legionio 1.4.107 → 1.4.109

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 852b32f5818f330941b385f4298e266c2906ff506f8111c58b708be29f83b707
-  data.tar.gz: 7a1ba8bfb20275e5e6fec4c89658c501cf81a63db55e873c9a6c08c0cffaba70
+  metadata.gz: 52e1d5b8749747a9fe4b89302f1e0122f86a7630e02f668dfa5df8de363399d7
+  data.tar.gz: 315b433465e06726391616a01d0cd6d8d8b13c849eff241a2702cdb8ab66cbaa
 SHA512:
-  metadata.gz: e8fd883eb244d806bc51a223ff300d12e06d160c8b5096a6e34898dd1f7c0577345c1e2d30f51e168d20da438d28108934cf57645df180c156f91c107d4eb964
-  data.tar.gz: e133ef05dd03f998185d2aa00fe1fe679a69f9e31db58b11987c8bff75ce2f9ed7baedcc4745ebb3a39362d228e1ca33943897b396dd585ce4981d83d1802709
+  metadata.gz: 4b8c67b2e70b786fc16abb5f43ce8a4d8155e87b22fcf4e901afb24c021fc2112b07b884b75e16f9a48e046a959cacc035885d4251f4812e3eb805f2465e66f6
+  data.tar.gz: 79b46b3605b2c249090b11dd4d12db71ff523061b9f9ae929cca2d7a1b3646489c3afb01f8dd36d6dcc532d925c86b2b48c6b90ee9cbac39c5bbdee5514618c7

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Legion Changelog
 
+## [1.4.109] - 2026-03-21
+
+### Added
+- `Legion::Cluster::Lock` Redis backend: SETNX + TTL acquire, Lua compare-and-delete release, thread-safe token storage via `Concurrent::Map`
+- `Legion::Cluster::Lock.backend` auto-detection: `:redis` (preferred), `:postgres` (advisory locks), or `:none`
+- `Legion::ProcessRole` module: role presets (full, api, worker, router) controlling which Service subsystems start
+- `Legion::Service#initialize` role integration: `role:` parameter resolves via `ProcessRole`, explicit kwargs override role defaults
+- 24 new specs (2404 total, 0 failures)
+
+## [1.4.108] - 2026-03-21
+
+### Added
+- `Legion::Registry::SecurityScanner` static analysis check — detects dangerous Ruby patterns (eval, system, exec, backtick, IO.popen, Open3) in extension source files
+- `Legion::Registry::Persistence` module — syncs in-memory registry with `extensions_registry` DB table (load at boot, persist on register/update)
+- Boot-time auto-population of `Legion::Registry` from discovered extensions with gemspec capability reading
+- `Legion::Sandbox` auto-wiring from gemspec `legion.capabilities` metadata at extension load
+- `legion marketplace install NAME` command — validates lex- naming, installs gem, registers in registry
+- `legion marketplace publish` command — full pipeline: rspec, rubocop, gem build, gem push, security scan, register
+- `Legion::Registry::Governance` module — naming convention enforcement, auto-approve by risk tier, review requirements via `Legion::Settings`
+- 65 new specs (2380 total, 0 failures)
+
 ## [1.4.107] - 2026-03-21
 
 ### Added

data/CLAUDE.md

@@ -9,7 +9,7 @@ The primary gem for the LegionIO framework. An extensible async job engine for s
 
 **GitHub**: https://github.com/LegionIO/LegionIO
 **Gem**: `legionio`
-**Version**: 1.4.79
+**Version**: 1.4.107
 **License**: Apache-2.0
 **Docker**: `legionio/legion`
 **Ruby**: >= 3.4

data/lib/legion/cli/doctor.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require 'legion/cli/doctor_command'

