@aitne/daemon 0.1.3 → 0.1.6

package/dist/core/dispatcher-hourly-check.js

@@ -0,0 +1,665 @@
+/**
+ * `HourlyCheckCoordinator` — owns the dispatcher's
+ * `triggerHourlyCheck` entry point and the cost-reduction-structural §B
+ * three-stage gate that fronts it. The coordinator decides whether a
+ * given hourly tick:
+ *   - skips (autonomous gate / morning routine active / already running
+ *     / below threshold);
+ *   - silently consumes observations + records an Agent Log line
+ *     (Stage 0 deterministic gate or Stage 2 lite-tier `log_only`);
+ *   - escalates to the existing Stage 3 enqueue (Stage 2 `escalate`
+ *     verdict or `failed` cautious-escalate path).
+ *
+ * Extracted from `core/dispatcher.ts` as part of phase D-2 of
+ * `docs/design/appendices/file-split-plan.md`. Pattern B (stateful
+ * coordinator): the coordinator owns the gate logic but borrows live
+ * accessors for state the dispatcher continues to own — the
+ * `hourlyCheckInProgress` flag (atomic check-and-set inside the
+ * trigger), the `morningRoutineInProgress` flag (read-only), and the
+ * lazily-injected delegated-sync refresh callback.
+ *
+ * Dispatcher entry points served:
+ *   - `EventDispatcher.triggerHourlyCheck(source, options)` is now a
+ *     thin one-liner that delegates to `trigger(source, options)`.
+ *
+ * Invariants preserved bit-for-bit from
+ * `docs/design/02-event-pipeline.md` §2:
+ *   - skip-if-morning-routine-in-progress;
+ *   - skip-if-hourly-already-running (atomic flag flip BEFORE any
+ *     await boundary — the C1 race fix from before the split);
+ *   - skip-if-pending-observations-below-threshold (legacy
+ *     min-observations floor honoured only when the gate would have
+ *     proceeded to Stage 3 anyway);
+ *   - skip-if-setup-incomplete / vault-degraded / user-paused via
+ *     `isAutonomousAllowed`.
+ *
+ * Shared-state references held:
+ *   - `setHourlyCheckInProgress` / `isHourlyCheckInProgress` —
+ *     getter/setter pair around the dispatcher's flag. The flag is
+ *     left `true` when an enqueue actually happens (the EventBus
+ *     consumer's `dispatchSafe` finally clears it on routine
+ *     completion); it is reset inline when the coordinator owns the
+ *     turn (silent gate paths) or when the trigger is skipping.
+ *   - `isMorningRoutineActive` — read-only mirror of the dispatcher
+ *     method so the gate stays single-sourced.
+ *   - `isAutonomousAllowed` — same; returns the
+ *     `TriggerHourlyCheckSkipReason` the gate should surface.
+ *   - `getDelegatedSyncRefresh` — accessor; null when no delegated
+ *     integration is wired, in which case the gate proceeds without
+ *     a refresh, matching pre-injection behaviour.
