@agfpd/iapeer 0.2.33 → 0.2.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.33",
+  "version": "0.2.35",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/cli.test.ts

@@ -145,6 +145,29 @@ describe('stop / start (C1 durable flag, warm runtime)', () => {
     expect(isStopped(cfg, 'claude-parked')).toBe(false)
     expect(hasIdleReaped(cfg, 'claude-parked')).toBe(true)
   })
+  test('start --all clears the flag of EVERY registered peer; unregistered garbage untouched (incident 11.06)', async () => {
+    await register('p1')
+    await register('p2')
+    const e = env()
+    const cfg = loadLifecycleConfig(e)
+    // a stopped fleet …
+    setStopped(cfg, 'claude-p1')
+    setStopped(cfg, 'claude-p2')
+    // … plus a stray stop-flag for an identity NO registry record claims
+    setStopped(cfg, 'claude-ghost')
+    expect(await runCli(['start', '--all'], e)).toBe(0)
+    expect(isStopped(cfg, 'claude-p1')).toBe(false)
+    expect(isStopped(cfg, 'claude-p2')).toBe(false)
+    expect(isStopped(cfg, 'claude-ghost')).toBe(true) // unregistered → never enumerated, never touched
+  })
+  test('start without a peer and without --all → usage, nothing executed', async () => {
+    await register('p3')
+    const e = env()
+    const cfg = loadLifecycleConfig(e)
+    setStopped(cfg, 'claude-p3')
+    expect(await runCli(['start'], e)).toBe(2)
+    expect(isStopped(cfg, 'claude-p3')).toBe(true) // flag untouched — usage only
+  })
 })
 
 describe('FLEET GUARD (H4) — foreign persistent-peer launchd plist is off-limits', () => {

