recomputed from the pure snapshot resolver at every prompt build, which is what keeps a resumed round byte identical: nothing new persists, and a pure resolver returns the same lines forever. Anchors that stopped resolving, repeated anchors, and anything past the finding or character budgets are silently absent; the block is an aid, never a verdict surface. |
| citationJudgePassOf | Which audit pass a citation judge label names (RV4206): the exact CITATION_JUDGE_LABEL is the first pass over the shipped document, and every suffixed variant is a post round re-audit (today citation-entailment-judge-round, the RV4004 round and the RV4202 merged round both dispatch it). undefined for every other label; one classifier for both reducers, the RV3302 doctrine. |
| citationTargetsValidator | Resolves EVERY citation of the result text against the host's own source snapshot (RV1401, the seventeenth comparison experiment P0-1). The seventeenth run's answer carried ghost.ts:0, a location no checkout ever held, and the whole configured chain passed it: the citation pattern accepts any digits (a line of 0 included), evidencePreservedValidator's requireKnown proves only that some child SAID the string, and citedValueValidator resolves a citation only when its sentence asserts an inline value beside it, so a fabricated location nobody asserted anything about counted as provenance and licensed the valid-draft skip. This validator closes the hole at the root: every match of pattern in the result text, inline code and plain prose alike, is parsed as path:line and resolved, with no sentence-level precondition. |
| citationUnitExcerptOf | Resolver v2's excerpt: the bounded LOGICAL UNIT the cited line belongs to (RV4208), through the same pure line resolver v1 reads. The v1 window is a fixed downward slice, and the sixth comparison experiment's confirmed false negative was structural: a section heading cited as the anchor with its support three lines below the window. The unit rules, all bounded by MAX_CITATION_UNIT_EXCERPT_LINES and MAX_CITATION_UNIT_EXCERPT_CHARS with a truncated flag when clipped: |
| citedValueValidator | Requires a cited location to actually carry the value the sentence asserts (RV1212, the sixteenth comparison experiment P2-2). Citation counting proves provenance was OFFERED, never that it holds: the judge's own repro cited retry.ts:24, an interface declaration, for a default that lives nine lines further down, and every pattern-based check passed. This validator closes the loop with the host's own source snapshot. |
| claimCoverageOf | Derives the ClaimCoverageGrade of a claim-consistency meta. |
| claimExpired | True when the claim steers nothing at at (the read-path filter). |
| claimExpiry | The asymmetric TTL applied to an observedAt ISO date. |
| claimIssues | Issues of one claim record (empty = valid). |
| claimJudgeStageOf | Which pass a claim-consistency judge label names (RV3404): the exact CLAIM_JUDGE_LABEL is the draft pass, and every suffixed variant is a post draft pass over the composed document (today the final pass and the repair round's re-judge, both dispatching under -final, RV2509/RV3307). undefined for every other label. One classifier for both reducers, the RV3302 doctrine extended from the judge predicate to the stage: the split must never read differently off the live stream and off the journal of one run. |
| claimMapHashOf | sha256 over the JCS bytes of the canonical map. |
| claimOpIssues | Issues of one op (empty = valid). GATE-DRIVEN (M11-T01): the gate on the op decides which claim rules apply, so the identity is enforced by shape alone. Referential integrity stays with apply. |
| classifyAgentError | task-class: schema-mismatch, terminal, non-retryable tool. transport, rate-limit, and budget are never memoized. |
| classifyAttemptOutcome | Classifies one settled root terminal into its attempt outcome class. |
| clauseAround | The claim clause nearest an anchor (RV4208): the sentence segment, cut at clause boundaries (';' or ',' followed by whitespace), that contains the anchor position. Pure text arithmetic, no NLP: the point is to hand the judge the claim half the anchor was cited FOR instead of the whole compound sentence. |
| collectDeclaredLadders | The ladders a run declares: every advertised profile whose model spec is a ladder. The card is tier-relative to exactly these. |
| compactMessages | Applies a produced summary: everything after the first message (the spawn prompt) is replaced by ONE user-role summary message. Compaction fires at tool turn boundaries only, so the replaced span never splits a tool-call/tool-result pair. |
| compareRates | Compares a pricing seed against rates extracted from the provider's documented pricing page, in BOTH directions (RV902): a seed rate the page moved or dropped is a finding, and so is a documented billable rate the seed never declared, because a billable column missing from the seed is a silent underpricing channel (the 1h cache-write premium hid exactly there). Declared long-context tiers compare field by field. Returns human-readable findings, empty when the sides agree; the weekly rates audit (scripts/rates-audit.mjs) runs this exact comparator over the live pages, and the fault-injection kit drives it as a permanent gate (RV909). It verifies DOCUMENTATION, not billing: only a statement reconciliation over saved exports settles what the provider's meter actually charges. |
| compilePermissionChain | Merges the engine-wide config and the profile config into one chain. Layers concatenate engine-first; since rules only deny or ask, ordering within a layer cannot change the verdict. The profile's canUseTool wins over the engine's (a single slot by construction). A declared preset compiles INTO the same layers, after the host-authored rules, never as a fifth layer (M5-T05). |
| compilePermissionPreset | - |
| compileRegulatedProfile | - |
| compileSecretMasker | Compiles the redaction policy: the DEFAULT credential pattern set plus host-defined patterns (RV-217), for the telemetry boundary (events and traces; never the journal, where lossless encryption is the right tool). String patterns compile as global regexes; RegExp patterns are recompiled with the global flag when it is missing, so replace-all semantics always hold. An invalid pattern is a typed ConfigError at compile time, before anything runs under the policy. |
| compileVerifiedLayer | The verified-layer compiler (M11-T06): start-tier recommendations per (ladder, taskClass) compiled EXCLUSIVELY from eval-measured claims. A strength on a rung below the default votes down (start cheaper); a weakness on the default rung or below votes up. The net sign shifts EXACTLY one rung, bounded to the ladder (the clamp: the price of any false belief is one rung); ties hold the default and compile nothing. Editorial claims NEVER compile. Floors and ModelCaps stay hard router constraints; budget is touched only through the existing admission path. A deterministic pure function: the M12 consumers read THIS, never the card text. |
| constantTimeEqual | Guards against non-constant-time comparisons in host key checks. |
| costReportFromJournal | The pure journal fold: the complete CostReport from terminal entries, the same summation the kernel ledger uses (each terminal entry's usage enters the sum once, priced per servedBy slice, abandoned subtrees contribute zero). The orchestrator block folds too: spend attributed to the orchestrator sub-account, the reserve-funded share of it, the armed wake count, and the at-cap freeze flag from the journaled cap decision, so a replay-only resume reproduces the block instead of reading this process's live accounts (which a replay never charges). |
| countsAgainstLimit | countsAgainstLimit derivation (XF-06): true iff scope_bigger; scope_different and blocked_with_evidence are exempt and never debit the escalation counter. |
| coverMerge | Monotone high-water merge of covers (checkpoint THEN consume). |
| createCanonicalIdMinter | Returns a per-engine minter of CanonicalId values. Monotonic within the factory instance; never a module-level singleton (no module state). |
| createCtx | Creates the per-run Ctx bound to internals. The current scope travels through AsyncLocalStorage so parallel branches and pipeline stages keep one ctx object while journaling under their own scope paths (I3: structure from call-and-return only). |
| createEngine | - |
| createEnvelopeEncryption | Builds the envelope-encryption SerializationHook. All DataKeyProvider calls happen HERE (the hook itself is synchronous, on in-memory data keys): a fresh data key is minted and wrapped for this instance, and every historical wrapped key is unwrapped for the read path. |
| createSandboxBridge | - |
| criticalPathFromJournal | Fold a run's critical path out of its journal. |
| currentOnlyKeyRing | - |
| decodeCheckpoint | Decodes a checkpoint blob. Returns undefined for an empty blob, an unknown format byte, unparseable JSON, a top-level payload that is not an object (RV1008: null, a number, a string, an array), a parseable payload whose nested message structure is malformed (RV804), or one whose required counters are not non-negative finite numbers (RV1409: turns, toolCallsUsed, schemaAttempts, the usage fields, the compaction points): a resume never trusts a checkpoint it cannot decode, and it never throws; the dangling dispatch reruns from the top instead (at-least-once is the documented floor). |
| dedupeRepeatedClaims | Removes later occurrences of repeated claim lines across the rows and indexes each repeated claim with its reporters. Deterministic: output depends only on the input order and bytes. |
| defineWorkflow | - |
| deriveContentKey | key = sha256(JCS(IdentityInput)). |
| digestOf | Folds one settled child into its digest (spawn-ordinal ordering is the caller's). includeFacts (RV1503) appends the replay-stable execution facts; absent or false keeps the digest byte identical. |
| dispatchProjectionReserveUsd | The ONE dispatch-projection reserve formula (the 1.63.0 experiment review, P0.3): the spawn's declared estimate (a spawn tool has no per-call estCost channel, so the estimate is the agentType profile's) or the flat default, clamped by the explicit child budget when one exists. This is the reserve the embedded layer-2 gate evaluates a spawn_agent call against BEFORE dispatch, and the number preflightEstimate projects for the same gate, so the linter and the runtime cannot drift: both call this function. |
| dispositionHook | Adapts the predicate to the matcher's disposition hook: two-phase operations dispatch on their terminal, single-phase on themselves. |
| documentAnchorsOf | Extracts the document's distinct citation anchors, in order. |
