@agentsfleet/orly 0.9.2 → 0.9.3

package/audits/cross-tier-rates.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # cross-tier-rates.sh — pin numeric parity of the rate constants
-# across Zig + three TypeScript surfaces.
+# across the daemon + three TypeScript surfaces.
 #
 # RULE UFS extension. The shipped billing surface depends on these constants
 # having identical numeric values everywhere they appear:
@@ -16,13 +16,13 @@
 #
 # Files (one definition site per constant per file):
 #
-#   src/agentsfleetd/state/tenant_billing.zig       — server enforces the charge
+#   rustd/crates/afd_billing/src/nanos.rs   — server enforces the charge
 #   ui/packages/website/src/lib/rates.ts    — pricing page display
 #   ui/packages/app/lib/types.ts            — dashboard display
 #   cli/src/constants/billing.ts    — `agentsfleet doctor --json` billing block
 #
 # A drift between any two = a billing-display lie or a server-vs-CLI disagreement.
-# Zig is the source of truth (server enforces); the three TS surfaces echo it.
+# The daemon is the source of truth (server enforces); the three TS surfaces echo it.
 #
 # Fires in: make harness-verify, make harness-verify-all.
 # Exits 0 clean, 1 on any drift.
@@ -37,7 +37,7 @@ readonly NAMES=(
 )
 
 readonly FILES=(
-  src/agentsfleetd/state/tenant_billing.zig
+  rustd/crates/afd_billing/src/nanos.rs
   ui/packages/website/src/lib/rates.ts
   ui/packages/app/lib/types.ts
   cli/src/constants/billing.ts
@@ -96,7 +96,7 @@ if [[ $FAIL -ne 0 ]]; then
     printf "  %s\n" "$v" >&2
   done
   printf "\nFix: align all four files on the canonical Zig value\n" >&2
-  printf "     (src/agentsfleetd/state/tenant_billing.zig is the server-side enforcer).\n" >&2
+  printf "     (rustd/crates/afd_billing/src/nanos.rs is the server-side enforcer).\n" >&2
   exit 1
 fi
 

package/audits/deinit-pairs.sh

@@ -60,11 +60,14 @@ note() { printf "NOTE: %s\n" "$*"; }
 # ---------------------------------------------------------------------------
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT \
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT \
       | grep -E '^src/.*\.zig$' || true)
     ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2
@@ -106,10 +109,13 @@ done
 # M70 perf: pre-compute file sets in batched greps instead of one grep
 # per file (~760 forks → 2 forks). Reads as "membership sets" for the
 # per-init loop below.
-declare -A files_with_cleanup=()
+# A membership set as a newline-delimited string, not declare -A: associative
+# arrays are bash 4+ and macOS ships 3.2. Lookup is a substring test on
+# \n<file>\n, which filenames cannot fake.
+files_with_cleanup=$'\n'
 if [[ ${#present_files[@]} -gt 0 ]]; then
   while IFS= read -r f; do
-    [[ -n "$f" ]] && files_with_cleanup["$f"]=1
+    [[ -n "$f" ]] && files_with_cleanup="${files_with_cleanup}${f}"$'\n'
   done < <(grep -lE "$CLEANUP_RE" "${present_files[@]}" 2>/dev/null || true)
 fi
 
@@ -151,7 +157,7 @@ if [[ -n "$inits_list" ]]; then
     fi
 
     inits_requires_cleanup=$((inits_requires_cleanup + 1))
-    if [[ -z "${files_with_cleanup[$f]+x}" ]]; then
+    if [[ "$files_with_cleanup" != *$'\n'"$f"$'\n'* ]]; then
       inits_unpaired=$((inits_unpaired + 1))
       reason=""
       [[ $heap -eq 1 ]] && reason="heap-return"

package/audits/error-codes.sh

@@ -108,7 +108,10 @@ gather_used_paths() {
   esac
 }
 
-mapfile -t USED_PATHS < <(gather_used_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+USED_PATHS=()
+while IFS= read -r p; do USED_PATHS+=("$p"); done < <(gather_used_paths)
 if [[ ${#USED_PATHS[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0

