@agfpd/iapeer 0.2.36 → 0.2.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/index.ts

@@ -48,6 +48,7 @@ import { resolveCallerIdentity, resolveIdentity } from '../identity/index.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
+  migrateProfileRuntimeField,
   reconcileIndex,
   reindexFromLocals,
   validateProfileStandard,
@@ -554,7 +555,7 @@ const USAGE = `usage: iapeer <verb> [args]
   init [cwd] [--personality p] [--runtime r] [--description d]   onboard the CURRENT folder as a peer (identity + MCP + doctrine)
   create <personality> [--runtime r] [--path dir] [--bin abs]   create a peer anywhere (default ~/.iapeer/peers/<p>) + provision
   list [--json]                                                  registered peers + per-runtime liveness
-  verify [--json] [--fix]                                        profile-standard conformance + index↔local drift (--fix self-heals the index)
+  verify [--json] [--fix]                                        profile-standard conformance + index↔local drift (--fix self-heals the index + migrates legacy runtime→default_runtime in local profiles)
   stop <peer> [runtime] | --all                                  warm peer: kill the live session + set a durable stop-flag — the daemon will NOT wake it
                                                                  until \`start\`; always-on (notifier/telegram): launchctl bootout. --all = every registered peer
   start <peer> [runtime] | --all                                 warm peer: clear the stop-flag — wakeable again; does NOT launch a session (the daemon brings
@@ -886,12 +887,18 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
       }
       case 'verify': {
         // Profile conformance + index↔local self-heal reconciliation. Read-only by
-        // default; --fix self-heals the index (reindex from local profiles). A drift
-        // is a signal that the index self-heal lapsed — caught by construction here.
+        // default; --fix self-heals the index (reindex from local profiles) AND
+        // migrates conformant local profiles off the legacy `runtime` field shape
+        // (Phase 2 of the staged default_runtime story). A drift is a signal that
+        // the index self-heal lapsed — caught by construction here.
         const index = readPeersIndex({ env })
         let errors = 0
         let driftCount = 0
         const lines: string[] = []
+        // Conformant profiles still carrying the LEGACY runtime field shape (no
+        // default_runtime, or a diverged mirror) — candidates for the --fix data
+        // migration (Phase 2 of the staged default_runtime story).
+        const legacyRuntimeProfiles: Array<{ personality: string; cwd: string }> = []
         for (const peer of index.peers) {
           const path = peerProfilePath(peer.cwd)
           if (!existsSync(path)) {
@@ -916,6 +923,12 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           } else if (warns.length > 0 && flags.json !== true) {
             lines.push(`⚠ ${peer.personality}: ${warns.map(i => i.field).join(', ')}`)
           }
+          // Migration candidate: conformant, but the default_runtime warn fired
+          // (legacy-only field or diverged mirror). Errored profiles are NEVER
+          // rewritten — migration heals shape, it does not guess at broken data.
+          if (errs.length === 0 && warns.some(i => i.field === 'default_runtime')) {
+            legacyRuntimeProfiles.push({ personality: peer.personality, cwd: peer.cwd })
+          }
         }
         const reconcile = reconcileIndex({ env })
         for (const r of reconcile) {
@@ -932,10 +945,23 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           for (const l of lines) out(l + '\n')
           out(`\n${index.peers.length} peers · ${errors} error(s) · ${driftCount} index↔local drift(s)\n`)
         }
-        if (flags.fix === true && (driftCount > 0 || errors === 0)) {
-          const { healed, missing } = await reindexFromLocals({ env })
-          if (healed.length > 0) out(`self-healed index from local profiles:\n  ${healed.join('\n  ')}\n`)
-          if (missing.length > 0) errOut(`peers with no local profile (left untouched): ${missing.join(', ')}\n`)
+        if (flags.fix === true) {
+          // Phase-2 data migration (staged default_runtime story): rewrite conformant
+          // local profiles still on the legacy field shape — the writer now emits
+          // `default_runtime` + the in-sync legacy `runtime` mirror. Runs BEFORE the
+          // reindex so the healed index is projected from migrated locals.
+          const migrated: string[] = []
+          for (const p of legacyRuntimeProfiles) {
+            if (migrateProfileRuntimeField(p.cwd)) migrated.push(p.personality)
+          }
+          if (migrated.length > 0) {
+            out(`migrated runtime→default_runtime (legacy mirror kept): ${migrated.join(', ')}\n`)
+          }
+          if (driftCount > 0 || errors === 0) {
+            const { healed, missing } = await reindexFromLocals({ env })
+            if (healed.length > 0) out(`self-healed index from local profiles:\n  ${healed.join('\n  ')}\n`)
+            if (missing.length > 0) errOut(`peers with no local profile (left untouched): ${missing.join(', ')}\n`)
+          }
         }
         return errors > 0 || (driftCount > 0 && flags.fix !== true) ? 1 : 0
       }

