@askexenow/exe-os 0.9.65 → 0.9.67

package/dist/hooks/summary-worker.js

@@ -213,6 +213,11 @@ function normalizeAutoUpdate(raw) {
   const userAU = raw.autoUpdate ?? {};
   raw.autoUpdate = { ...defaultAU, ...userAU };
 }
+function normalizeOrchestration(raw) {
+  const defaultOrg = DEFAULT_CONFIG.orchestration;
+  const userOrg = raw.orchestration ?? {};
+  raw.orchestration = { ...defaultOrg, ...userOrg };
+}
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   await ensurePrivateDir(dir);
@@ -237,10 +242,15 @@ async function loadConfig() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
     if (config.dbPath.startsWith("~")) {
       config.dbPath = config.dbPath.replace(/^~/, os.homedir());
     }
+    const envDbPath = path.join(dir, "memories.db");
+    if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
+      config.dbPath = envDbPath;
+    }
     return config;
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
@@ -260,7 +270,16 @@ function loadConfigSync() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
-    return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+    normalizeOrchestration(migratedCfg);
+    const config = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
+    if (config.dbPath.startsWith("~")) {
+      config.dbPath = config.dbPath.replace(/^~/, os.homedir());
+    }
+    const envDbPath = path.join(dir, "memories.db");
+    if (process.env.EXE_OS_DIR && config.dbPath !== envDbPath && !existsSync2(config.dbPath) && existsSync2(envDbPath)) {
+      config.dbPath = envDbPath;
+    }
+    return config;
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
   }
@@ -281,6 +300,7 @@ async function loadConfigFrom(configPath) {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG };
@@ -352,6 +372,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
     CONFIG_MIGRATIONS = [
@@ -1795,6 +1819,9 @@ function getClient() {
   if (_daemonClient && _daemonClient._isDaemonActive()) {
     return _daemonClient;
   }
+  if (!_resilientClient) {
+    return _adapterClient;
+  }
   return _resilientClient;
 }
 async function initDaemonClient() {
@@ -2827,6 +2854,127 @@ async function ensureSchema() {
       VALUES (new.rowid, new.content, new.subject, new.predicate, new.object);
     END;
   `);
+  await client.executeMultiple(`
+    CREATE TABLE IF NOT EXISTS agent_sessions (
+      id              TEXT PRIMARY KEY,
+      agent_id        TEXT NOT NULL,
+      project_name    TEXT,
+      started_at      TEXT NOT NULL,
+      last_event_at   TEXT NOT NULL,
+      event_count     INTEGER NOT NULL DEFAULT 0,
+      properties      TEXT DEFAULT '{}'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_sessions_agent_time
+      ON agent_sessions(agent_id, started_at);
+
+    CREATE TABLE IF NOT EXISTS agent_goals (
+      id                TEXT PRIMARY KEY,
+      statement         TEXT NOT NULL,
+      owner_agent_id    TEXT,
+      project_name      TEXT,
+      status            TEXT NOT NULL DEFAULT 'open',
+      priority          INTEGER NOT NULL DEFAULT 5,
+      success_criteria  TEXT,
+      parent_goal_id    TEXT,
+      due_at            TEXT,
+      achieved_at       TEXT,
+      supersedes_id     TEXT,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL,
+      source_memory_id  TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goals_project_status
+      ON agent_goals(project_name, status, priority);
+
+    CREATE TABLE IF NOT EXISTS agent_events (
+      id                  TEXT PRIMARY KEY,
+      event_type          TEXT NOT NULL,
+      occurred_at         TEXT NOT NULL,
+      sequence_index      INTEGER NOT NULL,
+      actor_agent_id      TEXT,
+      agent_role          TEXT,
+      project_name        TEXT,
+      session_id          TEXT,
+      task_id             TEXT,
+      goal_id             TEXT,
+      parent_event_id     TEXT,
+      intention           TEXT,
+      outcome             TEXT,
+      evidence_memory_id  TEXT,
+      impact              TEXT,
+      payload             TEXT DEFAULT '{}',
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_time
+      ON agent_events(occurred_at, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_session_seq
+      ON agent_events(session_id, sequence_index);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_goal_time
+      ON agent_events(goal_id, occurred_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_events_memory
+      ON agent_events(evidence_memory_id);
+
+    CREATE TABLE IF NOT EXISTS agent_goal_links (
