@ashlr/hub 3.12.0 → 3.14.0

package/CHANGELOG.md

@@ -339,6 +339,163 @@ superseded, not a setup procedure. Use [runtime activation authority](docs/RUNTI
 and the [current architecture boundary](docs/ARCHITECTURE.md#legacy-fleet-activation-boundary).
 Neither the historical record nor a successful test activates a resident fleet.
 
+## [3.14.0] — 2026-09-27 UTC — talk to the Leader anywhere, and a fleet that actually runs
+
+3.13.0 turned autonomy on: grant #1 signed, the switch Autonomous, the resident daemon under the grant. Running it
+live exposed what 3.14 fixes: paid seats were invisible to the fleet, the first tick stalled on a hung install, and
+there was no real way to talk to the Leader. Installing 3.14 changes authority code, so grant #1 pauses until
+`ashlr authority re-approve` (Touch ID); then `ashlr authority resident stop` / `start` puts the daemon on this build.
+
+### Talk to the Leader — Verse, Telegram and the CLI, one thread
+
+- One Leader brain. The legacy "Elon mode" dialogue and the Director are retired into it; free text from Telegram now
+  reaches the real Leader instead of a stateless side-brain reading a June briefing (#522).
+- A durable conversation thread (`~/.ashlr/vision/leader/thread.jsonl`, scrubbed, rotated). Replies come through the
+  Leader's own seat routing and budget (Grok, then local; no tools); when it can't think it says why, never silence.
+- Operator directives ("focus: …", "stop: …", "priority: …") become standing guidance fed into every memo run.
+  Questions in memos can be answered; answers feed the next run. Class-B actions can be approved early (same checks
+  as their window closing), class-C asks are recorded.
+- Mind (⌘4) is now the conversation: threaded messages with channel badges, memo cards with Approve/Veto and veto
+  countdowns, inline answers, directive chips; ⌘K "Message the Leader…" / "Add Leader directive…"; Needs-you
+  "Answer" jumps to the question (#519).
+- Telegram is a real two-way line: replies thread into the conversation, memos arrive with [Approve] [Veto] [Details],
+  `/leader`, `/directives`, `/status`, `/help`; informational messages never queue behind an unanswered question;
+  all text HTML-escaped and split safely; digests are change-driven (silent when nothing changed); a one-time
+  migration expires the stale legacy requests that had blocked the queue since June (#520).
+- `ashlr leader say | thread | answer | approve | directives`.
+
+### Leader reliability
+
+- The "zero active goals" memos were a read bug: three goal files with 1970 timestamps made the store read
+  incomplete and the Leader treated that as none. One shared definition of an open goal now; incomplete reads are
+  reported as "at least N" (#521).
+- Seat fallback: Grok → fast local (gpt-oss 20B) → the 27B → Claude only for the weekly deep run or by opt-in
+  (`foundry.leader.claudeFallback`). Local calls stream (the 09-26 memo failed on a 300 s non-streamed fetch). Failed
+  runs retry at 15 m / 45 m / 2 h. Health (healthy/degraded/down + why) in `GET /api/verse/leader`.
+- Check-ins every 2 h during working hours when evidence changed materially (`foundry.leader.checkinHours`), capped;
+  a cross-process lock and a stale-decision re-check stop double runs between the daemon and the comms poller.
+
+### The fleet, live
+
+- Accounts: the idle Verse sidecar kept the account-metadata lease and published an empty "fresh" snapshot, so the
+  daemon saw every paid seat as unknown and only local was eligible. Idle Verse now releases the lease and stops
+  publishing; the daemon reads its own or a live holder's evidence. The Resources drawer (⌘.) shows per account
+  "Chat: ready / why" and "Fleet: ready · reserve kept / why" with the fixing command; one Local card spans Ollama,
+  LM Studio and llama-server (#531).
+- The first tick stalled ~15 min: a sibling `file:../` dependency made `bun install` hang, and the old timeout then