data/lib/legion/cli/marketplace_command.rb

@@ -231,6 +231,87 @@ module Legion
         out.error(e.message)
       end
 
+      # ──────────────────────────────────────────────────────────
+      # install
+      # ──────────────────────────────────────────────────────────
+
+      desc 'install NAME', 'Install a lex extension gem'
+      def install(name)
+        require 'legion/registry'
+        out = formatter
+
+        unless name.start_with?('lex-')
+          out.error("Extension name must start with 'lex-'")
+          return
+        end
+
+        if Kernel.system('gem', 'install', name)
+          entry = Legion::Registry::Entry.new(name: name, status: :active, airb_status: 'pending')
+          Legion::Registry.register(entry)
+          out.success("'#{name}' installed successfully")
+        else
+          out.error("Failed to install '#{name}'")
+        end
+      end
+
+      # ──────────────────────────────────────────────────────────
+      # publish
+      # ──────────────────────────────────────────────────────────
+
+      desc 'publish', 'Publish current extension to rubygems'
+      def publish
+        require 'legion/registry'
+        require 'legion/registry/security_scanner'
+        out = formatter
+
+        gemspec_files = Dir.glob('*.gemspec')
+        if gemspec_files.empty?
+          out.error('No gemspec found — publish aborted')
+          return
+        end
+
+        gemspec_path = gemspec_files.first
+        gem_name = File.basename(gemspec_path, '.gemspec')
+
+        unless Kernel.system('bundle', 'exec', 'rspec')
+          out.error('Specs failed — publish aborted')
+          return
+        end
+
+        unless Kernel.system('bundle', 'exec', 'rubocop')
+          out.error('Rubocop failed — publish aborted')
+          return
+        end
+
+        unless Kernel.system('gem', 'build', gemspec_path)
+          out.error("Failed to build gem '#{gem_name}'")
+          return
+        end
+
+        gem_files = Dir.glob("#{gem_name}-*.gem")
+        if gem_files.empty?
+          out.error('No built gem file found after build')
+          return
+        end
+
+        gem_file = gem_files.max_by { |f| File.mtime(f) }
+
+        unless Kernel.system('gem', 'push', gem_file)
+          out.error("Failed to push '#{gem_file}'")
+          return
+        end
+
+        scanner = Legion::Registry::SecurityScanner.new
+        scan_result = scanner.scan(name: gem_file)
+
+        version = gem_file.sub("#{gem_name}-", '').sub('.gem', '')
+        entry = Legion::Registry::Entry.new(name: gem_name, version: version,
+                                            status: :active, airb_status: 'pending')
+        Legion::Registry.register(entry)
+
+        out.success("'#{gem_name}' v#{version} published — security: #{scan_result[:passed] ? 'passed' : 'failed'}")
+      end
+
       # ──────────────────────────────────────────────────────────
       # stats
       # ──────────────────────────────────────────────────────────

data/lib/legion/cluster/leader.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Legion
+  module Cluster
+    class Leader
+      HEARTBEAT_INTERVAL = 10 # seconds
+      LOCK_NAME = 'legion_leader'
+
+      attr_reader :node_id, :is_leader
+
+      def initialize(node_id: SecureRandom.uuid)
+        @node_id = node_id
+        @is_leader = false
+        @heartbeat_thread = nil
+        @running = false
+      end
+
+      def start
+        @running = true
+        @heartbeat_thread = Thread.new { election_loop }
+      end
+
+      def stop
+        @running = false
+        @heartbeat_thread&.join(HEARTBEAT_INTERVAL + 2)
+        resign if @is_leader
+      end
+
+      def leader?
+        @is_leader
+      end
+
+      private
+
+      def election_loop
+        while @running
+          attempt_election
+          sleep(HEARTBEAT_INTERVAL)
+        end
+      end
+
+      def attempt_election
+        @is_leader = if Lock.acquire(name: LOCK_NAME)
+                       true
+                     else
+                       false
+                     end
+      rescue StandardError
+        @is_leader = false
+      end
+
+      def resign
+        Lock.release(name: LOCK_NAME) if @is_leader
+        @is_leader = false
+      end
+    end
+  end
+end

