@aitne/daemon 0.1.7 → 0.1.9

package/dist/observers/calendar-poller.js

@@ -3,7 +3,16 @@ import { CALENDAR_HORIZON_MS, } from "../core/roadmap-refresh-triggers.js";
 import { createLogger } from "../logging.js";
 import { reconcile } from "../services/integrations/reconcile.js";
 import { applyDriftEffects } from "../core/drift-effects.js";
+import { PollGuard, raceWithAbort } from "./poll-guard.js";
 const logger = createLogger("calendar-poller");
+/**
+ * Wall-clock cap per tick. The Google Calendar `listEvents` round-trip
+ * is normally <2s; the reconcile + drift-effects path is bounded by
+ * `MAX_PAGES`-style invariants in the snapshot writer. A 2-minute cap
+ * comfortably absorbs API slowness without letting a stuck tick block
+ * the next interval — see {@link PollGuard} for the contract.
+ */
+const TICK_TIMEOUT_MS = 120_000;
 const calendarNormalizer = getSnapshotNormalizer("google_calendar");
 /**
  * CalendarPoller — polls Google Calendar for upcoming events.
@@ -30,6 +39,10 @@ export class CalendarPoller {
     timezone;
     name = "calendar";
     pollTimer = null;
+    guard = new PollGuard({
+        name: "calendar-poller",
+        tickTimeoutMs: TICK_TIMEOUT_MS,
+    });
     constructor(calendarService, db, pollIntervalSeconds, calendarId, writeTracker, 
     /**
      * Optional roadmap-refresh trigger (ROADMAP-REDESIGN §3.4 RFC-C).
@@ -49,9 +62,9 @@ export class CalendarPoller {
     }
     async start() {
         // Initial poll
-        await this.poll();
+        await this.tick();
         // Start periodic polling
-        this.pollTimer = setInterval(() => void this.poll(), this.pollIntervalSeconds * 1000);
+        this.pollTimer = setInterval(() => void this.tick(), this.pollIntervalSeconds * 1000);
         logger.info({ intervalSeconds: this.pollIntervalSeconds }, "Calendar poller started");
     }
     async stop() {
@@ -59,70 +72,78 @@ export class CalendarPoller {
             clearInterval(this.pollTimer);
             this.pollTimer = null;
         }
+        this.guard.abortInFlight(new Error("calendar_poller_stopped"));
         logger.info("Calendar poller stopped");
     }
-    async poll() {
+    async tick() {
         try {
-            const now = new Date();
-            // Window must exceed CALENDAR_HORIZON_MS (14d) so newly created
-            // far-future events become visible to the change-detection diff and
-            // satisfy `shouldTriggerRefreshForCalendarEvent` (ROADMAP-REDESIGN
-            // §3.4 RFC-C). 1 extra day of buffer covers events created right at
-            // the boundary; the 15-min approaching scan is unaffected because it
-            // filters with its own `minutesUntil <= 15` check below.
-            const timeMax = new Date(now.getTime() + CALENDAR_HORIZON_MS + 24 * 60 * 60 * 1000);
-            const events = await this.calendarService.listEvents(now.toISOString(), timeMax.toISOString());
-            const fetchedAt = now.toISOString();
-            const items = events
-                .filter((calEvent) => calEvent.id)
-                .map((calEvent) => {
-                const payload = calendarNormalizer.payload(calEvent);
-                const itemId = calendarNormalizer.itemId(calEvent);
-                const actorHint = this.resolveActorHint(itemId);
-                return {
-                    itemId,
-                    contentHash: calendarNormalizer.hash(payload),
-                    payload,
-                    itemStart: calendarNormalizer.itemStart(calEvent),
-                    ...(actorHint ? { actorHint } : {}),
-                };
-            });
-            reconcile(this.db, {
-                integration: "google_calendar",
-                windowKey: "primary:14d",
-                windowMin: fetchedAt,
-                windowMax: timeMax.toISOString(),
-                fetchedAt,
-                items,
-            }, {
-                normalizer: calendarNormalizer,