+ */
+import { EventPriority, createEvent, nativeIntegrationsContributingObservationsForProcessKey, } from "@aitne/shared";
+import { readIntegrations } from "../db/integrations-store.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { CONTEXT_RELATIVE_PATHS } from "./context-paths.js";
+import { getContextDir } from "../config.js";
+import { consumeObservations, getPendingCount, getPendingObservations, } from "../db/observations.js";
+import { computeHourlyCheckSignals } from "../db/hourly-check-signals.js";
+import { buildGateAuditDetail, decideStage, renderGateDecisionBlock, } from "../scheduler/hourly-check-gate.js";
+import { appendAgentLogLine } from "./today-direct-writer.js";
+import { parseStage2Verdict } from "./dispatcher-types.js";
+import { createLogger } from "../logging.js";
+const logger = createLogger("dispatcher-hourly-check");
+export class HourlyCheckCoordinator {
+    db;
+    config;
+    eventBus;
+    contextBuilder;
+    agentRouter;
+    audit;
+    todayWriteLock;
+    prompt;
+    fetchWindowRunner;
+    getDelegatedSyncRefresh;
+    setHourlyCheckInProgress;
+    isHourlyCheckInProgress;
+    isMorningRoutineActive;
+    isAutonomousAllowed;
+    constructor(deps) {
+        this.db = deps.db;
+        this.config = deps.config;
+        this.eventBus = deps.eventBus;
+        this.contextBuilder = deps.contextBuilder;
+        this.agentRouter = deps.agentRouter;
+        this.audit = deps.audit;
+        this.todayWriteLock = deps.todayWriteLock;
+        this.prompt = deps.prompt;
+        this.fetchWindowRunner = deps.fetchWindowRunner;
+        this.getDelegatedSyncRefresh = deps.getDelegatedSyncRefresh;
+        this.setHourlyCheckInProgress = deps.setHourlyCheckInProgress;
+        this.isHourlyCheckInProgress = deps.isHourlyCheckInProgress;
+        this.isMorningRoutineActive = deps.isMorningRoutineActive;
+        this.isAutonomousAllowed = deps.isAutonomousAllowed;
+    }
+    async trigger(source, options = {}) {
+        const forced = options.force === true;
+        const minObservations = this.config.hourlyCheckMinObservations;
+        // C1 fix: atomic check-and-set on hourlyCheckInProgress BEFORE any await
+        // boundary. Previously `await this.isMorningRoutineActive()` yielded to
+        // the microtask queue, allowing cron + /api/agent/run-now arriving in
+        // the same tick to both observe `hourlyCheckInProgress === false` and
+        // both enqueue. Because Node is single-threaded and better-sqlite3 is
+        // synchronous, doing set-first + sync checks + rollback-on-skip is now
+        // race-free.
+        if (this.isHourlyCheckInProgress()) {
+            logger.info({ source }, "Hourly check skipped — previous hourly check is still running");
+            return {
+                status: "skipped",
+                reason: "hourly_check_in_progress",
+                minObservations,
+                forced,
+            };
+        }
+        this.setHourlyCheckInProgress(true);
+        // Rollback flag unless we actually enqueue the event or land on a
+        // silent path that owns its own reset.
+        let enqueued = false;
+        let silentPathOwnsReset = false;
+        try {
+            const setupBlock = this.isAutonomousAllowed();
+            if (setupBlock !== null) {
+                logger.info({ source, reason: setupBlock }, "Hourly check skipped — autonomous work paused for setup");
+                return {
+                    status: "skipped",
+                    reason: setupBlock,
+                    minObservations,
+                    forced,
+                };
+            }
+            if (this.isMorningRoutineActive()) {
+                logger.info({ source }, "Hourly check skipped — morning routine is active");
+                return {
+                    status: "skipped",
+                    reason: "morning_routine_active",
+                    minObservations,
+                    forced,
+                };
+            }
+            // Refresh delegated-sync snapshots for any cadence the operator
+            // left opted-OUT (the post-Phase-9 default). Without this, Gmail /
+            // Notion observations would dry up entirely in delegated mode and
+            // the routine.hourly_check.delegated.* task flow's Step 0a / 0c
+            // would have nothing to consume — Step 1's `/api/observations`
+            // call would return only Obsidian / Git rows. Calendar's Step 0b
+            // already fetches actively via `/reconcile`, so the gap is
+            // specific to gmail / notion. See `docs/design/appendices/
+            // delegated-sync-opt-in.md` and the worker's
+            // `runDisabledCadencesForHourlyCheck` doc-comment for the full
+            // reasoning. Failures are logged but do NOT block the check —
+            // a stuck cadence cannot starve the entire hourly loop.