+  deleted `node_modules` synchronously on the main thread. Installs now run in their own process group with a hard
+  timeout, cleanup is async, per-repo and per-tick deadlines keep one bad repo from holding the rest, and
+  `ashlr daemon status` shows "tick in progress: <phase> for <duration>" (#527).
+- Repos with `file:../<sibling>` dependencies resolve siblings to pinned snapshots of their enrolled fleet mirrors;
+  pins are part of the install key and the G3 digest, so a moved sibling invalidates the proof (#532).
+- Private repos on GitHub's free plan can't have rulesets or branch protection: new grants use local enforcement with
+  the fleet App's `ashlr/verify` there; status/setup explain the mismatch for an existing grant and re-approve
+  switches it (low risk, 4/day) (#524).
+- Command shows the rollout ladder while a grant is active (stage x of 8, progress to the next stage, grant countdown,
+  what happened last); Fleet lists every shadow decision with G0–G7 chips and why (#525).
+
+### A sidecar that can't freeze
+
+- A macOS privacy (TCC) prompt on ~/Desktop or ~/Documents froze every route for ~3 minutes after an install: a
+  synchronous folder read on the main thread waited on the dialog. The login-shell probe can no longer hang,
+  the Apps warm-up runs after startup (#518), and every Verse request path now reaches project folders
+  asynchronously with a bounded pool; `git` runs as `git -C <dir>` from `/`; routes that must start in a folder
+  check access first and answer 503 while a prompt is pending. `scripts/check-verse-sync-io.mjs` fails any new
+  `*Sync(` in a Verse API route. The Bun-only per-request usage rollup moved to the background worker (#523).
+
+### Charts
+
+- Monotone curves through every reading (no overshoot), per-series gradients, pixel-snapped hairlines, tabular
+  numerals, exact-value tooltips with local-time titles, keyboard reading, one-time draw-in (reduced-motion aware),
+  shape-matched skeletons, reserve bands on seat burn-downs, consistent provider colors (#528).
+
+Released with `npm run gate -- --base v3.13.0` (959 backend files, 22,464/22,551 tests; 218 web files,
+3,779/3,779) and a follow-up `--base a1a0b0ef` for #532 (GATE PASS). The one backend failure, a `verse-adapters`
+`elapsedMs` 0-vs-1 timing assertion in a file unchanged since 3.10, passed 51/51 in three solo reruns.
+
+## [3.13.0] — 2026-09-26 UTC — autonomy you can actually turn on
+
+3.12.0 compiled in the operator's custody key. 3.13.0 closes the gaps that kept a signed grant from doing anything:
+G7 could never pass on a repo without CI, cloud and self-improvement PRs never entered the merge gates, and the
+resident daemon could not be installed at all. Autonomy still starts only when Mason signs a standing grant (Touch
+ID), sets the switch, and runs `ashlr authority resident start` himself; `ashlr authority setup` walks every step.
+
+### A host-verified `ashlr/verify` check (G7 can pass without CI)
+
+- The ashlr-fleet App posts `ashlr/verify` on each fleet PR head from the G3 result: `success` only when G3 passed,
+  commands ran, and GitHub's head carries exactly the verified tree on the verified base; anything else is `failure`
+  (#511). The run lists the verify digest, tree, base and the commands that ran.
+- G7 on local-enforcement repos requires the App's own green `ashlr/verify`; a deploy-only green (a Vercel preview)
+  or a same-named run from any other App no longer passes. `ashlr authority protect` pins `ashlr/verify` to the App
+  even when master has no check runs. The App manifest asks for Checks: write; setup links the settings page when an
+  existing App lacks it.
+
+### Cloud and self-improvement PRs land through the standing gates
+
+- Each standing tick ingests `pr-open` cloud tasks whose repo is in the grant: identity-checked against the pinned PR
+  (head `ashlr-cloud/<task>`, unchanged base, pinned head SHA), size-capped, filed as a pending proposal with the
+  session report marked UNVERIFIED, and host-signed over the diff hash (#514). Correctness still comes from G3–G7;