package/src/cli/index.ts

@@ -45,6 +45,13 @@ import {
 import { getAdapter } from '../launch/index.ts'
 import { isFoundationOwnedPlist, kickstartDaemon, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
 import { resolveCallerIdentity, resolveIdentity } from '../identity/index.ts'
+import { peerProfilePath } from '../storage/index.ts'
+import {
+  isConformant,
+  reconcileIndex,
+  reindexFromLocals,
+  validateProfileStandard,
+} from '../identity/profileStandard.ts'
 import { runAlwaysOn } from '../launch/launchdRun.ts'
 import { installDaemonPlist, startConfiguredDaemon } from '../daemon/main.ts'
 import { MARKETPLACE_NAME, onboardHost } from '../onboard/index.ts'
@@ -438,7 +445,7 @@ export async function sendMessage(
   // unawaited in-process wake would die with it; the daemon's supervise-tick
   // drain scan (≤60 s) picks the queue up — the EXISTING retry path for failed
   // kicks, not a new mechanism.
-  const { makeArmEphemeralOnDelivered, makeEphemeralRouteDeps } = await import('../daemon/main.ts')
+  const { makeArmEphemeralOnDelivered, makeEphemeralRouteDeps, makeNoteLiveTopic } = await import('../daemon/main.ts')
   const cfg = loadLifecycleConfig(env)
   const t0 = Date.now()
   const result = await routeSend(
@@ -450,7 +457,10 @@ export async function sendMessage(
       topic: opts.topic,
       attachments: opts.attachments,
     },
-    { wake: cliWake, ephemeral: makeEphemeralRouteDeps(cfg, env, () => {}) },
+    // noteLiveTopic — CLI-path parity (same seam the daemon wires): a live delivery
+    // through the CLI fallback must update the target's .topic marker too, or a
+    // daemon-restart-window send re-opens the stale-marker false-fresh (defect 11.06).
+    { wake: cliWake, ephemeral: makeEphemeralRouteDeps(cfg, env, () => {}), noteLiveTopic: makeNoteLiveTopic(cfg, env) },
   )
   // delivery.log sink — CLI-path parity (boris's observability gap 10.06: enqueues
   // routed through the CLI left to=<peer> at ZERO for the day while real wakes
@@ -544,8 +554,11 @@ const USAGE = `usage: iapeer <verb> [args]
   init [cwd] [--personality p] [--runtime r] [--description d]   onboard the CURRENT folder as a peer (identity + MCP + doctrine)
   create <personality> [--runtime r] [--path dir] [--bin abs]   create a peer anywhere (default ~/.iapeer/peers/<p>) + provision
   list [--json]                                                  registered peers + per-runtime liveness
-  stop <peer> [runtime] | --all                                  durable-stop a warm peer / bootout an always-on one
-  start <peer> [runtime]                                         re-enable a stopped peer / bootstrap an always-on one
+  verify [--json] [--fix]                                        profile-standard conformance + index↔local drift (--fix self-heals the index)
+  stop <peer> [runtime] | --all                                  warm peer: kill the live session + set a durable stop-flag — the daemon will NOT wake it
+                                                                 until \`start\`; always-on (notifier/telegram): launchctl bootout. --all = every registered peer
+  start <peer> [runtime] | --all                                 warm peer: clear the stop-flag — wakeable again; does NOT launch a session (the daemon brings
+                                                                 it up on the peer's first message); always-on: launchctl bootstrap. --all = every registered peer
   remove <peer> [--force]                                        delete a peer's registry record (locked writer); refuses a LIVE peer unless --force
   send <target> (--message <text> | --message-file <f|->) [--from <id>] [--attachment <p>]… [--topic <t>]   manual IAP send (fallback)
   <runtime>                                                      launch the cwd's peer (ALWAYS fresh)
@@ -871,6 +884,61 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         out(flags.json ? JSON.stringify(rows, null, 2) + '\n' : formatListTable(rows))
         return 0
       }
+      case 'verify': {
+        // Profile conformance + index↔local self-heal reconciliation. Read-only by
+        // default; --fix self-heals the index (reindex from local profiles). A drift
+        // is a signal that the index self-heal lapsed — caught by construction here.
+        const index = readPeersIndex({ env })
+        let errors = 0
+        let driftCount = 0
+        const lines: string[] = []
+        for (const peer of index.peers) {
+          const path = peerProfilePath(peer.cwd)
+          if (!existsSync(path)) {
+            errors++
+            lines.push(`✗ ${peer.personality}: no local profile at ${path}`)
+            continue
+          }
+          let raw: unknown
+          try {
+            raw = JSON.parse(readFileSync(path, 'utf8'))
+          } catch (e) {
+            errors++
+            lines.push(`✗ ${peer.personality}: profile is invalid JSON — ${e instanceof Error ? e.message : String(e)}`)
+            continue
+          }
+          const issues = validateProfileStandard(raw, peer.cwd)
+          const errs = issues.filter(i => i.severity === 'error')
+          const warns = issues.filter(i => i.severity === 'warn')
+          if (errs.length > 0) errors += errs.length
+          if (!isConformant(issues)) {
+            lines.push(`✗ ${peer.personality}: ${errs.map(i => `${i.field} — ${i.message}`).join('; ')}`)
+          } else if (warns.length > 0 && flags.json !== true) {
+            lines.push(`⚠ ${peer.personality}: ${warns.map(i => i.field).join(', ')}`)
+          }
+        }
+        const reconcile = reconcileIndex({ env })
+        for (const r of reconcile) {
+          if (r.drift === null) {
+            // missing local profile already reported above as an error
+          } else if (r.drift.length > 0) {
+            driftCount++
+            lines.push(`↯ ${r.personality}: index↔local drift on ${r.drift.join(', ')}`)
+          }
+        }
+        if (flags.json === true) {
+          out(JSON.stringify({ peers: index.peers.length, errors, drift: driftCount, reconcile }, null, 2) + '\n')
+        } else {
+          for (const l of lines) out(l + '\n')
+          out(`\n${index.peers.length} peers · ${errors} error(s) · ${driftCount} index↔local drift(s)\n`)
+        }
+        if (flags.fix === true && (driftCount > 0 || errors === 0)) {
+          const { healed, missing } = await reindexFromLocals({ env })
+          if (healed.length > 0) out(`self-healed index from local profiles:\n  ${healed.join('\n  ')}\n`)
+          if (missing.length > 0) errOut(`peers with no local profile (left untouched): ${missing.join(', ')}\n`)
+        }
+        return errors > 0 || (driftCount > 0 && flags.fix !== true) ? 1 : 0
+      }
       case 'stop': {
         // --all stops every registered peer (the fleet guard still refuses foreign
         // persistent-peer plists, so the live fleet stays untouched).
@@ -885,8 +953,19 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
       }
       case 'start': {
-        if (!positionals[0]) return usage(errOut)
-        const outcomes = startPeer(positionals[0], positionals[1], { env })
+        // --all re-enables every REGISTERED peer (mirror of `stop --all` — the 11.06
+        // incident: bringing a stopped fleet back required a manual loop over ~25
+        // peers). Enumeration is the registry, so unregistered garbage (stray flag
+        // files for identities no record claims) is never touched. NOTE: for warm
+        // peers this clears the stop flag only — no session is launched; each peer
+        // becomes wakeable and the daemon brings its session up on the first message.
+        const peers = flags.all === true
+          ? readPeersIndex({ env }).peers.map(p => p.personality)
+          : positionals[0]
+            ? [positionals[0]]
+            : null
+        if (!peers) return usage(errOut)
+        const outcomes = peers.flatMap(p => startPeer(p, flags.all === true ? undefined : positionals[1], { env }))
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
       }