+            const delegatedSyncRefresh = this.getDelegatedSyncRefresh();
+            if (delegatedSyncRefresh) {
+                try {
+                    await delegatedSyncRefresh();
+                }
+                catch (err) {
+                    logger.warn({ err, source }, "Pre-hourly-check delegated sync refresh failed; proceeding with stale snapshot");
+                }
+            }
+            const pendingCount = getPendingCount(this.db, { actorFilter: "user" });
+            // INTEGRATION_NATIVE_MODE_DESIGN.md §6.5.1 — threshold bypass when
+            // at least one native integration contributes observations during
+            // hourly_check execution. "Contributes observations" is the union
+            // of `taskFlowsTouched` (in-turn variant POSTs) and
+            // `taskFlowsReferenced` (partial-include POSTs from the
+            // `routine.fetch_window` pre-pass — RDAD §10 R3). Without the
+            // referenced arm, an Outlook-only-native deployment
+            // (taskFlowsTouched is `[]` for user-managed connectors) would
+            // never trip the bypass: pre-pass would never run, no observations
+            // would land, and the gate would lock the routine into permanent
+            // skip. When the bypass fires the legacy `below_threshold` floor
+            // is suppressed; the in-turn POSTs populate the table by end of
+            // turn.
+            const nativeHourlyCheckIntegrations = nativeIntegrationsContributingObservationsForProcessKey("routine.hourly_check", readIntegrations(this.db));
+            const hasNativeForHourlyCheck = nativeHourlyCheckIntegrations.length > 0;
+            if (hasNativeForHourlyCheck) {
+                logger.debug({
+                    source,
+                    pendingCount,
+                    minObservations,
+                    nativeIntegrations: nativeHourlyCheckIntegrations,
+                }, "Hourly check: native integrations active — pre-run threshold bypass per §6.5.1");
+            }
+            // cost-reduction-structural §B — three-stage gate.
+            // Mode `off` falls through to the legacy min-observations gate +
+            // straight enqueue (rollback path for the gate); `shadow`/`live`
+            // compute the gate verdict before any other branch fires.
+            const gateMode = (this.config.hourlyCheckGateMode
+                ?? "shadow");
+            if (gateMode === "off") {
+                if (!forced && !hasNativeForHourlyCheck && pendingCount < minObservations) {
+                    logger.debug({ source, pendingCount, minObservations }, "Hourly check skipped — not enough pending observations");
+                    return {
+                        status: "skipped",
+                        reason: "below_threshold",
+                        pendingCount,
+                        minObservations,
+                        forced,
+                    };
+                }
+                await this.eventBus.put({
+                    ...createEvent({
+                        type: "routine.hourly_check",
+                        source,
+                        priority: EventPriority.NORMAL,
+                    }),
+                    routine: "hourly_check",
+                    data: { pendingCount, forced },
+                    ...(options.requestedModel ? { requestedModel: options.requestedModel } : {}),
+                });
+                enqueued = true;
+                return {
+                    status: "queued",
+                    pendingCount,
+                    minObservations,
+                    forced,
+                    gateMode: "off",
+                };
+            }
+            const decision = this.computeHourlyCheckGateDecision();
+            if (gateMode === "shadow") {
+                // Shadow mode: log the gate verdict, then proceed to Stage 3
+                // exactly as before so the existing pipeline is uncovered.
+                this.logGateAuditRow(decision, {
+                    mode: "shadow",
+                    appliedDecision: "stage3_shadow",
+                    forced,
+                });
+                if (!forced && !hasNativeForHourlyCheck && pendingCount < minObservations) {
+                    logger.debug({ source, pendingCount, minObservations, gateStage: decision.stage }, "Hourly check skipped (shadow) — not enough pending observations");
+                    return {
+                        status: "skipped",
+                        reason: "below_threshold",
+                        pendingCount,
+                        minObservations,
+                        forced,
+                        gateMode: "shadow",
+                        gateStage: decision.stage,
+                        gateReason: decision.reason,
+                        appliedStage: "stage3_shadow",
+                    };
+                }
+                await this.enqueueStage3HourlyCheck(source, { ...decision }, { mode: "shadow", forced, pendingCount, requestedModel: options.requestedModel });
+                enqueued = true;
+                return {
+                    status: "queued",
+                    pendingCount,
+                    minObservations,
+                    forced,
+                    gateMode: "shadow",
+                    gateStage: decision.stage,
+                    gateReason: decision.reason,
+                    appliedStage: "stage3_shadow",
+                };
+            }
+            // gateMode === 'live'
+            // Honour the legacy min-observations floor only when the gate
+            // would have proceeded to Stage 3 anyway. The silent gate path
+            // already short-circuits the noisy "1 obs, no signal" case below
+            // it, so keeping the floor active there would just suppress the
+            // gate's telemetry.
