@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.26

package/packages/azdo/src/workflow-rules.ts

@@ -0,0 +1,128 @@
+// Workflow gate matrix for the board's six Build flags (Custom.Planwritten,
+// Custom.Implementationcomplete, Custom.Reviewpassed, Custom.Testspassing,
+// Custom.Docsupdated, Custom.Mergedtointegration) against the seven
+// Product Backlog Item/Bug states. Rebuild (2026-10-02) of the gate lost in
+// the P4 port — the authoritative definition is
+// docs/operations/workflow-matrix.csv in the enact-combined repo, copied
+// verbatim to src/workflow-rules-matrix.csv next to this file. The unit test
+// tests/workflow-rules.test.ts asserts this embedded table agrees with that
+// CSV on all 84 rows, so the compiled binary needs no file access at runtime.
+// Features and Epics carry no flags ("A Feature carries neither") and are
+// exempt: evaluateWorkflowState returns no violations for them.
+
+/** The six Build flags, in CSV column order. */
+export const WORKFLOW_FLAG_REFS = [
+  'Custom.Planwritten',
+  'Custom.Implementationcomplete',
+  'Custom.Reviewpassed',
+  'Custom.Testspassing',
+  'Custom.Docsupdated',
+  'Custom.Mergedtointegration',
+] as const;
+export type WorkflowFlagRef = (typeof WORKFLOW_FLAG_REFS)[number];
+
+export const WORKFLOW_FLAG_LABELS: Record<WorkflowFlagRef, string> = {
+  'Custom.Planwritten': 'Plan written',
+  'Custom.Implementationcomplete': 'Implementation complete',
+  'Custom.Reviewpassed': 'Review passed',
+  'Custom.Testspassing': 'Tests passing',
+  'Custom.Docsupdated': 'Docs updated',
+  'Custom.Mergedtointegration': 'Merged to integration',
+};
+
+/**
+ * Only four flags carry a failure reason in the CSV; Implementation complete
+ * and Docs updated have none.
+ */
+export const WORKFLOW_FAILURE_REASONS: Partial<Record<WorkflowFlagRef, string>> = {
+  'Custom.Planwritten': 'Plan rejected',
+  'Custom.Reviewpassed': 'Reviewer rejected',
+  'Custom.Testspassing': 'Tests failed',
+  'Custom.Mergedtointegration': 'Build failed',
+};
+
+/** The seven board states; the matrix has one rule vector per state. */
+const WORKFLOW_STATES = ['New', 'Approved', 'Committed', 'In Progress', 'In Testing', 'Done', 'Removed'] as const;
+export type WorkflowState = (typeof WORKFLOW_STATES)[number];
+
+/**
+ * `yes` = flag must be true, `no` = flag must be false, `free` = either.
+ * The Product Backlog Item and Bug rows are identical in the CSV, so one
+ * table serves both types; per state the entries follow WORKFLOW_FLAG_REFS
+ * order.