package/src/daemon/index.ts

@@ -188,6 +188,10 @@ export interface CallToolDeps {
   onDelivered?: (caller: ResolvedCaller) => void
   /** Ephemeral-target serial-queue delivery (M3) — see transport.EphemeralRouteDeps. */
   ephemeral?: EphemeralRouteDeps
+  /** LIVE-delivered topic → the target's `.topic` marker (fresh-vs-resume seam) —
+   *  see transport.RouteDeps.noteLiveTopic. Injected so the daemon never imports
+   *  lifecycle; the production main wires makeNoteLiveTopic. */
+  noteLiveTopic?: (identity: string, topic: string) => void
 }
 
 export async function callTool(
@@ -205,7 +209,7 @@ export async function callTool(
       attachments: Array.isArray(args.attachments) ? (args.attachments as string[]) : undefined,
     }
     const t0 = Date.now()
-    const sent = await routeSend(caller, input, { wake: deps.wake, ephemeral: deps.ephemeral })
+    const sent = await routeSend(caller, input, { wake: deps.wake, ephemeral: deps.ephemeral, noteLiveTopic: deps.noteLiveTopic })
     // Ф-#8a: ONE durable outcome line per delivery attempt (delivery.log, sibling
     // to lifecycle.log) — metadata only, never the body. Both branches of the
     // routeSend result are recorded, so a suspected loss is reconstructable from
@@ -367,6 +371,12 @@ export interface StartDaemonOptions extends StorageOptions {
    * lifecycle queue + drain (makeEphemeralRouteDeps).
    */
   ephemeral?: EphemeralRouteDeps
+  /**
+   * LIVE-delivered topic → the target identity's `.topic` marker (fresh-vs-resume
+   * seam) — see transport.RouteDeps.noteLiveTopic. OFF by default; the production
+   * main wires the lifecycle marker write (makeNoteLiveTopic).
+   */
+  noteLiveTopic?: (identity: string, topic: string) => void
   /**
    * Write the discovery file (router.json) at <root>/state/iapeer/router.json with
    * the active addresses `{sock, tcp}` — atomically on listen, removed on close.
@@ -399,6 +409,7 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
       deliveryLogDir: opts.deliveryLogDir,
       onDelivered: opts.onDelivered,
       ephemeral: opts.ephemeral,
+      noteLiveTopic: opts.noteLiveTopic,
     })
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined })
     res.on('close', () => {