| effectiveEffectState | The compensated overlay (see the module doc): 'compensated' when a confirmed compensation cites a confirmed original, else the machine's own state. |
| effectLaneAdmissible | Evaluates the five conjuncts of RFC section 5 over a terminal envelope, fail closed on absence: an unsettled or superseded segment never licenses effects; an exhausted or cancelled terminal can still carry artifacts, but they are diagnostics, not deliverables; a partial salvage is readable by humans and unacceptable to an effect lane; without a finish contract there is no accepted deliverable to act on; and waived, partial, vacuous, and not-judged semantic verdicts all refuse, by the RV4209 rule. |
| emptyDigestBlocks | The all-zero blocks of runs without the PlanRunner extension. |
| emptyFairQueue | - |
| emptySlidingWindow | - |
| emptyToolset | The empty toolset (no tools declared anywhere). |
| encodeCheckpoint | Serializes a checkpoint to its blob: format byte then UTF-8 JSON. |
| enforceToolsetAttestation | Holds a spawn's resolved toolset to its profile's attested pin (RV1514): a hash mismatch is a typed ConfigError before any provider call or budget admission. With per-tool hashes on the attestation the refusal names the drift (changed / missing / unexpected); without them it lists the resolved per-tool hashes, so the pin can be corrected from the refusal itself. When the pin carries the authority side (RV1802), a contract-clean resolution is additionally held to the attested authorityHash, so risk, needsApproval, executor, and executorSpec drift refuses at the same pre-wire site; a legacy contract-only pin keeps its documented posture and passes it. |
| entryUsageSlices | The per-model slices of a terminal entry: the recorded split when the call spanned several models, else the whole usage attributed to servedBy. The fallback is what makes every journal written before the split shipped price exactly as it did before. |
| escalateTool | The engine opt-in tool: registered through the same path as any tool under escalation opt-in of EITHER flavor (the worker's only authoring channel for a report), never available without opt-in, and dispatched through the same permission chain. The loop intercepts accepted calls; execute is unreachable by construction. |
| evaluatePermission | Evaluates the chain for one dispatch, or OFFLINE against a hypothetical call by tool name (the dry-run API: nothing executes; shells and tests read the verdict, the deciding layer, and the matched rule). Hooks run in deterministic registration order; { modifiedInput } substitutes the input and continues; the first decisive verdict wins. The returned input is what execute receives and what the approval identity hashes (post hook modification). Advisory domain-rule matches ride every verdict for the audit payload. |
| evaluateReuse | The four-outcome verdict evaluation on a SpawnKey match, computed once live at the fold head and embedded into the deciding entry; replay never re-evaluates. |
| evidenceGradeValidator | Requires every evidence-GRADE claim to point at an artifact (RV1212). A sentence that says live-observed, provider bill, or production-proven is claiming the report watched it happen, and a claim of that grade with nothing to check it against is the most expensive kind of wrong: the sixteenth comparison run's answer used the register about a runtime its own live run never observed, and every reader-side check passed because the text was well formed. The rule is deliberately local and deterministic: the artifact reference must appear in the SAME sentence as the phrase (a run id or a path:line citation by default), so moving the evidence three paragraphs away no longer satisfies the grade. Purely textual: what the referenced artifact contains is citedValueValidator's question, and whether it exists on disk is the host's. |
| evidencePreservedValidator | The RV-202 evidence preservation contract: the finish result must PRESERVE the citations the children actually produced. Distinct matches of pattern are collected across the outputs of children settled 'ok' (spawn order); at least minShare of them (default DEFAULT_EVIDENCE_MIN_SHARE, the plan's 95 percent gate, compared as a ceiling on the required count so an exact boundary like 19 of 20 passes) must appear literally in the result text. Zero child citations pass vacuously UNLESS requireNonEmptyPool: true (RV507): for an evidence-critical run the empty pool IS the failure, so that mode refuses it with an empty child citation pool reason instead of the vacuous pass. With requireKnown: true the contract also runs in reverse: every citation in the RESULT must appear in some child's output, so a fabricated but pattern valid citation is rejected instead of silently counting as evidence. Rejection reasons list the missing (and unknown) citations, capped at 20, so the repair turn can restore them. Purely textual and deterministic; checking that cited targets EXIST on disk is host territory (a custom validator), not this contract. Intake is fail closed (RV610): a pattern that can match the empty string is refused typed (an empty match would enter the pool as fabricated evidence and defeat requireNonEmptyPool), zero-length matches never enter the pool even when a lookaround produces them in context, and the strict-mode booleans must be real booleans, so a stray 'true' can never silently disable the mode it names. Default name 'evidence-preserved'. |
| executeWorkflow | Runs a workflow body against a fresh ctx: the engine core that engine.run wraps with RunHandle, events, and outcome assembly (M1-T11). Validates args against the declared schema, then executes single-pass. |
| executionFactsOf | Folds one settled child's replay-stable execution facts (RV1503). Per dispatch record: the wire count is the adapter-reported wireRequests when present, else the absorbed id list's length, else one (a single-wire dispatch); the named side counts the absorbed ids or the single responseId, clamped by the wire count (RV1410: a keyless single-wire row contributes one missing id). Pure over the settled result, so live and resumed folds agree byte for byte. |
| executionScopeDigest | The canonical digest of a scope (RV4205): sha256 over the JCS bytes of the NORMALIZED scope, a fixed-length identity for causal records (the genesis decision, the invoice header) and external joins, so a FinOps pipeline correlates runs by one column instead of comparing structured objects field by field. |
| executionScopeKey | The canonical identity string of a scope (RV4007): JCS bytes, total and deterministic. |
| exhaustionCodeOf | The typed error code surfaced after a denied debit. |
| extractCandidate | Extracts the structured-output candidate from a collected turn per tier. Returns undefined when the turn carries no candidate (for example the model answered prose without the forced tool call). |
| failoverTriggerOf | Maps a retry class to its failover trigger once retries exhaust. Overloaded (529) is transport-class for failover purposes; a non-retryable error never fails over. |
| fallbackTriggerOf | Classifies a terminal agent outcome for the degenerate fallback: schema-mismatch errors are 'schema-exhausted'; any other error is 'error'; limit terminals (the no-progress abort included) are 'limit'; cancelled, escalated, and skipped never trigger. |
| filterClaimsForRun | The admission filter: status active, unexpired at now, and the subject reachable through the run's declared ladders after the role-floor filter. |
| finalizeFires | The finalize firing rule: only if configured in routing, and only after tools stop, which presupposes a non-empty toolset. A no-tools agent's single loop turn is already its synthesis (as amended in M4-T01). The caller additionally gates on the loop having ended without an abort: a limit/error/cancelled/escalated loop never reaches synthesis. |
| findContradictions | Folds the settled children's outputs into the contradictions they hold against each other. Pure and deterministic: the output depends only on the input order and bytes, so a resumed run re-derives it without journaling anything. |
| finishContract | Builds a FinishContract from one manifest: validation and the golden fixtures happen HERE, at configuration time, so a self-contradictory contract (mandatory content alone above words.max, an unsampled custom pattern) fails before any run exists. Spread contract.validators into finishValidation.validators and pass the contract itself as finishValidation.contract; the orchestrator then injects promptLines into the coordination and synthesis prompts, runs the golden self test at construction, and journals the frozen bundle descriptor. |
| foldLedger | The budget ledger fold as a PURE function over entries (extracted in RV1209 so an offline reader folds the identical arithmetic instead of a lookalike): usage sums over terminal entries once, never twice; agentsSpawned counts agent dispatches. Dollars fold on the settled billing basis (RV801): per provider call where the entry's records cover its usage, the per-slice aggregate otherwise, the same basis as the CostReport and the invoice. |
| foldTermination | The replay fold: rebuilds the account from termination.init and the debiting decision entries, asserting every embedded balance-after against the recomputation. A divergence raises the typed journal-integrity error at exactly the diverging entry; denials are re-issued from termination.denied with zero live calls. |
| formatAcceptanceTailTerms | The one rendering of the tail arithmetic (RV4001): the runtime refusal message and the preflight finding print this same string, so an operator can diff them by eye and a test can assert them equal. |
| formatCharacterValidator | Rejects invisible Unicode format characters in the result text (RV1509, the eighteenth improvement plan). The seventeenth comparison run's answer carried five U+200B characters immediately before hidden-file citations, and every configured check passed: the citation pattern's boundary class simply excluded the invisible byte from the match, so the extracted citations were clean while the LITERAL text was not byte-identical to any repository path. A format character in a dossier is at best copy-paste rot and at worst a smuggling channel, so the default is to reject the whole category (Unicode Cf: zero-width spaces and joiners, the word joiner, the BOM, bidi controls, soft hyphens), each distinct character listed once with its codepoint, first index, occurrence count, and a short visible-context excerpt, so the repair turn can find the exact bytes. allow admits specific characters for hosts whose content legitimately needs them (bidi marks in RTL prose); every allow entry must itself be a single Cf character, refused typed otherwise (the RV610 posture: a typo in the allow list must not silently widen it). Purely textual and deterministic. Default name 'format-characters'. |