-                resolveActorHint: (_integration, itemId) => this.resolveActorHint(itemId),
-                onDiffInTransaction: (diff) => {
-                    applyDriftEffects({
-                        integration: "google_calendar",
-                        windowKey: "primary:14d",
-                        windowMin: fetchedAt,
-                        windowMax: timeMax.toISOString(),
-                        fetchedAt,
-                        items,
-                    }, diff, {
-                        db: this.db,
-                        calendarId: this.calendarId,
-                        timezone: this.timezone,
-                        todayWriteLock: this.todayWriteLock,
-                        triggerRoadmapRefresh: this.triggerRoadmapRefresh,
-                    });
-                },
-            });
+            await this.guard.run((signal) => this.poll(signal));
         }
         catch (err) {
             logger.error({ err }, "Calendar poll failed");
         }
     }
+    async poll(signal) {
+        const now = new Date();
+        // Window must exceed CALENDAR_HORIZON_MS (14d) so newly created
+        // far-future events become visible to the change-detection diff and
+        // satisfy `shouldTriggerRefreshForCalendarEvent` (ROADMAP-REDESIGN
+        // §3.4 RFC-C). 1 extra day of buffer covers events created right at
+        // the boundary; the 15-min approaching scan is unaffected because it
+        // filters with its own `minutesUntil <= 15` check below.
+        const timeMax = new Date(now.getTime() + CALENDAR_HORIZON_MS + 24 * 60 * 60 * 1000);
+        // CalendarService.listEvents does not accept an AbortSignal natively
+        // (the underlying googleapis client v144 ignores signal on the events
+        // API). raceWithAbort bounds the wait on our side: the underlying
+        // HTTP call leaks if it hangs, but PollGuard's inFlight flag can
+        // reset and the next tick is unblocked.
+        const events = await raceWithAbort(this.calendarService.listEvents(now.toISOString(), timeMax.toISOString()), signal);
+        const fetchedAt = now.toISOString();
+        const items = events
+            .filter((calEvent) => calEvent.id)
+            .map((calEvent) => {
+            const payload = calendarNormalizer.payload(calEvent);
+            const itemId = calendarNormalizer.itemId(calEvent);
+            const actorHint = this.resolveActorHint(itemId);
+            return {
+                itemId,
+                contentHash: calendarNormalizer.hash(payload),
+                payload,
+                itemStart: calendarNormalizer.itemStart(calEvent),
+                ...(actorHint ? { actorHint } : {}),
+            };
+        });
+        reconcile(this.db, {
+            integration: "google_calendar",
+            windowKey: "primary:14d",
+            windowMin: fetchedAt,
+            windowMax: timeMax.toISOString(),
+            fetchedAt,
+            items,
+        }, {
+            normalizer: calendarNormalizer,
+            resolveActorHint: (_integration, itemId) => this.resolveActorHint(itemId),
+            onDiffInTransaction: (diff) => {
+                applyDriftEffects({
+                    integration: "google_calendar",
+                    windowKey: "primary:14d",
+                    windowMin: fetchedAt,
+                    windowMax: timeMax.toISOString(),
+                    fetchedAt,
+                    items,
+                }, diff, {
+                    db: this.db,
+                    calendarId: this.calendarId,
+                    timezone: this.timezone,
+                    todayWriteLock: this.todayWriteLock,
+                    triggerRoadmapRefresh: this.triggerRoadmapRefresh,
+                });
+            },
+        });
+    }
     resolveActorHint(itemId) {
         return this.writeTracker?.isMarked(`calendar:${itemId}`, null)
             ? "agent"
             : undefined;
     }
 }
-//# sourceMappingURL=calendar-poller.js.map

