@aria_asi/cli 0.2.40 → 0.2.41

package/runtime-src/codex-bridge.mjs

@@ -13,7 +13,7 @@ const require = createRequire(import.meta.url);
 const { WebSocketServer, WebSocket } = require('ws');
 
 const HOME = homedir();
-const LOG_PATH = `${HOME}/.aria/runtime/logs/codex-bridge.log`;
+const LOG_PATH = process.env.ARIA_CODEX_BRIDGE_LOG_PATH || `${HOME}/.aria/runtime/logs/codex-bridge.log`;
 const RUNTIME_BASE_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
 const BRIDGE_PORT = Number(process.env.ARIA_CODEX_BRIDGE_PORT || '4320');
 const DOWNSTREAM_PORT = Number(process.env.ARIA_CODEX_DOWNSTREAM_PORT || '4321');
@@ -21,6 +21,36 @@ const BRIDGE_HOST = process.env.ARIA_CODEX_BRIDGE_HOST || '127.0.0.1';
 const DOWNSTREAM_URL = process.env.ARIA_CODEX_DOWNSTREAM_URL || `ws://${BRIDGE_HOST}:${DOWNSTREAM_PORT}`;
 const DOWNSTREAM_STARTUP_GRACE_MS = Number(process.env.ARIA_CODEX_DOWNSTREAM_STARTUP_GRACE_MS || '5000');
 const BRIDGE_WARNING_METHOD = 'guardianWarning';
+const CODEX_FORCED_SKILLS = Object.freeze([
+  'aria-cognition-autofire',
+  'aria-first-class-operating-contract',
+  'aria-cognition-batch',
+  'aria-quality-audit',
+  'aria-repo-doctrine',
+  'aria-http-harness-client',
+  'aria-harness-substrate-binding',
+  'aria-axioms-first-principles',
+  'never-guess',
+  'tadabbur',
+  'tadabbur-ops',
+  'tafakkur',
+  'qiyas-analogy',
+  'forge-quality-rules',
+  'aria-task-codex-executor',
+  'aria-backend-architect',
+  'aria-harness-no-stripping',
+  'aria-readable-output',
+  'aria-ledger-fleet-execution',
+  'predictor',
+  'aria-aristotle-pre-phase',
+  'aria-aristotle-intra-phase',
+  'aria-aristotle-post-phase',
+  'mizan',
+  'ghazali-8lens',
+  'aria-noor-cognitives',
+]);
+
+const CODEX_FORCED_SKILL_FLOOR = 50;
 
 let downstreamProcess = null;
 let downstreamProcessStarting = null;
@@ -126,6 +156,19 @@ async function postRuntime(pathname, body) {
   return parsed;
 }
 
+function remoteCoachEnabled() {
+  return /^(?:1|true|yes|on)$/i.test(String(
+    process.env.ARIA_REMOTE_COACH_ENABLED ||
+    process.env.ARIA_RUNTIME_COACH_ENABLED ||
+    process.env.ARIA_COACH_REMOTE_ENABLED ||
+    ''
+  ));
+}
+
+function externalDownstreamEnabled() {
+  return /^(?:1|true|yes|on)$/i.test(String(process.env.ARIA_CODEX_BRIDGE_EXTERNAL_DOWNSTREAM || ''));
+}
+
 function ensureTurnState(threadId, turnId) {
   const key = `${threadId}:${turnId}`;
   let state = turnState.get(key);
@@ -139,6 +182,7 @@ function ensureTurnState(threadId, turnId) {
       bufferedAgentNotifications: [],
       firstAgentItemId: null,
       preRecorded: false,
+      forcedSkillReceipt: null,
       traceId: `trace_${randomUUID()}`,
     };
     turnState.set(key, state);
@@ -170,6 +214,102 @@ function extractInputText(input) {
   return parts.join('\n\n').trim();
 }
 