| formatRePrompt | The bounded re-prompt message sent back to the model on a validation miss. |
| formatScopePath | Serializes parsed segments back to the canonical path (round-trip). |
| hasFencedWrites | Capability guard: the store declares the fenced writes promise. |
| hashRunArgs | sha256 hex over the JCS canonical serialization of a run's args: the value the engine records as RunMeta.argsHash at genesis, exposed so hosts can verify re-supplied resume args against the recorded hash (the v1.23.0 review: a resume that silently drops or changes args changes the logical run and pays again). Returns undefined for undefined args (a run started without args records none). Throws when JCS cannot serialize the value (functions, cycles, non-finite numbers); the engine then records argsProvided without a hash. |
| hashRunOutput | sha256 hex over the JCS canonical serialization of a run's result value: the digest the engine records as outputHash on the journaled run-settle decision when the settling segment computed a value, and the value rulvar replay --compare-output-hash compares a replayed result against (RV-209). Best-effort by design: returns undefined for undefined values and for values JCS cannot serialize (functions, cycles, non-finite numbers), so an unhashable result records no baseline rather than failing the settle. Like hashRunArgs, the digest is deterministic and unsalted: treat it as sensitive-derived metadata for low-entropy results. |
| hashWorkflowBody | Content hash of an in-process workflow body (run-to-definition binding). |
| hashWorkflowSource | Content hash of a compiled workflow source (run-to-definition binding). |
| hasMetaLookup | Capability guard, same shape as the lease capability detection. |
| headingStructureValidator | Judges the markdown HEADING STRUCTURE of the result (the sixth comparison experiment; the judge's P1.3): line presence proves each declared heading EXISTS, not that the document carries them in the declared order without extras. The sections must all start with the SAME markdown heading marker (an identical count of leading '#' characters, one to six, followed by whitespace); the governed level derives from that marker. Fenced code is ALWAYS stripped first, because a '## ' line inside a code sample is not a heading in rendered markdown, so a fenced fake can neither satisfy a declared heading nor trip exclusivity. Heading lines compare trimmed, whole line. With ordered (default true) the declared headings must appear in declaration order; with exclusive (default true) each declared heading must appear once, unrepeated, and no undeclared heading of the governed level may exist (other levels stay free). Default name 'heading-structure'. |
| identityJcs | The JCS form of an IdentityInput under the hashVersion 2 profile. |
| implementationAgentProfile | The implementation child template: the caller's task tools plus the progress contract, with IMPLEMENTATION_PROFILE_LIMITS as the stop conditions (a no-progress detector instead of the research no-new-evidence guard: implementation legitimately re-reads state). |
| insertRunIdIntoSentence | The deterministic edit behind the insert-run-id mechanism (RV3801): the id lands INSIDE the sentence, before its trailing terminator run (a ., !, or ? with any closing quotes, brackets, or markdown emphasis after it), or at the very end when the sentence carries no terminator. Inside matters: appended AFTER the terminator the id would belong to the NEXT sentence under the shared sentencesOf segmentation and the re-validation would fail the same sentence again. Exported so tests and hosts can reproduce the loop's exact bytes. |
| invoiceFromJournal | The pure invoice fold. Pass the same entries and price table you would pass costReportFromJournal; the totals are that report's gross/net split verbatim. To make the export historically stable against price-table updates, pass the priceUsd rebuilt by journalPricingSnapshot and declare it via options.pricing (RV407); without a snapshot the fold prices at the current table's rates, exactly as before. |
| isClaimJudgeLabel | Whether a synthesize span's label names a claim-consistency judge invocation: the exact CLAIM_JUDGE_LABEL, or a suffixed variant of it (the final pass dispatches under claim-consistency-judge-final since RV2509 so the two passes of stage: 'both' stay separable). BOTH reducers must classify through this one predicate (RV3302): the live fold compared the label for exact equality while the journal fold accepted the suffix, and the 2026-08-12 comparison run reported semanticJudgeMs 0 with the whole 272923 ms window read as final composition on the live surface while the journal fold correctly split 224864 against 48059. |
| isEscalated | - |
| isSchemaPairSpec | Form-2 guard: an explicit { jsonSchema, validate } pair. |
| isStandardSchemaSpec | Form-1 guard: the value implements the Standard Schema interface. Some libraries expose callable schemas (ArkType types are functions), so both object- and function-typed values qualify. |
| isStrictCompatibleSchema | Strict-schema compatibility as both first-class providers define it: every object node declares additionalProperties: false and lists every property in required. Boolean schemas and non-object shapes are trivially compatible. |
| journalPricingSnapshot | The read side. Every settling segment pins the union it applied, and each pin's settle seq bounds the rows it settled FIRST, so the pins compose without any journal change (RV505): a seq-aware caller gets the rates of the row's own segment, and a seq-less caller keeps the historical last-pin behavior. Journals settled before the pin shipped, or without any priced model, return undefined: the caller keeps its current-table fold and its export says so. |
| kMaxOf | kMax: the maximum declared ladder length across the registry snapshot. |
| knowledgeHash | Deterministic content hash of the claims array (JCS + sha256). |
| ladderLengthOf | Reads the declared ladder length of one agent profile. Ladders are declared through the profile's ModelSpec (model: { ladder }, or the loop-role routing entry). The reader is defensive so the snapshot is total over every registry shape (an undeclared ladder has length 1: the single implicit rung). |
| ladderRungChoice | The concrete ModelChoice of one rung attempt: each attempt is an ordinary agent scope whose CanonicalModelSpec is that rung's { kind: 'model' } form. |
| lastMechanicalRepairCostUsd | The observed price of the run's LAST mechanical repair turn (RV3802): the window of the candidate that FOLLOWED a 'repair' verdict inside the same settled synthesize span, priced by the same per-call fold every candidate window uses. This is the fallback the repair round's mechanical money leg sizes itself from when the host declared no estimate: by the time the round is admitted the initial composition has settled, so a mechanical repair it performed is a priced window in the journal. Fail closed under RV1209: no such pairing, an unattributed span, or an unpriceable window all return undefined (never a guessed number), and the caller treats undefined as an inert zero-size leg. |
| lastRunSettle | The last journaled run settle of a journal, if any. outputHash is present when that settle recorded the result digest (RV-209; settles written before it, or over undefined/non-serializable results, carry none). |
| latestProgressReport | The deterministic terminal scan: pairs report_progress tool calls with their SUCCESSFUL results by id (a denied or failed call never counts, mirroring the exploration guard's restore) and normalizes the last one into a ProgressReport. Pure over the message window it is given: the live loop hands its own history, the replay path hands the terminal checkpoint's messages, and a compaction naturally narrows the window to what the model itself still sees. |
| lexShellCommand | Lexes a command into segments per the matching algorithm above. Quotes and escapes are honored; nothing is expanded; $(, backticks, <(, >(, and << (outside single quotes) poison their segment. |
| liftRetainedParts | Lifts the adapter-shipped retention payload of one finished turn into provider-raw parts (the retention transport). Reads providerMetadata[<adapter id>].retainedParts and tags each block with the adapter's provider family. Returns [] when the adapter shipped nothing. |
| lineageWeightOf | C = E0 + kMax: the per-spawn weight of the variant function. |
| localKeyProvider | The local reference DataKeyProvider: the key-encryption key is HKDF-SHA256(secret, info), data keys are random 32-byte AES keys, and wrapping is AES-256-GCM under the KEK. info partitions one master secret into unrelated KEKs (tenant-scoped keys: one provider per tenant with info: tenantId); a provider with different secret or info CANNOT unwrap this provider's keys. For production KMS, implement the same interface over GenerateDataKey/Decrypt. |
| logicalRunTelemetry | Folds a run's journal into the logical run's telemetry (RV2510): how many segments ran, how each settled, and how much durable work each one did, from entries the journal already holds. No new field, so it reads journals written by every prior version exactly as well as today's. |
| makeOrchestratorWorkflow | Builds the orchestrator workflow: ONE implementation behind both surfaces. The body wires the spawn tools over the per-call runtime, recovers spawn records from the journal on resume, and runs the orchestrator agent with the finish terminal tool. |
| manifestValidators | The manifest's gate half (RV3308): heading structure (ordered, exclusive), word bounds, the citation floor, and the mention universe, in that stable order, each through the existing named validator. Everything is derived from the SAME object the prompt block renders from. |
| maskSecrets | Masks credential-shaped substrings in one string. |
| maskSecretsDeep | Deep-masks every string value in a JSON tree; non-strings pass through. Returns the input identity when nothing matched, so the default-on policy costs no allocation on clean events. |
| maskSecretsJson | Convenience for hosts: masks a Json value (alias of the deep walk). |
| matchArgvPattern | Pattern grammar (5.1): literal words match one identical token; * matches exactly one token; ** matches zero or more remaining tokens and may appear only as the final word. A pattern matches only if it consumes the segment's ENTIRE argv. |
| matchShellCommand | The strictest-across-segments composition (5.3): deny if ANY segment denies; otherwise ask if ANY segment asks or fails to match an allow pattern; otherwise allow. |