package/src/identity/index.ts

@@ -292,6 +292,12 @@ export function writePeerProfileAtomic(cwd: string, profile: PeerProfileWrite):
   const merged: Record<string, unknown> = {
     ...existing,
     personality: profile.personality,
+    // Phase-2 write-flip (contract Идентичность, staged default_runtime migration):
+    // emit the contract field `default_runtime` AND keep the legacy `runtime` as an
+    // IN-SYNC MIRROR — readers that still read `runtime` only (IAP peers.ts,
+    // Spawned-Peer, external scripts) stay alive with zero blast radius. Phase 3
+    // (gated on every reader shipping dual-read) removes the mirror.
+    default_runtime: profile.runtime,
     runtime: profile.runtime,
     runtimes: profile.runtimes,
     description,

package/src/identity/profileStandard.test.ts

@@ -4,7 +4,8 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
-import { isConformant, reconcileIndex, reindexFromLocals, validateProfileStandard } from './profileStandard.ts'
+import { isConformant, migrateProfileRuntimeField, reconcileIndex, reindexFromLocals, validateProfileStandard } from './profileStandard.ts'
+import { readFileSync } from 'fs'
 import { readPeersIndex } from '../registry/index.ts'
 
 describe('validateProfileStandard', () => {
@@ -28,6 +29,47 @@ describe('validateProfileStandard', () => {
     expect(issues.find(i => i.field === 'default_runtime')?.severity).toBe('warn')
   })
 