package/dist/observers/context-index-reconciler-observer.d.ts

@@ -69,4 +69,3 @@ export declare class ContextIndexReconcilerObserver implements Observer {
     private handleFsEvent;
     private runOnce;
 }
-//# sourceMappingURL=context-index-reconciler-observer.d.ts.map

package/dist/observers/context-index-reconciler-observer.js

@@ -250,4 +250,3 @@ function defaultWatcherFactory(contextDir) {
         },
     };
 }
-//# sourceMappingURL=context-index-reconciler-observer.js.map

package/dist/observers/delegated-probe-observer.d.ts

@@ -80,4 +80,3 @@ export declare class DelegatedProbeObserver implements Observer {
     private collectGroups;
     private probeGroup;
 }
-//# sourceMappingURL=delegated-probe-observer.d.ts.map

package/dist/observers/delegated-probe-observer.js

@@ -234,4 +234,3 @@ export class DelegatedProbeObserver {
         }
     }
 }
-//# sourceMappingURL=delegated-probe-observer.js.map

package/dist/observers/delegated-sync-worker.d.ts

@@ -13,8 +13,8 @@ interface DelegatedSyncRuntimeConfig {
      *   - "primary:imminent" (integration-local, kept for backwards compat)
      *
      * The integration-local form was introduced when calendar was the only
-     * cadence; Phase 5 added gmail (`inbox:7d`) and notion (`recently_updated`)
-     * cadences. Their window keys are unique across integrations today, so
+     * cadence; gmail (`inbox:7d`) and notion (`recently_updated`) later
+     * joined. Their window keys are unique across integrations today, so
      * the integration-local fallback still resolves unambiguously, but
      * operators should prefer the canonical fully-qualified form
      * (`<integration>:<windowKey>`) — a future cadence collision would
@@ -23,6 +23,15 @@ interface DelegatedSyncRuntimeConfig {
     intervals?: Record<string, number>;
     /** Global floor in seconds. Per-cadence soft floors still apply. */
     minIntervalSeconds?: number;
+    /**
+     * Per-invocation wall-clock timeout in seconds. Bounds the worst-case
+     * time `runCadence` can hold the `tickRunning` mutex when an invoker
+     * subprocess hangs without honouring its own abort signal. Clamped to
+     * `[MIN_INVOKER_TIMEOUT_MS / 1000, ∞)` — operators cannot push the
+     * timeout below 30 s, which would cause healthy cadences to flap into
+     * the "timeout" retry path.
+     */
+    invokerTimeoutSeconds?: number;
     /**
      * Per-cadence opt-in flag. Default false (cadence dormant) — see
      * `docs/design/appendices/delegated-sync-opt-in.md`. Keys are canonical
@@ -49,10 +58,9 @@ export interface DelegatedSyncCadenceContext {
     /** Calendar id from worker options. Calendar cadences forward this; gmail
      *  and notion ignore it. */
     calendarId: string;
-    /** Operator-tunable cap. Phase 1 used a per-cadence `maxResults` field;
-     *  Phase 5 generalises it through the context object so a future cadence
-     *  can drop the cap (Gemini Calendar `maxResults` is silently ignored
-     *  upstream — the arg is a hint). */
+    /** Operator-tunable cap. Generalised through the context object so a
+     *  future cadence can drop the cap (Gemini Calendar `maxResults` is
+     *  silently ignored upstream — the arg is a hint). */
     maxResults: number;
 }
 export interface DelegatedSyncToolCall {
@@ -213,6 +221,15 @@ export interface DelegatedSyncWorkerOptions {
     tickIntervalSeconds?: number;
     now?: () => Date;
     cadences?: readonly DelegatedSyncCadenceDefinition[];
+    /**
+     * Wall-clock timeout for a single `invoker.invoke()` call. Defaults to
+     * `DEFAULT_INVOKER_TIMEOUT_MS`. Per-invocation override path:
+     *   1. constructor option (this field) → fixed for the worker's lifetime
+     *   2. runtime_state `delegatedSync.invokerTimeoutSeconds` → re-read per call
+     *      (so a dashboard PATCH lands on the next cadence without restart)
+     * Floor `MIN_INVOKER_TIMEOUT_MS` applies to both paths.
+     */
+    invokerTimeoutMs?: number;
 }
 /**
  * Worker stand-up predicate. True when at least one cadence-eligible
@@ -248,6 +265,12 @@ export declare class DelegatedSyncWorker implements Observer {