+function prependForcedPromptToInput(input, forcedPrompt, userText) {
+  const current = Array.isArray(input) ? input.map((item) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) return item;
+    return { ...item };
+  }) : [];
+  const originalText = String(userText || extractInputText(current) || '').trim();
+  const bridgedText = [
+    '--- ARIA CODEX FORCED COGNITION PACKET ---',
+    forcedPrompt,
+    '--- /ARIA CODEX FORCED COGNITION PACKET ---',
+    '',
+    '--- CURRENT USER REQUEST ---',
+    originalText || '(no explicit user text)',
+  ].join('\n');
+
+  const textIndex = current.findIndex((item) => item && typeof item === 'object' && typeof item.text === 'string');
+  if (textIndex >= 0) {
+    current[textIndex] = {
+      ...current[textIndex],
+      text: bridgedText,
+      ariaOriginalText: current[textIndex].text,
+    };
+    return current;
+  }
+
+  return [
+    { type: 'text', text: bridgedText, ariaOriginalText: originalText },
+    ...current,
+  ];
+}
+
+async function buildForcedSkillPromptForTurn(threadId, turnId, userText, params = {}) {
+  const state = ensureTurnState(threadId, turnId);
+  const message = String(userText || 'codex turn start').trim();
+  const result = await postRuntime('/build-system-prompt', {
+    sessionId: `codex:${threadId}:${turnId}`,
+    surface: 'codex',
+    message,
+    requiredSkills: CODEX_FORCED_SKILLS,
+    allowOwnerBypass: true,
+    injection: {
+      harness: {
+        packet: {
+          harness: [
+            'surface=codex-bridge',
+            'namespace=live-codex-turn',
+            'purpose=force skill firing before cognition, before tool use, during tool use, after tool use, QA correction, and learning integration',
+          ].join('\n'),
+          sessionId: `codex:${threadId}:${turnId}`,
+          threadId,
+          turnId,
+          traceId: state.traceId,
+        },
+      },
+      task: message,
+      docs: [
+        {
+          title: 'Codex bridge forced cognition contract',
+          content: 'Apply these loaded skill bodies as binding pre-cognition, intra-cognition, post-cognition, QA, correction, verification, and learning-loop instructions before answering or using tools.',
+        },
+      ],
+      files: {},
+      loadedAt: new Date().toISOString(),
+    },
+    metadata: {
+      threadId,
+      turnId,
+      traceId: state.traceId,
+      cwd: params.cwd || null,
+      bridge: 'codex',
+    },
+  });
+
+  const missingSkills = Array.isArray(result?.missingSkillIds) ? result.missingSkillIds : [];
+  const missingCookbooks = Array.isArray(result?.missingCookbooks) ? result.missingCookbooks : [];
+  const loadedSkillIds = Array.isArray(result?.loadedSkillIds) ? result.loadedSkillIds : [];
+  if (result?.ok !== true || typeof result?.prompt !== 'string' || loadedSkillIds.length < CODEX_FORCED_SKILL_FLOOR || missingSkills.length > 0 || missingCookbooks.length > 0) {
+    throw new Error(`forced skill prompt build failed: loaded=${loadedSkillIds.length} missingSkills=${missingSkills.join(',') || 'none'} missingCookbooks=${missingCookbooks.length}`);
+  }
+
+  state.forcedSkillReceipt = {
+    promptHash: createHash('sha256').update(result.prompt).digest('hex'),
+    promptChars: result.prompt.length,
+    loadedSkillIds,
+    loadedSkillHashes: Array.isArray(result.loadedSkillHashes) ? result.loadedSkillHashes : [],
+    loadedCookbooks: Array.isArray(result.loadedCookbooks) ? result.loadedCookbooks.map((cookbook) => ({
+      skillId: cookbook.skillId,
+      cookbookName: cookbook.cookbookName,
+      hash: cookbook.hash,
+      chars: cookbook.chars,
+    })) : [],
+    builtAt: new Date().toISOString(),
+  };
+  return result.prompt;
+}
+
 function inferThreadId(params = {}) {
   return params.threadId || params.thread_id || params.turn?.threadId || params.turn?.thread_id || params.item?.threadId || params.item?.thread_id || null;
 }
@@ -479,6 +619,16 @@ async function checkActionAgainstRuntime(action, target, threadId, turnId, metad
 