| mcp | Imports MCP tools as a McpToolSource. The client connects lazily on the first tools() call; tools/list is fetched with cursor pagination until exhaustion and cached per session; a listChanged notification invalidates the cache, affecting subsequently spawned agents only (a spawn's toolset snapshot is immutable by construction). The host owns the source's lifecycle: close() releases the client, the transport, and the stdio child once the runs using the source have settled; a one shot host should close in a finally block, or its process never exits naturally (v1.33.0 review P2). |
| memoryQuotaLimiter | The in-process reference QuotaLimiter: fixed epoch-aligned one-minute windows over the shared rule model. Coordinates every engine that shares THIS instance inside one process; processes coordinate through a shared-storage implementation of the same SPI (SqliteQuotaLimiter in @rulvar/store-sqlite) instead. |
| mergeQuotaDenial | Folds one more failing rule into the decision the caller returns: the wait is the LONGEST failing horizon (every matching rule must admit), and the FIRST failing rule names the denial. |
| mergeUsageLimits | Limits merge per spawn: AgentOpts.limits over profile limits over engine defaults.limits. |
| metaMatchesFilter | The RunFilter predicate shared by the shipped stores (and usable by callers re-checking an advisory statuses filter a legacy store may have ignored). status and statuses combine as either-matches. |
| minMatchesValidator | Requires at least min matches of pattern in the result text (the plan's citation and source count checks: a file:line pattern, a URL pattern). The pattern compiles at construction (invalid patterns are a ConfigError before any run exists) and matches globally; min is a positive integer. Default name 'min-matches'; pass name to run several instances, because names must be unique per orchestrate call. fencedCode: 'excluded' matches only outside fenced code blocks (cycle 74), so citations quoted inside code samples do not count; the default matches everything, byte identical to the historical behavior. |
| modelEpochOf | Builds the optional modelEpoch block; empty inputs give undefined. |
| modelKnowledgeCard | The deterministic card render. Pure: same filtered claims and ladders give byte-identical text. The render budget is 4096 chars by default; over it, the OLDEST-observed notes withhold first behind an explicit marker, and the budget is a HARD upper bound of the returned string: a card whose mandatory sections alone exceed it is truncated with the shared marker (v1.35.0 review P2-5: a budget of 32 used to return the full 136-char header form). budgetChars is a nonnegative integer, validated as a ConfigError. |
| modelSpecIdentity | The identity projection of a CanonicalModelSpec. For the plain-model kind the projection is { model, effort? } WITHOUT the kind discriminant, exactly as frozen by the hashVersion 2 profile; effort is omitted when unresolved. The ladder embedding lands with ladder execution (M7). |
| needsSeparateExtract | The completed extract-necessity rule: a separate final structured-output invocation fires only when a schema is set AND (routing directs extract to a different model OR the loop model's caps cannot serve the required tier OR finalize is routed, in which case the schema never rides a loop or synthesis turn). Otherwise the schema rides the last loop turn with no extra call (as amended in M4-T01). |
| nextFailover | The next target index past from that serves trigger, or undefined when the chain is exhausted. Index 0 is the primary; the chain never moves backwards (sticky failover). |
| nodeLinkKey | node.link identity: sha256 of {kind, spawnKey, donorScope, targetNodeId}; targetNodeId is deterministic on replay because NodeIds are assigned inside plan.revision. |
| normalizeApproachTag | Approach-tag normalization: NFC, lowercase, runs of non-alphanumerics collapse into a hyphen, truncate to 32 characters; an empty value canonicalizes to 'default'. Prompt prose never enters any signature: rephrasings collide by construction, not by heuristic. |
| normalizeEntry | Round-1 normalization: hashVersion is taken from hashVersion, else from the legacy v field, else 1. Stores are never rewritten; normalization happens at read. |
| normalizeExecutionScope | Validates and copies a declared scope (RV4007): own properties only (the RV1205 doctrine: a prototype member must never resolve), non-empty strings of at most 256 chars, at least one field, and the copy is what gets recorded, so later host mutation of the passed object cannot move the recorded identity. Under policy.unknown: 'reject' (RV4205) an own enumerable field outside the named dimensions refuses typed by name instead of dropping. |
| normalizeFallbacks | Normalizes the author-facing ModelChoice.fallbacks list. |
| openEffectLane | Opens the effect lane on one run's journal: acquires the lane lease in production mode and validates the store capabilities. The lane operates on SETTLED runs (the admission predicate requires settled: true), so it never contends with a live engine segment, only with other lane holders, which is exactly what the lease and the A5 contention rule arbitrate. |
| openWireIntentsOf | The open provider wire intents of a journal (RV4006): every provider-intent decision with neither a provider-call receipt row nor a settled terminal record covering its (agentRef, ordinal, attempt). ONE pairing rule, shared by the invoice's openIntents lane and the resume refusal, the dispatchProjectionReserveUsd precedent: the linter and the gate cannot drift. |
| orchestrate | Top-level surface: creates a run. runOptions are the ordinary engine RunOptions of the created run; in particular runOptions.budgetUsd is the ROOT hard ceiling over the WHOLE tree (the orchestrator and every child), immutable within a segment, while opts.budget only shapes the orchestrator's own sub-account inside that ceiling. The shortcut previously accepted no RunOptions at all, so the canonical entry point could not set a root ceiling without dropping to engine.run(makeOrchestratorWorkflow(...)) (v1.18.0 review P1-5). |
| orchestratorAdmissionEstCostUsd | The capped orchestrator's own admission estimate (the 1.63.0 experiment review, P0.3): the effective cap MINUS the finalize carve-out already committed on the cap account, so the dispatch admits at EXACT FILL by construction (a capped orchestrator can never spend past its effectiveCap, and pricing the model's full maxOutputTokens instead pinned small run ceilings at zero remainder; the M12 checkpoint measured a self-solving orchestrator because no child was ever admitted). Exported so the live dispatch and preflightEstimate share ONE formula: both call this function. |
| pairDraftClaims | Folds the composed draft against the settled pool it composed from: every draft sentence citing an anchor is paired with the pool sentences citing an intersecting span of the same file, verbatim agreement dropped. Pure and deterministic: the output depends only on the input order and bytes, so a resumed run re-derives it without journaling anything (the findContradictions precedent). |
| pairRunFactClaims | Pairs draft sentences that speak about the RUN with the run's own recorded fact sheet (RV1603), so the same judge invocation that rules on source claims also rules on run claims. The eighteenth comparison benchmark shipped both failure shapes this closes: a dossier claiming "each role recorded 18-20 evidence entries" over recorded profiles of 23/18/22/20/20/20, and "real models were not run" beside 125 recorded wire requests, with executionFacts ENABLED on the input side; facts offered to the composer verify nothing about what it composed. |
| parallelScope | Branch branch of parallel site site: par:<site>:<branch>. |
| parseCitationVerdicts | Parses the judge output strictly: one verdict per judged row, no duplicates, no rows beyond the judged set, verdicts from the closed vocabulary. Anything else returns undefined and the caller treats the invocation as a failed judge (nothing was judged; partial verdicts over a partial parse would claim more than the judge said). The row set is a BIJECTION with the sample (RV4402): a fabricated extra row is a parse failure, never surplus information, because a judge inventing rows is a judge whose output cannot be trusted about the rows it was asked. |
| parseModelRef | ModelRef is strictly 'adapterId:model', no query parameters. The wire model id may itself contain colons (for example ollama tags), so only the FIRST colon splits. |
| parseScopePath | Parses a scope path against the frozen grammar (M2-T04): |
| parseTerminalEnvelope | The runtime gate over the terminal envelope contract (RV3903, the fourth comparison experiment). terminalEnvelopeOf is the ONE producer, but a producer is a compile-time promise, and the envelope crosses trust boundaries the type system never sees: a journal read back after a restart, a plain JS caller, an HTTP body a pipeline gates on. The experiment probed the built dist and the typed copy accepted status: 'green', NaN dollars, and negative counts without a sound; a finance or compliance consumer downstream would have gated a run on fiction. |
| persistedTerminalEnvelope | Rebuilds one run's terminal envelope from its journal (RV1209). priceUsd is the caller's composed pricing, exactly what the cost endpoint passes: the settle's pinned rows composed over the host's current table, so a rebuilt envelope reports the dollars the run settled at rather than today's rates. |
| phiInitialOf | Phi0 = V0 + C * S0, finite and fixed in termination.init. |
| pilotAgentProfile | The read-only pilot preset (RV1606): the production profiles guide's controlled-pilot posture as ONE shipped factory instead of a page of assembly. Builds on researchAgentProfile (the confined read-only repository toolset, evidence recording, progress contract, stop conditions) and adds the fail-closed session posture the eighteenth comparison benchmark's improvement plan asked to ship: |
| pipelineScope | Stage stage processing source item item: pipe:<stage>:<item>. |
| planNodeScope | PlanRunner node scopes: plan/<NodeId> (NodeIds are engine-minted ULIDs). |
| preflightEstimate | Computes the preflight report: the effective merged limits per declared spawn, the layer-1 admission projection over the declared wave, the per-tool and weighted-unit bottleneck ordering, the concurrency and quota exposure at the declared estimates, and the linter findings. Pure: no engine is constructed, no store is opened, no adapter stream is dispatched, and no journal entry is written. |
