@agfpd/iapeer 0.4.103 → 0.4.104

package/docs/08-peer-management.md

@@ -55,6 +55,8 @@ iapeer verify --fix    # repair
 
 `verify` checks two things: profiles' conformance to the standard, and divergences between the registry and the local profiles. With `--fix` the command self-heals the registry from the profiles (and migrates profiles from the old runtime-field format to the current one along the way). It's the standard way to put the registry in order if it's gone out of sync.
 
+**The daemon reconciles continuously (0.4.104).** The local `peer-profile.json` is the source of truth and the registry only its projection — but until 0.4.104 a direct edit of the source (the owner's legitimate move) propagated only when some reindexing verb happened to run afterwards; the router reads the INDEX per-request, so a stale projection mis-routed deliveries (measured live 17.07.2026: a peer's local profile said `default_runtime: claude` for days while the index kept `codex`, and deliveries went to a mute codex session). The daemon now runs a profile-sync sweep (`daemon/profilesync.ts`, 60 s, mtime/set-gated — steady state is stats only, zero writes): any change to a registered peer's local profile triggers the same locked `reindexFromLocals` the verbs use, and a boot sweep heals drift accumulated while the daemon was down. Heals are logged to `lifecycle.log` as `profile-reindex` events. `verify` remains the read-only report and the manual lever; the daemon closes the propagation gap.
+
 ## Stop and start: stop, start
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.103",
+  "version": "0.4.104",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/main.ts

@@ -69,6 +69,7 @@ import { appendDeliveryEvent } from './deliverylog.ts'
 import { buildFleetHandler } from './fleet.ts'
 import { NoticeBoard } from './notices.ts'
 import { startMuteWatch } from './mutewatch.ts'
+import { DEFAULT_PROFILE_SYNC_INTERVAL_MS, startProfileSync } from './profilesync.ts'
 import { startGoalWatch } from './goalwatch.ts'
 import { ActivityBoard, startTurnWatch } from './turnwatch.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
@@ -348,6 +349,8 @@ export interface ConfiguredDaemonOptions {
   goalWatchIntervalMs?: number
   /** Turn-watch sweep cadence (default DEFAULT_TURNWATCH_INTERVAL_MS). */
   turnWatchIntervalMs?: number
+  /** Profile-sync sweep cadence (default DEFAULT_PROFILE_SYNC_INTERVAL_MS). */
+  profileSyncIntervalMs?: number
   /** Write the router.json discovery file (default true for production). */
   discovery?: boolean
   rootDir?: string
@@ -417,6 +420,34 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
       } catch { /* best-effort */ }
     },
   })
+  // Profile-sync (identity self-heal, continuous half) — the local peer-profile.json is
+  // the SOURCE OF TRUTH and the registry only its projection; this sweep is what makes
+  // that invariant operationally true (an owner's hand-edit of the source propagates
+  // within a minute instead of waiting for someone to run a reindexing verb — the
+  // 17.07.2026 routing-desync incident class). mtime-gated: steady state is stats only.
+  const stopProfileSync = startProfileSync({
+    env,
+    intervalMs: opts.profileSyncIntervalMs ?? DEFAULT_PROFILE_SYNC_INTERVAL_MS,
+    onHealed: r => {
+      try {
+        appendLifecycleEvent(
+          cfg.eventLogDir,
+          {
+            ev: 'profile-reindex',
+            ...(r.healed.length > 0 ? { healed: r.healed.join('; ').slice(0, 600) } : {}),
+            ...(r.missing.length > 0 ? { missing: r.missing.join(', ').slice(0, 300) } : {}),
+          },
+          { env },
+        )
+      } catch { /* best-effort */ }
+    },
+    onError: (err: unknown) => {
+      try {
+        const detail = err instanceof Error ? (err.stack ?? err.message) : String(err)
+        appendLifecycleEvent(cfg.eventLogDir, { ev: 'profilesync-error', error: detail.replace(/\s+/g, ' ').slice(0, 600) }, { env })
+      } catch { /* best-effort */ }
+    },
+  })
   const handle = await startDaemon({
     wake: makeWakeFn(cfg, env),
     // M2 arm-on-outbound (see makeArmEphemeralOnDelivered): ephemeral caller's ok
@@ -491,7 +522,7 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
   // The mute-watch timer is OURS, not startDaemon's — so its teardown must hang off the
   // handle we return, or a closed daemon would leave a live timer sweeping the disk (and
   // every test that starts a daemon would hang on exit).
-  return { ...handle, close: async () => { stopMuteWatch(); stopGoalWatch(); stopTurnWatch(); await handle.close() } }
+  return { ...handle, close: async () => { stopMuteWatch(); stopGoalWatch(); stopTurnWatch(); stopProfileSync(); await handle.close() } }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/daemon/profilesync.ts

