@agfpd/iapeer 0.2.76 → 0.2.78

package/src/shadow/gate.ts

@@ -1,9 +1,9 @@
 // Gate-grade instrumentation for the tmux→pty fidelity burn-in (cutover Block 1).
 //
 // PURE classifiers + one stateful tracker, with NO tmux and NO @xterm import — the observer
-// loop feeds it booleans, so all classification is hermetically unit-testable. That is exactly
-// the synthetic acceptance boris requires: PROVE the instrument classifies known-behind vs
-// known-ahead and records coverage correctly BEFORE we trust any pty verdict for a flip.
+// loop feeds it booleans, so all classification is hermetically unit-testable. The synthetic
+// acceptance: PROVE the instrument classifies known-behind vs known-ahead and records coverage
+// correctly BEFORE we trust any pty verdict for a flip.
 //
 // It operationalizes the adjudicated gate criterion (NOT a flat sample count):
 //   • DIRECTION — pty-BEHIND (pty=False,tmux=True: a stale frame while live tmux moved on) is
@@ -37,7 +37,7 @@ export type SampleState = 'idle' | 'model-advancing' | 'composer-busy'
  * Per-sample fleet state for the coverage matrix. composer-busy when tmux (authoritative) sees
  * human occupancy; else model-advancing when output churned this tick (the model is actively
  * rendering — the NON-trivial fidelity regime, not at rest); else idle. The split is what keeps
- * an idle burn-in from reading as a false green (boris's acceptance lesson).
+ * an idle burn-in from reading as a false green.
  */
 export function classifySampleState(occTmux: boolean, bytesFedThisTick: number): SampleState {
   if (occTmux) return 'composer-busy'
@@ -332,7 +332,7 @@ export class GateTracker {
   }
 }
 
-/** Ready-gate FLIP eligibility — boris's verdict-scoped gate, operationalized so the burn-in
+/** Ready-gate FLIP eligibility — the verdict-scoped gate, operationalized so the burn-in
  *  SELF-REPORTS instead of being eyeballed. NECESSARY input, NOT an auto-trigger: the flip stays
  *  an explicit human decision (the representativeness of the filled cells — e.g. the splash truly
  *  scrolled off-screen — is verified separately on top of this). Eligible iff:
@@ -342,7 +342,7 @@ export class GateTracker {
  *    • a restart was observed.
  *  composer-busy is ORTHOGONAL to readiness (a typing human already passed readiness) → excluded;
  *  it gates the LATER occupancy flip. On !eligible `reasons` say WHICH cell is empty/dirty —
- *  actionable, never a black-box "not yet". PURE → its own logic is unit-testable (boris's guardrail). */
+ *  actionable, never a black-box "not yet". PURE → its own logic is unit-testable. */
 export function evaluateReadyGateFlipEligibility(s: GateSummary): FlipEligibility {
   const reasons: string[] = []
   const rg = s.verdicts.readyGate

package/src/shadow/index.ts

@@ -1,4 +1,4 @@
-// Read-only fidelity OBSERVER for the tmux→pty migration (prod burn-in track «b»).
+// Read-only fidelity OBSERVER for the tmux→pty migration (prod burn-in track).
 //
 // For each warm claude/codex peer it builds an @xterm/headless model from the daemon's
 // EXISTING pipe-pane log (`<identity>.log` under cfg.logDir) — the same raw child bytes
@@ -154,7 +154,7 @@ export async function runShadowFidelity(opts: ShadowOptions): Promise<void> {
     writeFileSync(statsFile, JSON.stringify({
       startedISO, lastISO: new Date().toISOString(), elapsedMin: +((Date.now() - t0) / 60000).toFixed(1),
       peers: models.size, samples: totalSamples,
-      // Gate (boris's criterion): clean iff zero hard divergences across all verdicts. Hard =
+      // Gate criterion: clean iff zero hard divergences across all verdicts. Hard =
       // every pty-behind + non-benign pty-ahead (steady-state or non-converging). Benign =
       // boot-window ahead that self-heals within budget. Coverage proves the matrix was traversed.
       gateClean: VERDICTS.every(v => gs.verdicts[v].gateClean),

package/src/status/index.ts

@@ -4,7 +4,7 @@
 // by the PROVIDER's own init/uninstall — the core only ever READS it. An absent or
 // unreadable file is the EMPTY slot — a fully valid state (bare core), never an
 // error (fail-open). The core never acts on heartbeat staleness — it only REPORTS
-// it (healing the provider's daemon is the provider's job, their ADR-010).
+// it (healing the provider's daemon is the provider's job).
 
 import { closeSync, openSync, readFileSync, statSync } from 'fs'
 import { join } from 'path'
@@ -18,18 +18,18 @@ import { iapeerBinPath } from '../install/index.ts'
 export const MEMORY_PROVIDER_FILE = 'memory-provider.json'
 
 // NB: the v1.1 `plugin` block (MemoryProviderPlugin + its parser) was REMOVED
-// 11.06 (provider's ADR-017 retired the plugin form ecosystem-wide; contract
-// §Плагин провайдера is a tombstone). An unknown `plugin` key in a legacy
+// (the plugin form was retired ecosystem-wide; contract §Плагин провайдера is a
+// tombstone). An unknown `plugin` key in a legacy
 // declaration is simply ignored — the same fail-open as any unknown block.
 