+  G6 needs a non-Claude judge. Once the fleet PR opens, the cloud PR is closed as superseded and the task follows the
+  fleet PR to `merged`.
+- Needs-you can Land, Close or Update a cloud PR, with an inline gate preview (G1/G1b/G2/G4 on the pinned diff,
+  GitHub mergeability and checks), multi-select and "Land all clean" (#508).
+- Self-improvement waits for review: at `selfImprove.maxOpenPrs` (default 3) open PRs it stops launching
+  (`ashlr cloud budget --self-improve-max-open <n>`) (#508).
+- Every cloud task has an evidence timeline — objective, session, worker, report (a claim), PR, diff, checks, gates,
+  merge, release, health, cost (an estimate) — each step marked verified, claim or unknown (#507).
+
+### Rerun-safe autonomy setup, and a live setup checklist in Verse
+
+- `ashlr authority setup` is safe to rerun. The provenance key is rotated
+  only once; the rotation is recorded, so a rerun with `--yes` no longer
+  invalidates pending proposals. A ruleset GitHub already holds with the same
+  content is reported `already` and is not applied again, and
+  `protect --apply` skips it too. The GitHub App counts as done only once it
+  is installed on the enrolled repos; until then setup prints the install
+  page.
+- A failure in the App flow, the Claude token prompt, key creation or the
+  grant draft is recorded as a failed step, and the run still ends with its
+  summary.
+- The `--dry-run --json` checklist now gives each open step the command
+  that moves it on, plus a `link` where there is one (the install page or the
+  trust-root PR). Both fields are additive to `ashlr.authority-setup.v1`.
+- New read-only route `GET /api/verse/authority/setup` serves the dry run's
+  checklist, cached for 30 s. It never prompts, signs or opens a browser, and
+  it runs only bounded `gh api` reads.
+- Verse's "Autonomy is off" state and onboarding step 4 show that checklist:
+  the next step with what it needs and the command to copy for it, plus
+  every step. Verse no longer asks the server for a grant draft on load (a
+  dormant fleet used to log a 409 there on every launch). It drafts only
+  when you open the Touch ID sheet.
+
+### Resident runtime under the standing grant
+
+- Adds `ashlr authority resident start|stop|status`. `start` installs or
+  restarts `ai.ashlr.daemon` only under an active Touch-ID-signed standing
+  grant, from a clean compiled release, with Stop off. You run it yourself in a
+  terminal: agent, daemon or swarm environments, a redirected HOME, no TTY and
+  `--yes` are all refused. It claims a single-use capability before any launchd
+  effect and records the start in the authority ledger.
+- Regenerates the launchd plist (budget, interval, parallelism) from config on
+  every start. `status` and setup report drift after a config change.
+- `ashlr authority setup` now reports the resident step as already in place,
+  waiting on you with the exact command, or blocked on a missing prerequisite,
+  instead of a permanent build block.
+- The legacy install, reinstall, repair and restart paths stay denied, and the
+  permit-based compiled roots stay empty.
+- See [docs/RESIDENT-RUNTIME.md](docs/RESIDENT-RUNTIME.md).
+
+### Verse's own improvements
+
+- A spent seat reports when it actually reopens (the latest reset among its spent windows) (#499).
+- Budget, decisions, capacity, session-meta and activity read failures return a 503 with a plain sentence instead of
+  defaults or empty lists, and the UI says so (#501).
+- Lane and seat reasons are written in plain words on the server; older journal wording is still rewritten (#504).
+- A regression test pins Pulse's local-day labels outside UTC (#505).
+
+Released with `npm run gate -- --base v3.12.0`: GATE PASS in 43m29s (854 backend files, 19,846/19,924 tests with
+known failures; 190 web files, 3,335/3,335).
+
 ## [3.12.0] — 2026-09-26 UTC — your key is the trust root, and Verse says one clear next step
 