+  test('default_runtime + in-sync legacy mirror (Phase-2 write shape) → NO issues', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', default_runtime: 'claude', runtime: 'claude', runtimes: ['claude'], description: 'PM', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(issues).toEqual([])
+  })
+
+  test('DIVERGED legacy mirror → WARN on default_runtime, still conformant', () => {
+    const issues = validateProfileStandard(
+      { personality: 'boris', default_runtime: 'codex', runtime: 'claude', runtimes: ['codex', 'claude'], description: '', intelligence: 'artificial' },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    const warn = issues.find(i => i.field === 'default_runtime')
+    expect(warn?.severity).toBe('warn')
+    expect(warn?.message).toContain('diverged')
+  })
+
+  test('aliases misfiled in interfaces.telegram → WARN (owner migration to expansion.aliases pending)', () => {
+    const issues = validateProfileStandard(
+      {
+        personality: 'boris', default_runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial',
+        interfaces: { telegram: { bot: 'k', bot_username: 'x_bot', aliases: { '/alias-new': 'txt' } } },
+      },
+      cwd,
+    )
+    expect(isConformant(issues)).toBe(true)
+    expect(issues.some(i => i.field === 'interfaces.telegram.aliases' && i.severity === 'warn')).toBe(true)
+    // passport-only telegram section → silent
+    const clean = validateProfileStandard(
+      {
+        personality: 'boris', default_runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial',
+        interfaces: { telegram: { bot: 'k', bot_username: 'x_bot' } },
+        expansion: { aliases: { '/alias-new': 'txt' } },
+      },
+      cwd,
+    )
+    expect(clean).toEqual([])
+  })
+
   test('top-level aliases → WARN (owner migration pending), still conformant', () => {
     const issues = validateProfileStandard(
       { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', aliases: { '/new': 'x' } },
@@ -113,4 +155,50 @@ describe('reconcileIndex / reindexFromLocals (self-heal)', () => {
     // after the heal, reconcile is clean
     expect(reconcileIndex({ env: process.env }).find(e => e.personality === 'boris')?.drift).toEqual([])
   })
+
+  test('reindex writes the Phase-2 disk shape: default_runtime + in-sync legacy mirror', async () => {
+    await reindexFromLocals({ env: process.env })
+    const disk = JSON.parse(readFileSync(join(root, 'peers-profiles.json'), 'utf8'))
+    expect(disk.peers[0].default_runtime).toBe('claude')
+    expect(disk.peers[0].runtime).toBe('claude') // legacy mirror until Phase 3
+  })
+
+  test('migrateProfileRuntimeField: legacy-only profile → rewritten with default_runtime + mirror, owner fields preserved, idempotent', () => {
+    const profilePath = join(borisCwd, '.iapeer', 'peer-profile.json')
+    // enrich the legacy profile with owner-section + lifecycle fields that MUST survive
+    writeFileSync(
+      profilePath,
+      JSON.stringify({
+        personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: 'd', intelligence: 'human',
+        initial_prompt: 'boot', wake_policy: 'ephemeral',
+        interfaces: { telegram: { bot: 'k' } },
+        expansion: { aliases: { '/alias-new': 'txt' } },
+        notifier: { triggers: [] },
+      }),
+    )
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(true)
+    const after = JSON.parse(readFileSync(profilePath, 'utf8'))
+    expect(after.default_runtime).toBe('claude')
+    expect(after.runtime).toBe('claude') // in-sync legacy mirror
+    expect(after.intelligence).toBe('human') // legacy vocab preserved VERBATIM (no silent migration)
+    expect(after.initial_prompt).toBe('boot')
+    expect(after.wake_policy).toBe('ephemeral')
+    expect(after.interfaces).toEqual({ telegram: { bot: 'k' } })
+    expect(after.expansion).toEqual({ aliases: { '/alias-new': 'txt' } })
+    expect(after.notifier).toEqual({ triggers: [] })
+    // idempotent: already in shape → untouched
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(false)
+  })
+
+  test('migrateProfileRuntimeField: DIVERGED mirror heals to default_runtime (the contract side wins)', () => {
+    const profilePath = join(borisCwd, '.iapeer', 'peer-profile.json')
+    writeFileSync(
+      profilePath,
+      JSON.stringify({ personality: 'boris', default_runtime: 'codex', runtime: 'claude', runtimes: ['codex', 'claude'], description: '', intelligence: 'artificial' }),
+    )
+    expect(migrateProfileRuntimeField(borisCwd)).toBe(true)
+    const after = JSON.parse(readFileSync(profilePath, 'utf8'))
+    expect(after.default_runtime).toBe('codex')
+    expect(after.runtime).toBe('codex') // mirror re-synced to the governing field
+  })
 })

package/src/identity/profileStandard.ts

@@ -8,16 +8,20 @@
 //     ORDER = preference, first = primary), description, intelligence ∈
 //     {artificial|natural|absent}. Optional lifecycle: initial_prompt, wake_policy.
 //   • OWNER sections (validated only as well-typed, NEVER restructured here): interfaces
-//     (telegram/capability passport), aliases (legacy persistent-peer → contract
-//     relocates to interfaces.telegram.aliases, telegram-runtime owns the migration),
-//     notifier (notifier-runtime), <plugin> sections — each plugin writes only its own
-//     field via atomic merge.
+//     (telegram/capability passport — PASSPORT ONLY: aliases are misfiled there and the
+//     contract relocates them to `expansion.aliases`, the runtime-agnostic plugin-config
+//     section owned by the chat-runtime — telegram-runtime today, future discord/matrix
+//     read the SAME section per the 25.05 expansion design), notifier (notifier-runtime),
+//     expansion (chat-runtime aliases), <plugin> sections — each plugin writes only its
+//     own field via atomic merge. Plugin-config sections are NOT projected into the
+//     registry index (private config is read from the LOCAL profile by its owner).
 //
 // peers-profiles.json is a regenerable self-heal PROJECTION of the local profiles —
 // projectProfileToRecord builds the record the index SHOULD hold; verify compares the
 // live index against it, reindex rewrites it. The index is never the source of truth.
 
