@agfpd/iapeer 0.4.103 → 0.4.105

package/docs/08-peer-management.md

@@ -55,6 +55,8 @@ iapeer verify --fix    # repair
 
 `verify` checks two things: profiles' conformance to the standard, and divergences between the registry and the local profiles. With `--fix` the command self-heals the registry from the profiles (and migrates profiles from the old runtime-field format to the current one along the way). It's the standard way to put the registry in order if it's gone out of sync.
 
+**The daemon reconciles continuously (0.4.104).** The local `peer-profile.json` is the source of truth and the registry only its projection — but until 0.4.104 a direct edit of the source (the owner's legitimate move) propagated only when some reindexing verb happened to run afterwards; the router reads the INDEX per-request, so a stale projection mis-routed deliveries (measured live 17.07.2026: a peer's local profile said `default_runtime: claude` for days while the index kept `codex`, and deliveries went to a mute codex session). The daemon now runs a profile-sync sweep (`daemon/profilesync.ts`, 60 s, mtime/set-gated — steady state is stats only, zero writes): any change to a registered peer's local profile triggers the same locked `reindexFromLocals` the verbs use, and a boot sweep heals drift accumulated while the daemon was down. Heals are logged to `lifecycle.log` as `profile-reindex` events. `verify` remains the read-only report and the manual lever; the daemon closes the propagation gap.
+
 ## Stop and start: stop, start
 
 ```bash

package/docs/09-runtimes.md

@@ -67,6 +67,8 @@ iapeer default-runtime codex --all              # all peers
 
 Switches the primary runtime — where routing goes and which runtime comes up first. A bulk `--all` switch is exactly the "transplant" of the whole team from one agent runtime to another; it's symmetric back (`default-runtime claude --all`). The command refuses if the peer doesn't declare that runtime (run `add-runtime` first), and skips infrastructure peers. The registry is fixed in the same command, so routing switches at once.
 
+The routing choice is strict: a send without an explicit `runtime` always targets `default_runtime`. A live session on another declared runtime does not capture that send; if the default session is asleep, the daemon wakes it. Passing `runtime` explicitly remains the way to target a non-default surface.
+
 ## Connecting Telegram: connect
 
 ```bash

package/docs/10-messaging.md

@@ -25,7 +25,7 @@ The `--from` flag sets the sender (`<runtime>-<name>`); by default it's the iden
 
 ## The delivery path
 
-The daemon finds the recipient in the registry and looks at its state:
+The daemon finds the recipient in the registry and selects its endpoint first. With no explicit `runtime`, the endpoint is always the recipient's `default_runtime`; liveness of other declared runtimes does not change that choice. An explicit `runtime` selects that exact surface. The daemon then looks at the selected endpoint's state:
 
 - **alive** — the daemon writes the message into the peer's session through the supervisor socket onto the session's input. The daemon waits for confirmation that the input was accepted (the input field cleared); the answer is `delivered`.
 - **busy** (the agent is mid-turn, the input field isn't empty) — the message goes into the composer queue and is delivered as soon as the agent is free; the answer to the sender is `queued`. The queue waits up to 120 seconds, then force-delivers.

package/docs/ru/09-/321/200/320/260/320/275/321/202/320/260/320/271/320/274/321/213.md

@@ -67,6 +67,8 @@ iapeer default-runtime codex --all              # все пиры
 
 Переключает основной рантайм — куда идёт маршрутизация и какой рантайм поднимается первым. Массовое переключение `--all` — это и есть «пересадка» всей команды с одного агентского рантайма на другой; обратно симметрично (`default-runtime claude --all`). Команда откажет, если пир не объявляет этот рантайм (сначала `add-runtime`), и пропустит инфраструктурных. Реестр чинится в той же команде, поэтому маршрутизация переключается сразу.
 