 /** The provider's provision command (declaration v1.2, контракт §Provision
- *  провайдера — ADR-009 inversion, решение Артура 10.06 + дизайн-консенсус
- *  сторон). The slot declares not surfaces but a COMMAND the core shells into at
- *  the lifecycle joints (birth / verb sweeps / remove); surface forms and their
- *  uninstall accounting live entirely with the provider. The `command` must be
- *  ABSOLUTE (the daemon runs under launchd's minimal PATH); `args` get PER-ARG
- *  placeholder substitution ({cwd}/{runtime}/{personality}/{occasion}) and are
- *  spawned WITHOUT a shell (injection/quoting class — бэктик-грабли 10.06). */
+ *  провайдера — inversion of the surface-list model). The slot declares not
+ *  surfaces but a COMMAND the core shells into at the lifecycle joints (birth /
+ *  verb sweeps / remove); surface forms and their uninstall accounting live
+ *  entirely with the provider. The `command` must be ABSOLUTE (the daemon runs
+ *  under launchd's minimal PATH); `args` get PER-ARG placeholder substitution
+ *  ({cwd}/{runtime}/{personality}/{occasion}) and are spawned WITHOUT a shell
+ *  (injection/quoting class). */
 export interface MemoryProviderProvision {
   /** Absolute path to the provider's executable. */
   command: string
@@ -179,7 +179,7 @@ export function formatHostStatus(s: HostStatus): string {
   const daemon = s.daemon.healthy
     ? `healthy${s.daemon.url ? ` @ ${s.daemon.url}` : ''}${s.daemon.sock ? ` + ${s.daemon.sock}` : ''}`
     : 'NOT healthy (socket not accepting connections)'
-  // Heartbeat interpretation (slot contract, provider semantics agreed 10.06):
+  // Heartbeat interpretation (slot contract, provider semantics):
   // file REMOVED on graceful shutdown → declared-but-absent = daemon not running;
   // present = age shown. The core only REPORTS — staleness healing is the
   // provider's own job (its verify/repair), never the core's.

package/src/storage/index.ts

@@ -4,7 +4,7 @@
 // peers.ts (resolveGlobalRoot/resolvePeersPaths/ensureGlobalIapScaffold) +
 // identity.ts (ensureLocalIapScaffold/ensureLocalRuntimeScopes/peerProfilePath).
 //
-// Structural invariant (#3, boris adversarial-review): peers-profiles.json is
+// Structural invariant (#3): peers-profiles.json is
 // the registry's exclusive, locked write target. `writeFileAtomic` REFUSES that
 // basename so no module can write the registry file out from under the lock by
 // reaching for the generic atomic-write primitive. The registry keeps its own

package/src/supervisor/daemon.ts

@@ -27,11 +27,17 @@ import { modelToPlainText } from '../shadow/render.ts'
 import { codexAdapter } from '../launch/adapters/codex.ts'
 import { claudeAdapter } from '../launch/adapters/claude.ts'
 
-/** Known runtime launchers; `tick` is a deterministic test stream (no TUI noise) for hermetic
- *  spawn/attach/reattach tests — it never needs a real claude/codex on the box. */
-const KNOWN: Record<string, string> = {
-  claude: '/Users/macmini/.local/bin/claude',
-  codex: '/opt/homebrew/bin/codex',
+/** Resolve a runtime launcher from the host AT CALL TIME — env override (IAPEER_<RT>_BIN, the same
+ *  knob the rest of the foundation uses) → PATH lookup — never a baked machine-specific path. Returns
+ *  undefined for an unknown runtime, incl. the hermetic `tick` test stream (which uses TICK_CMD, so the
+ *  spawn/attach/reattach tests never need a real claude/codex on the box). */
+function knownLauncher(runtime: string): string | undefined {
+  const override =
+    runtime === 'claude' ? process.env.IAPEER_CLAUDE_BIN
+    : runtime === 'codex' ? process.env.IAPEER_CODEX_BIN
+    : undefined
+  if (override?.trim()) return override.trim()
+  return Bun.which(runtime) ?? undefined
 }
 const TICK_CMD = ['sh', '-c', 'i=0; while true; do printf "STREAMTICK_%d\\r\\n" "$i"; i=$((i+1)); sleep 0.3; done']
 