     private readonly now;
     private readonly cadences;
     private readonly states;
+    /**
+     * Constructor-supplied invoker timeout. When undefined (production
+     * default), `resolveInvokerTimeoutMs()` falls back to the runtime_state
+     * value (if set) or `DEFAULT_INVOKER_TIMEOUT_MS`.
+     */
+    private readonly invokerTimeoutMsOverride;
     constructor(options: DelegatedSyncWorkerOptions);
     start(): Promise<void>;
     stop(): Promise<void>;
@@ -307,11 +330,49 @@ export declare class DelegatedSyncWorker implements Observer {
     private runTick;
     private runCadence;
     private getState;
+    /**
+     * Resolve the effective wall-clock timeout for a single invocation.
+     * Precedence: constructor override > runtime_state > built-in default.
+     *
+     * The runtime_state path is clamped to `[MIN_INVOKER_TIMEOUT_MS, ∞)` so
+     * an operator typo cannot flap healthy cadences into the timeout retry
+     * path. The constructor override deliberately bypasses the floor — it
+     * is a programmatic injection point (production wiring + tests) and the
+     * caller already knows the floor. This mirrors the convention used by
+     * the rest of the options surface (e.g. `tickIntervalSeconds`, where
+     * the constructor option also bypasses operator-side floors).
+     *
+     * Defensive: an override of zero or a negative number (programmer bug)
+     * would race the timeout against the very first event-loop turn and
+     * effectively disable cadences. Fall back to the default in that case
+     * — tests that need a tiny timeout must use a small positive value
+     * (e.g. 50 ms), which is what every existing test does.
+     */
+    private resolveInvokerTimeoutMs;
+    /**
+     * Race `invoker.invoke()` against a wall-clock timer. On timeout:
+     *   1. Abort the invoker's `abortSignal` so the subprocess gets a chance
+     *      to bail out (proxy path honours abort; CLI subprocess paths kill
+     *      the child).
+     *   2. Resolve with a synthetic `errorClass: "timeout"` result so the
+     *      existing retry path inside `runCadence` handles it identically
+     *      to invoker-internal timeouts. `RETRYABLE_ERROR_CLASSES` already
+     *      includes "timeout".
+     *
+     * Why this exists even though the invoker has its own timeout: a hung
+     * subprocess that ignores SIGTERM (rare, but observed under heavy fs
+     * pressure during integration tests) would still leave the invoker's
+     * await unresolved indefinitely. The outer race is the worker's
+     * self-defence: it guarantees `tickRunning` releases within
+     * `invokerTimeoutMs + a small scheduling delay`, regardless of whether
+     * the invoker's own cancellation path completed.
+     */
+    private invokeWithTimeout;
     private readRuntimeConfig;
     private resolveIntervalSeconds;
     /**
-     * Phase 7 (h): rebuild per-cadence `lastAttemptAt` / `lastSuccessAt` from
-     * the most recent `delegated_sync` row in `agent_actions` so a daemon
+     * Rebuild per-cadence `lastAttemptAt` / `lastSuccessAt` from the most
+     * recent `delegated_sync` row in `agent_actions` so a daemon
      * restart shortly after a successful sync does not re-spawn a subprocess
      * for that cadence. Idempotent — re-running on an already-warm states
      * map only overwrites with same-or-newer timestamps. Failures during
@@ -321,7 +382,7 @@ export declare class DelegatedSyncWorker implements Observer {
      */
     private hydrateStateFromHistory;
     /**
-     * Phase 7 (g) + (c): emit a single warn at start when the operator's
+     * Emit a single warn at start when the operator's
      * `runtime_state.delegatedSync.intervals` includes typo'd keys or when a
      * resolved cadence violates the TTL × 1.5 contract. Both checks fire
      * once per `start()` to avoid log spam; they are also exposed via
@@ -423,4 +484,3 @@ export declare const __delegatedSyncWorkerTestExports: {
     DEFAULT_ACTIVE_END_HOUR: number;
 };
 export {};
-//# sourceMappingURL=delegated-sync-worker.d.ts.map