package/audits/logging.sh

@@ -110,7 +110,10 @@ gather_paths() {
   esac
 }
 
-mapfile -t FILES < <(gather_paths)
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r p; do FILES+=("$p"); done < <(gather_paths)
 if [[ ${#FILES[@]} -eq 0 ]]; then
   ok "no source files in scope ($MODE)"
   exit 0
@@ -139,7 +142,9 @@ for f in "${FILES[@]}"; do
 done
 
 if [[ ${#rust_nontest[@]} -gt 0 ]]; then
-  mapfile -t rust_candidates < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
+  rust_candidates=()
+  while IFS= read -r p; do rust_candidates+=("$p"); done \
+    < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
 fi
 
 # ---------------------------------------------------------------------------
@@ -388,12 +393,17 @@ fi
 # ---------------------------------------------------------------------------
 scoped_hits=0
 scoped_eligible=()
-for f in "${zig_nontest[@]}"; do
-  case "$f" in
-    src/logging/*) continue ;;
-  esac
-  scoped_eligible+=("$f")
-done
+# Guarded like every sibling loop: bash 3.2 under `set -u` treats "${empty[@]}"
+# as unbound (fixed only in 4.4), so an unguarded expansion aborts the audit in
+# any repository with no Zig sources. macOS ships 3.2.
+if [[ ${#zig_nontest[@]} -gt 0 ]]; then
+  for f in "${zig_nontest[@]}"; do
+    case "$f" in
+      src/logging/*) continue ;;
+    esac
+    scoped_eligible+=("$f")
+  done
+fi
 if [[ ${#scoped_eligible[@]} -gt 0 ]]; then
   while IFS= read -r line; do
     [[ -z "$line" ]] && continue

package/audits/spec-template.sh

@@ -48,13 +48,17 @@ note() { printf "NOTE: %s\n" "$*"; }
 # Discover spec files in scope.
 case "$MODE" in
   --staged|staged)
-    mapfile -t SPECS < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(git diff --cached --name-only --diff-filter=ACMRT | grep -E '^docs/v[0-9]+/(pending|active|done)/.*\.md$' || true)
     ;;
   --all|all)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active)/' || true)
     ;;
   --include-done|include-done)
-    mapfile -t SPECS < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
+    SPECS=()
+    while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
     ;;
   --file|file)
     # Single named spec, both families — the lifecycle engine's spec.gate

package/audits/sql-mod.sh

@@ -46,10 +46,13 @@ added_hit() {
 
 case "$MODE" in
   --staged|staged)
-    mapfile -t FILES < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
+    # while read, not mapfile — bash-3.2 portability (see scripts/run-playbook-tests.sh).
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(git diff --cached --name-only --diff-filter=ACMRT -- '*.zig' || true)
     STAGED=1 ;;
   --all|all)
-    mapfile -t FILES < <(find src -type f -name '*.zig' 2>/dev/null || true)
+    FILES=()
+    while IFS= read -r f; do FILES+=("$f"); done < <(find src -type f -name '*.zig' 2>/dev/null || true)
     STAGED=0 ;;
   *)
     printf "usage: %s [--staged|--all]\n" "$0" >&2

package/audits/ufs.sh

@@ -116,7 +116,12 @@ if [ "$MODE" = "--staged" ]; then
 else
   scope_files() { git ls-files; }
 fi
-mapfile -t FILES < <(scope_files | while read -r f; do
+# `while read` rather than mapfile: mapfile is bash 4+ and macOS ships 3.2 —
+# the portability rule scripts/run-playbook-tests.sh already records.
+FILES=()
+while IFS= read -r f; do
+  FILES+=("$f")
+done < <(scope_files | while read -r f; do
   is_source "$f" && echo "$f"
 done)
 
@@ -344,9 +349,13 @@ done < <(awk -v re="$NUMERIC_RE" '
 