@@ -84,7 +90,7 @@ export interface SupervisorDaemonOptions {
   runDir: string
   /** Child working directory (default: runDir — a throwaway scratch for dark validation). */
   cwd?: string
-  /** Override the runtime launcher (else KNOWN[runtime] if it exists, else the bare name). */
+  /** Override the runtime launcher (else resolved from env override / PATH, else the bare name). */
   bin?: string
   /** SERVING SEAM (slice b): the composed runtime argv (buildLaunchInvocation). When set, the daemon
    *  serves THIS verbatim instead of the bare [bin] — the supervisor is a HOST, not a composer
@@ -127,7 +133,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   const ser = new SerializeAddon()
   xterm.loadAddon(ser)
 
-  const bin = opts.bin ?? (KNOWN[runtime] && existsSync(KNOWN[runtime]!) ? KNOWN[runtime]! : runtime)
+  const bin = opts.bin ?? knownLauncher(runtime) ?? runtime
   // SERVING SEAM (slice b): opts.argv (launch-composed, carries the system-prompt swap + PEER_START_ARGS)
   // is served verbatim; else the bare conduit ([bin], or the deterministic tick stream for tests).
   const CMD = opts.argv ?? (runtime === 'tick' ? TICK_CMD : [bin])
@@ -170,7 +176,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       /* */
     }
   }
-  // CRASH-ROBUSTNESS (boris): a crashed predecessor daemon skips shutdown-cleanup, so a STALE
+  // CRASH-ROBUSTNESS: a crashed predecessor daemon skips shutdown-cleanup, so a STALE
   // `.attached` could survive into this fresh daemon — and a stale-present marker would make the
   // warm-deliver gate believe a human is attached when none is, holding deliveries forever (the
   // anti-bug inverted). A fresh daemon has ZERO clients, so clear the marker on START (idempotent).

package/src/transport/index.ts

@@ -8,7 +8,7 @@
 // ViaTmux byte layout) is ported BYTE-FOR-BYTE — it is the validated 0.7.6
 // deterministic submit and must not be refactored (anti-regression of the
 // Enter-swallow flap; blueprint §5 "submit-надёжность"). The ONLY contract-
-// sanctioned change (07.06 refactor, docs/Рантайм-адаптеры): the prompt glyphs /
+// sanctioned change (docs/Рантайм-адаптеры): the prompt glyphs /
 // paste patterns are no longer a hardcoded union here — they come from the target
 // runtime's adapter.deliveryMarkers. The poll/re-press logic is untouched; only the
 // marker SOURCE moved, so the timing behaviour is identical.
@@ -38,7 +38,7 @@ import {
 import { buildEnvelope } from '../codec/index.ts'
 import { findPeer, readPeersIndex, type PeerRecord } from '../registry/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
-// Delivery markers are OWNED by the runtime adapter (07.06 refactor). transport
+// Delivery markers are OWNED by the runtime adapter. transport
 // reads them from getAdapter(target.runtime) for the tui submit path. One-way
 // dependency: launch does NOT import transport, so no cycle.
 import { getAdapter } from '../launch/index.ts'
@@ -480,7 +480,7 @@ export function deliverViaTmux(target: DeliveryTarget, envelope: string, cwd?: s
     // transcript — only a model turn does), so an advance afterwards proves a busy
     // session is alive. null proxy / no cwd → 0 (the advance check is skipped below).
     const baselineMtime = cwd ? adapter.newestActivityMtime(cwd) ?? 0 : 0
-    // Submit markers come from the target runtime's adapter (07.06 refactor).
+    // Submit markers come from the target runtime's adapter.
     const confirmed = submitIntoTui(target.socketPath, target.address, envelope, adapter.deliveryMarkers)
     tmux(target.socketPath, 'delete-buffer', '-b', bufferName)
     if (confirmed) return ok(undefined) // idle session accepted the submit
@@ -794,8 +794,8 @@ function compactReadyGraceMs(env: NodeJS.ProcessEnv | undefined): number {
  * Idle-composer (`isInputReady`) is treated as a FAST-PATH confirmation, NOT a
  * requirement. A healthy large-context session auto-continues into a working turn
  * right after compact — its composer is legitimately busy (not idle) for a while, so
- * requiring idle here false-failed a finished compact (live incident 15.06, boris:
- * marker at 12:14:58, first post-compact idle only ~232s later, past the ~290s gate).
+ * requiring idle here false-failed a finished compact (marker seen, but the first
+ * post-compact idle only arrived hundreds of seconds later, past the ~290s gate).
  * Therefore: marker seen + composer idle → 'transcript+ready' (clean); marker seen +
  * composer still busy past a short grace → 'transcript' (busy-but-done, still SUCCESS).
  *
@@ -1079,8 +1079,8 @@ export interface RouteDeps {
    *  wake, so it held «the topic the session woke with», while the resolver's
    *  semantics want «the topic the session last worked on». A long-lived executor
    *  that took live-delivered messages of topic B all day then false-FRESHED on
-   *  stop→start→wake with topic B (live incident 11.06, claude-iapeer: a day of
-   *  context lost to cause=idle-reaped-new-topic). Injected so transport never
+   *  stop→start→wake with topic B (a day of context lost to
+   *  cause=idle-reaped-new-topic). Injected so transport never
    *  imports lifecycle (layering — main.ts is where the two meet); call sites
    *  swallow hook errors (a hook must never fail a delivered message). */
   noteLiveTopic?: (identity: string, topic: string) => void
@@ -1324,12 +1324,12 @@ function validateAttachments(value: readonly string[] = []): Result<string[]> {
   return ok(out)
 }
 