+ */
+export const WORKFLOW_STATE_RULES: Record<WorkflowState, Record<WorkflowFlagRef, WorkflowRule>> = {
+  New: { 'Custom.Planwritten': 'no', 'Custom.Implementationcomplete': 'no', 'Custom.Reviewpassed': 'no', 'Custom.Testspassing': 'no', 'Custom.Docsupdated': 'no', 'Custom.Mergedtointegration': 'no' },
+  Approved: { 'Custom.Planwritten': 'yes', 'Custom.Implementationcomplete': 'no', 'Custom.Reviewpassed': 'no', 'Custom.Testspassing': 'no', 'Custom.Docsupdated': 'no', 'Custom.Mergedtointegration': 'no' },
+  Committed: { 'Custom.Planwritten': 'yes', 'Custom.Implementationcomplete': 'no', 'Custom.Reviewpassed': 'no', 'Custom.Testspassing': 'no', 'Custom.Docsupdated': 'no', 'Custom.Mergedtointegration': 'no' },
+  'In Progress': { 'Custom.Planwritten': 'yes', 'Custom.Implementationcomplete': 'free', 'Custom.Reviewpassed': 'no', 'Custom.Testspassing': 'free', 'Custom.Docsupdated': 'free', 'Custom.Mergedtointegration': 'no' },
+  'In Testing': { 'Custom.Planwritten': 'yes', 'Custom.Implementationcomplete': 'yes', 'Custom.Reviewpassed': 'free', 'Custom.Testspassing': 'free', 'Custom.Docsupdated': 'free', 'Custom.Mergedtointegration': 'no' },
+  Done: { 'Custom.Planwritten': 'yes', 'Custom.Implementationcomplete': 'yes', 'Custom.Reviewpassed': 'yes', 'Custom.Testspassing': 'yes', 'Custom.Docsupdated': 'yes', 'Custom.Mergedtointegration': 'yes' },
+  Removed: { 'Custom.Planwritten': 'free', 'Custom.Implementationcomplete': 'free', 'Custom.Reviewpassed': 'free', 'Custom.Testspassing': 'free', 'Custom.Docsupdated': 'free', 'Custom.Mergedtointegration': 'free' },
+};
+export type WorkflowRule = 'yes' | 'no' | 'free';
+
+export interface WorkflowViolation {
+  flagRef: WorkflowFlagRef;
+  flagLabel: string;
+  required: 'true' | 'false';
+  state: string;
+  failureReason?: string;
+}
+
+const GATED_TYPES = ['Product Backlog Item', 'Bug'] as const;
+
+/**
+ * Evaluate the RESULTING (state, flags) pair against the matrix. One
+ * violation per breached yes/no row; `free` rows and exempt types
+ * (Feature/Epic) yield none. A flag absent from `flags` counts as false,
+ * matching an unset Azure boolean. A state outside the seven board states
+ * has no rows and yields no violations.
+ */
+export function evaluateWorkflowState(
+  workItemType: string,
+  state: string,
+  flags: Partial<Record<WorkflowFlagRef, boolean>> = {},
+): WorkflowViolation[] {
+  if (!(GATED_TYPES as readonly string[]).includes(workItemType)) return [];
+  const rules = WORKFLOW_STATE_RULES[state as WorkflowState];
+  if (!rules) return [];
+  const violations: WorkflowViolation[] = [];
+  for (const flagRef of WORKFLOW_FLAG_REFS) {
+    const rule = rules[flagRef];
+    if (rule === 'free') continue;
+    if ((flags[flagRef] ?? false) !== (rule === 'yes')) {
+      violations.push({
+        flagRef,
+        flagLabel: WORKFLOW_FLAG_LABELS[flagRef],
+        required: rule === 'yes' ? 'true' : 'false',
+        state,
+        ...(WORKFLOW_FAILURE_REASONS[flagRef] === undefined ? {} : { failureReason: WORKFLOW_FAILURE_REASONS[flagRef] }),
+      });
+    }
+  }
+  return violations;
+}
+
+export function formatWorkflowViolation(violation: WorkflowViolation): string {
+  const reason = violation.failureReason === undefined ? '' : ` (${violation.failureReason})`;
+  return `fenced by workflow matrix: State '${violation.state}' requires '${violation.flagLabel}' to be ${violation.required}${reason}`;
+}
+
+/** One refusal line per violation, joined for a loud multi-line error. */
+export function formatWorkflowRefusal(violations: WorkflowViolation[]): string {
+  return violations.map(formatWorkflowViolation).join('\n');
+}
+
+/**
+ * Pick the workflow flags out of a raw fields record (an Azure work item's
+ * `fields`, or a write's `fields` argument). Only strict booleans count;
+ * anything else is coerced to false rather than guessed at.