+Выбор для маршрутизации строгий: отправка без явного `runtime` всегда целится в `default_runtime`. Живая сессия на другом объявленном рантайме не перехватывает такую отправку; если дефолтная сессия спит, демон будит её. Явный `runtime` по-прежнему выбирает конкретную недефолтную поверхность.
+
 ## Подключение Telegram: connect
 
 ```bash

package/docs/ru/10-/320/276/320/261/320/274/320/265/320/275-/321/201/320/276/320/276/320/261/321/211/320/265/320/275/320/270/321/217/320/274/320/270.md

@@ -25,7 +25,7 @@ iapeer send assistant --message "..." --topic "релиз" --from claude-reviewe
 
 ## Путь доставки
 
-Демон находит получателя в реестре и смотрит на его состояние:
+Демон находит получателя в реестре и сначала выбирает поверхность доставки. Без явного `runtime` это всегда `default_runtime` адресата; живость других объявленных рантаймов выбор не меняет. Явный `runtime` выбирает ровно указанную поверхность. Затем демон смотрит на состояние выбранной поверхности:
 
 - **живой** — демон пишет сообщение в сессию пира через сокет супервизора на ввод сессии. Демон ждёт подтверждения, что ввод принят (поле ввода очистилось); ответ — `доставлено`.
 - **занят** (агент в середине хода, поле ввода не пустое) — сообщение встаёт в очередь композера и доставляется, как только агент освободится; ответ отправителю — `в очереди`. Очередь ждёт до 120 секунд, потом досылает принудительно.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.103",
+  "version": "0.4.105",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/daemon/main.ts

@@ -69,6 +69,7 @@ import { appendDeliveryEvent } from './deliverylog.ts'
 import { buildFleetHandler } from './fleet.ts'
 import { NoticeBoard } from './notices.ts'
 import { startMuteWatch } from './mutewatch.ts'
+import { DEFAULT_PROFILE_SYNC_INTERVAL_MS, startProfileSync } from './profilesync.ts'
 import { startGoalWatch } from './goalwatch.ts'
 import { ActivityBoard, startTurnWatch } from './turnwatch.ts'
 import { defaultDaemonSocketPath, startDaemon, type DaemonHandle } from './index.ts'
@@ -348,6 +349,8 @@ export interface ConfiguredDaemonOptions {
   goalWatchIntervalMs?: number
   /** Turn-watch sweep cadence (default DEFAULT_TURNWATCH_INTERVAL_MS). */
   turnWatchIntervalMs?: number
+  /** Profile-sync sweep cadence (default DEFAULT_PROFILE_SYNC_INTERVAL_MS). */
+  profileSyncIntervalMs?: number
   /** Write the router.json discovery file (default true for production). */
   discovery?: boolean
   rootDir?: string
@@ -417,6 +420,34 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
       } catch { /* best-effort */ }
     },
   })
+  // Profile-sync (identity self-heal, continuous half) — the local peer-profile.json is
+  // the SOURCE OF TRUTH and the registry only its projection; this sweep is what makes
+  // that invariant operationally true (an owner's hand-edit of the source propagates
+  // within a minute instead of waiting for someone to run a reindexing verb — the
+  // 17.07.2026 routing-desync incident class). mtime-gated: steady state is stats only.
+  const stopProfileSync = startProfileSync({
+    env,
+    intervalMs: opts.profileSyncIntervalMs ?? DEFAULT_PROFILE_SYNC_INTERVAL_MS,
+    onHealed: r => {
+      try {
+        appendLifecycleEvent(
+          cfg.eventLogDir,
+          {
+            ev: 'profile-reindex',
+            ...(r.healed.length > 0 ? { healed: r.healed.join('; ').slice(0, 600) } : {}),
+            ...(r.missing.length > 0 ? { missing: r.missing.join(', ').slice(0, 300) } : {}),
+          },
+          { env },
+        )
+      } catch { /* best-effort */ }
+    },
+    onError: (err: unknown) => {
+      try {
+        const detail = err instanceof Error ? (err.stack ?? err.message) : String(err)
+        appendLifecycleEvent(cfg.eventLogDir, { ev: 'profilesync-error', error: detail.replace(/\s+/g, ' ').slice(0, 600) }, { env })
+      } catch { /* best-effort */ }
+    },
+  })
   const handle = await startDaemon({
     wake: makeWakeFn(cfg, env),
     // M2 arm-on-outbound (see makeArmEphemeralOnDelivered): ephemeral caller's ok
@@ -491,7 +522,7 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
   // The mute-watch timer is OURS, not startDaemon's — so its teardown must hang off the
   // handle we return, or a closed daemon would leave a live timer sweeping the disk (and
   // every test that starts a daemon would hang on exit).
-  return { ...handle, close: async () => { stopMuteWatch(); stopGoalWatch(); stopTurnWatch(); await handle.close() } }