 import { basename } from 'path'
+import { existsSync, readFileSync } from 'fs'
 import { isRuntime, normalizeIntelligenceValue, normalizeNameCandidate } from '../core/constants.ts'
 import {
   clampDescription,
@@ -26,7 +30,8 @@ import {
   type PeerRecord,
   type PeersUpdateOptions,
 } from '../registry/index.ts'
-import { readPeerProfile } from './index.ts'
+import { peerProfilePath } from '../storage/index.ts'
+import { readPeerProfile, writePeerProfileAtomic } from './index.ts'
 
 export type IssueSeverity = 'error' | 'warn'
 export interface ProfileIssue {
@@ -60,12 +65,21 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
     })
   }
 
-  // default_runtime (contract) / runtime (legacy, staged migration).
+  // default_runtime (contract) / runtime (legacy, staged migration). Since the Phase-2
+  // write-flip the writer emits BOTH (legacy `runtime` as an in-sync mirror); a profile
+  // carrying only the legacy name, or a DIVERGED mirror (a legacy writer updated
+  // `runtime` behind the contract field — dual-read ignores it), is a migration WARN.
   const dr = obj.default_runtime ?? obj.runtime
   if (!isRuntime(dr)) {
     issues.push({ severity: 'error', field: 'default_runtime', message: `must be a valid runtime id, got "${String(dr ?? '')}"` })
   } else if (obj.default_runtime === undefined) {
     issues.push({ severity: 'warn', field: 'default_runtime', message: 'legacy field name `runtime` — standard is `default_runtime` (staged migration)' })
+  } else if (obj.runtime !== undefined && obj.runtime !== obj.default_runtime) {
+    issues.push({
+      severity: 'warn',
+      field: 'default_runtime',
+      message: `legacy mirror \`runtime\`="${String(obj.runtime)}" diverged from default_runtime="${String(obj.default_runtime)}" — default_runtime governs; re-run \`iapeer verify --fix\` to re-sync the mirror`,
+    })
   }
 
   // runtimes[] — array of valid runtime ids that includes the default_runtime.
@@ -106,14 +120,35 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
   if (obj.interfaces !== undefined && (typeof obj.interfaces !== 'object' || obj.interfaces === null || Array.isArray(obj.interfaces))) {
     issues.push({ severity: 'error', field: 'interfaces', message: 'must be a JSON object' })
   }
-  // Legacy top-level aliases — contract relocates to interfaces.telegram.aliases with
-  // the /alias-* namespace (clean slash-keys are reserved for the control layer).
-  // telegram-runtime owns that migration; flagged, not an error.
+  // Legacy top-level aliases — contract relocates to the `expansion.aliases` plugin-
+  // config section with the /alias-* namespace (clean slash-keys are reserved for the
+  // control layer). telegram-runtime owns that migration; flagged, not an error.
   if (obj.aliases !== undefined) {
     issues.push({
       severity: 'warn',
       field: 'aliases',
-      message: 'legacy top-level `aliases` — contract relocates to interfaces.telegram.aliases (/alias-* namespace); telegram-runtime migration pending',
+      message: 'legacy top-level `aliases` — contract relocates to expansion.aliases (/alias-* namespace); owner migration pending',
+    })
+  }
+  // aliases misfiled in the PASSPORT (interfaces.telegram) — the 07.06 interim home.
+  // Taxonomy revision (11.06, Артур): aliases are PRIVATE plugin config (one reader,
+  // the chat-runtime at expansion), not a public passport attribute — the contract
+  // relocates them to the runtime-agnostic `expansion.aliases` section (25.05 замысел:
+  // future discord/matrix runtimes read the SAME aliases). Transition observability:
+  // this warn goes silent once the owner migration moves the data.
+  const interfacesObj =
+    obj.interfaces && typeof obj.interfaces === 'object' && !Array.isArray(obj.interfaces)
+      ? (obj.interfaces as Record<string, unknown>)
+      : undefined
+  const telegramSection =
+    interfacesObj?.telegram && typeof interfacesObj.telegram === 'object' && !Array.isArray(interfacesObj.telegram)
+      ? (interfacesObj.telegram as Record<string, unknown>)
+      : undefined
+  if (telegramSection?.aliases !== undefined) {
+    issues.push({
+      severity: 'warn',
+      field: 'interfaces.telegram.aliases',
+      message: 'aliases are plugin config, not passport — contract relocates to expansion.aliases; owner migration pending',
     })
   }
 