+ */
+export function pickWorkflowFlags(fields: Record<string, unknown> | undefined): Partial<Record<WorkflowFlagRef, boolean>> {
+  const flags: Partial<Record<WorkflowFlagRef, boolean>> = {};
+  for (const flagRef of WORKFLOW_FLAG_REFS) {
+    if (fields !== undefined && flagRef in fields) flags[flagRef] = fields[flagRef] === true;
+  }
+  return flags;
+}

package/packages/fleet/manifest.json

@@ -3,7 +3,7 @@
     "schema": 1,
     "repository": "https://dev.azure.com/amsterdamdatalabs/Infrastructure-AzDo/_git/adl-agent-control",
     "branch": "main",
-    "interval_seconds": 21600,
+    "interval_seconds": 43200,
     "update_policy": "latest-stable",
     "allow_major_updates": true,
     "remove_deleted_entries": true,
@@ -23,22 +23,33 @@
     "vscode_settings": {
       "enabled": true
     },
+    "repo_maintain": {
+      "branch_max_age_days": 7
+    },
     "scratch_reap": {
       "enabled": true,
       "idle_days": 1,
       "reap_days": 7,
       "remove_worktrees": true
     },
+    "brew_upgrade_exclude": [],
     "protected_tools": ["git", "jq"],
     "git_global_config": {
+      "credential.helper": ["", "{git-credential-manager}"],
+      "credential.https://dev.azure.com.useHttpPath": "true",
       "lfs.ssh://ssh.dev.azure.com/.sshtransfer": "never",
-      "lfs.https://ssh.dev.azure.com/.locksverify": "false"
-    },
-    "azure_agents": {
-      "organization": "amsterdamdatalabs",
-      "pool_id": 1,
-      "coordinator": "hostinger-vps-1",
-      "enabled_agents": ["mac-m5-ci", "hostinger-vps-1-agent-1", "hostinger-vps-1-agent-2"]
+      "lfs.https://ssh.dev.azure.com/.locksverify": "false",
+      "push.autoSetupRemote": "true",
+      "push.default": "current",
+      "branch.autoSetupMerge": "simple",
+      "init.defaultBranch": "main",
+      "advice.addEmbeddedRepo": "false",
+      "fetch.prune": "true",
+      "pull.rebase": "false",
+      "rerere.enabled": "true",
+      "merge.conflictStyle": "zdiff3",
+      "diff.algorithm": "histogram",
+      "core.autocrlf": "false"
     }
   },
   "mac": {
@@ -48,7 +59,7 @@
         "ast-grep": {"manager": "brew", "package": "ast-grep", "executable": "ast-grep"},
         "azure-cli": {"manager": "brew", "package": "azure-cli", "executable": "az"},
         "bun": {"manager": "brew", "package": "bun", "executable": "bun"},
-        "adl-embedding": {"manager": "embedding-model", "package": "adl-embedding", "executable": "adl-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
+        "enact-embedding": {"manager": "embedding-model", "package": "enact-embedding", "executable": "enact-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
         "code-review-graph": {"manager": "pip", "package": "code-review-graph", "executable": "code-review-graph"},
         "crg": {"manager": "shim", "package": "code-review-graph", "executable": "/usr/local/bin/crg"},
         "curl": {"manager": "brew", "package": "curl", "executable": "curl"},
@@ -62,44 +73,31 @@
         "git": {"manager": "brew", "package": "git", "executable": "git"},
         "jq": {"manager": "brew", "package": "jq", "executable": "jq"},
         "just": {"manager": "brew", "package": "just", "executable": "just"},
-        "lean-ctx": {"manager": "release-archive-latest", "package": "lean-ctx", "executable": "/usr/local/bin/lean-ctx", "repo": "yvgude/lean-ctx", "asset": "lean-ctx-aarch64-apple-darwin.tar.gz", "checksums_asset": "SHA256SUMS", "archive_executable": "lean-ctx"},
         "node": {"manager": "brew", "package": "node", "executable": "node"},
+        "orca": {"manager": "brew", "package": "stablyai/orca/orca", "tap": "stablyai/orca", "executable": "orca", "reason": "Stably's Orca agent runtime (com.stablyai.orca), official tap. Cask auto_updates: reconcile installs when missing and never fights the in-app stable-channel updater. No version pinned here. Linux CLI (orca-ide) has no cask — still undeclared, see plans/GAPS-AND-FINDINGS.md."},
         "ripgrep": {"manager": "brew", "package": "ripgrep", "executable": "rg"},
         "search": {"manager": "shim", "package": "enact-docs-search", "executable": "/usr/local/bin/search"},
         "shellcheck": {"manager": "brew", "package": "shellcheck", "executable": "shellcheck"},
         "shfmt": {"manager": "brew", "package": "shfmt", "executable": "shfmt"},