+            if (!forced
+                && !hasNativeForHourlyCheck
+                && decision.stage === "stage3"
+                && pendingCount < minObservations) {
+                this.logGateAuditRow(decision, {
+                    mode: "live",
+                    appliedDecision: "stage3",
+                    forced,
+                    // Mark the row as a skip even though the gate wanted Stage 3 —
+                    // the legacy min-observations floor short-circuited it. Without
+                    // this, every `below_threshold` skip would persist as a phantom
+                    // `result='success'` row in the audit feed.
+                    resultOverride: "skipped",
+                    extra: { skipped: "below_threshold" },
+                });
+                return {
+                    status: "skipped",
+                    reason: "below_threshold",
+                    pendingCount,
+                    minObservations,
+                    forced,
+                    gateMode: "live",
+                    gateStage: decision.stage,
+                    gateReason: decision.reason,
+                };
+            }
+            if (decision.stage === "stage0_silent") {
+                const silentResult = this.runSilentHourlyCheckPath(decision, "stage0_silent", {
+                    source,
+                    forced,
+                });
+                silentPathOwnsReset = true;
+                return {
+                    ...silentResult,
+                    minObservations,
+                    gateMode: "live",
+                    gateStage: decision.stage,
+                    gateReason: decision.reason,
+                    appliedStage: "stage0_silent",
+                };
+            }
+            if (decision.stage === "stage2") {
+                const verdict = await this.runStage2Triage(decision, source);
+                if (verdict === "log_only") {
+                    const silentResult = this.runSilentHourlyCheckPath(decision, "stage2_log_only", { source, forced });
+                    silentPathOwnsReset = true;
+                    return {
+                        ...silentResult,
+                        minObservations,
+                        gateMode: "live",
+                        gateStage: decision.stage,
+                        gateReason: decision.reason,
+                        appliedStage: "stage2_log_only",
+                    };
+                }
+                // verdict === 'escalate' OR 'failed' (failed → cautious escalate
+                // since a malformed JSON should not silently skip a hour's worth
+                // of signals; matches the prompt contract's stated default).
+                await this.enqueueStage3HourlyCheck(source, decision, {
+                    mode: "live",
+                    forced,
+                    pendingCount,
+                    requestedModel: options.requestedModel,
+                    stage2Verdict: verdict,
+                });
+                enqueued = true;
+                return {
+                    status: "queued",
+                    pendingCount,
+                    minObservations,
+                    forced,
+                    gateMode: "live",
+                    gateStage: decision.stage,
+                    gateReason: decision.reason,
+                    appliedStage: "stage3",
+                };
+            }
+            // decision.stage === 'stage3'
+            await this.enqueueStage3HourlyCheck(source, decision, { mode: "live", forced, pendingCount, requestedModel: options.requestedModel });
+            enqueued = true;
+            return {
+                status: "queued",
+                pendingCount,
+                minObservations,
+                forced,
+                gateMode: "live",
+                gateStage: decision.stage,
+                gateReason: decision.reason,
+                appliedStage: "stage3",
+            };
+        }
+        finally {
+            // Flag is only left true when we successfully enqueued OR the
+            // silent path explicitly opted out of resetting (it resets at
+            // the end of its own helper). The event loop's dispatchSafe()
+            // finally block clears the flag when an enqueued routine event
+            // finishes processing.
+            if (!enqueued && !silentPathOwnsReset) {
+                this.setHourlyCheckInProgress(false);
+            }
+        }
+    }
+    /**
+     * cost-reduction-structural §B — pull a fresh signal snapshot and run
+     * the deterministic gate. Helper so the dispatcher's call site stays
+     * compact and tests can spy on the boundary.