@@ -125,6 +160,38 @@ export function isConformant(issues: readonly ProfileIssue[]): boolean {
   return !issues.some(i => i.severity === 'error')
 }
 
+/**
+ * Phase-2 DATA migration of the staged default_runtime story: rewrite the LOCAL
+ * profile at `cwd` so it carries the contract field `default_runtime` with the legacy
+ * `runtime` kept as an in-sync mirror (writePeerProfileAtomic emits both since the
+ * write-flip). Heals BOTH legacy shapes: a profile with only `runtime`, and a DIVERGED
+ * mirror — the rewrite goes through readPeerProfile's dual-read, so default_runtime
+ * wins divergence (the contract: default_runtime governs the primary). Owner sections
+ * (interfaces / notifier / expansion / …), initial_prompt, wake_policy and the raw
+ * legacy intelligence vocab are preserved verbatim by the H1 merge-write. Returns true
+ * when the file was rewritten; false when already in shape, absent, or unparseable
+ * (verify reports those as errors — migration never guesses).
+ */
+export function migrateProfileRuntimeField(cwd: string): boolean {
+  const path = peerProfilePath(cwd)
+  if (!existsSync(path)) return false
+  let raw: unknown
+  try {
+    raw = JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    return false
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return false
+  const obj = raw as Record<string, unknown>
+  const inShape =
+    isRuntime(obj.default_runtime) && (obj.runtime === undefined || obj.runtime === obj.default_runtime)
+  if (inShape) return false
+  const profile = readPeerProfile(cwd)
+  if (!profile) return false
+  writePeerProfileAtomic(cwd, profile)
+  return true
+}
+
 /**
  * The PeerRecord the index SHOULD hold for the peer at `cwd`, projected from its LOCAL
  * profile (the self-heal source of truth) — readPeerProfile already self-heals the

package/src/lifecycle/lifecycle.test.ts

@@ -290,7 +290,11 @@ describe('wakeOrSpawn H4 refusal', () => {
 // ─────────────────────────────────────────────────────────────────────────────
 
 describe('wakeOrSpawn live-session fast path', () => {
-  test('READY with taskDelivered:false — the winning wake delivered only ITS envelope', async () => {
+  // Live tmux required (spawns a real session). Skipped where tmux is absent — a
+  // clean CI runner has none; the foundation's preversion gate runs it locally
+  // (this machine has tmux), so the release path keeps the coverage.
+  const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+  test.if(tmuxAvailable)('READY with taskDelivered:false — the winning wake delivered only ITS envelope', async () => {
     const root = mkdtempSync(join(tmpdir(), 'iapeer-fpl-root-'))
     const laDir = mkdtempSync(join(tmpdir(), 'iapeer-fpl-la-')) // empty → not launchd-managed
     const sockDir = join(root, 'socks')