+      id           TEXT PRIMARY KEY,
+      goal_id      TEXT NOT NULL,
+      link_type    TEXT NOT NULL,
+      target_id    TEXT NOT NULL,
+      target_type  TEXT NOT NULL,
+      created_at   TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_goal_links_goal
+      ON agent_goal_links(goal_id, target_type);
+
+    CREATE TABLE IF NOT EXISTS agent_semantic_labels (
+      id                TEXT PRIMARY KEY,
+      source_memory_id  TEXT NOT NULL,
+      event_id          TEXT,
+      labeler           TEXT NOT NULL,
+      schema_version    INTEGER NOT NULL DEFAULT 1,
+      confidence        REAL NOT NULL DEFAULT 0,
+      labels            TEXT NOT NULL,
+      created_at        TEXT NOT NULL,
+      updated_at        TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_memory
+      ON agent_semantic_labels(source_memory_id, labeler);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_semantic_labels_event
+      ON agent_semantic_labels(event_id);
+
+    CREATE TABLE IF NOT EXISTS agent_reflection_checkpoints (
+      id                  TEXT PRIMARY KEY,
+      project_name        TEXT,
+      session_id          TEXT,
+      window_start_at     TEXT NOT NULL,
+      window_end_at       TEXT NOT NULL,
+      event_count         INTEGER NOT NULL DEFAULT 0,
+      goal_count          INTEGER NOT NULL DEFAULT 0,
+      success_count       INTEGER NOT NULL DEFAULT 0,
+      failure_count       INTEGER NOT NULL DEFAULT 0,
+      risk_count          INTEGER NOT NULL DEFAULT 0,
+      summary             TEXT NOT NULL,
+      learnings           TEXT NOT NULL DEFAULT '[]',
+      next_actions        TEXT NOT NULL DEFAULT '[]',
+      evidence_event_ids  TEXT NOT NULL DEFAULT '[]',
+      confidence          REAL NOT NULL DEFAULT 0,
+      created_at          TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_project_time
+      ON agent_reflection_checkpoints(project_name, window_end_at);
+
+    CREATE INDEX IF NOT EXISTS idx_agent_reflection_session_time
+      ON agent_reflection_checkpoints(session_id, window_end_at);
+  `);
   try {
     await client.execute({
       sql: `ALTER TABLE memories ADD COLUMN tier INTEGER DEFAULT 3`,
@@ -2979,12 +3127,13 @@ var keychain_exports = {};
 __export(keychain_exports, {
   deleteMasterKey: () => deleteMasterKey,
   exportMnemonic: () => exportMnemonic,
+  getKeyStorageInfo: () => getKeyStorageInfo,
   getMasterKey: () => getMasterKey,
   importMnemonic: () => importMnemonic,
   setMasterKey: () => setMasterKey
 });
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync6, statSync as statSync2 } from "fs";
 import { execSync as execSync2 } from "child_process";
 import path6 from "path";
 import os5 from "os";
@@ -2994,29 +3143,65 @@ function getKeyDir() {
 function getKeyPath() {
   return path6.join(getKeyDir(), "master.key");
 }
-function macKeychainGet() {
+function nativeKeychainAllowed() {
+  return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
+}
+function linuxSecretAvailable() {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
+  try {
+    execSync2("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+  } catch {
+    linuxSecretAvailability = false;
+    return false;
+  }
+  try {
+    execSync2("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    linuxSecretAvailability = true;
+  } catch {
+    linuxSecretAvailability = false;
+  }
+  return linuxSecretAvailability;
+}
+function isRootOnlyTrustedServerKeyFile(keyPath) {
+  if (process.platform !== "linux") return false;
+  try {
+    const uid = typeof os5.userInfo().uid === "number" ? os5.userInfo().uid : -1;
+    const st = statSync2(keyPath);
+    if (!st.isFile() || (st.mode & 63) !== 0) return false;
+    if (uid === 0) return true;
+    const exeOsDir = process.env.EXE_OS_DIR;
+    return Boolean(exeOsDir && path6.resolve(keyPath).startsWith(path6.resolve(exeOsDir) + path6.sep));
+  } catch {
+    return false;
+  }
+}
+function macKeychainGet(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return null;
   if (process.platform !== "darwin") return null;
   try {
     return execSync2(
-      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
   } catch {
     return null;
   }
 }
-function macKeychainSet(value) {
+function macKeychainSet(value, service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
     try {
       execSync2(
-        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
         { timeout: 5e3 }
       );
     } catch {
     }