package/src/daemon/main.test.ts

@@ -15,6 +15,7 @@ import {
   installDaemonPlist,
   makeArmEphemeralOnDelivered,
   makeEphemeralRouteDeps,
+  makeNoteLiveTopic,
   startConfiguredDaemon,
   DEFAULT_DAEMON_PORT,
 } from './main.ts'
@@ -23,6 +24,10 @@ import {
   ephemeralQueueDepth,
   hasEphemeralArmed,
   peekEphemeralTask,
+  readTopic,
+  resolveWakeMode,
+  setIdleReaped,
+  writeTopic,
   type LifecycleConfig,
 } from '../lifecycle/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
@@ -304,3 +309,61 @@ describe('makeEphemeralRouteDeps (M3 serial-queue composition)', () => {
     expect(r.ok).toBe(false) // 'codex' is not declared for this worker
   })
 })
+
+// ─────────────────────────────────────────────────────────────────────────────
+// makeNoteLiveTopic — the live-delivered-topic composition (fresh-vs-resume seam):
+// the .topic marker must track the topic the session last WORKED ON, not the one
+// it woke with (defect 11.06: a day-stale wake-time marker false-freshed the
+// stop→start resume of a long-lived executor).
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('makeNoteLiveTopic (live-delivered topic → .topic marker)', () => {
+  function noteCfg(): LifecycleConfig {
+    const root = mkTmp()
+    return { stateDir: join(root, 'state'), eventLogDir: join(root, 'logs') } as LifecycleConfig
+  }
+
+  test('topic SHIFT → marker updated + ev=topic-note logged; same topic → no churn, no log spam', () => {
+    const cfg = noteCfg()
+    const note = makeNoteLiveTopic(cfg, {} as NodeJS.ProcessEnv)
+    writeTopic(cfg, 'claude-x', 'topic-a') // the wake established topic A
+    note('claude-x', 'topic-b') // a live delivery switches the work to B
+    expect(readTopic(cfg, 'claude-x')).toBe('topic-b')
+    const logPath = join(cfg.eventLogDir, 'lifecycle.log')
+    const log = readFileSync(logPath, 'utf8')
+    expect(log).toContain('ev=topic-note')
+    expect(log).toContain('identity=claude-x')
+    expect(log).toContain('topic=topic-b')
+    // the common case — every further message continues topic B → strictly nothing
+    note('claude-x', 'topic-b')
+    note('claude-x', 'topic-b')
+    expect(readFileSync(logPath, 'utf8').match(/ev=topic-note/g)?.length).toBe(1)
+  })
+
+  test('acceptance scenario (boris 11.06): woke with topic A → worked live-delivered topic B → clean stop-park → wake with topic B = RESUME, not fresh', () => {
+    const cfg = noteCfg()
+    const id = 'claude-x'
+    // executor peer cwd: no telegram interface (not human-conversational), no wake_policy
+    const cwd = mkTmp()
+    mkdirSync(join(cwd, '.iapeer'), { recursive: true })
+    writeFileSync(join(cwd, '.iapeer', 'peer-profile.json'), JSON.stringify({ personality: 'x', runtime: 'claude' }))
+    writeTopic(cfg, id, 'topic-a') // session woke with topic A (the stale pre-fix marker)
+    makeNoteLiveTopic(cfg)(id, 'topic-b') // ...then took topic-B messages in the LIVE session all day
+    setIdleReaped(cfg, id) // deliberate stop = clean park (stopPeer's promise)
+    const hasTranscript = () => ({ ok: true, ref: 'uuid-1' })
+    // pre-fix this read the stale 'topic-a' → cause=idle-reaped-new-topic → FRESH (context lost)
+    expect(resolveWakeMode(cfg, id, cwd, undefined, hasTranscript, 'topic-b')).toEqual({
+      resume: true,
+      resumeRef: 'uuid-1',
+      cause: 'idle-reaped-resume',
+    })
+  })
+
+  test('marker/log failure → no-op, never throws (a delivered message must stand)', () => {
+    const root = mkTmp()
+    const blocker = join(root, 'state-is-a-file')
+    writeFileSync(blocker, 'not a dir')
+    const cfg = { stateDir: join(blocker, 'state'), eventLogDir: join(blocker, 'logs') } as LifecycleConfig // mkdir must fail
+    expect(() => makeNoteLiveTopic(cfg)('claude-x', 'topic-b')).not.toThrow()
+  })
+})