 # ── 3. cross-runtime-orphan ─────────────────────────────────────────────────
 # Full-tree ERR_* parity. Scoped to the ERR_* prefix because that is the
-# cross-runtime contract surface — server error codes a client consumes. Zig is
-# the source of truth: every client-side ERR_* must have a matching Zig
-# `pub const ERR_*`. Zig-only codes are fine; a server-internal code needs no
+# cross-runtime contract surface — server error codes a client consumes. The
+# daemon is the source of truth. A Rust daemon declares its codes through a
+# registry — `ErrorCode::declare("…")` — and the contract a client holds is
+# that STRING, so parity is checked on the string: every client
+# `export const ERR_X = "…"` must name a code the registry declares. Where no
+# registry exists and Zig does, the Zig `pub const ERR_*` NAMES are the
+# oracle instead. Daemon-only codes are fine; a server-internal code needs no
 # client mirror.
 #
 # Scoped BY RUNTIME, not by one repository's directory names. The previous form
@@ -381,11 +390,29 @@ parity_codes() {
     | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true
 }
 
+# The Rust registry outranks a Zig mirror: a runner that keeps a Zig subset of
+# the daemon's codes for its own use is a client, not the oracle. `record`
+# mutates globals, so the loop runs in this shell over a here-string — never on
+# the right of a pipe, which would run it in a subshell and drop every finding.
+rust_codes=$(git ls-files -z -- '*.rs' 2>/dev/null \
+  | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+  | { xargs -0 grep -hoE 'ErrorCode::declare\("[^"]+"\)' 2>/dev/null || true; } \
+  | { grep -oE '"[^"]+"' || true; } | tr -d '"' | sort -u)
 zig_err=$(parity_codes '^pub const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.zig')
 client_err=$(parity_codes '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.js' '*.jsx' '*.ts' '*.tsx')
 
-if [ -z "$zig_err" ]; then
-  ok "audit-ufs: cross-runtime parity skipped — no Zig ERR_* declared, so this repository has no source of truth to compare against"
+if [ -n "$rust_codes" ]; then
+  client_decls=$(git ls-files -z -- '*.js' '*.jsx' '*.ts' '*.tsx' 2>/dev/null \
+    | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+    | { xargs -0 grep -hE '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=[[:space:]]*"[^"]+"' 2>/dev/null || true; })
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    name=$(printf '%s' "$line" | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | head -1)
+    code=$(printf '%s' "$line" | sed -E 's/^[^=]*=[[:space:]]*"([^"]+)".*/\1/')
+    echo "$rust_codes" | grep -qxF -- "$code" || record "cross-runtime-orphan $name ($code) absent-in-daemon"
+  done <<<"$client_decls"
+elif [ -z "$zig_err" ]; then
+  ok "audit-ufs: cross-runtime parity skipped — no Rust registry and no Zig ERR_* declared, so this repository has no source of truth to compare against"
 else
   # Every client-side ERR_* must exist in Zig.
   for c in $client_err; do

package/dispatch/lib.sh

@@ -53,7 +53,10 @@ DISPATCH_RC=0
 # Rule-code gloss map — canonical short expansions (full text in RULES.md legend).
 # Keep in sync with RULES.md; dispatch-coverage.sh fails on a code with no
 # gloss entry. snake-of-record: CODE → "Short Gloss".
-declare -A DISPATCH_GLOSS=(
+# A heredoc of `[CODE]="Gloss"` lines, not declare -A: associative arrays are
+# bash 4+ and macOS ships 3.2. The line shape is load-bearing —
+# evals/dispatch/coverage.sh greps lib.sh for it (checks f and g).
+DISPATCH_GLOSS="$(cat <<'GLOSS'
   [NDC]="No Dead Code"
   [NLR]="No Legacy Retained (touch-it-fix-it)"
   [NLG]="No Legacy compat shims (pre-v2.0.0)"
@@ -83,10 +86,17 @@ declare -A DISPATCH_GLOSS=(
   [ERR-RS]="Rust ERror discipline (one type per crate, Result alias, no stringified cause)"
   [GRP]="GREptile rule audit (diff vs greptile-learnings/RULES.md codes)"
   [LDC]="Legacy-Design Consult (A remove / B patch / C keep)"
-)
+GLOSS
+)"
 