+     */
+    computeHourlyCheckGateDecision() {
+        const todayMd = this.readTodayMdSafe();
+        const signals = computeHourlyCheckSignals(this.db, {
+            vipMailSenders: this.config.vipMailSenders ?? [],
+            todayMd,
+            // Pass the configured agent timezone so `agentPlanOverdueCount`
+            // compares HH:MM rows in the right zone. Falls back to the
+            // engine's local TZ inside `computeHourlyCheckSignals` when this
+            // config field is empty (the common single-user case).
+            ...(this.config.timezone
+                ? { agentTimezone: this.config.timezone }
+                : {}),
+        });
+        return decideStage(signals, {
+            heartbeatHours: this.config.hourlyCheckHeartbeatHours ?? 4,
+            stage2Enabled: this.config.hourlyCheckStage2Enabled ?? false,
+            pendingObsLowSignalCeiling: this.config.hourlyCheckLowSignalPendingCeiling ?? 0,
+        });
+    }
+    readTodayMdSafe() {
+        try {
+            const path = join(getContextDir(this.config, this.db), CONTEXT_RELATIVE_PATHS.today);
+            if (!existsSync(path))
+                return null;
+            return readFileSync(path, "utf-8");
+        }
+        catch (err) {
+            logger.warn({ err }, "Failed to read today.md for hourly_check signals");
+            return null;
+        }
+    }
+    /**
+     * cost-reduction-structural §B — daemon-direct silent path. Used by
+     * Stage 0 and Stage 2 log-only verdicts. Consumes pending user
+     * observations + appends a single Agent Log line + records the gate
+     * verdict to `agent_actions`. The flag is reset before return.
+     */
+    runSilentHourlyCheckPath(decision, appliedDecision, ctx) {
+        const reason = appliedDecision === "stage0_silent"
+            ? "gate_stage0_silent"
+            : "gate_stage2_log_only";
+        let pendingCount = 0;
+        try {
+            pendingCount = decision.signals.pendingObsCount;
+            // Append a single bullet to today.md ## Agent Log. Best-effort —
+            // when today.md is missing or the lock is held, we still consume
+            // the observations so the queue doesn't grow indefinitely.
+            const message = appliedDecision === "stage0_silent"
+                ? `[hourly_check] Quiet (${decision.reason}) — ${pendingCount} obs consumed silently`
+                : `[hourly_check] Stage 2 log-only (${decision.reason}) — ${pendingCount} obs consumed silently`;
+            if (this.todayWriteLock) {
+                appendAgentLogLine({
+                    contextDir: getContextDir(this.config, this.db),
+                    message,
+                    todayWriteLock: this.todayWriteLock,
+                    timezone: this.config.timezone || undefined,
+                });
+            }
+            // Consume the observations under the gate's correlation id so
+            // dashboards can attribute "consumed by gate" rows separately
+            // from agent-driven consumption.