     execSync2(
-      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
       { timeout: 5e3 }
     );
     return true;
@@ -3024,11 +3209,12 @@ function macKeychainSet(value) {
     return false;
   }
 }
-function macKeychainDelete() {
+function macKeychainDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "darwin") return false;
   try {
     execSync2(
-      `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+      `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -3036,22 +3222,22 @@ function macKeychainDelete() {
     return false;
   }
 }
-function linuxSecretGet() {
-  if (process.platform !== "linux") return null;
+function linuxSecretGet(service = SERVICE) {
+  if (!linuxSecretAvailable()) return null;
   try {
     return execSync2(
-      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { encoding: "utf-8", timeout: 5e3 }
     ).trim();
   } catch {
     return null;
   }
 }
-function linuxSecretSet(value) {
-  if (process.platform !== "linux") return false;
+function linuxSecretSet(value, service = SERVICE) {
+  if (!linuxSecretAvailable()) return false;
   try {
     execSync2(
-      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -3059,11 +3245,12 @@ function linuxSecretSet(value) {
     return false;
   }
 }
-function linuxSecretDelete() {
+function linuxSecretDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
   if (process.platform !== "linux") return false;
   try {
     execSync2(
-      `secret-tool clear service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
       { timeout: 5e3 }
     );
     return true;
@@ -3072,6 +3259,7 @@ function linuxSecretDelete() {
   }
 }
 async function tryKeytar() {
+  if (!nativeKeychainAllowed()) return null;
   try {
     return await import("keytar");
   } catch {
@@ -3145,7 +3333,19 @@ async function writeMachineBoundFileFallback(b64) {
   return "plaintext";
 }
 async function getMasterKey() {
-  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  let nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (!nativeValue) {
+    const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
+    if (legacyValue) {
+      const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
+      if (migrated) {
+        macKeychainDelete(LEGACY_SERVICE);
+        linuxSecretDelete(LEGACY_SERVICE);
+        process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
+      }
+      nativeValue = legacyValue;
+    }
+  }
   if (nativeValue) {
     return Buffer.from(nativeValue, "base64");
   }
@@ -3153,12 +3353,17 @@ async function getMasterKey() {
   if (keytar) {
     try {
       const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (keytarValue) {
-        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+      const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
+      if (legacyKeytarValue) {
+        const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
         if (migrated) {
           process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+          try {
+            await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+          } catch {
+          }
         }
-        return Buffer.from(keytarValue, "base64");
+        return Buffer.from(legacyKeytarValue, "base64");
       }
     } catch {
     }
@@ -3183,7 +3388,7 @@ async function getMasterKey() {
       const decrypted = decryptWithMachineKey(content, machineKey);
       if (!decrypted) {
         process.stderr.write(
-          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
         );
         return null;
       }
@@ -3192,6 +3397,9 @@ async function getMasterKey() {
       b64Value = content;
     }
     const key = Buffer.from(b64Value, "base64");
+    if (!content.startsWith(ENCRYPTED_PREFIX) && isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return key;
+    }
     const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
     if (migrated) {
       process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
@@ -3219,6 +3427,97 @@ async function getMasterKey() {
     return null;
   }
 }
+async function getKeyStorageInfo() {
+  if (macKeychainGet()) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in macOS Keychain via built-in security CLI"
+    };
+  }
+  if (macKeychainGet(LEGACY_SERVICE)) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in legacy macOS Keychain service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  if (linuxSecretGet()) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in Linux Secret Service via secret-tool"