         "uv": {"manager": "brew", "package": "uv", "executable": "uv"},
         "yq": {"manager": "brew", "package": "yq", "executable": "yq"}
-      },
-      "launch_agents": {
-        "git-maintain": {
-          "label": "com.adl.git-maintain",
-          "source": "packages/fleet/jobs/git-maintain",
-          "entry": "src/main.ts",
-          "start_interval_seconds": 86400,
-          "run_at_load": true,
-          "repo_scope": {"root": "Documents", "glob": "*", "recursive": true},
-          "environment": {
-            "PATH": "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
-          },
-          "log": "Library/Logs/adl/git-maintain.log",
-          "replaces": [".local/bin/git-maintain.sh"]
-        }
       }
     },
     "devices": {
       "m3": {
         "administrator": "tarunrana",
         "default_agent": "agent-tarun",
+        "git_user": {"name": "Tarun Rana", "email": "tarun.rana@amsterdamdatalabs.com"},
         "home": "/Users/tarunrana",
         "minimum_free_gib": 20,
         "schedule_minute": 5,
+        "repo_location": "/Users/tarunrana/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
           {"name": "codex", "manager": "brew", "command": "brew", "update_args": ["upgrade", "--cask", "codex"]},
           {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
-          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "bun", "package": "opencode-ai", "command": "opencode"},
           {"name": "agent", "manager": "native", "command": "agent", "update_args": ["update"]}
         ],
         "tools": {
@@ -111,15 +109,17 @@
       "m5": {
         "administrator": "ranahome",
         "default_agent": "agent-tarun",
+        "git_user": {"name": "Tarun Rana", "email": "tarun.rana@amsterdamdatalabs.com"},
         "home": "/Users/ranahome",
         "minimum_free_gib": 20,
         "schedule_minute": 35,
+        "repo_location": "/Users/ranahome/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
           {"name": "codex", "manager": "brew", "command": "brew", "update_args": ["upgrade", "--cask", "codex"]},
           {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
-          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "bun", "package": "opencode-ai", "command": "opencode"},
           {"name": "agent", "manager": "native", "command": "agent", "update_args": ["update"]}
         ],
         "tools": {
@@ -133,12 +133,16 @@
   "linux": {
     "common": {
       "os_upgrade": true,
+      "git_global_config": {
+        "credential.credentialStore": "cache",
+        "credential.cacheOptions": "--timeout 604800"
+      },
       "tools": {
         "agent-vault-cli": {"manager": "release-archive-latest", "package": "agent-vault", "executable": "/usr/local/bin/agent-vault", "repo": "Infisical/agent-vault", "asset": "agent-vault_{version}_linux_amd64.tar.gz", "checksums_asset": "checksums.txt", "archive_executable": "agent-vault"},
         "ast-grep": {"manager": "brew", "package": "ast-grep", "executable": "ast-grep"},
         "azure-cli": {"manager": "brew", "package": "azure-cli", "executable": "az"},
         "bun": {"manager": "brew", "package": "bun", "executable": "bun"},
-        "adl-embedding": {"manager": "embedding-model", "package": "adl-embedding", "executable": "adl-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
+        "enact-embedding": {"manager": "embedding-model", "package": "enact-embedding", "executable": "enact-embedding/model/model.bin", "version": "0.0.1", "source": "minishlab/potion-multilingual-128M", "vocab_limit": 150000, "dim": 256, "reason": "Model data is downloaded and verified into the per-user cache; it is not an Adl code component."},
         "code-review-graph": {"manager": "pip", "package": "code-review-graph", "executable": "code-review-graph"},
         "crg": {"manager": "shim", "package": "code-review-graph", "executable": "/usr/local/bin/crg"},
         "curl": {"manager": "brew", "package": "curl", "executable": "curl"},
@@ -152,7 +156,6 @@
         "git": {"manager": "brew", "package": "git", "executable": "git"},
         "jq": {"manager": "brew", "package": "jq", "executable": "jq"},
         "just": {"manager": "brew", "package": "just", "executable": "just"},