data/lib/legion/cluster/lock.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+
+module Legion
+  module Cluster
+    module Lock
+      module_function
+
+      @tokens = if defined?(Concurrent::Map)
+                  Concurrent::Map.new
+                else
+                  {}
+                end
+      @tokens_mutex = Mutex.new unless defined?(Concurrent::Map)
+
+      def tokens
+        @tokens
+      end
+
+      def backend
+        if defined?(Legion::Cache) &&
+           Legion::Cache.respond_to?(:const_defined?) &&
+           Legion::Cache.const_defined?(:Redis, false) &&
+           Legion::Cache::Redis.respond_to?(:client) &&
+           !Legion::Cache::Redis.client.nil?
+          :redis
+        elsif defined?(Legion::Data) &&
+              Legion::Data.respond_to?(:connection) &&
+              !Legion::Data.connection.nil?
+          :postgres
+        else
+          :none
+        end
+      end
+
+      def acquire(name:, ttl: 30, timeout: 5) # rubocop:disable Lint/UnusedMethodArgument
+        case backend
+        when :redis
+          acquire_redis(name: name, ttl: ttl)
+        when :postgres
+          acquire_postgres(name: name)
+        else
+          false
+        end
+      end
+
+      def release(name:, token: nil)
+        case backend
+        when :redis
+          release_redis(name: name, token: token)
+        when :postgres
+          release_postgres(name: name)
+        else
+          false
+        end
+      end
+
+      def with_lock(name:, ttl: 30, timeout: 5)
+        acquired = acquire(name: name, ttl: ttl, timeout: timeout)
+        return unless acquired
+
+        token = acquired == true ? nil : acquired
+
+        begin
+          yield
+        ensure
+          release(name: name, token: token)
+        end
+      end
+
+      def lock_key(name)
+        name.to_s.bytes.reduce(0) { |acc, b| ((acc * 31) + b) & 0x7FFFFFFF }
+      end
+
+      def redis_key(name)
+        "legion:lock:#{name}"
+      end
+
+      def acquire_redis(name:, ttl:)
+        client = Legion::Cache::Redis.client
+        token = SecureRandom.hex(16)
+        key = redis_key(name)
+        result = client.call('SET', key, token, 'NX', 'PX', ttl * 1000)
+        return nil unless result
+
+        store_token(name, token)
+        token
+      rescue StandardError
+        nil
+      end
+
+      def release_redis(name:, token:)
+        client = Legion::Cache::Redis.client
+        tok = token || fetch_token(name)
+        return false unless tok
+
+        key = redis_key(name)
+        lua = <<~LUA
+          if redis.call('GET', KEYS[1]) == ARGV[1] then
+            redis.call('DEL', KEYS[1])
+            return 1
+          else
+            return 0
+          end
+        LUA
+        result = client.call('EVAL', lua, 1, key, tok)
+        delete_token(name)
+        result == 1
+      rescue StandardError
+        false
+      end
+
+      def acquire_postgres(name:)
+        key = lock_key(name)
+        db = Legion::Data.connection
+        return false unless db
+
+        db.fetch('SELECT pg_try_advisory_lock(?) AS acquired', key).first[:acquired]
+      rescue StandardError
+        false
+      end
+
+      def release_postgres(name:)
+        key = lock_key(name)
+        db = Legion::Data.connection
+        return false unless db
+
+        db.fetch('SELECT pg_advisory_unlock(?) AS released', key).first[:released]
+      rescue StandardError
+        false
+      end
+
+      def store_token(name, token)
+        if defined?(Concurrent::Map)
+          @tokens[name.to_s] = token
+        else
+          @tokens_mutex.synchronize { @tokens[name.to_s] = token }
+        end
+      end
+
+      def fetch_token(name)
+        if defined?(Concurrent::Map)
+          @tokens[name.to_s]
+        else
+          @tokens_mutex.synchronize { @tokens[name.to_s] }
+        end
+      end
+
+      def delete_token(name)
+        if defined?(Concurrent::Map)
+          @tokens.delete(name.to_s)
+        else
+          @tokens_mutex.synchronize { @tokens.delete(name.to_s) }
+        end
+      end
+    end
+  end
+end

data/lib/legion/cluster.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Legion
+  module Cluster
+    autoload :Lock,   'legion/cluster/lock'
+    autoload :Leader, 'legion/cluster/leader'
+  end
+end

data/lib/legion/extensions.rb

@@ -70,6 +70,7 @@ module Legion
             next
           end
           Catalog.transition(gem_name, :loaded)
+          register_in_registry(gem_name: gem_name, version: entry[:version])
           @loaded_extensions.push(gem_name)
         end
         Legion::Logging.info(
@@ -227,8 +228,41 @@ module Legion
         end
       end
 