 # Look up a gloss; empty string if the code is unknown (audit will catch it).
-dispatch_gloss() { printf '%s' "${DISPATCH_GLOSS[$1]:-}"; }
+# Pure parameter expansion — no fork per finding. `[` is escaped so the code
+# is matched literally, not as a glob class.
+dispatch_gloss() {
+  local rest; rest="${DISPATCH_GLOSS#*\[$1\]=\"}"
+  [[ "$rest" == "$DISPATCH_GLOSS" ]] && return 0
+  printf '%s' "${rest%%\"*}"
+}
 
 dispatch_init() {
   DISPATCH_LANG="$1"; shift

package/dispatch/write_any.sh

@@ -33,12 +33,12 @@ dispatch_run_helper "LOG"  "logging.sh"      "--staged"
 dispatch_run_helper "MSID" "msid-ui.sh"      "--staged"
 
 # ── delegations (run only in the product repo — need state absent from dotfiles) ──
-# ERR's leaf hard-exits if src/agentsfleetd/errors/error_registry.zig is absent (it
+# ERR's leaf hard-exits if the product repo's error registry is absent (it
 # cross-references emitted codes against the registry), unlike UFS/LOG/MSID which
 # pass gracefully on empty input. So it can't run in dotfiles — delegate it; the
 # product repo's `make harness-verify` runs error-codes.sh against the real
 # registry. The .md keeps [DETERMINISTIC → ERR]: deterministic, just not run here.
-dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs src/agentsfleetd/errors/error_registry.zig)"
+dispatch_delegate "ERR" "make harness-verify (error-codes.sh — needs the product repo's error registry)"
 
 # ── judgment gates (no script can decide; agent states verdict in chat) ──
 dispatch_judgment "GRP" "per-iteration (diff langs change) + end-of-turn: audit the diff against docs/greptile-learnings/RULES.md — one row per applicable code (UFS/ORP/TST-NAM/PRI/EMS/…); \"it's just a label\" is not an exception"

package/dispatch/write_zig.md

@@ -480,7 +480,7 @@ Rules:
 
 New production Zig modules must not define SQL statement text inline. Put query
 text in a domain-local `sql.zig` and import it from the state/handler/service
-module. This mirrors `src/agentsfleetd/fleet_bundle/sql.zig`: table names and
+module. The shape is a domain-local `sql.zig` beside the module it serves: table names and
 query statements stay grepable in one place, while the public module owns row
 mapping, allocator ownership, and error translation.
 

package/docs/CHANGELOG_VOICE.md

@@ -14,5 +14,5 @@ Editing `~/Projects/docs/changelog.mdx` or any other Mintlify `<Update>` block.
 - **Internal cleanup / refactor entries get the most aggressive trimming.** One lead paragraph + one bullet list. Skip "Test coverage" sections unless the test count is the headline. Indy's exact direction: *"Keep internal code cleanup, refactor to a minimal."*
 - **Never drop load-bearing facts.** Error codes (`UZ-AUTH-003`), endpoint paths + method + body shape + status code, env var names + defaults, schema column / table names, CLI subcommand + flag names, migration steps, money amounts. Tighten prose, not meaning.
 - **Historical entries are archives.** Brevity-pass them; never rewrite the past. A typo correction (e.g. `$0.001` → `$0.01` when it was never true) is allowed and must be called out in the commit message.
-- **Rate constants flow through three pinned files only:** `src/agentsfleetd/state/tenant_billing.zig`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
+- **Rate constants flow through three pinned files only:** `rustd/crates/afd_billing/src/nanos.rs`, `ui/packages/website/src/lib/rates.ts`, `~/Projects/docs/snippets/rates.mdx`. Bumping a rate requires a paired Pull Request (PR) across the docs repo — there is no automated guard. In `*.mdx`, use `import { STARTER_CREDIT, EVENT_RATE, STAGE_RATE } from "/snippets/rates.mdx"` instead of hand-typing `$5`.
 - **The Mintlify reference Indy pasted (May 1 / May 8 entries) is canonical voice.** Mirror its rhythm, not its product nouns.

