feat(candidate): compile full improvement bundles

docs/api/candidate-execution.md

@@ -8,6 +8,48 @@
 
 ## References
 
+### AgentCandidateCodeSource
+
+Re-exports [AgentCandidateCodeSource](index.md#agentcandidatecodesource)
+
+***
+
+### AgentCandidateCodeSurfaceSource
+
+Re-exports [AgentCandidateCodeSurfaceSource](index.md#agentcandidatecodesurfacesource)
+
+***
+
+### AgentCandidateProfileSource
+
+Re-exports [AgentCandidateProfileSource](index.md#agentcandidateprofilesource)
+
+***
+
+### BuildAgentCandidateBundleInput
+
+Re-exports [BuildAgentCandidateBundleInput](index.md#buildagentcandidatebundleinput)
+
+***
+
+### buildAgentCandidateBundle
+
+Re-exports [buildAgentCandidateBundle](index.md#buildagentcandidatebundle)
+
+***
+
+### AgentCandidateBundleInput
+
+Re-exports [AgentCandidateBundleInput](index.md#agentcandidatebundleinput)
+
+***
+
+### sealAgentCandidateBundle
+
+Re-exports [sealAgentCandidateBundle](index.md#sealagentcandidatebundle)
+
+***
+
 ### AgentCandidateExecutionAttemptRecord
 
 Re-exports [AgentCandidateExecutionAttemptRecord](index.md#agentcandidateexecutionattemptrecord)

docs/api/index.md

@@ -1243,6 +1243,90 @@ Defined in: [sessions.ts:59](https://github.com/tangle-network/agent-runtime/blo
 
 ## Interfaces
 
+### AgentCandidateCodeSurfaceSource
+
+Defined in: [candidate-execution/builder.ts:48](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L48)
+
+The only accepted path from an agent-eval code candidate to executable bytes.
+
+#### Properties
+
+##### kind
+
+> **kind**: `"code-surface"`
+
+Defined in: [candidate-execution/builder.ts:49](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L49)
+
+##### surface
+
+> **surface**: `CodeSurface`
+
+Defined in: [candidate-execution/builder.ts:50](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L50)
+
+##### repository
+
+> **repository**: `AgentCandidateGitHubRepository`
+
+Defined in: [candidate-execution/builder.ts:51](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L51)
+
+##### worktreeDir?
+
+> `optional` **worktreeDir?**: `string`
+
+Defined in: [candidate-execution/builder.ts:53](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L53)
+
+Optional parent directory used to resolve a relative `surface.worktreeRef`.
+
+***
+
+### BuildAgentCandidateBundleInput
+
+Defined in: [candidate-execution/builder.ts:63](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L63)
+
+Complete measured surfaces and execution policy compiled into one candidate bundle.
+
+#### Properties
+
+##### profile
+
+> **profile**: [`AgentCandidateProfileSource`](#agentcandidateprofilesource)
+
+Defined in: [candidate-execution/builder.ts:64](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L64)
+
+##### code
+
+> **code**: [`AgentCandidateCodeSource`](#agentcandidatecodesource)
+
+Defined in: [candidate-execution/builder.ts:65](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L65)
+
+##### execution
+
+> **execution**: `AgentCandidateExecution`
+
+Defined in: [candidate-execution/builder.ts:66](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L66)
+
+##### knowledge?
+
+> `optional` **knowledge?**: `AgentCandidateKnowledge`
+
+Defined in: [candidate-execution/builder.ts:67](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L67)
+
+##### memory
+
+> **memory**: `AgentCandidateMemoryPolicy`
+
+Defined in: [candidate-execution/builder.ts:68](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L68)
+
+##### lineage
+
+> **lineage**: `Omit`\<`AgentCandidateLineage`, `"profileDiffIds"`\>
+
+Defined in: [candidate-execution/builder.ts:70](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L70)
+
+`profileDiffIds` is derived from `profile`; callers cannot contradict it.
+
+***
+
 ### FileAgentCandidateExecutionClaimStoreOptions
 
 Defined in: [candidate-execution/claim-file-store.ts:66](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/claim-file-store.ts#L66)
@@ -10044,6 +10128,78 @@ Defined in: [types.ts:571](https://github.com/tangle-network/agent-runtime/blob/
 