-        "lean-ctx": {"manager": "release-archive-latest", "package": "lean-ctx", "executable": "/usr/local/bin/lean-ctx", "repo": "yvgude/lean-ctx", "asset": "lean-ctx-x86_64-unknown-linux-gnu.tar.gz", "checksums_asset": "SHA256SUMS", "archive_executable": "lean-ctx"},
         "node": {"manager": "brew", "package": "node", "executable": "node"},
         "ripgrep": {"manager": "brew", "package": "ripgrep", "executable": "rg"},
         "search": {"manager": "shim", "package": "enact-docs-search", "executable": "/usr/local/bin/search"},
@@ -165,15 +168,16 @@
       "hostinger-vps-1": {
         "administrator": "root",
         "default_agent": "agent-tarun",
+        "git_user": {"name": "Tarun Rana", "email": "tarun.rana@amsterdamdatalabs.com"},
         "home": "/root",
         "minimum_free_gib": 25,
         "schedule_minute": 50,
         "scratch_repos": ["/root/enact-webview"],
-        "git_maintain_repos": ["/opt/adl-azdo"],
+        "repo_location": "/root/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
-          {"name": "opencode", "manager": "native", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "bun", "package": "opencode-ai", "command": "opencode"},
           {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]},
           {"name": "codex", "manager": "unknown", "report_only": true, "executable": "/root/codex"}
         ],
@@ -186,14 +190,15 @@
       "strato-vps-1": {
         "administrator": "root",
         "default_agent": "agent-tarun",
+        "git_user": {"name": "Tarun Rana", "email": "tarun.rana@amsterdamdatalabs.com"},
         "home": "/root",
         "minimum_free_gib": 25,
         "schedule_minute": 20,
         "scratch_repos": ["/root/enact-webview"],
-        "git_maintain_repos": ["/opt/adl-azdo"],
+        "repo_location": "/root/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
-          {"name": "opencode", "manager": "npm", "command": "opencode", "update_args": ["upgrade"]},
+          {"name": "opencode", "manager": "bun", "package": "opencode-ai", "command": "opencode"},
           {"name": "kimi", "manager": "native", "command": "kimi", "update_args": ["upgrade"]}
         ],
         "tools": {

package/packages/fleet/manifest.schema.json

@@ -8,7 +8,7 @@
   "properties": {
     "config": {
       "type": "object",
-      "required": ["schema", "repository", "branch", "interval_seconds", "update_policy", "allow_major_updates", "remove_deleted_entries", "global_surface_sweep", "kimi_hooks", "surface_policy", "global_agents", "vscode_settings", "scratch_reap", "protected_tools", "git_global_config", "azure_agents"],
+      "required": ["schema", "repository", "branch", "interval_seconds", "update_policy", "allow_major_updates", "remove_deleted_entries", "global_surface_sweep", "kimi_hooks", "surface_policy", "global_agents", "vscode_settings", "repo_maintain", "scratch_reap", "brew_upgrade_exclude", "protected_tools", "git_global_config"],
       "properties": {
         "global_surface_sweep": {
           "type": "object",
@@ -52,6 +52,15 @@
             "enabled": {"const": true}
           }
         },
+        "repo_maintain": {
+          "type": "object",
+          "description": "The 12-hourly repository step (adl maintain). branch_max_age_days: local branches whose tip commit is older than this many days are deleted with a WARN line carrying the tip sha; integration/main/master/develop, the checked-out HEAD and any branch checked out in a worktree are never deleted.",
+          "additionalProperties": false,
+          "required": ["branch_max_age_days"],
+          "properties": {
+            "branch_max_age_days": {"type": "integer", "minimum": 1}
+          }
+        },
         "scratch_reap": {
           "type": "object",
           "description": "Reclaim scratch-worktree disk on the devices that declare scratch_repos. The regenerable-artifact tier is always on; remove_worktrees arms the destructive tier.",
@@ -64,30 +73,40 @@
             "remove_worktrees": {"type": "boolean"}
           }
         },
-        "git_global_config": {
-          "type": "object",
-          "description": "Global git config entries set for the administrator on every host; entries removed from the manifest are unset.",
-          "propertyNames": {"pattern": "^[A-Za-z][A-Za-z0-9-]*\\..+"},
-          "additionalProperties": {"type": "string"}