+    };
+  }
+  if (linuxSecretGet(LEGACY_SERVICE)) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in legacy Linux Secret Service service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      if (await keytar.getPassword(SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar backend; will migrate to native keychain when possible"
+        };
+      }
+      if (await keytar.getPassword(LEGACY_SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar service exe-mem; will migrate to native exe-os keychain when possible"
+        };
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync6(keyPath)) {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "no key found in OS keychain, legacy keytar, or file fallback"
+    };
+  }
+  try {
+    const content = (await readFile3(keyPath, "utf-8")).trim();
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      return {
+        kind: "encrypted-file",
+        secure: true,
+        path: keyPath,
+        note: "stored in machine-bound encrypted file fallback"
+      };
+    }
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return {
+        kind: "server-secret-file",
+        secure: true,
+        path: keyPath,
+        note: "stored as root-only trusted server secret file"
+      };
+    }
+    return {
+      kind: "plaintext-file",
+      secure: false,
+      path: keyPath,
+      note: "stored in legacy plaintext file; reading it will migrate or encrypt it"
+    };
+  } catch {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "key file exists but could not be read"
+    };
+  }
+}
 async function setMasterKey(key) {
   const b64 = key.toString("base64");
   if (macKeychainSet(b64) || linuxSecretSet(b64)) {
@@ -3244,10 +3543,13 @@ async function setMasterKey(key) {
 async function deleteMasterKey() {
   macKeychainDelete();
   linuxSecretDelete();
+  macKeychainDelete(LEGACY_SERVICE);
+  linuxSecretDelete(LEGACY_SERVICE);
   const keytar = await tryKeytar();
   if (keytar) {
     try {
       await keytar.deletePassword(SERVICE, ACCOUNT);
+      await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
     } catch {
     }
   }
@@ -3285,12 +3587,14 @@ async function importMnemonic(mnemonic) {
   const entropy = mnemonicToEntropy(trimmed);
   return Buffer.from(entropy, "hex");
 }
-var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
+var SERVICE, LEGACY_SERVICE, ACCOUNT, linuxSecretAvailability, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
-    SERVICE = "exe-mem";
+    SERVICE = "exe-os";
+    LEGACY_SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    linuxSecretAvailability = null;
     ENCRYPTED_PREFIX = "enc:";
   }
 });
@@ -3366,7 +3670,7 @@ __export(shard_manager_exports, {
   shardExists: () => shardExists
 });
 import path7 from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync2 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readdirSync, renameSync as renameSync3, statSync as statSync3 } from "fs";
 import { createClient as createClient2 } from "@libsql/client";
 function initShardManager(encryptionKey) {
   _encryptionKey = encryptionKey;
@@ -3430,7 +3734,7 @@ async function auditShardHealth(options = {}) {
   const shards = [];
   for (const name of names) {
     const dbPath = path7.join(SHARDS_DIR, `${name}.db`);
-    const stat = statSync2(dbPath);
+    const stat = statSync3(dbPath);
     const item = {
       name,
       path: dbPath,
@@ -3683,7 +3987,7 @@ async function getReadyShardClient(projectName) {
     _shardLastAccess.delete(safeName);
     const dbPath = path7.join(SHARDS_DIR, `${safeName}.db`);
     if (existsSync7(dbPath)) {
-      const stat = statSync2(dbPath);
+      const stat = statSync3(dbPath);
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       const archivedPath = path7.join(SHARDS_DIR, `${safeName}.db.broken-${stamp}`);
       renameSync3(dbPath, archivedPath);
@@ -3803,6 +4107,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
+      {
+        title: "Customer orchestration maturity \u2014 recommend, never trap",
+        domain: "workflow",
+        priority: "p1",
+        content: "New customers start best in Phase 1: founder \u2194 coordinator/Chief of Staff, building company context. Suggest Phase 2 executives when domain work repeats; suggest Phase 3 parallel execution only when review/permission gates are ready. This is guidance, not a blocker: users may jump phases anytime. Never overwrite their phase, role titles, identities, or custom org design."