 async function recordCoachPhaseForTurn(threadId, turnId, phase, patch = {}) {
   const state = ensureTurnState(threadId, turnId);
+  if (!remoteCoachEnabled()) {
+    return {
+      ok: true,
+      skipped: true,
+      permitted: true,
+      decision: 'allow',
+      phase,
+      reasons: ['remote_coach_disabled'],
+    };
+  }
   try {
     return await postRuntime('/coach/phase', {
       phase,
@@ -509,13 +659,24 @@ async function recordCoachPhaseForTurn(threadId, turnId, phase, patch = {}) {
 async function recordMizanPre(threadId, turnId) {
   const state = ensureTurnState(threadId, turnId);
   try {
+    const preEvidenceRefs = [
+      makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId }),
+      ...(state.forcedSkillReceipt
+        ? [makeEvidenceRef('codex_forced_skill_prompt', state.forcedSkillReceipt, { threadId, turnId, traceId: state.traceId })]
+        : []),
+    ];
     await recordCoachPhaseForTurn(threadId, turnId, 'pre_turn', {
       text: state.userText || 'codex turn start',
-      evidenceRefs: [makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId })],
+      evidenceRefs: preEvidenceRefs,
+      metadata: { forced_skill_receipt: state.forcedSkillReceipt },
     });
     await recordCoachPhaseForTurn(threadId, turnId, 'pre_cognition', {
       text: state.userText || 'codex pre-cognition',
-      evidenceRefs: [makeEvidenceRef('codex_pre_cognition_request', state.userText, { threadId, turnId, traceId: state.traceId })],
+      evidenceRefs: [
+        makeEvidenceRef('codex_pre_cognition_request', state.userText, { threadId, turnId, traceId: state.traceId }),
+        ...preEvidenceRefs.slice(1),
+      ],
+      metadata: { forced_skill_receipt: state.forcedSkillReceipt },
     });
     const result = await postRuntime('/mizan/pre', {
       sessionId: `codex:${threadId}:${turnId}`,
@@ -533,7 +694,8 @@ async function recordMizanPre(threadId, turnId) {
         platform: 'codex',
         userText: state.userText,
         traceId: state.traceId,
-        evidenceRefs: [makeEvidenceRef('user_input', state.userText, { threadId, turnId, traceId: state.traceId })],
+        evidenceRefs: preEvidenceRefs,
+        forcedSkillReceipt: state.forcedSkillReceipt,
       },
     });
     state.preReceiptId = result?.receipt?.receiptId || null;
@@ -541,8 +703,9 @@ async function recordMizanPre(threadId, turnId) {
       text: state.userText || 'codex post-cognition',
       evidenceRefs: [
         makeEvidenceRef('mizan_pre_receipt', result?.receipt || null, { threadId, turnId, traceId: state.traceId }),
+        ...preEvidenceRefs.slice(1),
       ],
-      metadata: { pre_receipt_id: state.preReceiptId },
+      metadata: { pre_receipt_id: state.preReceiptId, forced_skill_receipt: state.forcedSkillReceipt },
     });
   } catch (error) {
     log(`warn mizan/pre thread=${threadId} turn=${turnId} error="${error instanceof Error ? error.message : String(error)}"`);
@@ -824,6 +987,25 @@ async function releaseTurnOutput(upstream, notification) {
 }
 
 async function ensureDownstreamReady() {
+  if (externalDownstreamEnabled()) {
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      try {
+        await new Promise((resolvePromise, rejectPromise) => {
+          const socket = new WebSocket(DOWNSTREAM_URL);
+          socket.once('open', () => {
+            socket.terminate();
+            resolvePromise();
+          });
+          socket.once('error', rejectPromise);
+        });
+        return;
+      } catch {
+        await sleep(100);
+      }
+    }
+    throw new Error(`external downstream codex app-server not reachable at ${DOWNSTREAM_URL}`);
+  }
+
   if (downstreamProcess && !downstreamProcess.killed) return;
   if (downstreamProcessStarting) {
     await downstreamProcessStarting;
@@ -904,6 +1086,11 @@ async function startBridge() {
   });
 