package/dist/observers/delegated-sync-worker.js

@@ -62,6 +62,22 @@ const RETRYABLE_ERROR_CLASSES = new Set([
     "subprocess_crashed",
     "tool_not_registered",
 ]);
+/**
+ * Wall-clock timeout for a single cadence invocation. The invoker has its
+ * own per-request budget (see `delegated-backend-invoker.ts` ~line 585) but
+ * a hung subprocess that ignores its abort signal would still leave
+ * `tickRunning` pinned true forever and silently kill the worker. This
+ * outer race guarantees the worker recovers even when the invoker's
+ * cancellation path fails.
+ *
+ * 5 min is long enough for the slowest observed cadence (Gemini calendar
+ * cold-start + tool roundtrip ≈ 75 s × 2 retries ≈ 150 s) plus headroom.
+ * Operators can override via `runtime_state.delegatedSync.invokerTimeoutSeconds`
+ * — the floor `MIN_INVOKER_TIMEOUT_MS` prevents pathological tiny values
+ * that would treat every real call as a timeout.
+ */
+const DEFAULT_INVOKER_TIMEOUT_MS = 5 * 60 * 1000;
+const MIN_INVOKER_TIMEOUT_MS = 30 * 1000;
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -227,12 +243,19 @@ export class DelegatedSyncWorker {
     now;
     cadences;
     states = new Map();
+    /**
+     * Constructor-supplied invoker timeout. When undefined (production
+     * default), `resolveInvokerTimeoutMs()` falls back to the runtime_state
+     * value (if set) or `DEFAULT_INVOKER_TIMEOUT_MS`.
+     */
+    invokerTimeoutMsOverride;
     constructor(options) {
         this.options = options;
         this.tickIntervalSeconds =
             options.tickIntervalSeconds ?? DEFAULT_TICK_INTERVAL_SECONDS;
         this.now = options.now ?? (() => new Date());
         this.cadences = options.cadences ?? DEFAULT_CADENCES;
+        this.invokerTimeoutMsOverride = options.invokerTimeoutMs;
     }
     async start() {
         if (this.timer)
@@ -245,7 +268,7 @@ export class DelegatedSyncWorker {
         //     of leaving the worker permanently silent.
         this.timer = setInterval(() => void this.tick(), this.tickIntervalSeconds * 1000);
         this.timer.unref?.();
-        // Phase 7 (h): seed per-cadence state from the most recent successful
+        // Seed per-cadence state from the most recent successful
         // delegated_sync row in agent_actions before the first tick. Daemon
         // restarts no longer re-spawn every cadence's subprocess when a sync
         // ran shortly before the restart; the natural cadenceDue check picks
@@ -501,10 +524,10 @@ export class DelegatedSyncWorker {
             if (!force && !isCadenceEnabled(def, runtimeConfig))
                 continue;
             const normalizer = getSnapshotNormalizer(def.integration);
-            // Defensive: every IntegrationKey ships a normalizer after Phase 5.
-            // The branch survives so a future integration whose connector
-            // wiring lands before its normalizer doesn't crash the worker; the
-            // cadence is silently skipped instead.
+            // Defensive: every IntegrationKey should ship a normalizer. This
+            // guard catches a registry regression where a future integration's
+            // connector wiring lands before its normalizer — the cadence is
+            // silently skipped instead of crashing the worker.
             /* c8 ignore start */
             if (!normalizer) {
                 logger.debug({ integration: def.integration, windowKey: def.windowKey }, "Skipping cadence sync without a snapshot normalizer");
@@ -559,7 +582,7 @@ export class DelegatedSyncWorker {
                 modelOverride: cadenceModelOverride,
             };
             while (true) {
-                invokeResult = await this.options.invoker.invoke(invokeParams);
+                invokeResult = await this.invokeWithTimeout(invokeParams);
                 if (invokeResult.ok)
                     break;
                 if (retryAttempts >= MAX_RETRY_ATTEMPTS
@@ -600,7 +623,7 @@ export class DelegatedSyncWorker {