+            try {
+                const pending = getPendingObservations(this.db, {
+                    actorFilter: "user",
+                    limit: 100,
+                });
+                if (pending.length > 0) {
+                    consumeObservations(this.db, pending.map((row) => row.id), `hourly_check_gate:${appliedDecision}`);
+                }
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to consume observations on silent gate path");
+            }
+            this.logGateAuditRow(decision, {
+                mode: "live",
+                appliedDecision,
+                forced: ctx.forced,
+            });
+            logger.info({
+                source: ctx.source,
+                gateStage: decision.stage,
+                gateReason: decision.reason,
+                appliedDecision,
+                pendingCount,
+            }, "Hourly check silenced by Stage-1 gate");
+        }
+        finally {
+            this.setHourlyCheckInProgress(false);
+        }
+        return {
+            status: "skipped",
+            reason,
+            pendingCount,
+            forced: ctx.forced,
+        };
+    }
+    async enqueueStage3HourlyCheck(source, decision, extra) {
+        const gateBlock = renderGateDecisionBlock(decision, {
+            mode: extra.mode,
+            forced: extra.forced,
+        });
+        if (extra.mode === "live") {
+            this.logGateAuditRow(decision, {
+                mode: extra.mode,
+                appliedDecision: "stage3",
+                forced: extra.forced,
+                ...(extra.stage2Verdict ? { stage2Verdict: extra.stage2Verdict } : {}),
+            });
+        }
+        const stage3Event = {
+            ...createEvent({
+                type: "routine.hourly_check",
+                source,
+                priority: EventPriority.NORMAL,
+            }),
+            routine: "hourly_check",
+            data: {
+                pendingCount: extra.pendingCount,
+                forced: extra.forced,
+                gateDecision: {
+                    mode: extra.mode,
+                    stage: decision.stage,
+                    reason: decision.reason,
+                    forced: extra.forced,
+                    ...(extra.stage2Verdict ? { stage2Verdict: extra.stage2Verdict } : {}),
+                    block: gateBlock,
+                },
+            },
+            ...(extra.requestedModel ? { requestedModel: extra.requestedModel } : {}),
+        };
+        // ROUTINE_DATA_ACQUISITION_DESIGN.md Phase 4 / D3 — synchronous
+        // pre-pass between the gate's escalate verdict and the Stage 3
+        // enqueue. The block lives on `event.data.fetchReportBlock` so
+        // ContextBuilder folds it into the Stage 3 prompt when the EventBus
+        // consumer dispatches the routine. Pre-pass is skipped when the
+        // gate's escalate reason is `forced` (operator-pushed runs already
+        // know they want a fresh look) or `shadow` (shadow mode is
+        // explicitly running the existing pipeline unchanged, so the
+        // pre-pass would change the comparison fixture). Failures inside
+        // the runner surface as `<fetch_report status="failed">` and never
+        // throw — design §11 R5.
+        if (extra.mode === "live" && !extra.forced) {
+            const prepass = await this.fetchWindowRunner.run(stage3Event, "routine.hourly_check");
+            stage3Event.data = {
+                ...stage3Event.data,
+                fetchReportBlock: prepass.block,
+            };
+        }
+        await this.eventBus.put(stage3Event);
+    }
+    logGateAuditRow(decision, params) {
+        try {
+            // The gate-audit helper only knows about the canonical stages
+            // (gate output) plus the shadow-mode marker. Map the silent-path
+            // alias `stage2_log_only` onto its canonical sibling so the
+            // helper's typing stays narrow; the verdict is preserved verbatim
+            // alongside `stage_reached` in the merged detail.
+            const auditAppliedDecision = params.appliedDecision === "stage2_log_only"
+                ? "stage0_silent"
+                : params.appliedDecision;
+            const detail = {
+                ...buildGateAuditDetail(decision, {
+                    mode: params.mode,
+                    appliedDecision: auditAppliedDecision,
+                    forced: params.forced,
+                    ...(params.stage2Verdict ? { stage2Verdict: params.stage2Verdict } : {}),
+                }),
+                // Always reflect the *real* applied stage in the row regardless
+                // of the alias mapping above.
+                stage_reached: params.appliedDecision,
+                ...(params.extra ?? {}),
+            };
+            const isShadow = params.appliedDecision === "stage3_shadow";
+            const isSilentPath = params.appliedDecision === "stage0_silent"
+                || params.appliedDecision === "stage2_log_only";
+            const result = params.resultOverride
+                ?? (isShadow ? "success" : isSilentPath ? "skipped" : "success");
+            this.db
+                .prepare(`INSERT INTO agent_actions
+             (action_type, trigger, result, detail, started_at, completed_at)
+           VALUES ('hourly_check.gate', 'autonomous', ?, json(?), datetime('now'), datetime('now'))`)
+                .run(result, JSON.stringify(detail));
+        }
+        catch (err) {
+            logger.warn({ err }, "Failed to record hourly_check.gate audit row");
+        }
+    }
+    /**
+     * cost-reduction-structural §B Stage 2 — synchronous lite-tier triage.
+     * Builds a `routine.hourly_check.triage` RoutineEvent and runs it
+     * inline through the agent router (NOT the EventBus, so the result
+     * is available before we decide whether to silence or escalate).
