@agfpd/iapeer 0.4.70 → 0.4.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.70",
+  "version": "0.4.71",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/core/constants.ts

@@ -65,6 +65,27 @@ export function defaultIntelligenceForRuntime(runtime: string): Intelligence {
   return 'artificial'
 }
 
+/**
+ * The intelligences a runtime may LEGITIMATELY carry (the single Ф0 source; provision
+ * validates against it, the launch gate enforces it). Identity (natural/absent/artificial)
+ * is ORTHOGONAL to the channel: a human-channel runtime can carry a HUMAN (natural) OR a
+ * FACELESS SERVICE bot (absent) — e.g. a Telegram approval-card bot — but never an LLM agent
+ * (artificial) on that channel. A service-only runtime carries services (absent). An agentic
+ * runtime carries an LLM (artificial). The DEFAULT (defaultIntelligenceForRuntime) stays the
+ * first of each set, so an existing peer with no explicit nature is unchanged — `absent` on a
+ * channel runtime is strictly OPT-IN (an explicit `--intelligence absent` / manifest decl).
+ */
+export function allowedIntelligencesForRuntime(runtime: string): readonly Intelligence[] {
+  if (NATURAL_RUNTIMES.has(runtime)) return ['natural', 'absent']
+  if (ABSENT_RUNTIMES.has(runtime)) return ['absent']
+  return ['artificial']
+}
+
+/** Is `intelligence` a legitimate nature for `runtime`? (provision fail-loud + launch gate.) */
+export function isIntelligenceAllowedForRuntime(runtime: string, intelligence: Intelligence): boolean {
+  return allowedIntelligencesForRuntime(runtime).includes(intelligence)
+}
+
 // Infra runtimes are ALWAYS-ON (held live by launchd KeepAlive), as opposed to the
 // warm-on-demand agentic runtimes (claude/codex, woken by the daemon). Liveness is
 // a property of the RUNTIME, not the personality (zone Идентичность). Infra runtimes

package/src/identity/index.ts

@@ -11,8 +11,10 @@ import {
   IAPEER_DIR,
   PEER_PROFILE_FILE,
   NAME_RE,
+  allowedIntelligencesForRuntime,
   defaultIntelligenceForRuntime,
   isInfraRuntime,
+  isIntelligenceAllowedForRuntime,
   isRuntime,
   isValidName,
   normalizeIntelligenceValue,
@@ -131,6 +133,12 @@ export interface EnsurePeerProfileOptions {
    *  always-on plist so launchd's minimal PATH resolves it. Forwarded to
    *  installAlwaysOnPlist; ignored for warm-on-demand runtimes. */
   runtimeBin?: string
+  /** Explicit peer nature (natural/absent/artificial). OPT-IN override of the runtime
+   *  default (defaultIntelligenceForRuntime): a channel runtime defaults `natural` but may be
+   *  provisioned `absent` for a FACELESS SERVICE bot (e.g. a Telegram approval-card bot).
+   *  Validated against allowedIntelligencesForRuntime — an out-of-set value fails LOUD. Absent
+   *  (undefined) ⇒ the runtime default (unchanged for every existing peer). */
+  intelligence?: Intelligence
   /** В36 — peer description, persisted into the LOCAL profile (the source of truth the
    *  registry is reindexed FROM). Writing it only to the registry made it a stale copy:
    *  the first reindexFromLocals (addRuntime on a dual-runtime create, connect telegram,
@@ -503,6 +511,21 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
   const peers = options.peers ?? []
   ensureLocalIapScaffold(cwd)
   const discoveredRuntimes = discoverPeerRuntimes(cwd, options.runtime)
+  // Nature = the EXPLICIT intelligence when supplied (validated against the runtime's allowed
+  // set — an out-of-set value, e.g. artificial on telegram, fails LOUD), else the runtime
+  // default. This is where a FACELESS SERVICE bot (absent) on a channel runtime becomes
+  // first-class (docs/Идентичность); an omitted intelligence keeps every existing peer's
+  // default nature unchanged.
+  const resolvedIntelligence = (rt: Runtime): Intelligence => {
+    const explicit = options.intelligence
+    if (explicit === undefined) return defaultIntelligenceForRuntime(rt)
+    if (!isIntelligenceAllowedForRuntime(rt, explicit)) {
+      throw new IapError(
+        `intelligence "${explicit}" is not valid for runtime "${rt}" — allowed: ${allowedIntelligencesForRuntime(rt).join(', ')}`,
+      )
+    }
+    return explicit
+  }
   const existing = readPeerProfile(cwd)
   if (!existing) {
     let personality: string
@@ -550,7 +573,7 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
       // В36 — the description lands in the LOCAL profile at birth (source of truth);
       // the registry row is a projection of this file, not the other way around.
       description: options.description?.trim() ?? '',
-      intelligence: defaultIntelligenceForRuntime(options.runtime),
+      intelligence: resolvedIntelligence(options.runtime),
     }
     ensureLocalRuntimeScopes(cwd, profile.runtimes)
     // INFRA runtime → provision the always-on launchd plist that holds it live.
@@ -607,7 +630,10 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
       runtimeBin: options.runtimeBin,
       env: options.env,
     })
-    intelligence = defaultIntelligenceForRuntime(options.runtime)
+    // Re-provision honors an EXPLICIT nature (a manifest-declared absent service bot survives
+    // update-runtime re-provision), else the runtime default (the legacy vocab-flip this fix
+    // preserved). resolvedIntelligence validates the explicit against the runtime's allowed set.
+    intelligence = resolvedIntelligence(options.runtime)
   }
   // В36 — an explicit description on RE-provision updates the local profile too (H1 in
   // writePeerProfileAtomic still guards: absent/empty never wipes an existing value).