                         timezone: this.options.timezone,
                         todayWriteLock: this.options.todayWriteLock,
                         triggerRoadmapRefresh: this.options.triggerRoadmapRefresh,
-                        // Phase 7: forward the worker's clock so today-drift detection
+                        // Forward the worker's clock so today-drift detection
                         // is deterministic in tests (the worker uses an injected now()
                         // for window construction; without this forwarder drift-effects
                         // would call real `new Date()` and the test would flap across
@@ -668,6 +691,110 @@ export class DelegatedSyncWorker {
         }
         return state;
     }
+    /**
+     * Resolve the effective wall-clock timeout for a single invocation.
+     * Precedence: constructor override > runtime_state > built-in default.
+     *
+     * The runtime_state path is clamped to `[MIN_INVOKER_TIMEOUT_MS, ∞)` so
+     * an operator typo cannot flap healthy cadences into the timeout retry
+     * path. The constructor override deliberately bypasses the floor — it
+     * is a programmatic injection point (production wiring + tests) and the
+     * caller already knows the floor. This mirrors the convention used by
+     * the rest of the options surface (e.g. `tickIntervalSeconds`, where
+     * the constructor option also bypasses operator-side floors).
+     *
+     * Defensive: an override of zero or a negative number (programmer bug)
+     * would race the timeout against the very first event-loop turn and
+     * effectively disable cadences. Fall back to the default in that case
+     * — tests that need a tiny timeout must use a small positive value
+     * (e.g. 50 ms), which is what every existing test does.
+     */
+    resolveInvokerTimeoutMs(runtimeConfig) {
+        const override = this.invokerTimeoutMsOverride;
+        if (override !== undefined) {
+            if (Number.isFinite(override) && override > 0)
+                return override;
+            logger.warn({ invokerTimeoutMsOverride: override }, "Ignoring non-positive invokerTimeoutMs override; falling back to default");
+        }
+        const configuredSeconds = positiveNumber(runtimeConfig.invokerTimeoutSeconds);
+        if (configuredSeconds !== null) {
+            return Math.max(configuredSeconds * 1000, MIN_INVOKER_TIMEOUT_MS);
+        }
+        return DEFAULT_INVOKER_TIMEOUT_MS;
+    }
+    /**
+     * Race `invoker.invoke()` against a wall-clock timer. On timeout:
+     *   1. Abort the invoker's `abortSignal` so the subprocess gets a chance
+     *      to bail out (proxy path honours abort; CLI subprocess paths kill
+     *      the child).
+     *   2. Resolve with a synthetic `errorClass: "timeout"` result so the
+     *      existing retry path inside `runCadence` handles it identically
+     *      to invoker-internal timeouts. `RETRYABLE_ERROR_CLASSES` already
+     *      includes "timeout".
+     *
+     * Why this exists even though the invoker has its own timeout: a hung
+     * subprocess that ignores SIGTERM (rare, but observed under heavy fs
+     * pressure during integration tests) would still leave the invoker's
+     * await unresolved indefinitely. The outer race is the worker's
+     * self-defence: it guarantees `tickRunning` releases within
+     * `invokerTimeoutMs + a small scheduling delay`, regardless of whether
+     * the invoker's own cancellation path completed.
+     */
+    async invokeWithTimeout(params) {
+        const runtimeConfig = this.readRuntimeConfig();
+        const timeoutMs = this.resolveInvokerTimeoutMs(runtimeConfig);
+        const ac = new AbortController();
+        // If the caller supplied a signal, forward its abort to our controller
+        // so cancellation chains transparently. The cadence path does not pass
+        // one today, but the type allows it (`InvokeParams.abortSignal`).
+        const externalSignal = params.abortSignal;