+      },
       {
         title: "Single dispatch path \u2014 create_task only",
         domain: "workflow",
@@ -3861,6 +4171,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Commit discipline \u2014 never leave verified work floating",
+        domain: "workflow",
+        priority: "p1",
+        content: "After any code-change batch passes typecheck/tests/build, run git status, summarize changed files, and commit with a clear message before ending the session. If work must remain uncommitted for review/dogfood, explicitly say so, list the files, and state the blocker. Never imply work is complete while verified changes are still floating locally."
+      },
       {
         title: "Desktop and TUI are the same product",
         domain: "architecture",
@@ -4565,8 +4881,8 @@ async function validateLicense(apiKey, deviceId) {
 }
 function getCacheAgeMs() {
   try {
-    const { statSync: statSync6 } = __require("fs");
-    const s = statSync6(CACHE_PATH);
+    const { statSync: statSync7 } = __require("fs");
+    const s = statSync7(CACHE_PATH);
     return Date.now() - s.mtimeMs;
   } catch {
     return Infinity;
@@ -5543,7 +5859,7 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync5, unlinkSync as unlinkSync7, statSync as statSync4 } from "fs";
+import { copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync9, readdirSync as readdirSync5, unlinkSync as unlinkSync7, statSync as statSync5 } from "fs";
 import path19 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
@@ -5587,7 +5903,7 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
       const filePath = path19.join(BACKUP_DIR, file);
       try {
-        const stat = statSync4(filePath);
+        const stat = statSync5(filePath);
         if (stat.mtimeMs < cutoff) {
           unlinkSync7(filePath);
           deleted++;
@@ -5605,7 +5921,7 @@ function listBackups() {
     const files = readdirSync5(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
       const p = path19.join(BACKUP_DIR, name);
-      const stat = statSync4(p);
+      const stat = statSync5(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
   } catch {
@@ -5638,8 +5954,10 @@ var init_db_backup = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
+  CLOUD_REUPLOAD_REQUIRED_MESSAGE: () => CLOUD_REUPLOAD_REQUIRED_MESSAGE,
   assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
+  clearCloudReuploadRequired: () => clearCloudReuploadRequired,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
   cloudPullBlob: () => cloudPullBlob,
@@ -5658,13 +5976,16 @@ __export(cloud_sync_exports, {
   cloudPushGraphRAG: () => cloudPushGraphRAG,
   cloudPushRoster: () => cloudPushRoster,
   cloudPushTasks: () => cloudPushTasks,
+  cloudResetMemoryBlobs: () => cloudResetMemoryBlobs,
   cloudSync: () => cloudSync,
+  getCloudReuploadRequired: () => getCloudReuploadRequired,
+  markCloudReuploadRequired: () => markCloudReuploadRequired,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync19, readdirSync as readdirSync6, mkdirSync as mkdirSync10, appendFileSync as appendFileSync3, unlinkSync as unlinkSync8, openSync as openSync2, closeSync as closeSync2, statSync as statSync5 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, existsSync as existsSync19, readdirSync as readdirSync6, mkdirSync as mkdirSync10, appendFileSync as appendFileSync3, unlinkSync as unlinkSync8, openSync as openSync2, closeSync as closeSync2, statSync as statSync6 } from "fs";
 import crypto4 from "crypto";
 import path20 from "path";
 import { homedir as homedir2 } from "os";
@@ -5711,18 +6032,36 @@ function loadPgClient() {
       const { pathToFileURL: pathToFileURL3 } = await import("url");
       const explicitPath = process.env.EXE_OS_PRISMA_CLIENT_PATH;
       if (explicitPath) {
-        const mod2 = await import(pathToFileURL3(explicitPath).href);
-        const Ctor2 = mod2.PrismaClient ?? mod2.default?.PrismaClient;
-        if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
-        return new Ctor2();
+        const mod = await import(pathToFileURL3(explicitPath).href);