+      def register_in_registry(gem_name:, version: nil, description: nil)
+        return unless defined?(Legion::Registry)
+        return if Legion::Registry.lookup(gem_name)
+
+        capabilities = read_gemspec_capabilities(gem_name)
+        entry = Legion::Registry::Entry.new(
+          name:         gem_name,
+          version:      version,
+          description:  description,
+          capabilities: capabilities,
+          airb_status:  'pending',
+          risk_tier:    'low'
+        )
+        Legion::Registry.register(entry)
+        register_sandbox_policy(gem_name: gem_name, capabilities: capabilities)
+      end
+
+      def register_sandbox_policy(gem_name:, capabilities: [])
+        return unless defined?(Legion::Sandbox)
+
+        Legion::Sandbox.register_policy(gem_name, capabilities: capabilities)
+      end
+
       private
 
+      def read_gemspec_capabilities(gem_name)
+        spec = Gem::Specification.find_by_name(gem_name)
+        raw  = spec.metadata['legion.capabilities']
+        return [] unless raw
+
+        raw.split(',').map(&:strip)
+      rescue Gem::MissingSpecError
+        []
+      end
+
       def hook_subscription_actor(extension_hash, size, opts)
         ext_name   = extension_hash[:extension_name]
         extension  = extension_hash[:extension]

data/lib/legion/process_role.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Legion
+  module ProcessRole
+    ROLES = {
+      full:   { transport: true,  cache: true, data: true,  extensions: true,  api: true,  llm: true,  gaia: true,  crypt: true, supervision: true  },
+      api:    { transport: true,  cache: true, data: true,  extensions: false, api: true,  llm: false, gaia: false, crypt: true, supervision: false },
+      worker: { transport: true,  cache: true, data: true,  extensions: true,  api: false, llm: true,  gaia: true,  crypt: true, supervision: true  },
+      router: { transport: true,  cache: true, data: false, extensions: true,  api: false, llm: false, gaia: false, crypt: true, supervision: false }
+    }.freeze
+
+    def self.resolve(role_name)
+      key = role_name.to_sym
+      unless ROLES.key?(key)
+        warn_unrecognized(key)
+        key = :full
+      end
+      ROLES[key]
+    end
+
+    def self.current
+      settings = Legion::Settings[:process] rescue nil # rubocop:disable Style/RescueModifier
+      return :full unless settings.is_a?(Hash)
+
+      role = settings[:role]
+      return :full if role.nil?
+
+      role.to_sym
+    end
+
+    def self.role?(name)
+      current == name.to_sym
+    end
+
+    def self.warn_unrecognized(key)
+      message = "ProcessRole: unrecognized role '#{key}', falling back to :full"
+      if defined?(Legion::Logging) && Legion::Logging.respond_to?(:warn)
+        Legion::Logging.warn(message)
+      else
+        warn "[Legion] #{message}"
+      end
+    end
+    private_class_method :warn_unrecognized
+  end
+end

data/lib/legion/registry/governance.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Legion
+  module Registry
+    module Governance
+      DEFAULTS = {
+        require_airb_approval:      false,
+        auto_approve_risk_tiers:    %w[low],
+        review_required_risk_tiers: %w[medium high critical],
+        naming_convention:          'lex-[a-z][a-z0-9_]*',
+        deprecation_notice_days:    30
+      }.freeze
+
+      class << self
+        def config
+          @config ||= load_config
+        end
+
+        def check_name(name)
+          pattern = Regexp.new("\\A#{config[:naming_convention]}\\z")
+          pattern.match?(name.to_s)
+        end
+
+        def auto_approve?(risk_tier)
+          config[:auto_approve_risk_tiers].include?(risk_tier.to_s)
+        end
+
+        def review_required?(risk_tier)
+          config[:review_required_risk_tiers].include?(risk_tier.to_s)
+        end
+
+        def reset!
+          @config = nil
+        end
+
+        private
+
+        def load_config
+          return DEFAULTS unless defined?(Legion::Settings)
+
+          overrides = Legion::Settings.dig(:registry, :governance)
+          return DEFAULTS.merge(overrides) if overrides.is_a?(Hash)
+
+          DEFAULTS
+        rescue StandardError
+          DEFAULTS
+        end
+      end
+    end
+  end
+end