   wss.on('connection', async (upstream) => {
+    const earlyUpstreamMessages = [];
+    const earlyUpstreamMessageHandler = (data) => {
+      earlyUpstreamMessages.push(data);
+    };
+    upstream.on('message', earlyUpstreamMessageHandler);
     await ensureDownstreamReady();
     const downstream = new WebSocket(DOWNSTREAM_URL);
     const pendingDownstreamMessages = [];
@@ -916,9 +1103,45 @@ async function startBridge() {
       pendingTurnStarts.set(String(message.id), {
         threadId,
         userText: extractInputText(params.input),
+        forcedSkillReceipt: null,
       });
     }
 
+    async function forceSkillPromptOnTurnStart(message) {
+      if (message?.method !== 'turn/start' || !message?.params?.threadId) return { ok: true, message };
+      const params = message.params;
+      const threadId = params.threadId;
+      const turnId = params.turnId || params.turn_id || `pending-${message.id ?? Date.now()}`;
+      const userText = extractInputText(params.input);
+      const state = ensureTurnState(threadId, turnId);
+      if (!state.userText && userText) state.userText = userText;
+      try {
+        const forcedPrompt = await buildForcedSkillPromptForTurn(threadId, turnId, userText, params);
+        const pending = message?.id == null ? null : pendingTurnStarts.get(String(message.id));
+        if (pending) pending.forcedSkillReceipt = state.forcedSkillReceipt;
+        return {
+          ok: true,
+          message: {
+            ...message,
+            params: {
+              ...params,
+              input: prependForcedPromptToInput(params.input, forcedPrompt, userText),
+              ariaForcedSkillIds: CODEX_FORCED_SKILLS,
+              ariaForcedSkillPromptHash: state.forcedSkillReceipt?.promptHash || null,
+            },
+          },
+        };
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        log(`block turn/start thread=${threadId} reason="${reason}"`);
+        return {
+          ok: false,
+          threadId,
+          reason: formatCodexRecoveryBlock('codex-bridge-forced-skill-prompt', reason),
+        };
+      }
+    }
+
     function takePendingTurnStart(threadId) {
       for (const [requestId, pending] of pendingTurnStarts.entries()) {
         if (pending.threadId === threadId) {
@@ -945,7 +1168,10 @@ async function startBridge() {
       const turnId = turn?.id || result.turnId || result.turn_id;
       if (!turnId) return;
       pendingTurnStarts.delete(String(message.id));
-      hydrateTurnState(pending.threadId, turnId, pending.userText);
+      const state = ensureTurnState(pending.threadId, turnId);
+      if (!state.userText && pending.userText) state.userText = pending.userText;
+      if (pending.forcedSkillReceipt && !state.forcedSkillReceipt) state.forcedSkillReceipt = pending.forcedSkillReceipt;
+      void recordMizanPreOnce(pending.threadId, turnId);
     }
 
     function sendDownstream(payload) {
@@ -973,7 +1199,7 @@ async function startBridge() {
       try { upstream.close(); } catch {}
     });
 
-    upstream.on('message', async (data) => {
+    async function handleUpstreamMessage(data) {
       const raw = typeof data === 'string' ? data : data.toString();
       let message;
       try {
@@ -988,10 +1214,29 @@ async function startBridge() {
         if (!message.params.approvalPolicy) {
           message.params.approvalPolicy = 'untrusted';
         }
+        const forced = await forceSkillPromptOnTurnStart(message);
+        if (!forced.ok) {
+          safeSendJson(upstream, makeGuardianWarning(forced.threadId || message.params.threadId, forced.reason), 'forced skill prompt warning');
+          safeSendJson(upstream, {
+            id: message.id,
+            error: {
+              code: -32000,
+              message: forced.reason,
+            },
+          }, 'forced skill prompt error');
+          return;
+        }
+        message = forced.message;
       }
 