-        }
+        "brew_upgrade_exclude": {
+          "type": "array",
+          "description": "Homebrew formulae and casks the automatic brew upgrade step never upgrades (an outdated excluded package is logged and skipped). Not a brew pin and not a version pin. git: every Homebrew git upgrade installs an ad-hoc-signed binary at a new Cellar path, which re-prompts the osxkeychain ACL.",
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9@._+/-]*$"}
+        },
+        "git_global_config": {"$ref": "#/$defs/git_global_config"}
       }
     },
-    "mac": {
-      "allOf": [{"$ref": "#/$defs/platform"}],
-      "properties": {
-        "common": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}},
-        "devices": {"additionalProperties": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}}}
+    "mac": {"$ref": "#/$defs/platform"},
+    "linux": {"$ref": "#/$defs/platform"}
+  },
+  "$defs": {
+    "git_global_config": {
+      "type": "object",
+      "description": "Global git config entries set for the administrator by bin/git-defaults (reconcile). A value is a string (single-valued key) or an ordered array of strings (multi-valued key, e.g. the empty-reset-then-helper pattern of credential.helper): the key is rewritten with --unset-all then --add in order when the current values differ. Keys not declared here are never touched. The only placeholder is {git-credential-manager}, resolved at run time as the administrator; when it is not installed the key is skipped with a WARN. Platform common may add keys for that platform only.",
+      "propertyNames": {"pattern": "^[A-Za-z][A-Za-z0-9-]*\\..+"},
+      "additionalProperties": {
+        "oneOf": [
+          {"type": "string"},
+          {"type": "array", "minItems": 1, "items": {"type": "string"}}
+        ]
       }
     },
-    "linux": {
-      "allOf": [{"$ref": "#/$defs/platform"}],
+    "git_user": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "email"],
+      "description": "user.name and user.email set in the administrator's global git config on this device. Every device carries the same identity so the human git setup is identical on every host.",
       "properties": {
-        "common": {"not": {"required": ["launch_agents"]}},
-        "devices": {"additionalProperties": {"not": {"required": ["launch_agents"]}}}
+        "name": {"type": "string", "minLength": 1},
+        "email": {"type": "string", "minLength": 1}
       }
-    }
-  },
-  "$defs": {
+    },
     "tool": {
       "type": "object",
       "additionalProperties": false,
@@ -101,6 +120,7 @@
         "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
         "archive_executable": {"type": "string", "pattern": "^[^/][^\\n]*$"},
         "repo": {"type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$"},
+        "tap": {"type": "string", "pattern": "^[^/\\s]+/[^/\\s]+$", "description": "brew only: tap (owner/repo) to ensure is tapped before install/upgrade — required for fully-qualified package names like stablyai/orca/orca, which Homebrew will not auto-tap. Declaring it also grants item-level brew trust (`brew trust --formula|--cask <package>`) per Homebrew ≥6 tap trust; the whole tap is never trusted."},
         "asset": {"type": "string", "pattern": "^[^/][^\\n]*$"},
         "checksums_asset": {"type": "string", "pattern": "^[^/][^\\n]*$"},
         "source": {"type": "string", "pattern": "^[^/][^\\n]*$"},
@@ -157,14 +177,18 @@
       "type": "object",
       "additionalProperties": {"$ref": "#/$defs/tool"}
     },
-    "relative_path": {"type": "string", "pattern": "^(?!/)(?!.*(^|/)\\.\\.(/|$)).+$"},
     "surface_cli": {
       "type": "object",
       "additionalProperties": false,
       "required": ["name", "manager"],
       "properties": {
         "name": {"type": "string", "minLength": 1},
-        "manager": {"enum": ["native", "npm", "brew", "unknown"]},
+        "manager": {"enum": ["native", "npm", "brew", "bun", "unknown"]},
+        "package": {
+          "type": "string",
+          "pattern": "^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$",
+          "description": "manager=bun only: the bare npm registry package, installed and updated with `bun add -g <package>@latest` as the device administrator. Never a version spec; versions are never pinned."