package/docs/EXECUTE_DOC_READS.md

@@ -22,7 +22,7 @@ Every triggered document requires one `📖 DOC READ: <path>` proof-line **per t
 | `*.mdx` | `dispatch/write_mdx.md` — structure, front matter, links, code fences, accessibility, and Mintlify isolation. | <!-- oracle-packs:language.mdx -->
 | Log emit (any language; see LOGGING GATE triggers) | `docs/LOGGING_STANDARD.md` — wire format (logfmt), severity ladder, error-code embedding, scope/event discipline, PII redaction, §10A tightenings. LOGGING GATE per edit. |
 | Lifecycle method in `*.zig` (`init|deinit|close|release|destroy|shutdown|dispose|free`) | `docs/LIFECYCLE_PATTERNS.md` — init/deinit pairing, errdefer placement, allocator ownership, defer/errdefer mutual exclusion, §10A tightenings. LIFECYCLE GATE per edit. |
-| `src/agentsfleetd/http/handlers/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
+| `rustd/crates/afd_api*/src/handler/**` or `public/openapi/**` | `docs/REST_API_DESIGN_GUIDELINES.md` — Quick Checklist; §1–§5 (URL/method/body/response/error), §6 (OpenAPI), §7 (6-place route registration), §8 (`Hx` handler interface), §10 (pre-PR gates). |
 | `ui/packages/**/*.{tsx,jsx,css}`, `app/**/*.{tsx,jsx,css}`, `components/**/*.{tsx,jsx,css}`, repo-root `globals.css`, or any file changing visual tokens / motion / typography | `DESIGN.md` (repo root) or `docs/DESIGN_SYSTEM.md` — whichever the repo carries. Design system source of truth: typography stack, color tokens, the single accent and its currency rule, motion signature, spacing/density, component principles, CLI palette mapping. DOC READ proof-line per turn. |
 | `*.tsx` / `*.jsx` under `ui/packages/{app,website}/` | `dispatch/write_ts_adhere_bun.md` (Design Tokens) — token-utility table (text/tracking/leading/max-w/min-w/spacing/motion/radius/color). DESIGN TOKEN GATE fires per edit; audit via project-side `audits/design-tokens.sh`. |
 | Auth-flow | `docs/AUTH.md`. |

package/docs/LOGGING_STANDARD.md

@@ -35,7 +35,7 @@ Documented honestly, not aspirationally. Pre-M62 baseline (the fix-pass converge
 
 - The named module `log` (source: `src/lib/logging/mod.zig`) exposes `scoped(.tag)` returning a logger struct with `.err` / `.warn` / `.info` / `.debug` methods. M62 removed the older free-function helpers (`logErr` / `logErrWithHint` / `logWarnErr`) — there is no compat shim.
 - TypeScript (`cli/src/**`) calls `console.log`/`console.error` directly. No structure. No scope. No severity beyond err vs out.
-- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`src/agentsfleetd/errors/error_registry.zig`) is the source of truth, but enforcement is voluntary.
+- Error-code embedding (`UZ-XXX-NNN`) appears on some `err` lines but not others. The registry (`rustd/crates/afd_core/src/error_code.rs`) is the source of truth, but enforcement is voluntary.
 - No collector-friendly format. Logs are a mix of free-form English and ad-hoc `key={value}` fragments.
 
 The proposed standard below is what every new emit must conform to and what the fix-pass converges existing emits toward.
@@ -168,7 +168,7 @@ Log the source (`source=env:OPENAI_API_KEY`), never the value, at every level.
 
 > [DETERMINISTIC → LOG]
 
-Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `src/agentsfleetd/errors/error_registry.zig`.
+Every `err` and `warn` record that maps to a domain error MUST carry `error_code=UZ-XXX-NNN` where `UZ-XXX-NNN` is declared in `rustd/crates/afd_core/src/error_code.rs`.
 