       sendDownstream(JSON.stringify(message));
-    });
+    }
+
+    upstream.off('message', earlyUpstreamMessageHandler);
+    upstream.on('message', handleUpstreamMessage);
+    for (const earlyMessage of earlyUpstreamMessages.splice(0)) {
+      void handleUpstreamMessage(earlyMessage);
+    }
 
     downstream.on('message', async (data) => {
       const raw = typeof data === 'string' ? data : data.toString();
@@ -1050,6 +1295,7 @@ async function startBridge() {
         if (threadId && turnId) {
           const pending = takePendingTurnStart(threadId);
           const state = ensureTurnState(threadId, turnId);
+          if (pending?.forcedSkillReceipt && !state.forcedSkillReceipt) state.forcedSkillReceipt = pending.forcedSkillReceipt;
           if (!state.userText) {
             state.userText = message?.params?.turn?.input?.map?.((entry) => entry?.text).filter(Boolean).join('\n\n') || pending?.userText || '';
           }

package/runtime-src/embedded-public-key.mjs

@@ -0,0 +1,27 @@
+// embedded-public-key.mjs — Phase 2 Step 3.
+//
+// Linear: AI-11803-VNEXT-2-REDESIGN — Step 3.
+// Ledger spec: EXECUTION_LEDGER.md:1079-1085.
+//
+// The connector ships a frozen public key string at install time so the
+// verifier can validate signed packets offline (no live key-fetch in the
+// hot path; cluster outage doesn't brick the verifier).
+//
+// Doctrine:
+//  - Public key is PUBLIC by design. Embedding it in the npm package is
+//    correct — it is the verification half, not the signing half.
+//  - The private half lives ONLY in cluster env ARIA_PACKET_SIGNING_KEY_PRIVATE
+//    delivered via scripts/sync-local-env-to-cluster.sh. Never committed.
+//  - Quarterly rotation per owner decision LANDED 2026-05-12. When key rotates,
+//    publish a new connector version with the new PEM here; clients on old
+//    versions reject packets signed by the new key until they upgrade. The
+//    rotation procedure + transition-window design is Phase 2.5 work.
+//  - key_id matches the signer's default key_id constant. If they drift,
+//    verify() reports key_mismatch — that's the structural canary.
+
+export const KEY_ID = 'aria-packet-2026-q2';
+
+export const EMBEDDED_PUBLIC_KEY_PEM =
+  '-----BEGIN PUBLIC KEY-----\n' +
+  'MCowBQYDK2VwAyEAo3J8Zj61M55WFyfggKsSAmbN0/t02feFI8zK99BaJY8=\n' +
+  '-----END PUBLIC KEY-----\n';

package/runtime-src/gated-ledger.mjs

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+// ── doctrine-self-check-file: M0.SELFREVIEW.1+2 (2026-05-06) ──
+// Session added comments describing prior antipatterns being migrated.
+// Each comment names a trigger pattern; file-level ack covers them all.
+// doctrine-self-check-file: deterministic|one.?attempt session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: eventually|for now session-added-comments-describing-prior-state-or-migration
+
 /**
  * Gated Ledger — End-to-End Runtime Enforcement
  *
@@ -22,6 +28,18 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+// M0.F.X2 step 8 (2026-05-06): connector-side runtime-rails registry mirror.
+// Byte-identical to apps/arias-soul/api/lib/runtime-rails/registry.mjs
+// (verified via diff). Mirror enforced via M0.F.X2 step 7 CI guard's
+// allowlist policy + a future check-runtime-rails-connector-mirror step.
+import {
+  INTERNAL_GATE_LABEL_PATTERN,
+  COLLAPSE_PLACEHOLDER_PATTERN,
+  COMPLETION_CLAIM_PATTERN,
+  TEMPLATE_PHRASES_PATTERN,
+  KERNEL_FALLBACK_VOICE,
+  minCharsFor,
+} from './runtime-rails/registry.mjs';
 