+        const externalListener = () => ac.abort(externalSignal?.reason);
+        if (externalSignal) {
+            if (externalSignal.aborted) {
+                ac.abort(externalSignal.reason);
+            }
+            else {
+                externalSignal.addEventListener("abort", externalListener, { once: true });
+            }
+        }
+        let timer = null;
+        let timedOut = false;
+        const timeoutPromise = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                timedOut = true;
+                ac.abort(new Error("delegated-sync invoker wall-clock timeout"));
+                resolve({
+                    ok: false,
+                    errorClass: "timeout",
+                    message: `Delegated sync invoker did not return within ${timeoutMs} ms; `
+                        + "aborted to free the tickRunning mutex",
+                });
+            }, timeoutMs);
+        });
+        const invokePromise = this.options.invoker.invoke({
+            ...params,
+            abortSignal: ac.signal,
+        });
+        // Pre-attach a catch handler so a late rejection (after timeout fired)
+        // cannot escape as an `unhandledRejection`. The original promise still
+        // wins the race when it resolves first; this catch is only reached
+        // when the race already settled on the timeout branch.
+        invokePromise.catch((err) => {
+            if (!timedOut)
+                return;
+            logger.debug({ err }, "Invoker resolved late after wall-clock timeout — result discarded");
+        });
+        try {
+            return await Promise.race([invokePromise, timeoutPromise]);
+        }
+        finally {
+            if (timer !== null)
+                clearTimeout(timer);
+            if (externalSignal) {
+                externalSignal.removeEventListener("abort", externalListener);
+            }
+        }
+    }
     readRuntimeConfig() {
         const raw = readRuntimeState(this.options.db, RUNTIME_CONFIG_KEY);
         if (!raw || typeof raw !== "object")
@@ -683,8 +810,8 @@ export class DelegatedSyncWorker {
         return Math.max(floor, positiveNumber(configured) ?? def.defaultIntervalSeconds);
     }
     /**
-     * Phase 7 (h): rebuild per-cadence `lastAttemptAt` / `lastSuccessAt` from
-     * the most recent `delegated_sync` row in `agent_actions` so a daemon
+     * Rebuild per-cadence `lastAttemptAt` / `lastSuccessAt` from the most
+     * recent `delegated_sync` row in `agent_actions` so a daemon
      * restart shortly after a successful sync does not re-spawn a subprocess
      * for that cadence. Idempotent — re-running on an already-warm states
      * map only overwrites with same-or-newer timestamps. Failures during
@@ -730,7 +857,7 @@ export class DelegatedSyncWorker {
         }
     }
     /**
-     * Phase 7 (g) + (c): emit a single warn at start when the operator's
+     * Emit a single warn at start when the operator's
      * `runtime_state.delegatedSync.intervals` includes typo'd keys or when a
      * resolved cadence violates the TTL × 1.5 contract. Both checks fire
      * once per `start()` to avoid log spam; they are also exposed via
@@ -808,7 +935,7 @@ export function isWithinActiveHours(now, timezone, activeHours) {
  * must outlive the slowest reconcile cadence by ~1.5×, otherwise an
  * agent-originated write at T0 has its mark expire just before the next
  * worker tick re-fetches and the diff resolves `actor='user'` instead of
- * `'agent'`. Phase 7 (c) tightens both halves: the TTL constants
+ * `'agent'`. Two halves keep this safe: the TTL constants
  * (INTEGRATION_WRITE_TTL_MS, in @aitne/shared) cover the default
  * cadences with margin, and this ratio is the daemon-side check that fires
  * a warn when an operator-tuned cadence pushes past the boundary.
@@ -1141,4 +1268,3 @@ export const __delegatedSyncWorkerTestExports = {
     DEFAULT_ACTIVE_START_HOUR,
     DEFAULT_ACTIVE_END_HOUR,
 };
-//# sourceMappingURL=delegated-sync-worker.js.map