package/src/daemon/main.ts

@@ -35,12 +35,15 @@ import {
   isEphemeralPeer,
   loadLifecycleConfig,
   processEagerRelaunches,
+  readTopic,
   resolveWakeRuntime,
   setEphemeralArmed,
   superviseTick,
   wakeOrSpawn,
+  writeTopic,
   type LifecycleConfig,
 } from '../lifecycle/index.ts'
+import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { buildProcessAddress } from '../core/socket.ts'
 import { err, ok } from '../core/errors.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
@@ -98,6 +101,35 @@ export function makeArmEphemeralOnDelivered(cfg: LifecycleConfig): (caller: Reso
   }
 }
 
+/**
+ * The fourth lifecycle⇆transport seam (after makeWakeFn / makeArmEphemeralOnDelivered /
+ * makeEphemeralRouteDeps): record a LIVE-delivered topic as the target identity's
+ * `.topic` marker, so the marker tracks the topic the session LAST WORKED ON — the
+ * semantics resolveWakeMode's executor discriminator actually wants — not merely the
+ * topic it woke with. Live defect 11.06 (boris): an executor woke topicless at 13:13,
+ * worked a delivered topic all day, was stop-parked clean, and the topic-matching
+ * resume-wake at 17:06 compared against the STALE wake-time marker → cause=
+ * idle-reaped-new-topic → FRESH; the day's context was lost despite the clean park.
+ * Same-topic deliveries are a no-op (no marker churn, no log spam) — the lifecycle.log
+ * line `ev=topic-note` therefore marks exactly the moments the session's working
+ * topic SHIFTED, which is what a fresh-vs-resume postmortem needs. Best-effort: a
+ * marker/log failure never fails the already-delivered message.
+ */
+export function makeNoteLiveTopic(
+  cfg: LifecycleConfig,
+  env: NodeJS.ProcessEnv = process.env,
+): (identity: string, topic: string) => void {
+  return (identity, topic) => {
+    try {
+      if (readTopic(cfg, identity) === topic) return
+      writeTopic(cfg, identity, topic)
+      appendLifecycleEvent(cfg.eventLogDir, { ev: 'topic-note', identity, topic }, { env })
+    } catch {
+      /* the marker is a discriminator hint — never fail a delivered message */
+    }
+  }
+}
+
 /**
  * wake_policy:"ephemeral" M3 — the serial-queue delivery composition (the third
  * lifecycle⇆transport seam after makeWakeFn / makeArmEphemeralOnDelivered).
@@ -178,6 +210,10 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     // M3 serial queue (see makeEphemeralRouteDeps): ephemeral TARGET ⇒ enqueue +
     // async drain. No-op for every other target.
     ephemeral: makeEphemeralRouteDeps(cfg, env),
+    // Live-delivered topic → the target's .topic marker (see makeNoteLiveTopic):
+    // the wake resolver's executor discriminator then compares against the topic
+    // the session last WORKED ON, not the one it woke with (defect 11.06).
+    noteLiveTopic: makeNoteLiveTopic(cfg, env),
     supervise: {
       intervalMs: opts.superviseIntervalMs ?? DEFAULT_SUPERVISE_INTERVAL_MS,
       // idle-reap / zombie-sweep, THEN the eager fresh re-launch for any peer whose

package/src/enable/enable.test.ts

@@ -44,21 +44,24 @@ describe('findPeerScopedEntry (per-peer, fleet-safe)', () => {
   })
 })
 