 const HOME = homedir();
 const STATE_DIR = join(HOME, '.aria', 'runtime', 'state');
@@ -37,18 +55,29 @@ function appendRecord(record) {
   try {
     appendFileSync(GATED_LEDGER_PATH, `${JSON.stringify(record)}\n`, { mode: 0o600 });
     return true;
-  } catch { return false; }
+  } catch (err) {
+    // M0.H.X3: connector gated-ledger write failure now surfaces.
+    process.stderr.write(`[connector:gated-ledger:append-record] caught: ${err instanceof Error ? err.message : String(err)}\n`);
+    return false;
+  }
 }
 
 function hash(text) {
   return createHash('sha256').update(String(text)).digest('hex').slice(0, 16);
 }
 
-const GATE_LABEL_RX = /\b(?:personal_mouth_[a-z_]+\b|code_no_tests\b|code_fake_implementation\b|code_type_safety\b|ip_infrastructure\b|8lens_[a-z_]+\b|voice_cold_[a-z_]+\b|harness_output_gate_block\b|auto_fix:\s|personal_mouth_harness_[a-z_]+\b|personal_mouth_unsupported_[a-z_]+\b)/i;
-const COLLAPSE_RX = /I need to pause and reconsider\.?/i;
-const COMPLETION_CLAIM_RX = /\b(?:done|complete|completed|ready|verified|fixed|shipped|production-ready|passing|passed|all phases|all done)\b/i;
-const TEMPLATE_RX = /\b(?:Decision: use Owner Runtime kernels|Sequence: contract, Garden Service snapshot|Repair context loaded|Research context loaded|Action kernel engaged|I'm here with you\.\s*No fixing,\s*no task pressure)\b/i;
-const MINIMUM_CHARS = 50;
+// M0.F.X2 (2026-05-06): patterns sourced from registry. Local aliases for
+// readable downstream references.
+const GATE_LABEL_RX = INTERNAL_GATE_LABEL_PATTERN;
+const COLLAPSE_RX = COLLAPSE_PLACEHOLDER_PATTERN;
+const COMPLETION_CLAIM_RX = COMPLETION_CLAIM_PATTERN;
+const TEMPLATE_RX = TEMPLATE_PHRASES_PATTERN;
+// MINIMUM_CHARS preserved here as the connector code still uses the global
+// constant in checkQuality / isTemplateOutput. Per Phase 0 audit M0.F.X2,
+// this is a connector-side legacy check (kernel-aware floor lives on the
+// pod-side gated-ledger). Connector-tier client traffic is bounded by
+// the registry's MIN_CHARS_BY_KERNEL.default (20) — keep both for now.
+const MINIMUM_CHARS = minCharsFor('default');
 
 /** Detect deterministic/templated kernel output */
 function isTemplateOutput(text, kernel) {
@@ -80,14 +109,12 @@ function checkQuality(text) {
   return { passed: reasons.length === 0, reasons };
 }
 
-const SAFE_FALLBACKS = {
-  emotional_presence: "I'm here. Tell me what's with you right now.",
-  architect: "I need more context for a proper architecture answer.",
-  repair: "Let me trace the root cause. What's the specific error?",
-  action: "Action kernel requires confirmation. What would you like to execute?",
-  research: "Let me gather relevant information. What should I research?",
-  default: "Let me try again — that last response wasn't right.",
-};
+// M0.F.X2 (2026-05-06): SAFE_FALLBACKS sourced from canonical registry.
+// Same reconciled Aria-voice strings as apps-side gated-ledger; closes
+// the cross-package drift between apps/arias-soul/api/lib/gated-ledger.mjs
+// and packages/aria-connector/runtime-src/gated-ledger.mjs (which had
+// drifted to slightly different voices for the same kernels).
+const SAFE_FALLBACKS = KERNEL_FALLBACK_VOICE;
 
 /**
  * Enforce all gates on a kernel output.