 - **Used-but-undeclared** (`UZ-FAKE-999` appearing in code, no entry in registry): **blocking** in `make lint`.
 - **Declared-but-unreferenced** (registry has `UZ-LEGACY-007`, no code references it): **informational**. Deletion may be deferred to a sweep milestone.

package/docs/ORLY_ARCHITECTURE.md

@@ -115,7 +115,7 @@ surfaces:
 {
   "commands": { "conform": [["make", "harness-verify"]],
                 "verify.unit": [["make", "test-unit-all"]] },
-  "surfaces": { "user": ["src/agentsfleetd/http/", "cli/src/"],
+  "surfaces": { "user": ["src/http/", "cli/src/"],
                 "docs": ["docs/"] }
 }
 ```

package/docs/SCHEMA_CONVENTIONS.md

@@ -16,7 +16,7 @@ Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an expl
 
 - Each SQL file must be **≤100 lines** and **single-concern** (one table, one logical group, or one additive change).
 - Files are numbered sequentially: `001_core_foundation.sql`, `002_core_workflow.sql`, etc. New migrations append the next number; shipped numbers are never reused or slid.
-- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `src/agentsfleetd/cmd/common.zig` (migration version array).
+- Every SQL file must be registered in `schema/embed.zig` (compile-time embed) and `rustd/crates/afd_db/src/migration.rs` (migration version array).
 - No-op stub files (e.g., columns folded into earlier files) are kept for version history but excluded from the migrations array.
 
 ## SQL Qualification
@@ -37,14 +37,14 @@ Destructive changes (`DROP TABLE`, `DROP COLUMN`, type rewrites) require an expl
 
 - **Column:** `id`
 - **Type:** Universally Unique Identifier (UUID) `PRIMARY KEY`
-- **Generation:** Application-side UUID version 7 (UUIDv7) via `src/agentsfleetd/types/id_format.zig`, never `gen_random_uuid()`.
+- **Generation:** Application-side UUID version 7 (UUIDv7) via `rustd/crates/afd_core/src/id.rs`, never `gen_random_uuid()`.
 - **No second unique key on the same value.** This is a correctness rule, not only a storage one: `ON CONFLICT` can arbitrate exactly one constraint, so a table carrying two unique keys over the same value makes two sessions inserting a brand-new row race to a duplicate-key error on the *other* index instead of taking the update arm. `schema/043_runner_lifetime_counters.sql` recorded this before the rule was generalised.
 - **Foreign keys reference the primary key**, never a secondary unique constraint.
 - **Constraint:** every table carries a UUIDv7 CHECK:
   ```sql
   CONSTRAINT ck_{table}_id_uuidv7 CHECK (substring(id::text from 15 for 1) = '7')
   ```
-- **Adding a new table:** add a `generate{TableName}Id()` function to `src/agentsfleetd/types/id_format.zig`.
+- **Adding a new table:** add a `generate{TableName}Id()` function to `rustd/crates/afd_core/src/id.rs`.
 - **API shape:** unchanged — public fields keep exposing `id`, `tenant_id`, `workspace_id` and the other documented names. The column now *is* the public name in most tables, so the aliasing the old rule required mostly disappears; where a public field differs from `id`, alias at the boundary rather than renaming client-facing payloads.
 - **Exceptions,** each stated in the slot that creates the table: a curated catalogue keyed by a stable slug (`core.fleet_library`) and a singleton keyed by a pinned integer (`core.model_catalogue_revision`) carry no UUID.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/skills/orly-write-integration-test/SKILL.md

@@ -80,7 +80,7 @@ Spec asserts "503 on Redis down", code returns 200 → test the spec, flag the c
 | **Standard** | New service method, new Redis stream/key, schema change with logic | + T4 + T5 + T6 |
 | **Hardening** | Auth / payment / lease / migration / streaming / anything in the data-loss radius | + T7 (if applicable) + T8 + chaos pass |
 
-Auto-detect from diff: `src/auth/**`, `src/agent/leases/**`, `src/runner/**` + `src/agentsfleetd/fleet/**` (the lease/reclaim/fence + client-daemon surface → T9), schema migrations, streaming handlers → Hardening. CRUD-only against existing schema → Smoke. Default → Standard.
+Auto-detect from diff: `src/auth/**`, `src/agent/leases/**`, `src/runner/**` + `rustd/crates/afd_fleet/**` (the lease/reclaim/fence + client-daemon surface → T9), schema migrations, streaming handlers → Hardening. CRUD-only against existing schema → Smoke. Default → Standard.
 
 Any operation that touches multiple systems or acquires the same resource more than once is **Standard at minimum** and must run T4, even when the endpoint is otherwise CRUD-only.