+        const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+        if (!Ctor) throw new Error(`No PrismaClient at ${explicitPath}`);
+        return new Ctor();
       }
       const exeDbRoot = process.env.EXE_DB_ROOT ?? path20.join(homedir2(), "exe-db");
-      const req = createRequire3(path20.join(exeDbRoot, "package.json"));
-      const entry = req.resolve("@prisma/client");
-      const mod = await import(pathToFileURL3(entry).href);
-      const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
-      if (!Ctor) throw new Error("No PrismaClient");
-      return new Ctor();
+      const packagePath = path20.join(exeDbRoot, "package.json");
+      if (existsSync19(packagePath)) {
+        const req = createRequire3(packagePath);
+        const entry = req.resolve("@prisma/client");
+        const mod = await import(pathToFileURL3(entry).href);
+        const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
+        if (!Ctor) throw new Error("No PrismaClient");
+        return new Ctor();
+      }
+      const { Pool } = await import("pg");
+      const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+      return {
+        async $queryRawUnsafe(query, ...values) {
+          const result = await pool.query(query, values);
+          return result.rows;
+        },
+        async $executeRawUnsafe(query, ...values) {
+          const result = await pool.query(query, values);
+          return result.rowCount ?? 0;
+        },
+        async $disconnect() {
+          await pool.end();
+        }
+      };
     })().catch(() => {
       _pgFailed = true;
       _pgPromise = null;
@@ -5743,7 +6082,7 @@ async function pushToPostgres(records) {
   let inserted = 0;
   for (const rec of records) {
     try {
-      await prisma.$executeRawUnsafe(
+      const changed = await prisma.$executeRawUnsafe(
         `INSERT INTO raw.raw_events (id, source, source_id, event_type, payload, metadata, timestamp)
          VALUES (gen_random_uuid(), 'cloud_sync', $1, 'memory', $2::jsonb, $3::jsonb, $4)
          ON CONFLICT (source, source_id, event_type) DO NOTHING`,
@@ -5752,7 +6091,7 @@ async function pushToPostgres(records) {
         JSON.stringify({ agent_id: rec.agent_id, project_name: rec.project_name, tool_name: rec.tool_name }),
         rec.timestamp ? new Date(String(rec.timestamp)) : /* @__PURE__ */ new Date()
       );
-      inserted++;
+      inserted += Number(changed ?? 0);
     } catch {
     }
   }
@@ -5857,6 +6196,23 @@ async function cloudPush(records, maxVersion, config) {
     return false;
   }
 }
+async function cloudResetMemoryBlobs(config) {
+  assertSecureEndpoint(config.endpoint);
+  const resp = await fetchWithRetry(`${config.endpoint}/sync/reset-memory`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${config.apiKey}`,
+      "Content-Type": "application/json",
+      "X-Device-Id": loadDeviceId()
+    },
+    body: JSON.stringify({ confirm: "LOCAL DB IS SOURCE OF TRUTH" })
+  });
+  if (!resp.ok) {
+    throw new Error(`cloud reset failed: HTTP ${resp.status}`);
+  }
+  const data = await resp.json();
+  return { deleted: Number(data.deleted ?? 0), freedBytes: Number(data.freed_bytes ?? 0) };
+}
 async function cloudPull(sinceVersion, config) {
   assertSecureEndpoint(config.endpoint);
   try {
@@ -5876,22 +6232,61 @@ async function cloudPull(sinceVersion, config) {
     if (!response.ok) return { records: [], maxVersion: sinceVersion };
     const data = await response.json();
     const allRecords = [];
-    for (const { blob } of data.blobs ?? []) {
+    let maxReadableVersion = sinceVersion;
+    let skippedBlobs = 0;
+    for (const { version, blob } of data.blobs ?? []) {
       try {
         const compressed = decryptSyncBlob(blob);
         const json = decompress(compressed).toString("utf8");
         const records = JSON.parse(json);
         allRecords.push(...records);
+        const recordMax = records.reduce((max, rec) => {
+          const v = Number(rec.version ?? 0);
+          return Number.isFinite(v) ? Math.max(max, v) : max;
+        }, 0);