@@ -0,0 +1,112 @@
+// Profile-sync — the daemon's CONTINUOUS half of the registry self-heal invariant.
+//
+// THE INVARIANT (identity/profileStandard.ts; contract zone «Идентичность пира — модель,
+// профиль, реестр»): the per-cwd peer-profile.json is the SOURCE OF TRUTH and
+// peers-profiles.json is a regenerable PROJECTION of it — "the index is never the source
+// of truth". Before this module that sentence was true only lexically. reindexFromLocals
+// ran on a handful of verbs (add-runtime / default-runtime / connect / verify --fix), so
+// an edit of the source file ITSELF — the owner's legitimate edit, on the very file the
+// contract names as the truth — propagated NEVER unless one of those verbs happened to
+// run afterwards. Measured on the real fleet (17.07.2026): linus's local profile had said
+// default_runtime=claude for days; the index still said codex; the router, which reads
+// the INDEX per-request, kept delivering into a mute codex session until an operator ran
+// the verb by hand. A projection invariant without a continuous reconciler is a promise
+// the system does not keep.
+//
+// MECHANISM. Every tick (60 s default) stat each registered peer's peer-profile.json.
+// Only when a profile mtime advanced past the previous sweep's maximum — or the set of
+// profile paths changed — run reindexFromLocals: the SAME locked writer the verbs use,
+// so the registry single-writer invariant is untouched. The steady state is N stats and
+// ZERO writes; the index is rewritten only when a source actually changed. Reindex
+// writes the index and never the profiles, so there is no feedback loop. A corrupt or
+// missing profile is preserved-and-reported by reindexFromLocals itself (it treats both
+// as "leave the record, surface in `missing`" — a half-saved editor buffer must never
+// wipe a live record).
+//
+// The boot tick ALWAYS reconciles once (the gate starts empty): drift accumulated while
+// the daemon was down — exactly the incident shape — heals on startup, not on the next
+// hand-run verb.
+
+import { statSync } from 'node:fs'
+import { reindexFromLocals } from '../identity/profileStandard.ts'
+import { readPeersIndex } from '../registry/index.ts'
+import { peerProfilePath } from '../storage/index.ts'
+
+export const DEFAULT_PROFILE_SYNC_INTERVAL_MS = 60_000
+
+export interface ProfileSyncResult {
+  healed: string[]
+  missing: string[]
+}
+
+export interface ProfileSyncDeps {
+  /** Registered peers' profile paths. Default: the live registry (readPeersIndex). */
+  listProfilePaths?: () => string[]
+  /** The locked self-heal writer. Default: reindexFromLocals({ env }). */
+  reindex?: () => Promise<ProfileSyncResult>
+  /** Fired ONLY when a reindex actually changed/flagged something (healed or missing
+   *  non-empty) — the caller's audit hook; quiet reconciles stay quiet. */
+  onHealed?: (r: ProfileSyncResult) => void
+  /** Reported, never thrown — a reconciler must never take the daemon down. */
+  onError?: (err: unknown) => void
+  env?: NodeJS.ProcessEnv
+}
+
+/** The sweep gate: the profile set + the newest profile mtime, folded into one string.
+ *  A changed gate = some source changed (edit, new peer, dropped profile) → reindex. */
+function computeGate(paths: string[]): string {
+  let maxMtime = 0
+  const present: string[] = []
+  for (const p of paths) {
+    try {
+      const m = statSync(p).mtimeMs
+      present.push(p)
+      if (m > maxMtime) maxMtime = m
+    } catch {
+      // Missing profile: participates via the PATH SET (its appearance/disappearance
+      // flips the gate once), not via mtime. reindexFromLocals handles the rest.
+    }
+  }
+  return `${maxMtime}|${present.sort().join(',')}`
+}
+
+/**
+ * One sweep: reindex IFF the gate moved since `lastGate`. Returns the new gate.
+ * Exported for tests; the timer below is just this on an interval.
+ */
+export async function profileSyncTick(deps: ProfileSyncDeps, lastGate: string): Promise<string> {
+  try {
+    const env = deps.env ?? process.env
+    const paths = deps.listProfilePaths
+      ? deps.listProfilePaths()
+      : readPeersIndex({ env }).peers.map(rec => peerProfilePath(rec.cwd))
+    const gate = computeGate(paths)
+    if (gate === lastGate) return lastGate
+    const reindex = deps.reindex ?? (() => reindexFromLocals({ env }))
+    const result = await reindex()
+    if (result.healed.length > 0 || result.missing.length > 0) deps.onHealed?.(result)
+    return gate
+  } catch (e) {
+    deps.onError?.(e)
+    return lastGate // a failed sweep retries the same gate next tick — never silently skips
+  }
+}
+
+/** Start the profile-sync timer. Returns its stop function — the caller OWNS teardown. */
+export function startProfileSync(opts: ProfileSyncDeps & { intervalMs?: number } = {}): () => void {
+  let gate = '' // empty ≠ any computed gate → the FIRST tick always reconciles (boot heal)
+  let running = false
+  const sweep = async (): Promise<void> => {
+    if (running) return // a slow reindex must never overlap itself
+    running = true
+    try {
+      gate = await profileSyncTick(opts, gate)
+    } finally {
+      running = false
+    }
+  }
+  void sweep() // boot heal — drift accumulated while the daemon was down heals NOW
+  const timer = setInterval(() => void sweep(), opts.intervalMs ?? DEFAULT_PROFILE_SYNC_INTERVAL_MS)
+  ;(timer as { unref?: () => void }).unref?.()
+  return () => clearInterval(timer)
+}