-// the real `codex plugin list` table shape (whitespace-aligned columns)
-const CODEX_LIST = `Marketplace \`agfpd\`
-
-PLUGIN                      STATUS              VERSION  PATH
-spawned-peer@agfpd          not installed                https://github.com/agfpd/Spawned-Peer.git
-peer-voice@agfpd            installed, enabled  0.1.8    https://github.com/agfpd/Peer-Voice.git
-MergeMind@agfpd             installed, disabled 0.14.70  https://github.com/agfpd/MergeMind.git`
+// the real `codex plugin list --json` shape (codex-cli 0.138, live-captured fields)
+const CODEX_LIST = JSON.stringify({
+  installed: [
+    { pluginId: 'peer-voice@agfpd', installed: true, enabled: true },
+    { pluginId: 'MergeMind@agfpd', installed: true, enabled: false },
+    { pluginId: 'spawned-peer@agfpd', installed: false, enabled: false }, // marketplace-known, not installed
+  ],
+})
 
 describe('parseCodexPluginStatus', () => {
-  test('reads the STATUS column per plugin id', () => {
+  test('reads the installed/enabled flags per plugin id', () => {
     expect(parseCodexPluginStatus(CODEX_LIST, 'peer-voice@agfpd')).toBe('enabled')
-    expect(parseCodexPluginStatus(CODEX_LIST, 'spawned-peer@agfpd')).toBe('absent') // "not installed"
-    expect(parseCodexPluginStatus(CODEX_LIST, 'MergeMind@agfpd')).toBe('disabled')
-    expect(parseCodexPluginStatus(CODEX_LIST, 'totp-presence@agfpd')).toBe('absent') // not in list
-    expect(parseCodexPluginStatus('', 'x@agfpd')).toBe('absent')
+    expect(parseCodexPluginStatus(CODEX_LIST, 'spawned-peer@agfpd')).toBe('absent') // installed:false
+    expect(parseCodexPluginStatus(CODEX_LIST, 'MergeMind@agfpd')).toBe('disabled') // installed, not enabled
+    expect(parseCodexPluginStatus(CODEX_LIST, 'totp-presence@agfpd')).toBe('absent') // not in array
+    expect(parseCodexPluginStatus('', 'x@agfpd')).toBe('absent') // empty
+    expect(parseCodexPluginStatus('not json', 'x@agfpd')).toBe('absent') // malformed → fail-safe
+    expect(parseCodexPluginStatus('{"no":"installed-array"}', 'x@agfpd')).toBe('absent')
   })
 })
 

package/src/enable/index.ts

@@ -274,24 +274,32 @@ function enableClaude(plugin: string, marketplace: string, peerCwd: string, env:
   return { runtime: 'claude', state: existing ? 'enabled' : 'installed', installPath: after.installPath }
 }
 
-/** Parse a `codex plugin list` STATUS column for one plugin id. The table is
- *  whitespace-aligned: `<id>  <status>  <version>  <path>`; status is `not installed`
- *  / `installed, enabled` / `installed, disabled`. PURE → unit-testable. */
-export function parseCodexPluginStatus(listOutput: string, id: string): 'enabled' | 'disabled' | 'absent' {
-  for (const line of listOutput.split('\n')) {
-    const cols = line.split(/\s{2,}/).map(c => c.trim())
-    if (cols[0] !== id) continue
-    const status = (cols[1] ?? '').toLowerCase()
-    if (status.includes('not installed')) return 'absent'
-    if (status.includes('enabled')) return 'enabled'
-    if (status.includes('installed')) return 'disabled'
+/** Parse `codex plugin list --json` for one plugin id's status. Shape (codex-cli
+ *  0.138, live-verified): `{ installed: [{ pluginId, installed, enabled }, …] }`.
+ *  A plugin absent from the array OR with `installed:false` → 'absent'; `enabled:true`
+ *  → 'enabled'; installed-but-not-enabled → 'disabled'. Replaces the prior whitespace-
+ *  table parse (brittle to column re-alignment / status-string wording) — the codex
+ *  counterpart of the claude path's `parseInstalledPlugins`. Malformed/empty input →
+ *  'absent' (same fail-safe). PURE → unit-testable. */
+export function parseCodexPluginStatus(jsonOutput: string, id: string): 'enabled' | 'disabled' | 'absent' {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(jsonOutput)
+  } catch {
     return 'absent'
   }
-  return 'absent'
+  const installed = (parsed as { installed?: unknown } | null)?.installed
+  if (!Array.isArray(installed)) return 'absent'
+  const entry = installed.find(
+    (e): e is { pluginId: string; installed?: boolean; enabled?: boolean } =>
+      !!e && typeof e === 'object' && (e as { pluginId?: unknown }).pluginId === id,
+  )
+  if (!entry || entry.installed === false) return 'absent'
+  return entry.enabled === true ? 'enabled' : 'disabled'
 }
 