| priceComponentsOf | Decomposes one usage against one pricing row into the four billing components. Under the Usage invariant inputTokens is the FULL prompt including cache reads and writes, so the input rate bills only the uncached remainder and cache tokens bill at their own rates, never twice; a row that omits a cache rate bills those tokens at the plain input rate rather than silently for free. A row may carry long-context tiers: the highest threshold strictly below the full prompt re-prices the ENTIRE request (input-side rates scale by inputMultiplier, the output rate by outputMultiplier). Cache writes price at the 5m premium rate by default; when the usage carries the TTL split (RV810: cacheWrite5mTokens and cacheWrite1hTokens, filled by adapters whose provider distinguishes write TTLs), the 1h share prices at cacheWrite1hUsdPerMTok (falling back to the plain write rate when the row lacks it) and everything the 1h share does not claim, the 5m share plus any unattributed remainder an upstream invariant violation left, bills at the write rate, never silently for free. The component's tokens stays the WHOLE cacheWriteTokens either way, so statement reconciliation keys are unchanged. |
| priceEntryBilling | The billing fold over one terminal entry (RV504), shared by the CostReport and invoice folds so the total, every breakdown, and the per-row prices can never disagree. Coverage is decided per MODEL with the symmetric key (RV604): for every model whose per-dispatch providerCalls sum to exactly its usage, each call is priced individually, so a nonlinear long-context tier fires per REQUEST, which is the pricing contract's stated semantics; an aggregate that crossed a threshold no single request crossed no longer re-prices that model (the ninth-experiment 52% overreport, and the round-52 multi-role default). A model with no records, or records that do not cover its usage, folds exactly as before: the per-model aggregate slices of priceEntryUsage. fullyAttributed is true only when every slice model is covered and no record names a model absent from the slices. |
| priceEntryUsage | The single pricing fold over one terminal entry, shared by the kernel ledger and the CostReport fold so a run's total and its per-model breakdown can never disagree. Each slice is priced at ITS OWN model's rate. A price function returning NaN or a negative amount (a broken user-supplied rate) is treated exactly like a missing row: the slice folds as unpriced instead of poisoning or crediting the totals (v1.20.0 review follow-up). The optional third argument hands the price function the entry's seq, so a segment-aware snapshot can price the row under the rates of ITS segment (RV505); two-argument price functions simply ignore it. |
| priceUsdOf | Dollars from normalized usage against one pricing row: the sum of the priceComponentsOf terms in their declared order, byte for byte the historical expression (uncached input, output, cached input, cache writes). |
| productionAcceptable | The production acceptance predicate (RV4209): the one boolean a production consumer gates on, with the stable reason when it refuses. A verdict is production-acceptable exactly when it exists and reads 'clean': 'partial' and 'vacuous' are legal diagnostics (strict keeps exit 0 on them by documented design), 'waived' is a human exception a machine gate must surface rather than inherit, and an ABSENT verdict means nothing judged anything, which a production gate reads fail closed. The refusal reason distinguishes the two refusal shapes a reader used to conflate (RV4402): an absent verdict reads 'not-recorded' (nothing was configured, or the run predates the fold), while a recorded 'not-judged' verdict lists its judge failure codes, so an operator can tell "the machinery never wrote a verdict" from "judges ran and nothing usable judged the shipped document". Exported so the CLI's --acceptance-policy production, a server consumer, and a host pipeline apply the SAME rule instead of three re-derivations. |
| profileCard | Renders the registry into the shared agent vocabulary card. Sorted, deterministic, byte-stable; an empty registry renders explicitly so the planner never guesses at unregistered agentTypes. When the engine registers toolsets, their names render as a closing line (v1.17.0 review P1-3): those are the ONLY values valid as string entries of a tools option, so the planner never invents a registry name. |
| profileRegistrySnapshotHash | The deterministic profile-registry snapshot hash frozen inside termination.init: profile names mapped to their declared ladder lengths, canonical JSON, sha256. |
| progressReportTool | The stock progress-report tool. Stateless and deterministic: the result echoes the counts, so a verbatim repeated report is a duplicate result digest to the exploration guards. The value is the side contract: the engine captures the LAST successful call of this tool as the structured terminal partial of a 'limit' invocation, so an agent that reports after every batch never loses its collected work to a budget expiry. |
| projectHistory | Projects the canonical history into the target provider's view: provider-raw parts of a DIFFERENT provider are omitted; everything else (text, images, tool calls, tool results, compaction content) passes through untouched. Messages whose parts all belong to another provider vanish entirely rather than ride as empty messages. |
| projectIdentity | The canonical identity object of an IdentityInput under the hashVersion 2 profile: what JCS serializes and sha256 hashes. The agent kind projects modelSpec through modelSpecIdentity; every other kind serializes its fields verbatim. Fields not listed for a kind are never included (the types make them unrepresentable). |
| projectToJsonSchema | Derives the JSON Schema of a SchemaSpec. Form 1 projects via the StandardJSONSchemaV1 input() converter, target draft 2020-12 with draft-07 fallback; a library without the projection is a typed ConfigError at definition time, never at first call. Transforming schemas therefore project their INPUT type. Forms 2 and 3 are taken verbatim. |
| proposalStatement | The typed statement template for a proposal-born claim (phase 3): assembled over the closed enum vocabulary ONLY, so tool-output text is unquotable into persistence, and model-free, because a claim statement renders into the knowledge card's notes layer, which never leaks model names to the orchestrator. |
| providerOf | The provider family of an adapter: provider when set, else id. |
| quotaActualRequestsDelta | The request-count settlement delta of one reservation (RV905): the reservation admitted ONE wire request, and actual.requests names how many the attempt actually made (an adapter absorbing provider-side continuations dispatches several inside one reserved call). Non-integer, non-positive, or absent actuals settle as the single reserved request (delta 0); a settlement only ever ADDS, the calls already happened. Shared by every reference limiter so the three implementations cannot disagree about the arithmetic. |
| quotaActualTokens | The tokens a settled attempt actually consumed. |
| quotaEstimateTokens | The tokens a reservation is admitted under: input estimate plus the output cap. |
| quotaRuleAdmission | One rule's admission verdict against its current-window counters, the pure decision both reference implementations share. A denial carries the window remainder as retryAfterMs, except when the estimate alone can never fit the token cap: that denial says retryAfterMs 0 (retry immediately), so the caller's bounded attempts exhaust without waiting and failover gets its chance. |
| quotaRuleKey | The canonical content key of one rule (RV608, promoted from the store limiters): a fixed-field-order JSON of the rule, identical across processes and hosts for identical rules. It is the bucket key of both store references, the input of quotaRulesFingerprint, and the CANONICAL ORDER every reference limiter folds denials in, so equal rule sets produce byte-identical refusal objects regardless of array permutation. |
| quotaRuleMatches | True when every dimension the rule pins matches the request. |
| readApprovalExpired | Reads one journal entry as an approval_expired decision (the clock fact of RFC section 4.5), fail closed like the lane reader. |
| readApprovalRevoked | Reads one journal entry as the shipped approval_revoked decision (RV4008), by the exact shape ExternalRegistry.revokeApproval appends. |
| readEffectLaneDecision | Reads one journal entry as an effect lane decision, fail closed: an entry that is not a kind-'decision' entry with a lane decisionType is not lane traffic; a lane decisionType whose payload fails validation reads malformed and participates in NOTHING (a hand-written broken row must never confuse the machine). approval_expired is read by the fold directly (it targets approvals, not machines). |
| readRunMeta | One run's meta: getMeta when the store has the capability, else the full listRuns scan. undefined means the run is not in the store. |
| readTerminationInit | Reads a termination.init entry's payload; undefined when malformed. |
| reconcileRunMeta | Repairs a divergent meta row from the journal: 'meta-behind' and 'stranded' audits rewrite status (every other meta field, unknown fields included, is preserved byte for byte), 'suspect' and 'consistent' audits change nothing. Zero model calls, no workflow needed; the crash residue between a settle's journal flush and its meta write repairs without resuming the run at all. |
| reconcileStatement | Reconciles the invoice against a normalized provider export. Pure and journal-free; see the module doc for the contract. Throws a typed ConfigError on inputs that cannot be evidence: an empty statement (a headline total with no rows), a request row without a response id, a duplicate response id on either side (an ambiguous join, statement rows and local invoice rows alike, RV1804), a request export whose rows carry neither dollars, components, nor usage, any non-finite or negative dollar amount, any non-integer or negative token count, a non-finite or negative tolerance (RV903: a statement that cannot be summed must refuse loudly, never verdict 'match' on NaN totals), or a row whose usd and componentsUsd contradict each other beyond totalToleranceUsd (RV1005: an internally contradictory export is not evidence either). |
| reduceAuditTrail | Folds a loaded journal into the audit trail, in seq order. Pass the FULL entry list (Engine.stores.journal.load(runId) or exportRun(runId).entries); filtering is the reducer's job. |
| reduceCriticalPath | - |
| reduceDecisionChain | Folds a run's entries into its decision chain: the seq-ordered authority records only. Input order is not trusted; rows sort by seq ascending, the journal's own total order. |