+  return { ...handle, close: async () => { stopMuteWatch(); stopGoalWatch(); stopTurnWatch(); stopProfileSync(); await handle.close() } }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/daemon/profilesync.ts

@@ -0,0 +1,112 @@
+// Profile-sync — the daemon's CONTINUOUS half of the registry self-heal invariant.
+//
+// THE INVARIANT (identity/profileStandard.ts; contract zone «Идентичность пира — модель,
+// профиль, реестр»): the per-cwd peer-profile.json is the SOURCE OF TRUTH and
+// peers-profiles.json is a regenerable PROJECTION of it — "the index is never the source
+// of truth". Before this module that sentence was true only lexically. reindexFromLocals
+// ran on a handful of verbs (add-runtime / default-runtime / connect / verify --fix), so
+// an edit of the source file ITSELF — the owner's legitimate edit, on the very file the
+// contract names as the truth — propagated NEVER unless one of those verbs happened to
+// run afterwards. Measured on the real fleet (17.07.2026): linus's local profile had said
+// default_runtime=claude for days; the index still said codex; the router, which reads
+// the INDEX per-request, kept delivering into a mute codex session until an operator ran
+// the verb by hand. A projection invariant without a continuous reconciler is a promise
+// the system does not keep.
+//
+// MECHANISM. Every tick (60 s default) stat each registered peer's peer-profile.json.
+// Only when a profile mtime advanced past the previous sweep's maximum — or the set of
+// profile paths changed — run reindexFromLocals: the SAME locked writer the verbs use,
+// so the registry single-writer invariant is untouched. The steady state is N stats and
+// ZERO writes; the index is rewritten only when a source actually changed. Reindex
+// writes the index and never the profiles, so there is no feedback loop. A corrupt or
+// missing profile is preserved-and-reported by reindexFromLocals itself (it treats both
+// as "leave the record, surface in `missing`" — a half-saved editor buffer must never
+// wipe a live record).
+//
+// The boot tick ALWAYS reconciles once (the gate starts empty): drift accumulated while
+// the daemon was down — exactly the incident shape — heals on startup, not on the next
+// hand-run verb.
+
+import { statSync } from 'node:fs'
+import { reindexFromLocals } from '../identity/profileStandard.ts'
+import { readPeersIndex } from '../registry/index.ts'
+import { peerProfilePath } from '../storage/index.ts'
+
+export const DEFAULT_PROFILE_SYNC_INTERVAL_MS = 60_000
+
+export interface ProfileSyncResult {
+  healed: string[]
+  missing: string[]
+}
+
+export interface ProfileSyncDeps {
+  /** Registered peers' profile paths. Default: the live registry (readPeersIndex). */
+  listProfilePaths?: () => string[]
+  /** The locked self-heal writer. Default: reindexFromLocals({ env }). */
+  reindex?: () => Promise<ProfileSyncResult>
+  /** Fired ONLY when a reindex actually changed/flagged something (healed or missing
+   *  non-empty) — the caller's audit hook; quiet reconciles stay quiet. */
+  onHealed?: (r: ProfileSyncResult) => void
+  /** Reported, never thrown — a reconciler must never take the daemon down. */
+  onError?: (err: unknown) => void
+  env?: NodeJS.ProcessEnv
+}
+
+/** The sweep gate: the profile set + the newest profile mtime, folded into one string.
+ *  A changed gate = some source changed (edit, new peer, dropped profile) → reindex. */
+function computeGate(paths: string[]): string {
+  let maxMtime = 0
+  const present: string[] = []
+  for (const p of paths) {
+    try {
+      const m = statSync(p).mtimeMs
+      present.push(p)
+      if (m > maxMtime) maxMtime = m
+    } catch {
+      // Missing profile: participates via the PATH SET (its appearance/disappearance
+      // flips the gate once), not via mtime. reindexFromLocals handles the rest.
+    }
+  }
+  return `${maxMtime}|${present.sort().join(',')}`
+}
+
+/**
+ * One sweep: reindex IFF the gate moved since `lastGate`. Returns the new gate.
+ * Exported for tests; the timer below is just this on an interval.
+ */
+export async function profileSyncTick(deps: ProfileSyncDeps, lastGate: string): Promise<string> {
+  try {
+    const env = deps.env ?? process.env
+    const paths = deps.listProfilePaths
+      ? deps.listProfilePaths()
+      : readPeersIndex({ env }).peers.map(rec => peerProfilePath(rec.cwd))
+    const gate = computeGate(paths)
+    if (gate === lastGate) return lastGate
+    const reindex = deps.reindex ?? (() => reindexFromLocals({ env }))
+    const result = await reindex()
+    if (result.healed.length > 0 || result.missing.length > 0) deps.onHealed?.(result)
+    return gate
+  } catch (e) {