package/dist/observers/entity-mirror-observer.d.ts

@@ -52,4 +52,3 @@ export declare class EntityMirrorObserver implements Observer {
     start(): Promise<void>;
     stop(): Promise<void>;
 }
-//# sourceMappingURL=entity-mirror-observer.d.ts.map

package/dist/observers/entity-mirror-observer.js

@@ -70,4 +70,3 @@ export class EntityMirrorObserver {
         }
     }
 }
-//# sourceMappingURL=entity-mirror-observer.js.map

package/dist/observers/git-delegated-cron.d.ts

@@ -38,4 +38,3 @@ export declare class GitDelegatedCronObserver implements Observer {
     private buildEvent;
 }
 export {};
-//# sourceMappingURL=git-delegated-cron.d.ts.map

package/dist/observers/git-delegated-cron.js

@@ -156,4 +156,3 @@ export class GitDelegatedCronObserver {
         };
     }
 }
-//# sourceMappingURL=git-delegated-cron.js.map

package/dist/observers/git-event-classifier.d.ts

@@ -49,4 +49,3 @@ export declare function classifyGitBranchDeleted(event: GitLifecycleEventInput):
 export declare function classifyGitTagCreated(event: GitLifecycleEventInput): GitEventClassification;
 export declare function classifyGitTagDeleted(event: GitLifecycleEventInput): GitEventClassification;
 export declare function classifyGitMergeToDefault(event: GitLifecycleEventInput): GitEventClassification;
-//# sourceMappingURL=git-event-classifier.d.ts.map

package/dist/observers/git-event-classifier.js

@@ -67,4 +67,3 @@ function observe(eventType, event, priority, emitEvent) {
         emitEvent,
     };
 }
-//# sourceMappingURL=git-event-classifier.js.map

package/dist/observers/git-watcher.d.ts

@@ -1,5 +1,6 @@
 import type Database from "better-sqlite3";
 import type { EventBus } from "../core/event-bus.js";
+import type { AgentWriteTracker } from "../safety/agent-write-tracker.js";
 import type { Observer } from "./manager.js";
 import { type GitEventClassification } from "./git-event-classifier.js";
 interface GitWatcherOptions {
@@ -43,6 +44,14 @@ interface GitWatcherOptions {
      * pre-unification behaviour).
      */
     repoIntervals?: ReadonlyMap<string, number | null>;
+    /**
+     * Optional commit-attribution tracker (C1). When provided, observations
+     * whose SHA matches a recently-marked agent commit are tagged
+     * `actor='agent'` instead of the historical `'user'` / `'unknown'`
+     * defaults. When absent (legacy callers, fixtures) the watcher falls
+     * back to the pre-fix literals — strict no-op for existing behaviour.
+     */
+    writeTracker?: AgentWriteTracker;
 }
 /**
  * GitWatcher — detects local and remote Git lifecycle changes across
@@ -74,6 +83,7 @@ export declare class GitWatcher implements Observer {
     private readonly onLifecycleObservation;
     private readonly repoEnvResolver;
     private readonly repoIntervals;
+    private readonly writeTracker;
     /** Per-row next-fire timestamp; `0` (or missing) means "due immediately". */
     private readonly nextFireAt;
     private lastWebhookEventAt;
@@ -81,6 +91,18 @@ export declare class GitWatcher implements Observer {
     /** Duration (ms) of no webhook events before restoring full-frequency polling */
     private static readonly WEBHOOK_STALE_MS;
     constructor(repoPaths: string[], db: Database.Database, pollIntervalSeconds?: number, options?: GitWatcherOptions);
+    /**
+     * Resolve an observation's `actor` against the agent-commit tracker
+     * (C1). When the tracker has been notified that the daemon just
+     * committed `sha` to `repoPath`, the observation flips to
+     * `'agent'`; otherwise the historical fallback (`'user'` for local
+     * HEAD changes, `'unknown'` for remote-side events) is preserved so
+     * absence of the tracker is a strict no-op.
+     *
+     * Deletion-event sites pass no SHA — those keep the fallback
+     * verbatim.
+     */
+    private resolveActor;
     /**
      * Per-row scheduling gate (unified-repositories §5). Override is
      * recognized only when longer than the global tick — the global
@@ -159,4 +181,3 @@ export declare class GitWatcher implements Observer {
 export declare function parseLsRemoteRefs(stdout: string, kind: "heads" | "tags"): Map<string, string>;
 export declare function parseDefaultBranch(stdout: string): string | null;
 export {};
-//# sourceMappingURL=git-watcher.d.ts.map