+     *
+     * The agent contract is JSON-only output (`{ "action": "log_only" |
+     * "escalate", "reason": "..." }`); on parse failure we return
+     * `'failed'` and the caller treats that as cautious escalate.
+     *
+     * Tool/turn clamp (defense-in-depth):
+     *   - `allowedToolsOverride: []` removes every tool from the SDK's
+     *     allowlist for the spawn. Stage 2 has nothing to do but emit a
+     *     JSON line; the design's "no write tools" rule is enforced here
+     *     instead of relying on the prompt alone.
+     *   - `maxTurns: 1` caps the spawn at a single assistant turn. Even
+     *     if a future prompt change accidentally invites tool use, the
+     *     spawn cannot loop. Codex/Gemini have no per-spawn `allowedTools`
+     *     surface today (acknowledged gap in `agent-core.ts`); the
+     *     `maxTurns` cap and process_backend_config envelope are the
+     *     remaining safety floor on those backends.
+     */
+    async runStage2Triage(decision, source) {
+        const triageEvent = {
+            ...createEvent({
+                type: "routine.hourly_check.triage",
+                source,
+                priority: EventPriority.NORMAL,
+            }),
+            routine: "hourly_check.triage",
+            data: {
+                forced: false,
+                gateDecision: {
+                    mode: "live",
+                    stage: decision.stage,
+                    reason: decision.reason,
+                    forced: false,
+                    block: renderGateDecisionBlock(decision, { mode: "live", forced: false }),
+                },
+            },
+        };
+        let context;
+        try {
+            context = await this.contextBuilder.build(triageEvent);
+        }
+        catch (err) {
+            logger.error({ err }, "Stage 2 triage context build failed");
+            return "failed";
+        }
+        const processKey = "routine.hourly_check.triage";
+        const reassemblePrompt = (bid) => this.prompt.assemble(triageEvent.type, processKey, bid);
+        let binding;
+        try {
+            binding = this.agentRouter.resolveBinding(triageEvent, { processKey });
+        }
+        catch (err) {
+            logger.error({ err }, "Stage 2 triage binding resolve failed");
+            return "failed";
+        }
+        const prompt = reassemblePrompt(binding.main.backendId);
+        let result;
+        try {
+            result = await this.agentRouter.execute({
+                prompt,
+                context,
+                event: triageEvent,
+                processKey,
+                preResolvedBinding: binding,
+                reassemblePrompt,
+                // Defense-in-depth: Stage 2 must not call any tool. Empty
+                // `allowedToolsOverride` REPLACES the default allowlist on
+                // Claude (Codex/Gemini have no per-spawn `allowedTools` surface
+                // — acknowledged gap in `agent-core.ts`). The `max_turns=1` cap
+                // for the spawn comes from the seeded `process_backend_config`
+                // row for `routine.hourly_check.triage` (see `db/schema.ts`),
+                // which the router reads via `binding.main.maxTurns`. Together
+                // these mean: zero tools on Claude, one assistant turn on every
+                // backend.
+                allowedToolsOverride: [],
+            });
+        }
+        catch (err) {
+            logger.error({ err }, "Stage 2 triage agent execution failed");
+            return "failed";
+        }
+        // Audit row for the lite-tier session itself, distinct from the gate
+        // audit row written by `logGateAuditRow`.
+        try {
+            this.audit.logAction({
+                event: triageEvent,
+                model: result.model,
+                costUsd: result.costUsd,
+                usage: result.usage,
+                modelUsage: result.modelUsage,
+                durationMs: result.durationMs,
+                numTurns: result.numTurns,
+                trigger: "autonomous",
+                backend: result.backendId,
+                costSource: result.costSource,
+                contextUpdated: result.contextUpdated,
+                advisorCallCount: result.advisorCallCount,
+            });
+        }
+        catch (err) {
+            logger.warn({ err }, "Failed to log Stage 2 triage agent_actions row");
+        }
+        return parseStage2Verdict(result.output);
+    }
+}
+//# sourceMappingURL=dispatcher-hourly-check.js.map