+    deps.onError?.(e)
+    return lastGate // a failed sweep retries the same gate next tick — never silently skips
+  }
+}
+
+/** Start the profile-sync timer. Returns its stop function — the caller OWNS teardown. */
+export function startProfileSync(opts: ProfileSyncDeps & { intervalMs?: number } = {}): () => void {
+  let gate = '' // empty ≠ any computed gate → the FIRST tick always reconciles (boot heal)
+  let running = false
+  const sweep = async (): Promise<void> => {
+    if (running) return // a slow reindex must never overlap itself
+    running = true
+    try {
+      gate = await profileSyncTick(opts, gate)
+    } finally {
+      running = false
+    }
+  }
+  void sweep() // boot heal — drift accumulated while the daemon was down heals NOW
+  const timer = setInterval(() => void sweep(), opts.intervalMs ?? DEFAULT_PROFILE_SYNC_INTERVAL_MS)
+  ;(timer as { unref?: () => void }).unref?.()
+  return () => clearInterval(timer)
+}

package/src/transport/index.ts

@@ -162,12 +162,18 @@ export function resolvePeerDeliveryTarget(
   peer: PeerRecord,
   env: NodeJS.ProcessEnv = process.env,
 ): Result<DeliveryTarget> {
-  if (runtime) return resolveDeliveryTarget({ personality, runtime, env })
-  if (peer.runtime) {
-    const exactDefault = resolveDeliveryTarget({ personality, runtime: peer.runtime, env })
-    if (exactDefault.ok) return exactDefault
-  }
-  return resolveDeliveryTarget({ personality, env })
+  // Routing is CONFIG-ANCHORED, not liveness-selected. An omitted runtime means
+  // exactly the peer's default_runtime (`PeerRecord.runtime` is the normalized
+  // in-memory name), even when another declared runtime already has a live
+  // session. If that default endpoint is asleep, returning its exact offline
+  // miss is load-bearing: routeSend will wake THE DEFAULT instead of falling
+  // through to whichever non-default session happens to be alive.
+  //
+  // An explicit runtime remains an exact override. `resolveDeliveryTarget`
+  // without a runtime is deliberately NOT used here: its sole-live discovery is
+  // useful for observation/control callers, but would silently defeat the
+  // operator's `default-runtime` routing lever.
+  return resolveDeliveryTarget({ personality, runtime: runtime ?? peer.runtime, env })
 }
 
 // Confirm poll interval — how often deliverViaHost re-reads the transcript for a NEW record carrying
@@ -1407,8 +1413,7 @@ export function hasTelegramPresence(record: PeerRecord): boolean {
  *  ok:true — a false-OK + silent loss, the class this contract forbids. Applied to
  *  the INTENDED channel (override / target default — before any wake side-effect,
  *  since a wake delivers the envelope as the boot first-message) AND to the RESOLVED
- *  channel at both delivery points (the only-live-session fallback can land on
- *  telegram without either). */
+ *  channel at both delivery points (defence in depth against registry/wake drift). */
 function telegramSenderGuard(
   caller: ResolvedCaller,
   targetRuntime: string,
@@ -1500,9 +1505,8 @@ async function routeSendInner(
   // a mismatch is HELD (persisted verbatim + instructive error), not delivered — the
   // agent then confirms cross-channel or redirects to the origin, zero regeneration.
   // Intended runtime = the explicit override or the human's default; exact for the
-  // natural-peer class (their channels are always-on launchd routers, so the
-  // only-live-session fallback cannot silently diverge outside a seconds-wide crash
-  // window). Initiative (answered / no inbound / ARM_TTL-stale) passes untouched.
+  // natural-peer class (implicit routing is strictly default_runtime-anchored).
+  // Initiative (answered / no inbound / ARM_TTL-stale) passes untouched.
   if (
     !deps.originGuardBypass &&
     originGuardEnabled(env) &&
@@ -1561,8 +1565,8 @@ async function routeSendInner(
   const target = resolvePeerDeliveryTarget(personality, runtime, peer, env)
   if (target.ok) {
     if (target.value.address === caller.address) return err('cannot send to self')
-    // Telegram sender policy — RESOLVED channel (the only-live-session fallback can
-    // land on telegram without an override and without telegram being the default).
+    // Telegram sender policy — RESOLVED channel (defence in depth: the resolved
+    // target must still obey the domain guard even though selection is exact).
     const liveGuard = telegramSenderGuard(caller, target.value.runtime, personality)
     if (!liveGuard.ok) return liveGuard
     const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: target.value, envelope, topic, sentAt })