| reduceInvocationTable | Reduces one run's event stream (or any slice of it) to the invocation table. Feed it the events in emission order; both a live stream and a replayed one produce the same usage and cost columns. |
| registryKeyRing | KeyRing over the registry: the live call is projected DOWN into the profile of the stored entry; there is no upward canonization. |
| remeasureQueue | The re-measurement queue: expired eval-measured claims that are still ACTIVE. Just a status filter: the next sweep re-measures these subjects; nothing archives them (archiving would empty the queue and hide the decay). |
| renderCapacitySheetMarkdown | Renders the sheet as Markdown: one heading per section, one line per figure with its provenance label on the line, and the named assumptions last. A reader who quotes any single line quotes its provenance with it; that is the point. |
| renderContractRequirements | The manifest's prompt half (RV3308): a deterministic requirements block enumerating the SAME headings, bounds, citation floor and literals the validators hold, byte for byte, for the host to embed in its question. Rendering is pure string assembly; nothing here consults the result. |
| repairLedgerFromJournal | Folds the workflow-wide repair ledger from a journal (RV4002). Pure over the entries, so the acceptance envelope's live aggregate (computed from the run's own snapshot at assembly) and a post-hoc fold over the persisted journal agree by construction on every count and row identity; wireRef/costUsd enrich rows exactly when the asynchronous billing lane covered them. |
| replayDisposition | The single canonical predicate, dispatched on the entry's own hashVersion (compatibility lemma: on the v1 domain the tables coincide). Suspended entries are outside the table (the DEF-4 fold consumes them); the alias column (DEF-5) activates with node.link producers in M7: a skipped entry WITHOUT an incoming alias is always skipped. |
| repositoryResearchToolset | - |
| requiredFieldsValidator | Requires the result to be a JSON object carrying every named field with a substantial value: present, not null, and not an empty or whitespace only string (empty arrays, zero, and false COUNT as present; emptiness rules beyond strings belong to a custom validator). Default name 'required-fields'. |
| requiredMentionsValidator | Every declared literal must appear in the finish result at least once (RV3308). The 2026-08-12 comparison run passed an exact twelve heading contract and a citation floor while its "all publishable packages" table silently dropped four of the seventeen names: shape validators cannot see an enumerable universe, so the universe is declared as literals and each one is held. Purely textual and deterministic; fenced code counts, because tables and inline code are legitimate places to name a package. Default name 'required-mentions'. |
| requiredSectionsValidator | Requires every named section to appear LITERALLY in the result text (a heading like 'FINDINGS' or any marker the goal demands). Default name 'required-sections'; pass name to run several instances. match: 'line' demands each marker as its own line and fencedCode: 'excluded' ignores markers inside fenced code blocks (cycle 74); both default to the historical byte identical behavior. |
| researchAgentProfile | The batteries-included research child: the confined repositoryResearchToolset over root, the stock report_progress tool, and RESEARCH_PROFILE_LIMITS as the stop conditions. A child spawned from this profile that runs out of budget settles 'limit' WITH its last progress report as the structured partial, and the recorded evidence stays readable host-side through evidence(). |
| reservationMinus | Reservation arithmetic helpers (component-wise, absent = 0). |
| resolveCitationAuditPlan | Validates the declared plan numbers; returns the resolved bounds. Garbage throws like every malformed intake. |
| resolveModelInvocation | Resolution runs on every model invocation, not once per agent: a layered merge of { model, effort, providerOptions, fallbacks } in the order call override > agent profile > workflow defaults > engine defaults, with the invocation role attached as a tag. After resolution the router reads ModelCaps and scrubs illegal parameters visibly: unsupported effort is removed from the wire but kept in identity; sampling params rejected by the model are removed from the adapter's namespace, never silently sent. |
| resolvePricing | Resolves the pricing for a model: the versioned table wins; the adapter-reported caps.pricing is the fallback; undefined means unpriced (the CostReport surfaces it, never a silent zero). |
| resolveToolset | Expands registered names and sources, validates every tool name and duplicate names across the whole toolset (ConfigError at spawn time), and computes the toolsetHash over contracts sorted by name. The toolsets registry is the engine's defaults.toolsets snapshot; without one, string entries fail with the same unknown-name error as a miss, so nothing outside the declared registry is ever reachable. |
| retentionKeyOf | The RETENTION identity of an adapter (RV4007): the provider family, composed with the adapter's declared scopeKey when one exists, so two adapters of one family serving different accounts stop sharing provider-raw blocks (cache handles, thinking blocks: provider-side identifiers minted under one account are not portable to another). Adapters without a scopeKey keep the family alone, byte for byte the historical sharing. |
| retryClassOf | Classifies a WireError for the retry engine. Task-class failures are never retryable by construction: adapters mark them retryable: false and this returns undefined. The kind travels in WireError.data.kind; anything retryable without a specific kind is transport. |
| retryDelayMs | The delay before retry number retryIndex (zero based: the delay after the first failed attempt has index 0). A VALID provider supplied retryAfterMs (finite and nonnegative) REPLACES the computed delay (Appendix A); anything else (NaN, Infinity, a negative) is ignored as adapter noise and the policy backoff applies, so this boundary stays defensive against custom adapters (v1.28.0 review P2). Jitter is equal jitter: half the backoff is deterministic, half random, so a jittered delay never collapses to zero. The result is always a finite nonnegative integer clamped to the Node timer maximum (2147483647 ms). |
| retryWireMultiplier | The retry share of a wire plan (RV4005): r retries over a base of B wires re-dispatch r of the B, so totals scale by 1 + r/B. The fifth comparison run's answer multiplied by 1 + r, reading every retry as a whole extra plan. |
| reviewAgentProfile | The review child template: the caller's task tools plus the progress contract, with REVIEW_PROFILE_LIMITS as the stop conditions (a tighter turn budget and the no-new-evidence guard: a reviewer circling over the same pages should stop, not spin). |
| roleConfiguredInRouting | True when any resolution layer configures the given role in its routing map. This is the finalize TRIGGER: firing is decided by the presence of a routing entry at any layer; the model it fires ON still resolves through the full chain (a higher layer's all-roles model may override the routed choice). |
| roundOneDisposition | The round-1 interim disposition; replaced by replayDisposition (M2-T06). |
| runAgent | Runs one agent to a typed AgentResult. Never throws past policy: every failure mode becomes a typed status on the result. |
| runProfile | Looks up a shipped RunProfile by name; undefined for unknown names. |
| sampleCitationRows | The deterministic stratified sample (RV4004): per H2 section, up to samplePerSection citing sentences, selected by a hash chain seeded from the audited document's own hash, so the same candidate always yields the same sample (replay-stable, no clock, no randomness) and a repaired candidate re-samples afresh from its new hash. The whole sample is capped at maxSampled by pick rank across sections (every section's first pick seats before any section's second), so a many-section document degrades to one citation per section instead of auditing the first sections only. |
| sanitizeTerminalText | Neutralizes terminal control sequences and control characters in one untrusted string, collapsing each remaining control run to a single space so a value can never inject a newline, an escape sequence, or a hidden byte into a rendered line. Visible text is preserved. |
| sanitizeTokenCount | One count, repaired in the conservative direction: non-numbers and non-finite values floor to zero (no evidence, no charge and no credit), negatives floor to zero (a negative count can only CREDIT the budget, which hostile telemetry must never do), and fractions round UP so a repaired charge is never an undercharge. |
| sanitizeUsage | Conservative repair for accounting. Pairs with usageViolations: the violation fails the call loud, and the sanitized numbers are the only ones the journal, the cost report, and the budget may see. After the per-field repair the cache subsets clamp into the input with reads keeping priority, mirroring the adapter-level subset clamp. Valid usage passes through structurally unchanged. |
| sanitizeUsageDelta | The per-field repair for DELTAS (mid-stream usage reports and other partial increments): each count is repaired like sanitizeTokenCount, but the whole-usage subset rule is deliberately NOT applied, because a delta legitimately carries cache counts without restating the full input in the same event; clamping those to the subset rule would silently drop a paid cache debit. Always returns a fresh object and is the identity on valid deltas. |
| scanJournalCompatibility | The one compatibility scan: immediately after load, strictly BEFORE any live call, any append, and any admission reserve; repeated at lease acquire in queue mode. Side-effect free. |
| schemaHash | schemaHash = sha256(JCS(canonicalize(schema))). Accepts the derived JSON Schema (or a boolean schema); pass undefined for "no schema declared". |
| schemaHashOfSpec | Derives and hashes a SchemaSpec in one step (identity path for spawns). |
| scopeBucket | The scope key rule of the byScope rollup (RV3805). The root's OWN scope is the empty string BY CONSTRUCTION: present data whose string happens to be empty, not an absence, so it folds under the addressable name 'root' instead of the RV3604 'unknown' fallback, which stays reserved for a scope that is truly missing. Children keep their scope strings verbatim. One rule for both builders, so the live report and the journal fold cannot disagree on the key. |