data/lib/legion/registry/persistence.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module Legion
+  module Registry
+    module Persistence
+      class << self
+        def data_available?
+          return false unless defined?(Legion::Data)
+          return false unless Legion::Data.respond_to?(:connection) && Legion::Data.connection
+
+          Legion::Data.connection.table_exists?(:extensions_registry)
+        rescue StandardError
+          false
+        end
+
+        def load_from_db
+          return 0 unless data_available?
+
+          count = 0
+          registry_dataset.each do |row|
+            entry = Entry.new(
+              name:        row[:name],
+              version:     row[:version],
+              author:      row[:author],
+              description: row[:description],
+              status:      row[:status]&.to_sym,
+              airb_status: row[:airb_status],
+              risk_tier:   row[:risk_tier]
+            )
+            Legion::Registry.register(entry)
+            count += 1
+          end
+          count
+        end
+
+        def persist(entry)
+          return false unless data_available?
+
+          attrs = persistence_attrs(entry)
+          existing = registry_dataset.where(name: entry.name).first
+
+          if existing
+            registry_dataset.where(name: entry.name).update(**attrs, updated_at: Time.now)
+          else
+            registry_dataset.insert(**attrs, created_at: Time.now, updated_at: Time.now)
+          end
+
+          true
+        rescue StandardError => e
+          Legion::Logging.warn("Registry::Persistence failed to persist #{entry.name}: #{e.message}") if defined?(Legion::Logging)
+          false
+        end
+
+        private
+
+        def registry_dataset
+          Legion::Data.connection[:extensions_registry]
+        end
+
+        def persistence_attrs(entry)
+          parts = entry.name.to_s.split('-')
+          mod_name = parts.map(&:capitalize).join('::')
+
+          {
+            name:        entry.name,
+            module_name: mod_name,
+            status:      entry.status.to_s,
+            description: entry.description
+          }
+        end
+      end
+    end
+  end
+end

data/lib/legion/registry/security_scanner.rb

@@ -5,10 +5,21 @@ require 'digest'
 module Legion
   module Registry
     class SecurityScanner
-      CHECKS = %i[checksum naming_convention gemspec_metadata].freeze
+      CHECKS = %i[checksum naming_convention gemspec_metadata static_analysis].freeze
 
-      def scan(gem_path: nil, name: nil, gemspec: nil)
-        results = CHECKS.map { |check| send(check, gem_path: gem_path, name: name, gemspec: gemspec) }
+      DANGEROUS_PATTERNS = [
+        { pattern: /\bKernel\.eval\b|\beval\s*\(/, label: 'eval' },
+        { pattern: /\bKernel\.system\b|\bsystem\s*\(/, label: 'system' },
+        { pattern: /\bKernel\.exec\b|\bexec\s*\(/, label: 'exec' },
+        { pattern: /\bIO\.popen\b/, label: 'IO.popen' },
+        { pattern: /\bOpen3\b/, label: 'Open3' },
+        { pattern: /`[^`]+`/, label: 'backtick subshell' }
+      ].freeze
+
+      def scan(gem_path: nil, name: nil, gemspec: nil, source_path: nil)
+        results = CHECKS.map do |check|
+          send(check, gem_path: gem_path, name: name, gemspec: gemspec, source_path: source_path)
+        end
         {
           passed:     results.all? { |r| r[:status] != :fail },
           checks:     results,
@@ -43,6 +54,26 @@ module Legion
         { check: :gemspec_metadata, status: status,
           details: has_caps ? 'capabilities declared' : 'no capabilities declared' }
       end
+
+      def static_analysis(source_path:, **_)
+        return { check: :static_analysis, status: :skip, details: 'no source path' } unless source_path && Dir.exist?(source_path.to_s)
+
+        findings = []
+        Dir.glob(File.join(source_path, '**', '*.rb')).each do |file|
+          relative = file.delete_prefix("#{source_path}/")
+          File.foreach(file).with_index(1) do |line, lineno|
+            DANGEROUS_PATTERNS.each do |entry|
+              findings << "#{relative}:#{lineno} #{entry[:label]}" if line.match?(entry[:pattern])
+            end
+          end
+        end
+
+        if findings.empty?
+          { check: :static_analysis, status: :pass, details: 'no dangerous patterns found' }
+        else
+          { check: :static_analysis, status: :warn, details: findings.join('; ') }
+        end
+      end
     end
   end
 end