package/runtime-src/harness-daemon.mjs

@@ -132,10 +132,36 @@ function extractPacketField(packet, field) {
 function cachedPacketMatchesRequest(envelope, body = {}) {
   const packet = envelope?.packet;
   if (!packet || typeof packet !== 'object') return false;
-  for (const field of ['stage', 'actor', 'system']) {
-    const expected = stableIdentityValue(body[field] || body.packetRequest?.[field]);
+  // Identity dimensions on which a cached packet must match the request body.
+  // Each pair maps a request-body field name to the packet-field name written
+  // into externalLines (the body uses camelCase, the packet uses snake_case).
+  //
+  // Pre-2026-05-17 this list was [stage, actor, system] only; that permissive
+  // match allowed a request for one surface to receive a packet templated for
+  // a different surface during cache hits — see
+  // memory:reference_codex_adapter_is_surface_templated.md (cache-match defect).
+  // Platform + delivery_surface are added so cross-surface consumers refresh
+  // instead of serving a stale per-surface fill from a different consumer.
+  const dims = [
+    { body: 'stage', packet: 'stage' },
+    { body: 'actor', packet: 'actor' },
+    { body: 'system', packet: 'system' },
+    { body: 'platform', packet: 'platform' },
+    { body: 'deliverySurface', packet: 'delivery_surface' },
+    // codex.ts narrows surface from three aliases:
+    //   body.deliverySurface || body.surface || body.platform
+    // Map both alternates also to packet.delivery_surface so a request that
+    // only sets body.surface OR body.platform-as-surface still rejects a
+    // cached envelope templated for a different delivery_surface. The
+    // separate 'platform → platform' check above stays for legitimate
+    // platform-as-platform tracking (e.g., body.platform=kubernetes).
+    { body: 'surface', packet: 'delivery_surface' },
+    { body: 'platform', packet: 'delivery_surface' },
+  ];
+  for (const { body: bodyField, packet: packetField } of dims) {
+    const expected = stableIdentityValue(body[bodyField] || body.packetRequest?.[bodyField]);
     if (!expected) continue;
-    const actual = extractPacketField(packet, field);
+    const actual = extractPacketField(packet, packetField);
     if (actual && actual !== expected) return false;
   }
   return true;
@@ -149,7 +175,12 @@ function loadCachedPacketEnvelope() {
       const parsed = JSON.parse(readFileSync(candidate, 'utf8'));
       const envelope = sanitizePacketEnvelope(parsed);
       if (envelope) return envelope;
-    } catch {}
+    } catch (err) {
+      // Cache file unreadable or corrupt — try the next candidate, but log
+      // so a silently-bad cache file shows up in logs per
+      // feedback_non_blocking_errors_unacceptable.md.
+      console.warn('[aria-harnessd] cached packet candidate unreadable', candidate, err?.message);
+    }
   }
   return null;
 }
@@ -195,7 +226,11 @@ function persistCachedPacketEnvelope(envelope) {
   for (const candidate of LEGACY_PACKET_CACHE_CANDIDATES) {
     try {
       writeFileSync(candidate, JSON.stringify(envelope) + '\n', { mode: 0o600 });
-    } catch {}
+    } catch (err) {
+      // Legacy-path write is best-effort (canonical write at LOCAL_PACKET_CACHE_PATH
+      // already succeeded). Log so dir-not-exist / perm issues are visible.
+      console.warn('[aria-harnessd] legacy cache write failed', candidate, err?.message);
+    }
   }
 }
 