| sectionalRoundPlan | Plans the sectional claim repair round (RV3803): which H2 sections of the accepted pre-repair document own the judged findings. The third comparison run's round regenerated the WHOLE 43k character document to consume findings that lived in a handful of sentences, and the tail after fan-in was 80.1 percent of the run's wall. Each finding's draftExcerpt (whitespace collapsed by the pairing fold) is located in the document through a collapse-aware scan, and its owning section is the nearest H2 line above it. Fail closed to the FULL regeneration (undefined, the historical round byte for byte) whenever the plan cannot be exact: no excerpts, a document without H2 headings, duplicated markers (the splice grammar needs unique lines), or any excerpt the scan cannot locate. |
| sectionCitationsValidator | Requires at least min matches of pattern INSIDE every named section (the v1.71 experiment review, P1.2: a total citation count hides sections carrying zero provenance). A section's slice runs from its FIRST occurrence to the next found section marker in text position order, or to the end of the text; a marker absent from the text is its own failure reason, because coverage of a missing section cannot silently count as satisfied. requiredSectionsValidator still owns plain presence. Default name 'section-citations'. match: 'line' anchors each section at the first line equal to its marker and fencedCode: 'excluded' removes fenced code before anchoring, slicing, and counting (cycle 74), so a marker echoed inside a code sample can neither anchor a slice nor donate citations; both default to the historical behavior. |
| sectionPatternCountValidator | Counted collections inside named sections (RV2206, the subscription parity series). The engine validated citations per section since the v1.71 review, but the numbered collections the parity contract demands (48 N-case ids, 16 counterexample ids) were policed by nothing: the second accepted dossier carried 0 and 0 against an instruction naming both, and only a runner-side format pre-teach closed the gap, by hope rather than contract. Each entry slices its section exactly like sectionCitationsValidator (first marker occurrence to the next marker in position order) and counts matches, DISTINCT by first capture when the pattern captures; the reasons name the section, the label, the found count against the minimum, and with a capturing pattern the missing count in ids, so a repair turn knows exactly what to add (the RV2105 lesson). Default name 'section-pattern-counts'. |
| selectStructuredOutputTier | Tier selection: the model's declared ceiling bounds the tier; the native tier additionally requires a strict-compatible canonical schema (relying on silent server-side fallback is forbidden), degrading to forced-tool. Prefill is not a tier. |
| selfTestFinishValidation | Runs a configured validator set against golden fixtures BEFORE any provider call exists (the v1.71 experiment review, P0.3): the accept fixture must pass every validator (a stale validator rejecting a correct skeleton is exactly the drift the experiment died of, three renamed sections deep into a paid run), and the reject fixture must fail at least one (a set that accepts the known-bad input validates nothing). A validator that THROWS here is a host defect and the ConfigError propagates, the same posture the live loop takes. Deterministic and free: validators are pure synchronous host code by contract, so this costs zero provider calls. rejects (cycle 74) carries the contract's per validator reject goldens: for each one the CONFIGURED validator of that name must exist and must reject the fixture, so a same-name replacement weaker than the contract's own validator fails here instead of silently accepting what the journaled contract hash forbids. |
| semanticRoundArming | The ONE arming derivation (RV4304): the acceptance tail's money and the capacity estimate's wires both read it, the dispatchProjectionReserveUsd precedent, so the two cannot disagree about which rounds a declared posture arms. The sixth comparison run's capacity model priced the round as a constant 2 while the merged round (RV4202) dispatches 3 wires; this function is where that distinction lives now. |
| semanticTerminalVerdictOf | Folds the one semantic verdict out of envelope facts (RV4209). Returns undefined when NO semantic meta is present: nothing was configured, nothing judged anything, and absence must keep meaning NOT RECORDED rather than a fabricated verdict. Never throws on malformed shapes, and malformation degrades toward 'not-judged', the fail-closed direction (RV4402): a meta that carries NO evidence anything judged (no judgedHash/auditedHash, no judgeInvoked, no judge flag, no judgedStage) folds 'not-judged' with a trust code, never 'clean', and a counter that is present but not a count taints its meta the same way. An ABSENT field still reads absent: absence is honest, garbage is not. |
| sfqGrantOrder | The deterministic grant order over queued rows: smallest start tag, ties by arrival seq. Two replicas over the same rows sort identically. |
| sfqRecordArrival | Records the arrival: the member's finish tag advances. |
| sfqRecordGrant | Records a grant: V advances to the granted start tag, monotonically. |
| sfqTagsOnArrival | The tags a ticket receives at arrival (pure; mutates nothing). |
| shouldCompact | The threshold check (M4-T03 committed semantics): the context estimate is the last loop turn's inputTokens + outputTokens; the Usage invariant makes inputTokens the full prompt, and the turn's output joins the next prompt. |
| snapshotQuotaRules | Validates a rule set and returns the immutable snapshot every reference limiter admits under (RV608): a fresh array of fresh objects carrying ONLY the known rule fields, each frozen, the array frozen. The caller's array and objects stay untouched and unshared, so ordinary JavaScript after the constructor (a pushed rule, a reassigned cap) can no longer change a decision, a bucket key, or a recorded fingerprint. |
| snapshotUsage | One field read per property, returning a detached plain copy. Both accounting boundaries validate and consume THIS snapshot, never the adapter-owned object, so a hostile accessor cannot answer the validator with valid counts and the accumulator with garbage. |
| spawnDepthOf | Nesting depth of a child scope: its workflow, agent, and plan-node segments. |
| spliceSections | The deterministic host half of sectional bounded repair (RV808b): a rejected finish used to resend the WHOLE document to fix one violated section, and the twelfth comparison run paid its post-fan-in wall exactly that way. This function reconstructs the full document from the RETAINED prior attempt and a sectional resubmission. The grammar is line anchored on purpose (the SectionMatchMode 'line' semantics): a section starts at the first line whose trimmed content EQUALS a declared marker and runs to the next such marker line (any declared marker) or the end of the text; the preamble before the first marker is retained verbatim. A patched marker present in the prior text has its whole section replaced by the marker line plus the new body; a patched marker absent from the prior text is APPENDED at the end in declared order (that is how a repair ADDS a section a validator demanded). A patch naming an undeclared marker is a ConfigError: the caller owns turning that into repair feedback. Deterministic and pure, so a spliced exchange recounts identically on replay; exported so custom hosts can stay symmetric with the orchestrator runtime. |
| statementFromRows | Normalizes raw keyed rows (a parsed CSV, a JSON export) into a ProviderStatement under one explicit StatementColumnMap (RV1703). Fail-closed at the cell: a mapped column whose value cannot be evidence (a non-numeric dollar figure, a fractional or negative token count, an empty response id, an unknown component name) refuses typed with the row index and column name instead of flowing a NaN or a guess into the reconciliation. Absent cells (missing key, null, empty string) mean "the export does not carry this figure" and simply omit the field; a requests row that ends up carrying no dollars, no component split, and no usage at all is refused, because a row without evidence cannot reconcile anything. |
| statementRowsFromDelimited | Parses a delimited billing export (the CSV/TSV a provider console hands a host) into the header-keyed rows statementFromRows consumes (RV2908). The library deliberately hard-codes NO provider's export format: the host owns the column map, this owns only the delimited grammar, and the pair closes the last manual step between a downloaded export and reconcileStatement. |
| stripFencedBlocks | Removes fenced code blocks from a text, the delimiter lines included, and returns the remaining lines joined by newlines. The grammar is the CommonMark shape as a deliberate line heuristic: a fence opens at a line starting (after at most three spaces) with three or more backticks or tildes, an optional info string allowed; it closes at the next line carrying only at least as many of the SAME character (a trailing carriage return from CRLF text does not keep a fence open); an unclosed fence runs to the end of the text. Indented (four space) code blocks are not treated as code. This is the exact exclusion the fencedCode: 'excluded' validator option applies, exported so custom host validators can stay symmetric. |
| summarizeInstruction | The instruction message appended to the projected transcript for the summarize invocation. Deterministic wording; the response text becomes the summary message body. |
| summarizeOutput | The M6 outputSummary: a deterministic truncation of the child's output (or error message), identical live and on replay (distillation lives with the child, ordered by spawn ordinal; the LLM distillation upgrade is M7 territory). |
| sumUsage | Canonical usage addition for aggregates. The four required counts sum field by field and reasoning appears when the sum is positive, byte for byte the historical fold. The cache-write TTL split survives aggregation (RV1001): when either side differentiates its writes, an undifferentiated side's writes count as the 5m share, which is financially identical (both bill at the plain write rate) and keeps the sum canonical under the split-sum rule instead of dropping the 1h attribution the money was debited under. Sides carrying no split add exactly as before, so aggregates over undifferentiated usage stay byte stable. |
| synthesisCandidatesFromJournal | Fold the finish candidates (RV2902) out of a run's journal: each journaled validation verdict with the window of wall, wires, usage, and priced cost that produced the candidate it judged. |