 function codexState(bin: string, id: string, env: NodeJS.ProcessEnv): 'enabled' | 'disabled' | 'absent' {
-  const r = spawnSync(bin, ['plugin', 'list'], { encoding: 'utf8', env: env as Record<string, string>, maxBuffer: 64 * 1024 * 1024 })
+  const r = spawnSync(bin, ['plugin', 'list', '--json'], { encoding: 'utf8', env: env as Record<string, string>, maxBuffer: 64 * 1024 * 1024 })
   return parseCodexPluginStatus(r.stdout ?? '', id)
 }
 

package/src/identity/index.ts

@@ -206,8 +206,16 @@ export function readPeerProfile(cwd: string = process.cwd()): PeerProfile | null
   if (typeof obj.personality !== 'string' || !obj.personality.trim()) {
     throw new IapError(`${IAPEER_DIR}/${PEER_PROFILE_FILE} personality is required`)
   }
+  // personality is a SYSTEM MIRROR (contract Идентичность): the canonical value is
+  // normalize(basename(cwd)). The stored field is read+normalized here; a mismatch
+  // with the cwd-derived name is SURFACED by validateProfileStandard (a self-heal WARN)
+  // rather than silently overridden on read — the read-time override conflicts with
+  // the `iapeer init --personality` override (a deliberately-named peer in a folder
+  // whose basename differs), so the heal stays a flagged drift, not a silent rewrite.
   const personality = validatePersonality(obj.personality, 'peer-profile personality')
-  const runtime = validateRuntime(obj.runtime, 'peer-profile runtime')
+  // default_runtime is the contract field name (the routing/wake/first-launch default);
+  // `runtime` is the legacy field. Dual-read accepts both during the staged migration.
+  const runtime = validateRuntime(obj.default_runtime ?? obj.runtime, 'peer-profile default_runtime')
   const interfaces = normalizeInterfaces(obj.interfaces, `${IAPEER_DIR}/${PEER_PROFILE_FILE}`)
   const intelligence = normalizeIntelligence(obj.intelligence, runtime)
   return {