+        const blobVersion = Number(version ?? 0);
+        maxReadableVersion = Math.max(
+          maxReadableVersion,
+          Number.isFinite(blobVersion) ? blobVersion : 0,
+          recordMax
+        );
       } catch {
+        skippedBlobs++;
         continue;
       }
     }
-    return { records: allRecords, maxVersion: data.max_version ?? sinceVersion };
+    if (skippedBlobs > 0) {
+      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); pull cursor advanced only to last readable version ${maxReadableVersion}`);
+    }
+    return { records: allRecords, maxVersion: maxReadableVersion };
   } catch (err) {
     logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
     return { records: [], maxVersion: sinceVersion };
   }
 }
+async function getCloudReuploadRequired(client = getClient()) {
+  try {
+    await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    const result = await client.execute("SELECT key, value FROM sync_meta WHERE key IN ('cloud_reupload_required', 'cloud_relink_required')");
+    return result.rows.some((row) => String(row.value ?? "") === "1");
+  } catch {
+    return false;
+  }
+}
+async function clearCloudReuploadRequired(client = getClient()) {
+  await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reupload_required', '0')");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relink_required', '0')");
+  await client.execute({
+    sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reuploaded_at', ?)",
+    args: [(/* @__PURE__ */ new Date()).toISOString()]
+  });
+  await client.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
+}
+async function markCloudReuploadRequired(client = getClient()) {
+  await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_reupload_required', '1')");
+}
 async function cloudSync(config) {
   if (!isSyncCryptoInitialized()) {
     try {
@@ -5913,13 +6308,10 @@ async function cloudSync(config) {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
   try {
-    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
-    if (String(relink.rows[0]?.value ?? "") === "1") {
-      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
-    }
+    if (await getCloudReuploadRequired(client)) throw new Error(CLOUD_REUPLOAD_REQUIRED_MESSAGE);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("Paused after key rotation")) throw err;
+    if (msg === CLOUD_REUPLOAD_REQUIRED_MESSAGE || msg.includes("key rotation")) throw err;
   }
   try {
     const { getRawClient: getRawClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
@@ -6177,7 +6569,7 @@ async function cloudSync(config) {
     const { getLatestBackup: getLatestBackup2 } = await Promise.resolve().then(() => (init_db_backup(), db_backup_exports));
     const latestBackup = getLatestBackup2();
     if (latestBackup) {
-      const backupSize = statSync5(latestBackup).size;
+      const backupSize = statSync6(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
         const backupData = readFileSync13(latestBackup);
@@ -6848,7 +7240,7 @@ async function cloudPullDocuments(config) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, CLOUD_REUPLOAD_REQUIRED_MESSAGE, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -6867,6 +7259,7 @@ var init_cloud_sync = __esm({
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
+    CLOUD_REUPLOAD_REQUIRED_MESSAGE = "Cloud sync is blocked because this device rotated its memory encryption key. Run `exe-os cloud reupload` first to re-upload the cloud backup with the new key.";
     ROSTER_DELETIONS_PATH = path20.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
@@ -6973,46 +7366,6 @@ function vectorToBlob(vector) {
 // src/adapters/claude/hooks/summary-worker.ts
 init_database();
 init_notifications();
-
-// src/lib/memory-queue-client.ts
-init_exe_daemon_client();
-
-// src/lib/memory-queue.ts
-init_config();
-import { appendFileSync as appendFileSync2, readFileSync as readFileSync11, renameSync as renameSync5, unlinkSync as unlinkSync4, existsSync as existsSync15, statSync as statSync3 } from "fs";
-import path16 from "path";
