refactor(core): make TurnOrigin single-authority

[CxHsin]

Summary

Make TurnOrigin a single-authority core contract. The shared type and decoder now live in a leaf module; session.ts and runtime-event.ts use that decoder, while runtime-inputs.ts preserves its existing type export. Released automation origins continue to normalize to legacy_automation.

Fixes#3083

Verification

• npm --workspace @maka/core test passed: 545 tests.
• npm --workspace @maka/core run typecheck passed.
• npm run build passed.
• npm run typecheck passed.
• npm run lint passed.
• npm run format:check passed.
• npx knip --workspace apps/desktop --workspace packages/ui passed.
• Added focused coverage for all origin variants, strict shape rejection, and Automation normalization. No UI changes are included.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex performed the implementation, test additions, verification, and code review. The commit includes the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[coderabbitai]

📝 Walkthrough

Summary

This PR makes TurnOrigin and its decoder the single shared source of truth. It removes duplicated origin types and validation logic from session.ts and runtime-event.ts. It preserves the runtime-inputs.ts type export through re-exporting.

The shared decoder supports all existing origin variants. It normalizes automation to legacy_automation. It rejects unknown fields and invalid shapes.

This change extends the existing contract through one leaf module. It does not create a parallel decoding path. The solution is the smallest coherent change because it removes duplicate schemas and helpers while preserving public type exports and existing behavior.

The focused tests cover all origin variants, strict shape validation, and Automation normalization. The deleted local decoders and duplicate type definitions can remain deleted without reducing regression coverage. No UI changes are included.

The current diff indicates no direct security, licensing, release, or governance change. The TurnOrigin public type and decoder are centralized, so future origin changes must update one implementation. Validation is reported for core tests, typechecks, build, lint, formatting, and related checks, but final check status is unverified here without direct command evidence.

Review-relevant risks

The public TurnOrigin contract and origin normalization behavior are affected. Material changes in this area require independent human review under repository policy.

The person performing the merge must review the final diff. A maintainer makes the final determination.

Walkthrough

The PR centralizes TurnOrigin types and decoding in turn-origin.ts. Runtime events, runtime inputs, and session decoding now use the shared definitions. Tests cover canonical variants, legacy normalization, and unknown fields.

Changes

TurnOrigin centralization

Layer / File(s)	Summary
Shared TurnOrigin contract and decoder packages/core/src/turn-origin.ts	Defines the supported TurnOrigin variants and validates exact object shapes. It normalizes automation to legacy_automation.
Runtime event and input integration packages/core/src/runtime-event.ts, packages/core/src/runtime-inputs.ts	Uses the shared decoder and re-exports the shared TurnOrigin type.
Session decoding and validation packages/core/src/session.ts, packages/core/src/__tests__/runtime-event.test.ts	Uses shared origin decoding for stored user messages and removes local origin validators. Tests cover accepted variants, normalization, and rejected extra fields.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk:⚪ Minimal · up to 54dc8

The change centralizes TurnOrigin decoding without evidence of a user-facing regression; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers:astro-han, m4n5ter

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: consolidating TurnOrigin into a single authority.
Description check	✅ Passed	The description follows the template and documents the change, verification results, AI use, and checklist status.
Linked Issues check	✅ Passed	The changes satisfy issue #3083 by centralizing TurnOrigin and its decoder, preserving normalization, and adding focused tests.
Out of Scope Changes check	✅ Passed	The changes are limited to TurnOrigin consolidation, related decoding tests, and core validation; no unrelated changes are indicated.
Ai Use Disclosure	✅ Passed	The PR selects generative tooling, names Codex and its scope, and its single introduced commit has a valid standalone Generated-by: Codex trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a82144f4-423c-43e5-85ab-91dcbef6ceb8

📥 Commits

Reviewing files that changed from the base of the PR and between 90b78a3 and 54dc873.

📒 Files selected for processing (5)

• packages/core/src/__tests__/runtime-event.test.ts
• packages/core/src/runtime-event.ts
• packages/core/src/runtime-inputs.ts
• packages/core/src/session.ts
• packages/core/src/turn-origin.ts

[Astro-Han]

Reviewed against #3083.

One type and one decoder now live in turn-origin.ts. session.ts and runtime-event.ts both call it, including the automation → legacy_automation normalization. Extra fields and unknown kinds are still rejected. The runtime-inputs.ts type re-export has to stay: packages/runtime/src/runtime-runner.ts imports TurnOrigin from @maka/core/runtime-inputs, and there is no root or turn-origin subpath.

The old session decoder returned the input object for the three non-automation kinds; the new one returns a fresh object. Callers load JSON, so that is not observable.

Non-blocking: the new shares one decoder across all TurnOrigin variants case in runtime-event.test.ts repeats the automation normalization already pinned by decodeStoredMessage / decodeRuntimeEvent. The scheduled_task / goal / agent_graph round-trips and the extra-field reject are the new coverage; those would sit more naturally in turn-origin.test.ts.

Approve.

AI-assisted review: Grok 4.6 drafted the first pass. A second pass on opencode-go/deepseek-v4-flash:max compared the old and new decoders variant by variant and confirmed no second decoder remains. I read the full diff, confirmed on the PR branch that decodeMessageOrigin and the four *_ORIGIN_SHAPE helpers are gone, and checked the runtime-inputs consumer. Unverified by me: I did not rerun @maka/core tests.

[Astro-Han]

Fast path: one leaf module now owns the TurnOrigin type and decoder; session and runtime-event decoding already agreed, including automation → legacy_automation. Public type export stays on runtime-inputs. No user-visible behavior change. Required checks are green. Easy to revert.

I reviewed the final diff and am merging on that basis. Human contributor of record for this review: Astro-Han.