package/src/registry/index.ts

@@ -159,7 +159,8 @@ function normalizePeer(raw: unknown): PeerRecord {
     )
   }
   // default_runtime is the contract field; `runtime` is legacy. Dual-read accepts
-  // both during the staged migration (write still emits `runtime` until Phase 2).
+  // both during the staged migration; when both are present default_runtime WINS
+  // (the write emits default_runtime + the legacy mirror since Phase 2).
   const defaultRuntime = obj.default_runtime ?? obj.runtime
   if (!isRuntime(defaultRuntime)) {
     throw new IapError(
@@ -314,9 +315,21 @@ function writePeersIndexAtomic(paths: PeersPaths, index: PeersIndex): void {
   // Persist the RAW intelligence verbatim (legacy-safe round-trip) and DROP the
   // intelligenceRaw shadow field from the on-disk shape — the file carries the
   // legacy vocab the live IAP reads, never the foundation's in-memory normalization.
+  // Phase-2 write-flip (staged default_runtime migration): the disk shape carries the
+  // contract field `default_runtime` PLUS the legacy `runtime` as an in-sync mirror,
+  // so not-yet-dual-read readers keep working. Phase 3 removes the mirror.
   const peersForDisk = [...index.peers]
     .sort((a, b) => a.personality.localeCompare(b.personality))
-    .map(({ intelligenceRaw, ...peer }) => ({ ...peer, intelligence: intelligenceRaw ?? peer.intelligence }))
+    .map(peer => ({
+      personality: peer.personality,
+      default_runtime: peer.runtime,
+      runtime: peer.runtime,
+      runtimes: peer.runtimes,
+      description: peer.description,
+      intelligence: peer.intelligenceRaw ?? peer.intelligence,
+      cwd: peer.cwd,
+      ...(peer.interfaces ? { interfaces: peer.interfaces } : {}),
+    }))
   const normalized = { version: PEERS_SCHEMA_VERSION, peers: peersForDisk }
   writeFileSync(tmp, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 })
   renameSync(tmp, paths.peersFile)

package/src/status/index.ts

@@ -6,12 +6,13 @@
 // error (fail-open). The core never acts on heartbeat staleness — it only REPORTS
 // it (healing the provider's daemon is the provider's job, their ADR-010).
 
-import { readFileSync, statSync } from 'fs'
+import { closeSync, openSync, readFileSync, statSync } from 'fs'
 import { join } from 'path'
 import { IAPEER_VERSION } from '../core/version.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { daemonDiscoveryPath } from '../daemon/index.ts'
 import { waitForDaemonHealthy } from '../update/index.ts'
+import { iapeerBinPath } from '../install/index.ts'
 
 /** The slot-declaration filename in the storage root (next to peers-profiles.json). */
 export const MEMORY_PROVIDER_FILE = 'memory-provider.json'
@@ -135,16 +136,48 @@ export function heartbeatAgeSecs(provider: MemoryProvider, nowMs: number = Date.
   }
 }
 
+/**
+ * Probe whether the iapeer binary holds Full Disk Access (macOS TCC). Reads the
+ * user TCC.db — a canonical FDA-gated resource that is NEVER promptable (silent
+ * EPERM without the grant), so THE PROBE ITSELF raises no dialog (it must not be
+ * the very noise it detects). Byte-free: open+close to prove access, no content
+ * read. Returns:
+ *   true  — readable → FDA granted
+ *   false — EPERM/EACCES → FDA NOT granted (peers will hit TCC prompts on
+ *           protected folders + foreign app containers — see onboard contract)
+ *   null  — not macOS / no HOME / TCC.db absent → cannot determine (no claim)
+ */
+export function probeFullDiskAccess(env: NodeJS.ProcessEnv = process.env): boolean | null {
+  if (process.platform !== 'darwin') return null
+  const home = env.HOME
+  if (!home) return null
+  const marker = join(home, 'Library', 'Application Support', 'com.apple.TCC', 'TCC.db')
+  try {
+    closeSync(openSync(marker, 'r'))
+    return true
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code
+    if (code === 'EPERM' || code === 'EACCES') return false
+    return null // ENOENT / unexpected → undeterminable, never a false claim
+  }
+}
+
 export interface HostStatus {
   version: string
   daemon: { healthy: boolean; url: string | null; sock: string | null }
   memory: { provider: MemoryProvider | null; heartbeatAgeSecs: number | null }
+  /** Full Disk Access of the iapeer binary: true granted / false not-granted /
+   *  null undeterminable (non-macOS or TCC.db unreadable for a non-TCC reason). */
+  fda: boolean | null
 }
 
 export interface HostStatusOptions {
   env?: NodeJS.ProcessEnv
   /** Injectable daemon probe (tests). Default: the real socket probe. */
   probe?: () => Promise<boolean>
+  /** Injectable FDA probe (tests — the default reads the real TCC.db, which a
+   *  hermetic test must not touch). Default: probeFullDiskAccess(env). */
+  fdaProbe?: () => boolean | null
 }
 