package/src/identity/profileStandard.test.ts

@@ -0,0 +1,116 @@
+// Profile-standard validator + index↔local self-heal (reconcile / reindex).
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { isConformant, reconcileIndex, reindexFromLocals, validateProfileStandard } from './profileStandard.ts'
+import { readPeersIndex } from '../registry/index.ts'
+
+describe('validateProfileStandard', () => {
+  const cwd = '/Users/x/Peers/boris' // basename normalizes to "boris"
+
+  test('a conformant profile (contract field default_runtime) has no issues', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', default_runtime: 'claude', runtimes: ['claude'], description: 'PM', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(issues).toEqual([])
+    expect(isConformant(issues)).toBe(true)
+  })
+
+  test('legacy `runtime` field → WARN (not error), still conformant', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    expect(issues.find(i => i.field === 'default_runtime')?.severity).toBe('warn')
+  })
+
+  test('top-level aliases → WARN (owner migration pending), still conformant', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', aliases: { '/new': 'x' } },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    expect(issues.some(i => i.field === 'aliases' && i.severity === 'warn')).toBe(true)
+  })
+
+  test('personality mirror disagreeing with cwd → WARN (self-heal), not error', () => {
+    const issues = validateProfileStandard(
+      { personality: 'WRONG', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    expect(issues.some(i => i.field === 'personality' && i.severity === 'warn')).toBe(true)
+  })
+
+  test('ERRORS: bad runtime, runtimes missing the default, bad intelligence', () => {
+    // runtime ids carry NO hyphen (/^[a-z][a-z0-9]{0,31}$/) → a hyphenated value is an error
+    expect(isConformant(validateProfileStandard({ default_runtime: 'no-dash', runtimes: ['claude'], intelligence: 'artificial' }, cwd))).toBe(false)
+    const e1 = validateProfileStandard({ default_runtime: 'claude', runtimes: ['codex'], intelligence: 'artificial' }, cwd)
+    expect(isConformant(e1)).toBe(false) // runtimes does not include the default
+    const e2 = validateProfileStandard({ default_runtime: 'claude', runtimes: ['claude'], intelligence: 'bogus' }, cwd)
+    expect(isConformant(e2)).toBe(false)
+    const e3 = validateProfileStandard({ runtimes: ['claude'], intelligence: 'artificial' }, cwd)
+    expect(isConformant(e3)).toBe(false) // no runtime/default_runtime at all
+  })
+
+  test('intelligence accepts the live vocab + legacy on read', () => {
+    for (const v of ['artificial', 'natural', 'absent', 'human', 'scripted']) {
+      const issues = validateProfileStandard({ default_runtime: 'claude', runtimes: ['claude'], intelligence: v }, cwd)
+      expect(issues.some(i => i.field === 'intelligence')).toBe(false)
+    }
+  })
+})
+
+describe('reconcileIndex / reindexFromLocals (self-heal)', () => {
+  let root: string
+  const prevRoot = process.env.IAPEER_ROOT
+  let borisCwd: string
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), 'iapeer-ps-'))
+    process.env.IAPEER_ROOT = root
+    // a local profile (source of truth) with a FRESH description + narrowed runtimes
+    borisCwd = join(root, 'peers', 'boris')
+    mkdirSync(join(borisCwd, '.iapeer'), { recursive: true })
+    writeFileSync(
+      join(borisCwd, '.iapeer', 'peer-profile.json'),
+      JSON.stringify({ personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: 'FRESH local desc', intelligence: 'artificial' }),
+    )
+    // a STALE index: old description + an extra runtime the local no longer declares
+    writeFileSync(
+      join(root, 'peers-profiles.json'),
+      JSON.stringify({
+        version: 2,
+        peers: [{ personality: 'boris', runtime: 'claude', runtimes: ['claude', 'codex'], description: 'STALE index desc', intelligence: 'artificial', cwd: borisCwd }],
+      }),
+    )
+  })
+  afterEach(() => {
+    if (prevRoot === undefined) delete process.env.IAPEER_ROOT
+    else process.env.IAPEER_ROOT = prevRoot
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  test('reconcile DETECTS the drift (description + runtimes) read-only', () => {
+    const r = reconcileIndex({ env: process.env })
+    const boris = r.find(e => e.personality === 'boris')
+    expect(boris?.drift).toContain('description')
+    expect(boris?.drift).toContain('runtimes')
+    // read-only: the index file is untouched
+    expect(readPeersIndex({ env: process.env }).peers[0].description).toBe('STALE index desc')
+  })
+
+  test('reindex SELF-HEALS the index from the local profile (REPLACE, not union)', async () => {
+    const { healed } = await reindexFromLocals({ env: process.env })
+    expect(healed.some(h => h.startsWith('boris:'))).toBe(true)
+    const rec = readPeersIndex({ env: process.env }).peers[0]
+    expect(rec.description).toBe('FRESH local desc')
+    expect(rec.runtimes).toEqual(['claude']) // codex DROPPED (reindex replaces, unlike upsert union)
+    // after the heal, reconcile is clean
+    expect(reconcileIndex({ env: process.env }).find(e => e.personality === 'boris')?.drift).toEqual([])
+  })
+})