 ## Type Aliases
 
+### AgentCandidateProfileSource
+
+> **AgentCandidateProfileSource** = \{ `kind`: `"profile"`; `profile`: `AgentProfile`; \} \| \{ `kind`: `"profile-diffs"`; `base`: `AgentProfile`; `diffs`: readonly `AgentProfileDiff`[]; \} \| \{ `kind`: `"candidate-profile"`; `profile`: `AgentCandidateProfile`; \}
+
+Defined in: [candidate-execution/builder.ts:30](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L30)
+
+A complete profile that can be frozen without losing behavior.
+
+#### Union Members
+
+##### Type Literal
+
+\{ `kind`: `"profile"`; `profile`: `AgentProfile`; \}
+
+***
+
+##### Type Literal
+
+\{ `kind`: `"profile-diffs"`; `base`: `AgentProfile`; `diffs`: readonly `AgentProfileDiff`[]; \}
+
+###### kind
+
+> **kind**: `"profile-diffs"`
+
+###### base
+
+> **base**: `AgentProfile`
+
+###### diffs
+
+> **diffs**: readonly `AgentProfileDiff`[]
+
+Applied in order. Each exact diff is content-addressed into lineage.
+
+***
+
+##### Type Literal
+
+\{ `kind`: `"candidate-profile"`; `profile`: `AgentCandidateProfile`; \}
+
+###### kind
+
+> **kind**: `"candidate-profile"`
+
+###### profile
+
+> **profile**: `AgentCandidateProfile`
+
+Already converted to the closed, secret-free candidate profile contract.
+
+***
+
+### AgentCandidateCodeSource
+
+> **AgentCandidateCodeSource** = `AgentCandidateCodeDisabled` \| `AgentCandidateCodeNoOp` \| [`AgentCandidateCodeSurfaceSource`](#agentcandidatecodesurfacesource)
+
+Defined in: [candidate-execution/builder.ts:57](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L57)
+
+Explicit control/no-op code or one finalized CodeSurface whose bytes must still verify.
+
+***
+
+### AgentCandidateBundleInput
+
+> **AgentCandidateBundleInput** = `Omit`\<`AgentCandidateBundle`, `"digest"`\>
+
+Defined in: [candidate-execution/bundle.ts:7](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/bundle.ts#L7)
+
+Exact candidate wire shape before the runtime computes its canonical digest.
+
+***
+
 ### AgentCandidateExecutionFailureClass
 
 > **AgentCandidateExecutionFailureClass** = `"pre-model-infrastructure"` \| `"execution"` \| `"post-model-infrastructure"` \| `"unknown"`
@@ -11604,6 +11760,50 @@ Maximum completion tokens, sent as OpenAI-compatible `max_tokens`. Omit for prov
 
 ***
 
+### buildAgentCandidateBundle()
+
+> **buildAgentCandidateBundle**(`input`): `AgentCandidateBundleV1`
+
+Defined in: [candidate-execution/builder.ts:80](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/builder.ts#L80)
+
+Compile one measured profile/code candidate into the immutable execution
+contract. Code bytes are re-read and verified by agent-eval before they are
+embedded. The returned bundle is schema-validated, canonically digested, and
+deeply immutable; call `verifyAgentCandidateBundle` at the execution boundary
+to re-read external knowledge, memory, repository, and workspace artifacts.
+
+#### Parameters
+
+##### input
+
+[`BuildAgentCandidateBundleInput`](#buildagentcandidatebundleinput)
+
+#### Returns
+
+`AgentCandidateBundleV1`
+
+***
+
+### sealAgentCandidateBundle()
+
+> **sealAgentCandidateBundle**(`input`): `AgentCandidateBundleV1`
+
+Defined in: [candidate-execution/bundle.ts:10](https://github.com/tangle-network/agent-runtime/blob/main/src/candidate-execution/bundle.ts#L10)
+
+Validate and content-address a candidate bundle before it crosses an approval boundary.
+
+#### Parameters
+
+##### input
+
+[`AgentCandidateBundleInput`](#agentcandidatebundleinput)
+
+#### Returns
+
+`AgentCandidateBundleV1`
+
+***
+
 ### candidateExecutionClaim()
 
 > **candidateExecutionClaim**(`prepared`): [`AgentCandidateExecutionClaim`](#agentcandidateexecutionclaim)