package/src/launch/adapters/telegram.ts

@@ -23,6 +23,7 @@
 // that is install-time (blueprint §0.6 fast-wake), not session bring-up.
 
 import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import { allowedIntelligencesForRuntime } from '../../core/constants.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
 // telegramAdapter
@@ -38,13 +39,14 @@ export const telegramAdapter: RuntimeAdapter = {
   deliveryMarkers: { promptGlyphs: [] },
 
   /**
-   * telegram is a HUMAN channel — launch REFUSES a non-natural peer (fail-loud).
-   * Porting the persistent-peer FATAL guard (it stood in two places): a peer with
-   * intelligence artificial/absent must never be brought up on telegram (it would
-   * route a human's bot to an agent/script). The launch primitive enforces this
-   * against LaunchSpec.intelligence; source of intelligence → docs/Идентичность.
+   * telegram carries a HUMAN (natural) OR a FACELESS SERVICE bot (absent) — but never an
+   * LLM agent (artificial), which would route a human's channel to an agent/script. Launch
+   * REFUSES anything outside this set (fail-loud), the persistent-peer FATAL guard relaxed to
+   * first-class faceless service bots (e.g. a Telegram approval-card bot). Sourced from the
+   * single Ф0 truth (allowedIntelligencesForRuntime); enforced by the launch primitive against
+   * LaunchSpec.intelligence. Source of intelligence → docs/Идентичность.
    */
-  requiresIntelligence: 'natural',
+  allowedIntelligences: allowedIntelligencesForRuntime('telegram'),
 
   /**
    * argv = telegramBin + 'run' + extraArgs (telegram-start.sh:119,

package/src/launch/adapters/voicetalk.ts

@@ -9,7 +9,7 @@
 //
 // voicetalk is a presence-runtime for a HUMAN (the owner's voice channel), modelled on
 // telegram per the foundation presence-runtime contract: kind:'router',
-// usesDoctrine:false, requiresIntelligence:'natural', argv = `<bin> run <extra>`. The
+// usesDoctrine:false, allowedIntelligences:['natural','absent'], argv = `<bin> run <extra>`. The
 // STT/TTS engines and providers live in a shared voice service (voice-connect), NOT in
 // this adapter and NOT in the peer passport — interfaces.voicetalk carries only the
 // binding ({wake_word, device}), opaque to the foundation.
@@ -19,6 +19,7 @@
 // bring-up.
 
 import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import { allowedIntelligencesForRuntime } from '../../core/constants.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
 // voicetalkAdapter
@@ -34,13 +35,12 @@ export const voicetalkAdapter: RuntimeAdapter = {
   deliveryMarkers: { promptGlyphs: [] },
 
   /**
-   * voicetalk is a HUMAN channel — launch REFUSES a non-natural peer (fail-loud).
-   * Same nature gate as telegram: a peer with intelligence artificial/absent must never
-   * be brought up on voicetalk (it would route the owner's voice channel to an
-   * agent/script). The launch primitive enforces this against LaunchSpec.intelligence;
-   * source of intelligence → docs/Идентичность.
+   * voicetalk carries a HUMAN (natural) OR a FACELESS SERVICE bot (absent) — never an LLM
+   * agent (artificial), which would route the owner's voice channel to an agent/script. Same
+   * nature gate as telegram, sourced from the single Ф0 truth (allowedIntelligencesForRuntime);
+   * enforced by the launch primitive against LaunchSpec.intelligence. Source → docs/Идентичность.
    */
-  requiresIntelligence: 'natural',
+  allowedIntelligences: allowedIntelligencesForRuntime('voicetalk'),
 