 /** Assemble the host snapshot: baked version + daemon probe + memory slot. */
@@ -161,10 +194,12 @@ export async function hostStatus(opts: HostStatusOptions = {}): Promise<HostStat
   }
   const health = await waitForDaemonHealthy({ env, timeoutMs: 2500, needConsecutive: 1, probe: opts.probe })
   const provider = readMemoryProvider(env)
+  const fda = (opts.fdaProbe ?? (() => probeFullDiskAccess(env)))()
   return {
     version: IAPEER_VERSION,
     daemon: { healthy: health.healthy, url, sock },
     memory: { provider, heartbeatAgeSecs: provider ? heartbeatAgeSecs(provider) : null },
+    fda,
   }
 }
 
@@ -184,5 +219,19 @@ export function formatHostStatus(s: HostStatus): string {
       : ' (daemon not running — no heartbeat file)'
   }
   const memory = s.memory.provider ? `${s.memory.provider.provider} ${s.memory.provider.version}${hb}` : 'none'
-  return `iapeer ${s.version}\ndaemon: ${daemon}\nmemory: ${memory}\n`
+  // FDA line: granted → terse OK; NOT granted → the actionable hint (a fresh host
+  // without FDA silently meets TCC prompts on every new protected class — peers
+  // read protected folders + foreign app containers, attributed to this binary;
+  // see onboard contract §INSTALL). undeterminable → say so, never a false claim.
+  let fda: string
+  if (s.fda === true) {
+    fda = 'fda: granted'
+  } else if (s.fda === false) {
+    fda =
+      `fda: NOT granted — peers will hit TCC prompts on protected paths.\n` +
+      `  grant: System Settings → Privacy & Security → Full Disk Access → + → ⇧⌘G → ${iapeerBinPath()}`
+  } else {
+    fda = 'fda: unknown (not macOS / undeterminable)'
+  }
+  return `iapeer ${s.version}\ndaemon: ${daemon}\nmemory: ${memory}\n${fda}\n`
 }

package/src/status/status.test.ts

@@ -128,7 +128,7 @@ describe('heartbeatAgeSecs', () => {
 describe('hostStatus + formatHostStatus', () => {
   test('empty slot → memory: none; daemon health from the injected probe', async () => {
     const root = mkTmp()
-    const s = await hostStatus({ env: envFor(root), probe: async () => true })
+    const s = await hostStatus({ env: envFor(root), probe: async () => true, fdaProbe: () => null })
     expect(s.daemon.healthy).toBe(true)
     expect(s.memory.provider).toBeNull()
     expect(formatHostStatus(s)).toContain('memory: none')
@@ -140,7 +140,7 @@ describe('hostStatus + formatHostStatus', () => {
     const hb = join(root, 'memoryd.heartbeat')
     writeFileSync(hb, '')
     writeFileSync(memoryProviderPath(env), JSON.stringify({ ...VALID, heartbeat: hb }))
-    const s = await hostStatus({ env, probe: async () => true })
+    const s = await hostStatus({ env, probe: async () => true, fdaProbe: () => null })
     expect(formatHostStatus(s)).toMatch(/memory: iapeer-memory 0\.1\.0 \(heartbeat \d+s ago\)/)
   })
 