@@ -265,7 +300,13 @@ async function refreshPacket(body = {}, apiKey = '') {
   const cacheKey = requestCacheKey(body, apiKey);
   if (refreshInFlight && refreshInFlightKey === cacheKey) return refreshInFlight;
   if (refreshInFlight) {
-    await refreshInFlight.catch(() => {});
+    // Wait for prior refresh to settle; its error is captured separately
+    // into lastRefreshError by the catch at the refreshPacket level. Log
+    // here so the wait-and-discard is not a silent swallow per
+    // feedback_non_blocking_errors_unacceptable.md.
+    await refreshInFlight.catch((err) => {
+      console.error('[aria-harnessd] prior in-flight refresh settled with error (continuing)', err?.message);
+    });
   }
   if (isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
     throw new Error(`upstream harness URL loops back to local daemon: ${UPSTREAM_HARNESS_URL}`);
@@ -312,7 +353,11 @@ async function refreshPacket(body = {}, apiKey = '') {
 function queuePacketRefresh(body, apiKey) {
   const age = packetAgeMs(cachedPacketEnvelope);
   if (refreshInFlight || age < PACKET_TTL_MS) return;
-  refreshPacket(body, apiKey).catch(() => {});
+  refreshPacket(body, apiKey).catch((err) => {
+    // Background refresh failure: do not propagate (we still have a cached
+    // envelope to serve), but surface LOUD so operators see drift.
+    console.error('[aria-harnessd] background packet refresh failed', err?.message);
+  });
 }
 
 async function resolvePacketEnvelope(packetRequest = {}, apiKey = '', message = '') {
@@ -323,7 +368,13 @@ async function resolvePacketEnvelope(packetRequest = {}, apiKey = '', message =
   if (!isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
     try {
       return await refreshPacket(packetRequest, apiKey);
-    } catch {}
+    } catch (err) {
+      // refreshPacket already wrote err.message into lastRefreshError; emit
+      // LOUD here so the upstream-fallback branch is visible in logs (the
+      // returned local doctrine envelope is silent about WHY upstream was
+      // skipped — log fixes that gap per LOUD-error doctrine).
+      console.error('[aria-harnessd] upstream refresh failed; falling back to local doctrine envelope', err?.message);
+    }
   }
   return buildLocalDoctrineEnvelope(message, lastRefreshError ? 'local-discipline-daemon-upstream-unavailable' : 'local-discipline-daemon');
 }
@@ -493,9 +544,28 @@ const server = createServer(async (req, res) => {
     res.writeHead(proxied.status, { 'content-type': proxied.contentType });
     res.end(proxied.body);
   } catch (error) {
+    // LOUD per feedback_non_blocking_errors_unacceptable.md — surface upstream
+    // URL + error name + cause chain instead of a bare "fetch failed" envelope
+    // that downstream consumers cannot diagnose. Pathname is included so the
+    // proxy hop being routed is visible in the audit trail.
+    const errName = error instanceof Error ? error.name : 'Unknown';
+    const errMsg = error instanceof Error ? error.message : String(error);
+    const cause = error instanceof Error && error.cause ? String(error.cause) : null;
+    const safePathname = (() => {
+      try { return new URL(req.url || '/', DEFAULT_URL).pathname; }
+      catch { return req.url || 'unknown'; }
+    })();
+    const detail = {
+      upstream: UPSTREAM_HARNESS_URL,
+      pathname: safePathname,
+      err_name: errName,
+      cause,
+    };
+    console.error('[aria-harnessd] proxy error', errMsg, JSON.stringify(detail));
     json(res, 500, {
       ok: false,
-      error: error instanceof Error ? error.message : String(error),
+      error: errMsg,
+      detail,
     });
   }
 });
@@ -503,6 +573,11 @@ const server = createServer(async (req, res) => {
 server.listen(DEFAULT_PORT, DEFAULT_HOST, () => {
   console.log(`[aria-harnessd] listening on ${DEFAULT_URL}`);
   if (!cachedPacketEnvelope && !isLoopedUpstream(UPSTREAM_HARNESS_URL)) {
-    refreshPacket({}, process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || '').catch(() => {});
+    refreshPacket({}, process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || '').catch((err) => {
+      // Startup-time best-effort refresh; daemon continues with whatever
+      // cached/local-doctrine envelope it has. Log LOUD so the cold-start
+      // failure is visible per feedback_non_blocking_errors_unacceptable.md.
+      console.error('[aria-harnessd] startup packet refresh failed', err?.message);
+    });
   }
 });