+        },
         "command": {"type": "string", "minLength": 1, "pattern": "^[^/]+$"},
         "executable": {"type": "string", "pattern": "^/"},
         "update_args": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}},
@@ -174,7 +198,20 @@
         {
           "if": {"properties": {"report_only": {"const": true}}, "required": ["report_only"]},
           "then": {"required": ["executable"]},
-          "else": {"required": ["command", "update_args"]}
+          "else": {"required": ["command"]}
+        },
+        {
+          "if": {"properties": {"manager": {"const": "bun"}}, "required": ["manager"]},
+          "then": {
+            "required": ["package", "command"],
+            "properties": {"report_only": {"const": false}},
+            "not": {"required": ["update_args"]}
+          },
+          "else": {
+            "not": {"required": ["package"]},
+            "if": {"properties": {"report_only": {"const": true}}, "required": ["report_only"]},
+            "else": {"required": ["update_args"]}
+          }
         },
         {
           "if": {"properties": {"manager": {"const": "brew"}}, "required": ["manager"]},
@@ -197,49 +234,17 @@
         }
       ]
     },
-    "launch_agent": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["label", "source", "entry", "start_interval_seconds", "run_at_load", "environment", "log"],
-      "properties": {
-        "label": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"},
-        "source": {"$ref": "#/$defs/relative_path", "description": "Checkout-relative job directory; reconcile compiles it to a dedicated signed binary, rebuilt when its content hash changes."},
-        "entry": {"$ref": "#/$defs/relative_path", "description": "TypeScript entry file relative to source."},
-        "start_interval_seconds": {"type": "integer", "minimum": 60},
-        "run_at_load": {"type": "boolean"},
-        "repo_scope": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["root", "glob", "recursive"],
-          "properties": {
-            "root": {"$ref": "#/$defs/relative_path", "description": "Repository scan root relative to the device administrator's home."},
-            "glob": {"type": "string", "minLength": 1},
-            "recursive": {"const": true}
-          }
-        },
-        "environment": {
-          "type": "object",
-          "propertyNames": {"pattern": "^[A-Z_][A-Z0-9_]*$"},
-          "additionalProperties": {"type": "string"}
-        },
-        "log": {"$ref": "#/$defs/relative_path"},
-        "replaces": {"type": "array", "items": {"$ref": "#/$defs/relative_path"}}
-      }
-    },
-    "launch_agents": {
-      "description": "User LaunchAgents enact-vps installs for the device administrator (macOS only).",
-      "type": "object",
-      "additionalProperties": {"$ref": "#/$defs/launch_agent"}
-    },
     "platform": {
       "type": "object",
       "required": ["common", "devices"],
       "properties": {
         "common": {
           "type": "object",
+          "additionalProperties": false,
           "required": ["tools"],
           "properties": {
             "os_upgrade": {"type": "boolean"},
+            "git_global_config": {"$ref": "#/$defs/git_global_config"},
             "tools": {"$ref": "#/$defs/tools"}
           }
         },
@@ -248,7 +253,7 @@
           "additionalProperties": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["administrator", "default_agent", "home", "minimum_free_gib", "schedule_minute", "tools"],
+            "required": ["administrator", "default_agent", "git_user", "home", "minimum_free_gib", "schedule_minute", "tools"],
             "properties": {
               "administrator": {"type": "string", "minLength": 1},
               "default_agent": {
@@ -256,6 +261,7 @@
                 "pattern": "^agent-[a-z0-9-]+$",
                 "description": "The adl identity a plain `claude`/`codex` session (no `adl run --as`) acts as on this device, and the identity host automation (sync-and-reconcile, scratch-reap) uses via git-ado. Written by reconcile to the machine's single default-agent file (docs/architecture/cli-design.md, 2026-09-27 decisions)."