   /**
    * argv = voicetalkBin + 'run' + extraArgs.

package/src/launch/index.ts

@@ -131,14 +131,16 @@ export const launch: LaunchFn = async (
   const { identity, socketPath: sock, cwd } = spec
   const env = cfg.env ?? process.env
 
-  // (0) Intelligence gate (fail-loud BEFORE any tmux work): an adapter that declares
-  //     requiresIntelligence (telegram → 'natural') refuses a peer whose nature does
-  //     not match — and refuses too when the nature is unknown (cannot confirm). Ports
-  //     the persistent-peer FATAL human-channel guard (docs/Рантайм-адаптеры).
-  if (adapter.requiresIntelligence && spec.intelligence !== adapter.requiresIntelligence) {
+  // (0) Intelligence gate (fail-loud BEFORE any bring-up work): an adapter that declares
+  //     allowedIntelligences (telegram/voicetalk → ['natural','absent']) refuses a peer whose
+  //     nature is not IN the set — and refuses too when the nature is unknown (cannot confirm).
+  //     A channel runtime carries a human (natural) OR a faceless service bot (absent), never an
+  //     LLM agent (artificial). Ports the persistent-peer FATAL human-channel guard, relaxed to
+  //     first-class faceless service bots (docs/Рантайм-адаптеры).
+  if (adapter.allowedIntelligences && (spec.intelligence == null || !adapter.allowedIntelligences.includes(spec.intelligence))) {
     return fail(
       identity,
-      `runtime "${spec.runtime}" requires intelligence=${adapter.requiresIntelligence}, ` +
+      `runtime "${spec.runtime}" requires intelligence ∈ {${adapter.allowedIntelligences.join(', ')}}, ` +
         `peer "${spec.personality}" is ${spec.intelligence ?? 'unknown'} — refusing to launch`,
     )
   }

package/src/launch/types.ts

@@ -160,9 +160,9 @@ export interface LaunchSpec {
   /** Free-form extra CLI args (PEER_START_ARGS). */
   extraArgs?: string[]
   /** Peer intelligence (artificial/natural/absent). Used to enforce an adapter's
-   *  intelligence gate at launch (telegram requires natural). Optional: a doctrine-
-   *  less throwaway may omit it, but an adapter that declares requiresIntelligence
-   *  then refuses (cannot confirm the required nature). */
+   *  intelligence gate at launch (telegram allows natural|absent). Optional: a doctrine-
+   *  less throwaway may omit it, but an adapter that declares allowedIntelligences
+   *  then refuses (cannot confirm the nature is in the set). */
   intelligence?: Intelligence
   /** Human-approval mode (docs/17): `yolo` (default/omitted) launches with the
    *  runtime bypass flag (current fleet behavior); `gated` launches WITHOUT bypass
@@ -273,13 +273,14 @@ export interface RuntimeAdapter {
   deliveryConfirm?: 'transcript' | 'socket-ack'
 
   /**
-   * If set, launch REFUSES unless the peer's intelligence equals this value
-   * (fail-loud). telegram → 'natural' — it is a human channel; launching an
-   * artificial/absent peer on it is a category error (the persistent-peer path held
-   * a FATAL guard in two places). Most adapters omit it (no nature gate). Source of intelligence →
+   * If set, launch REFUSES unless the peer's intelligence is IN this set (fail-loud —
+   * also when the nature is unknown). A channel runtime carries a HUMAN (natural) OR a
+   * FACELESS SERVICE bot (absent) but never an LLM agent (artificial): telegram/voicetalk →
+   * ['natural','absent'] (sourced from allowedIntelligencesForRuntime — the single Ф0 truth).
+   * Most adapters omit it (no nature gate — claude/codex/notifier). Source of intelligence →
    * docs/Идентичность; enforced by the launch primitive against LaunchSpec.intelligence.
    */
-  requiresIntelligence?: Intelligence
+  allowedIntelligences?: readonly Intelligence[]
 
   /**
    * Build the runtime argv: binary + flags, wiring systemPromptFile per-runtime

package/src/provision/index.ts

@@ -89,6 +89,11 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
     peers,
     personality: opts.personality,
     runtimeBin,
+    // The EXPLICIT nature now reaches the LOCAL profile too (A1) — previously it landed only
+    // in the registry upsert below, so a `--intelligence absent` telegram bot got a natural
+    // local profile (split-brain) and its plist crash-looped the natural gate. Validated
+    // against the runtime's allowed set inside ensurePeerProfile.
+    intelligence: opts.intelligence,
     // В36 — description goes into the LOCAL profile (source of truth); the registry
     // upsert below then persists a value reindexFromLocals can no longer wipe.
     description: opts.description,