data/lib/legion/registry.rb

@@ -40,7 +40,15 @@ module Legion
 
     class << self
       def register(entry)
+        raise ArgumentError, "Extension name '#{entry.name}' violates naming convention" if defined?(Governance) && !Governance.check_name(entry.name)
+
         store[entry.name] = entry
+
+        if defined?(Governance) && Governance.auto_approve?(entry.risk_tier)
+          update_entry(entry.name, entry, status: :approved, airb_status: 'approved', approved_at: Time.now.utc)
+        end
+
+        Persistence.persist(store[entry.name]) if defined?(Persistence)
       end
 
       def unregister(name)
@@ -147,7 +155,11 @@ module Legion
       def update_entry(name, entry, **overrides)
         attrs = entry.to_h.merge(overrides)
         store[name.to_s] = Entry.new(**attrs)
+        Persistence.persist(store[name.to_s]) if defined?(Persistence)
       end
     end
   end
 end
+
+require_relative 'registry/persistence'
+require_relative 'registry/governance'

data/lib/legion/service.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'readiness'
+require_relative 'process_role'
 
 module Legion
   class Service
@@ -11,8 +12,20 @@ module Legion
       base.freeze
     end
 
-    def initialize(transport: true, cache: true, data: true, supervision: true, extensions: true, # rubocop:disable Metrics/CyclomaticComplexity,Metrics/ParameterLists,Metrics/MethodLength,Metrics/PerceivedComplexity
-                   crypt: true, api: true, llm: true, gaia: true, log_level: 'info', http_port: nil)
+    def initialize(transport: nil, cache: nil, data: nil, supervision: nil, extensions: nil, # rubocop:disable Metrics/CyclomaticComplexity,Metrics/ParameterLists,Metrics/MethodLength,Metrics/PerceivedComplexity,Metrics/AbcSize
+                   crypt: nil, api: nil, llm: nil, gaia: nil, log_level: 'info', http_port: nil,
+                   role: nil)
+      role_opts = Legion::ProcessRole.resolve(role || Legion::ProcessRole.current)
+      transport  = role_opts[:transport] if transport.nil?
+      cache      = role_opts[:cache] if cache.nil?
+      data       = role_opts[:data] if data.nil?
+      supervision = role_opts[:supervision] if supervision.nil?
+      extensions = role_opts[:extensions] if extensions.nil?
+      crypt      = role_opts[:crypt] if crypt.nil?
+      api        = role_opts[:api] if api.nil?
+      llm        = role_opts[:llm] if llm.nil?
+      gaia       = role_opts[:gaia] if gaia.nil?
+
       setup_logging(log_level: log_level)
       Legion::Logging.debug('Starting Legion::Service')
       setup_settings

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.4.107'
+  VERSION = '1.4.109'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.4.107
+  version: 1.4.109
 platform: ruby
 authors:
 - Esity
@@ -483,6 +483,7 @@ files:
 - lib/legion/cli/dataset_command.rb
 - lib/legion/cli/detect_command.rb
 - lib/legion/cli/docs_command.rb
+- lib/legion/cli/doctor.rb
 - lib/legion/cli/doctor/bundle_check.rb
 - lib/legion/cli/doctor/cache_check.rb
 - lib/legion/cli/doctor/config_check.rb
@@ -587,6 +588,9 @@ files:
 - lib/legion/cli/update_command.rb
 - lib/legion/cli/version.rb
 - lib/legion/cli/worker_command.rb
+- lib/legion/cluster.rb
+- lib/legion/cluster/leader.rb
+- lib/legion/cluster/lock.rb
 - lib/legion/context.rb
 - lib/legion/data/local_migrations/20260319000001_create_extension_catalog.rb
 - lib/legion/data/local_migrations/20260319000002_create_extension_permissions.rb
@@ -647,8 +651,11 @@ files:
 - lib/legion/phi/access_log.rb
 - lib/legion/phi/erasure.rb
 - lib/legion/process.rb
+- lib/legion/process_role.rb
 - lib/legion/readiness.rb
 - lib/legion/registry.rb
+- lib/legion/registry/governance.rb
+- lib/legion/registry/persistence.rb
 - lib/legion/registry/security_scanner.rb
 - lib/legion/runner.rb
 - lib/legion/runner/log.rb