-// ─── Telegram-domain sender policy (defect track 11.06, sanctioned by Артур) ─
+// ─── Telegram-domain sender policy ─
 
 /** A SENDER face in the telegram domain: a non-empty interfaces.telegram.bot (the
  *  bot machine-key) in the peer's registry passport. Deliberately bot-ONLY, not
- *  bot|user_id — the bridge picks the SENDING bot from the sender's bot key
- *  (owner fact, telegram-runtime сверка 11.06): a user_id grants a receive/operator
+ *  bot|user_id — the bridge picks the SENDING bot from the sender's bot key:
+ *  a user_id grants a receive/operator
  *  identity but no ability to send, so a user_id-only sender passing the guard
  *  would still die at the bridge — a late asynchronous failure where the guard
  *  exists to give a synchronous one. The guard passes exactly what the bridge can
@@ -1360,7 +1360,7 @@ function telegramSenderGuard(
   if (targetRuntime !== 'telegram') return ok(undefined)
   if (hasTelegramPresence(caller.record)) return ok(undefined)
   return err(
-    `telegram policy: sender "${caller.personality}" has no telegram face (no interfaces.telegram.bot in its passport) — message to "${targetPersonality}" NOT delivered; route via a telegram-faced peer (e.g. boris) or provision a bot for this sender`,
+    `telegram policy: sender "${caller.personality}" has no telegram face (no interfaces.telegram.bot in its passport) — message to "${targetPersonality}" NOT delivered; route via a peer that has a telegram bot in its passport, or provision a bot for this sender`,
   )
 }
 

package/src/update/index.ts

@@ -17,7 +17,7 @@
 // Scope: the foundation ONLY (the @agfpd/iapeer binary + its daemon + launchd
 // registrations of foundation-owned infra jobs that point at that binary). It never
 // rewrites those plists, never updates runtime packages (telegram-runtime /
-// notifier-runtime / MergeMind), and never touches foreign / persistent-peer fleet
+// notifier-runtime / capability plugins), and never touches foreign / persistent-peer fleet
 // plists — only sentinel-marked foundation-owned com.iapeer.* jobs are recycled.
 //
 // updateIapeer takes its three side-effects as INJECTED deps so the version-gate is
@@ -184,7 +184,7 @@ function defaultResolveVersion(spec: string, env: NodeJS.ProcessEnv): string | n
  * install) npx resolves that bin NAME to the COMPILED binary already on PATH and
  * runs ITS `install` — which cannot rebuild itself from source (`bun build --compile`
  * gets a `/$bunfs/root` entrypoint → FileNotFound) — instead of fetching + running the
- * freshly-published source. Verified reproducible (09.06, 0.2.8 deploy): with NO
+ * freshly-published source. Verified reproducible: with NO
  * `iapeer` on PATH the same npx invocation prints `command not found` — it never
  * installs the package — so this is a structural bin-name collision, NOT the
  * publish-propagation transient (waiting/retry does not cure it).
@@ -287,8 +287,8 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
   if (!runInstall(desired, env)) {
     // NB: the installer is the DETERMINISTIC pack+build path (no npx — see
     // defaultRunInstall); the most common cause right after a publish is the npm
-    // CDN tarball lagging the version metadata (live-hit 10.06: `npm view` already
-    // showed the version, `npm pack` still failed; a retry ~1 min later succeeded).
+    // CDN tarball lagging the version metadata (`npm view` can already show the
+    // version while `npm pack` still fails; a retry ~1 min later succeeds).
     return {
       status: 'failed',
       from,