               },
+              "git_user": {"$ref": "#/$defs/git_user"},
               "home": {"type": "string", "pattern": "^/"},
               "minimum_free_gib": {"type": "integer", "minimum": 1},
               "schedule_minute": {"type": "integer", "minimum": 0, "maximum": 59},
@@ -274,14 +280,10 @@
                 "items": {"type": "string", "pattern": "^/[^\\s]*[^/\\s]$"},
                 "uniqueItems": true
               },
-              "git_maintain_repos": {
-                "type": "array",
-                "description": "An explicit, closed list of repositories bin/reconcile passes to git-maintain's --repo argv, for a device whose enrolled checkout sits at a fixed path outside any device's home (the Linux VPSes' /opt/adl-azdo) rather than under a recursively-scanned ~/Documents. Never a scan root: each entry is one exact repository path, so this can never walk into an unrelated directory the way scanning a shared parent like /opt could. Case-insensitive azagent/vsts.agent ban: git-maintain itself refuses the same names again, by realpath too, at the point of actual use.",
-                "items": {
-                  "type": "string",
-                  "pattern": "^/(?!$)(?!.*\\s)(?!.*/$)(?!.*\\.\\.)(?!.*[aA][zZ][aA][gG][eE][nN][tT])(?!.*[vV][sS][tT][sS]\\.[aA][gG][eE][nN][tT]).+$"
-                },
-                "uniqueItems": true
+              "repo_location": {
+                "type": "string",
+                "description": "One absolute directory on this host. `adl reconcile` maintains (fetch --prune, fast-forward integration and main, safe branch prune, then `adl install --repo`) every IMMEDIATE child of it that carries adl-config.toml and is a git top-level, as the device administrator. It is the entire scope of that step: nothing outside it is scanned or touched, and a child that resolves outside it is refused. A missing or unreadable location fails the run; a host that declares none skips the step with a log line. The case-insensitive azagent/vsts.agent ban keeps it away from Azure Pipelines agent installs (JSON Schema `pattern` has no case-insensitive flag, so the classes are spelled out).",
+                "pattern": "^/(?!$)(?!.*\\s)(?!.*/$)(?!.*\\.\\.)(?!.*[aA][zZ][aA][gG][eE][nN][tT])(?!.*[vV][sS][tT][sS]\\.[aA][gG][eE][nN][tT]).+$"
               },
               "tools": {"$ref": "#/$defs/tools"}
             }

package/packages/fleet/src/default-agent-file.ts

@@ -22,9 +22,9 @@
  * path computation every consumer of the READ side needs too
  * (`defaultAgentFilePath`). The read itself lives in ONE place,
  * `packages/azdo/src/lib/agent-identity.ts`'s `readDefaultAgentFile` /
- * `resolveAgentIdentity` (STATUS.md 12p, W1) —
- * every reader in this repo, including this package's own scratch-reap.ts,
- * goes through that module rather than duplicating the read here.
+ * `resolveAgentIdentity` — every reader in this repo, including this
+ * package's own scratch-reap.ts, goes through that module rather than
+ * duplicating the read here.
  *
  * `root` is an injectable filesystem root so tests can point every path here
  * at a disposable directory instead of the real system path — a test must