| synthesizeSpanClassOf | The ONE synthesize-span classifier both reducers fold through (RV4206, the RV3302 doctrine extended from a judge predicate to the whole vocabulary): the sixth comparison experiment's citation judge (label CITATION_JUDGE_LABEL, role 'synthesize') was recognized by neither reducer and fell into finalCompositionMs on both, so the run's 368889 ms "composition" was half verdict, its compositionSpans: 2 faked a repair round's signature on a clean run, and lastCandidateMs overshot the candidate by 154 seconds. |
| terminalEnvelopeOf | Assembles one terminal envelope (RV1105). settlement present means nothing durable records the terminal: settled reads false, and the optional settledReason: 'superseded' names the fenced-out segment (RV1009); absent means the settle held and settled reads true. The per-model split is detached, so a consumer mutating the envelope never reaches back into the cost report. |
| terminationConfigDrift | Config-drift detection at resume: the journaled vector always wins; every differing field is reported for the termination:config-drift event. Ambient config can never top up a budget through a restart; the one explicit, journaled door is ResumeOptions.run (RV2208), which is a decision entry, not a drift. |
| tierWithinCaps | True when tier is at or below the model's declared ceiling. |
| toApprovalDecision | Normalizes a resolution value into an ApprovalDecision. Anything that is not an explicit allow is a deny: an approval never fails open. |
| toJournalValue | Validates and snapshots a value for the journal: the returned value is a JSON round-trip clone, decoupled from later caller mutations, with undefined object members dropped. |
| tool | Defines a tool. Definition-time failures are typed ConfigErrors, never first-call surprises: an illegal name, a Standard Schema without the JSON Schema projection, a recursive local $ref, or a remote/dynamic reference all fail here. |
| toolAuthority | Derives one tool's authority record (RV1802). |
| toolCalibrationFromJournal | Folds the observed tool-budget calibration from a journal (RV3003): every terminal agent entry is partitioned by which sides of the evidence/counter pair it recorded, the paired rows carry their per-dispatch rate, and the aggregate is the number a host compares against its declared estCallsPerEntry. Pure over the entries, so live and resumed journals fold identically; nothing is re-derived and no checkpoint blob is read. |
| toolContract | The identity projection: the contract tuple that enters toolsetHash. parameters is the canonicalized derived JSON Schema. |
| toolContractHash | toolContractHash = sha256 over the JCS-canonical tuple of ONE tool contract: exactly one element of toolsetHash's array, so a per-tool hash identifies WHICH contract drifted when an attested toolsetHash stops matching (RV1514). Same tuple rule as the aggregate: the description is part of the contract, and an absent version participates as absent. |
| toolsetAuthorityHash | The aggregate authority hash (RV1802): sha256 over the JCS-canonical array of per-tool authority records, each carrying its tool name, sorted by name; toolsetHash's exact aggregation shape, over the authority side. |
| toolsetHash | toolsetHash = sha256 over the JCS-canonical JSON array of per-tool contract tuples (name, description, canonical parameters, version) sorted by name. Tool description IS part of the contract; schema annotations inside parameters are not. An absent version participates as absent. |
| ttlState | - |
| unionOfIntervalsMs | Total length of the union of possibly overlapping intervals, exported (RV3404) so the journal fold computes its window coverage through the SAME arithmetic the live RV710 decomposition uses, never a sibling implementation that can drift. |
| usageViolations | Names every rule the given usage violates; an empty array means the usage satisfies the full canonical invariant: each present count is a finite nonnegative integer and cacheReadTokens + cacheWriteTokens <= inputTokens. The subset rule is checked with a negated comparison so a NaN operand counts as a violation rather than vacuously passing. |
| validateClaimMapStructure | The structural verdict over a schema-valid claim map (RV4305): deterministic, relational, and HONEST about its own limits. Every reason names the offending rows or anchors so a rejected finish is repairable from the feedback alone. This function never judges whether a grade is true; that is the claim judge's question. |
| validateDetachedResolution | The detached resolution validator (RV1408): classifies the target entry exactly as the engine's own detached path does (a kind-'approval' entry by its RV1203 flavor, an external by its kind), then applies the shared payload arms and the pinned schema. Exported for offline authorities (the CLI server's lease-guarded append is the first): an escalation must resolve with its OWN EscalationDecision payload offline exactly as detached-live, and a lookalike validator that demanded the plain ApprovalDecision from every approval-kind entry both refused legitimate escalation decisions and waved wrong-shaped ones into the journal. Throws InvalidResolutionError; journals nothing. |
| validateEditorialCommit | The commit-batch validation: op shapes and gates first (GATE-DRIVEN since M11-T01: the human gate carries editorial claims, the eval-committer gate carries eval-measured claims with metrics), the post-apply cap second. Throws one ConfigError carrying every issue, so a maintenance caller fixes the batch in one round trip. |
| validateEngineAdmissionConfig | - |
| validateEngineQuotaConfig | Validates createEngine's quota config as a typed ConfigError before any run could dispatch under a malformed limiter (the intake discipline every engine option follows). |
| validateEntryShape | Validates the shape the engine is about to append. Returns issues; empty means valid. Unknown kinds are rejected here (the engine never writes them); stores still pass them through on read. |
| validateEscalationLimits | Validates a lineage-limits config record. The pre-rename knob name is rejected with a migration hint (XF-10): silently honoring it would change semantics (per logical task, not per node). |
| validateEscalationReport | Validates the runtime-completed report BEFORE append; returns issues. |
| validateQuotaRules | Validates a quota rule set as a typed ConfigError before any limiter can admit under it: a non-array or empty set, a rule without a cap, a malformed dimension, or a malformed cap all fail loud at construction. Shared by every reference implementation. |
| validateRetryPolicy | Validates a RetryPolicy and throws a typed ConfigError naming the offending field before any provider, journal, or store side effect can happen under it (v1.29.0 review P2). The engine calls this eagerly in createEngine for defaults.retry and every profile retry, and again after the call > profile > engine precedence merge of each agent call, so an invalid policy can never dispatch an adapter. The contract: |
| validateSchemaSpec | Runtime validation per form: form 1 via the Standard Schema's own validate, form 2 via the pair's type guard, form 3 via the vendored draft 2020-12 validator. The same machinery backs the structured-output tiers of the Agent Runtime. |
| validateTerminationLimits | Validates a raw limits record into the frozen vector. The pre-rename escalation knob is rejected with a migration hint (XF-10); counters must be non-negative integers; kMax at least 1. |
| validateToolsetAttestation | Validates a declared attestation's shape (typed at createEngine). |
| validateUsageLimits | Validates one UsageLimits layer at its intake boundary (v1.34.0 review P2-3): a malformed field (NaN, Infinity, a negative, a fraction) is a typed ConfigError before the merge, before any journal entry, and before any provider dispatch. site names the layer in the error text (e.g. RunOptions.limits). Counts are positive integers (maxToolCalls may be 0: a spawn that must not call tools). streamIdleTimeoutMs is handed to setTimeout as-is, so it is bounded by the Node timer maximum like RetryPolicy delays; timeoutMs is a wall-clock comparison, so it has no upper bound. Every present field is checked; absent fields keep their defaults. |
| verifyCandidateBytes | Verifies retained candidate bytes against a journaled candidateHash (RV4207). The retained blob holds the candidate's TEXT verbatim (the document itself for a string result, its JSON serialization otherwise), while the hash covers the canonical VALUE, so the check tries the value both ways: as the string document, then as parsed JSON. Returns false on any mismatch or unparsable bytes, never throws: the caller is an audit path, and a corrupt blob is a finding there, not a crash. |
| windowAdmits | Admits when the trailing sum stays under cap. This bounds the fixed epoch double burst to one sub-window's allowance, a documented burst, not a silent fix of the pinned RV708 semantics. |
| windowAdvance | Rotates the ring so nowSlot is the head; expired slots zero out. |
| windowConsume | - |
| windowRefund | Refunds into the head slot; never below zero across the ring. |
| windowSum | The trailing sum the cap bounds. |
| wireCapacityEstimate | The wire capacity of a declared orchestration plan (RV4005, the fifth comparison experiment): base wires by declaration, the armed repair round's delta, and the round's overhead share, from ONE exported function so an answer about the runtime's own economics has a source instead of an improvisation. The experiment's terminal answer wrote "34 wires without repair, 35 with" and multiplied retry share as 1 + r: the round is TWO wires (its composition plus the rejudge, orchestrate.ts's own doctrine), so 34 becomes 36 at 5.88 percent overhead, and r retries over a base of B multiply wires by 1 + r/B (retryWireMultiplier), not by 1 + r. |
| wordCountValidator | Requires the result text's word count (whitespace separated tokens; an empty text counts zero) to sit inside the configured bounds (the v1.71 experiment review, P0.7: a formal length requirement must be code, never a natural-language plea the model may round away). At least one bound is required; both are positive integers with min <= max. Default name 'word-count'. fencedCode: 'excluded' counts only words outside fenced code blocks (cycle 74), so code samples cannot pad a length requirement; the default counts everything, byte identical to the historical behavior. |
| workflowScope | ctx.workflow child scope: wf:<name>:<ordinal> (ordinal counts invocations of that name). |
| workflowSourceRef | TranscriptStore ref of the persisted CompiledWorkflow source blob. |
| wrapJournalStore | Wraps a journal store with the hook; the lease and meta lookup capabilities are preserved (meta is never hooked, exactly like putMeta/listRuns pass through). |
| wrapTranscriptStore | Wraps a transcript store with the hook. |