@@ -152,6 +152,7 @@ describe('hostStatus + formatHostStatus', () => {
         provider: { ...VALID, heartbeat: '/nope/hb' } as MemoryProvider,
         heartbeatAgeSecs: null,
       },
+      fda: null,
     }
     const text = formatHostStatus(s)
     expect(text).toContain('memory: iapeer-memory 0.1.0 (daemon not running — no heartbeat file)')
@@ -164,9 +165,48 @@ describe('hostStatus + formatHostStatus', () => {
     const stateDir = join(root, 'state', 'iapeer')
     mkdirSync(stateDir, { recursive: true })
     writeFileSync(join(stateDir, 'router.json'), JSON.stringify({ sock: '/x/router.sock', tcp: 'http://127.0.0.1:8765/mcp' }))
-    const s = await hostStatus({ env, probe: async () => true })
+    const s = await hostStatus({ env, probe: async () => true, fdaProbe: () => null })
     const text = formatHostStatus(s)
     expect(text).toContain('@ http://127.0.0.1:8765/mcp')
     expect(text).toContain('+ /x/router.sock')
   })
 })
+
+describe('FDA detection (iapeer status — fresh-host observability)', () => {
+  function base(fda: boolean | null): HostStatus {
+    return {
+      version: '0.0.0',
+      daemon: { healthy: true, url: null, sock: null },
+      memory: { provider: null, heartbeatAgeSecs: null },
+      fda,
+    }
+  }
+
+  test('granted → terse OK line, no instruction', () => {
+    const text = formatHostStatus(base(true))
+    expect(text).toContain('fda: granted')
+    expect(text).not.toContain('NOT granted')
+    expect(text).not.toContain('Full Disk Access')
+  })
+
+  test('NOT granted → actionable hint with the binary path', () => {
+    const text = formatHostStatus(base(false))
+    expect(text).toContain('fda: NOT granted')
+    expect(text).toContain('Full Disk Access')
+    expect(text).toMatch(/iapeer$|iapeer\n/m) // the grant path ends at the binary
+  })
+
+  test('undeterminable → explicit unknown, never a false claim', () => {
+    const text = formatHostStatus(base(null))
+    expect(text).toContain('fda: unknown')
+    expect(text).not.toContain('NOT granted')
+    expect(text).not.toContain('granted\n') // not the bare "granted" either
+  })
+
+  test('hostStatus threads the injected fdaProbe verbatim', async () => {
+    const root = mkTmp()
+    const s = await hostStatus({ env: envFor(root), probe: async () => true, fdaProbe: () => false })
+    expect(s.fda).toBe(false)
+    expect(formatHostStatus(s)).toContain('fda: NOT granted')
+  })
+})

package/src/transport/routesend-wake.test.ts

@@ -25,6 +25,13 @@ let root: string
 let sockDir: string
 const prevRoot = process.env.IAPEER_ROOT
 
+// These suites spawn a REAL tmux session (the live-delivery path). Skip where
+// tmux is absent — a clean CI runner has none, and an unguarded live-tmux test
+// is what kept main's CI red (fail: "tmux new-session failed: null"). The
+// foundation's preversion gate runs the full suite locally (this machine has
+// tmux), so the release path keeps the live coverage; CI gates the rest.
+const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+
 // Target peer: NON-TUI runtime (telegram) → the C-j delivery path lands into a
 // plain `cat` pane with no TUI prompt machinery; capture-pane then shows the
 // envelope text verbatim.
@@ -91,7 +98,7 @@ afterAll(() => {
   rmSync(root, { recursive: true, force: true })
 })
 
-describe('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
+describe.if(tmuxAvailable)('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
   test('taskDelivered:false → routeSend delivers the envelope itself via the live path', async () => {
     const marker = 'SECOND-SENDER-ENVELOPE-7741'
     // The loser-of-the-lock outcome: the session is up (the WINNING wake booted it),
@@ -145,7 +152,7 @@ describe('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
 // one it woke with (defect 11.06: stale wake-time marker → false fresh).
 // ─────────────────────────────────────────────────────────────────────────────
 
-describe('routeSend noteLiveTopic seam (live-delivered topic)', () => {
+describe.if(tmuxAvailable)('routeSend noteLiveTopic seam (live-delivered topic)', () => {
   test('live hit with a topic → hook fired ONCE with the TARGET identity + topic', async () => {
     startTargetSession()
     const notes: Array<[string, string]> = []