 **Your custody key is compiled in.** `src/core/authority/trust-roots.ts` now carries Mason's Secure Enclave key

package/README.md

@@ -168,23 +168,26 @@ ID).
    `ashlr cloud launch "<task>" --repo owner/name` ([cloud lane](#the-cloud-lane)).
 7. **Inspect autonomy preparation** with `ashlr authority setup --dry-run --json`
    and `ashlr authority status`. Guided setup can prepare prerequisites after
-   your explicit actions; this build cannot activate resident fleet work.
+   your explicit actions; once your standing grant is active,
+   `ashlr authority resident start` runs the resident fleet under it.
 
 ---
 
-## Autonomy commissioning path (currently unavailable)
+## Autonomy commissioning path
 
 **Current release status:** `ashlr authority setup` is a resumable preparation
 workflow. Its dry run is read-only; a live run can create custody, GitHub and
-grant state after your explicit actions. It never installs or restarts the
-daemon. Service install, repair and restart authority is withheld, compiled
-daemon and conductor trust roots are empty, and the native resident-start broker
-is absent. Non-dry resident work remains dormant. The setup checklist reports
-this runtime block even if every preparatory step is complete.
-
-Autonomy ships **dormant**. Guided setup can help prepare a standing grant, but
-that grant alone does not admit resident activation. The compiled execution
-roots and native release boundary must be provisioned through reviewed releases.
+grant state after your explicit actions. Setup itself never installs or restarts
+the daemon. The legacy service paths (`ashlr daemon install`, `ashlr setup`,
+`worker setup`, `update`) remain temporarily unavailable for install, reinstall, repair and restart and support status and uninstall only; the permit-based compiled daemon and conductor trust roots are empty.
+The resident runtime instead runs under your **standing grant**
+([docs/RESIDENT-RUNTIME.md](docs/RESIDENT-RUNTIME.md)): with a Touch-ID-signed
+grant active, `ashlr authority resident start`, typed by you in your own
+terminal, installs `ai.ashlr.daemon` from a clean release with its plist
+regenerated from config. Every tick re-verifies the grant, Stop and the switch.
+
+Autonomy ships **dormant**: nothing runs until your custody key is compiled in,
+you sign a grant, and you start the resident service yourself.
 
 ```sh
 ashlr authority setup --dry-run   # print every step and what it would do
@@ -193,8 +196,12 @@ ashlr authority setup --dry-run --json  # machine-readable checklist and runtime
 ashlr authority status            # grant, switch, Stop, rollout stage, ledger, custody
 ```
 
-`setup` performs each available step and pauses for the steps marked ✋. It
-cannot complete resident commissioning in the current build.
+`setup` performs each available step and pauses for the steps marked ✋. Its
+last step reports the resident runtime: in place, waiting on the exact command,
+or blocked on a missing prerequisite. Rerunning it is safe: whatever is already
+in place is reported `already` and left alone (the provenance key is rotated
+only once). Verse shows the same checklist, with the next step's command to
+copy.
 
 1. ✋ **Install the custody helper:** `sudo scripts/install-custody.sh`
    (root-owned, in `/usr/local/libexec/`).
@@ -218,9 +225,15 @@ cannot complete resident commissioning in the current build.
 9. **Rotate the provenance HMAC key** (`ashlr authority rotate-provenance`).
 10. ✋ **Sign the first grant** (Touch ID) and, optionally, set the switch to
     Autonomous. The grant starts on the shadow stage of its rollout ladder.
+11. ✋ **Start the resident daemon** in your own terminal:
+    `ashlr authority resident start`. It refuses agents, a dirty build, Stop,
+    the switch at Off and an inactive grant, shows the release, plist and daily
+    budget, and asks you to confirm. `ashlr authority resident status` shows
+    drift after a config change; `ashlr authority resident stop` removes the
+    service.
 
-After a future reviewed resident activation release, standing grants require
-Touch ID reapproval every 30 days or after authority code changes.
+Standing grants require Touch ID reapproval every 30 days or after authority
+code changes; until then the resident daemon parks without working.
 
 **What a grant allows.** A standing grant names the repositories, engines, risk
 and size caps, spend ceiling and Leader classes, and is valid for at most 30
@@ -398,7 +411,7 @@ runtime authority.
 | Judge-free evidence merge | **Off** | Base- and diff-bound deterministic verification, signed provenance/evidence, strict scope/risk policy, and live protected-branch checks | Protected remote PR handoff only; no local fallback, self-target merge, partial capture, or build/CI/manifest change |
 | Cloud task | Operator-invoked, or self-improvement under its budget | The cloud budget gates and a signed-in `claude-a` seat | A draft PR on `ashlr-cloud/<taskId>`; never merges |
 | Deploy | Never performed by the daemon | Explicit `ashlr ship --deploy <target> --confirm` after pre-ship checks | Runs the selected production deploy command |
-| OS service mutation | **Temporarily unavailable** | No production install/reinstall/repair/restart authority is currently issued | Existing services expose status and uninstall only; no live one-shot or resident start is admitted |
+| OS service mutation | **Temporarily unavailable** on legacy paths | No install/reinstall/repair/restart authority on `daemon install` / `setup` / `update`; the resident service installs only through `ashlr authority resident start` under an active standing grant | Legacy paths expose status and uninstall only; `resident start` installs `ai.ashlr.daemon` after your confirmation |
 
 No successful test, model verdict, or proposal record grants deployment or service-install authority. Those are separate operator commands.