-var QUEUE_PATH2 = path16.join(EXE_AI_DIR, "memory-queue.jsonl");
-var PROCESSING_PATH = QUEUE_PATH2 + ".processing";
-var TTL_MS2 = 24 * 60 * 60 * 1e3;
-function enqueueMemory(entry) {
-  appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");
-}
-
-// src/lib/memory-queue-client.ts
-async function writeMemoryViaDaemon(entry) {
-  if (process.env.EXE_IS_DAEMON === "1") {
-    enqueueMemory(entry);
-    return false;
-  }
-  if (!isClientConnected()) {
-    enqueueMemory(entry);
-    return false;
-  }
-  try {
-    const response = await sendDaemonRequest({
-      type: "write-memory",
-      entry
-    });
-    if (response.ok) return true;
-    enqueueMemory(entry);
-    return false;
-  } catch {
-    enqueueMemory(entry);
-    return false;
-  }
-}
-
-// src/adapters/claude/hooks/summary-worker.ts
 init_task_scope();
 init_employees();
 import { execSync as execSync5 } from "child_process";
@@ -7099,6 +7452,119 @@ function buildAutoCheckpoint(input) {
   };
 }
 
+// src/lib/memory-queue-client.ts
+init_exe_daemon_client();
+
+// src/lib/memory-queue.ts
+init_config();
+import { appendFileSync as appendFileSync2, readFileSync as readFileSync11, renameSync as renameSync5, unlinkSync as unlinkSync4, existsSync as existsSync15, statSync as statSync4 } from "fs";
+import path16 from "path";
+var QUEUE_PATH2 = path16.join(EXE_AI_DIR, "memory-queue.jsonl");
+var PROCESSING_PATH = QUEUE_PATH2 + ".processing";
+var TTL_MS2 = 24 * 60 * 60 * 1e3;
+function enqueueMemory(entry) {
+  appendFileSync2(QUEUE_PATH2, JSON.stringify(entry) + "\n");
+}
+
+// src/lib/memory-queue-client.ts
+async function writeMemoryViaDaemon(entry) {
+  if (process.env.EXE_IS_DAEMON === "1") {
+    enqueueMemory(entry);
+    return false;
+  }
+  if (!isClientConnected()) {
+    enqueueMemory(entry);
+    return false;
+  }
+  try {
+    const response = await sendDaemonRequest({
+      type: "write-memory",
+      entry
+    });
+    if (response.ok) return true;
+    enqueueMemory(entry);
+    return false;
+  } catch {
+    enqueueMemory(entry);
+    return false;
+  }
+}
+
+// src/lib/checkpoint-orchestrator.ts
+function toolNameForReason(reason) {
+  switch (reason) {
+    case "periodic":
+      return "auto-summary";
+    case "session-end":
+      return "SessionEnd";
+    case "pre-compact":
+      return "pre-compact-hook";
+    case "capacity-signal":
+      return "auto-checkpoint";
+  }
+}
+function importanceForReason(reason, override) {
+  if (override !== void 0) return override;
+  switch (reason) {
+    case "periodic":
+      return 7;
+    case "session-end":
+    case "pre-compact":
+    case "capacity-signal":
+      return 8;
+  }
+}
+function buildContinuityCheckpoint(input) {
+  const { checkpointText, decisionTexts } = buildAutoCheckpoint({
+    agentId: input.agentId,
+    agentRole: input.agentRole,
+    sessionId: input.sessionId,
+    projectName: input.projectName,
+    reason: input.reason,
+    memories: input.memories ?? [],
+    tasks: input.tasks ?? [],
+    maxSamples: input.maxSamples
+  });
+  const extra = input.extraSections?.filter((section) => section.trim().length > 0) ?? [];
+  return {
+    checkpointText: extra.length > 0 ? `${checkpointText}
+
+${extra.join("\n\n")}` : checkpointText,
+    decisionTexts
+  };
+}
+async function writeContinuityCheckpoint(input) {
+  const result = buildContinuityCheckpoint(input);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  await writeMemoryViaDaemon({
+    raw_text: result.checkpointText,
+    agent_id: input.agentId,
+    agent_role: input.agentRole,
+    session_id: input.sessionId,
+    tool_name: toolNameForReason(input.reason),
+    project_name: input.projectName,
+    timestamp: now,
+    importance: importanceForReason(input.reason, input.importance),
+    task_id: input.taskId,
+    memory_type: "checkpoint"
+  });
+  const decisionLimit = input.reason === "periodic" ? 3 : 5;
+  for (const decisionText of result.decisionTexts.slice(0, decisionLimit)) {
+    await writeMemoryViaDaemon({
+      raw_text: decisionText,
+      agent_id: input.agentId,
+      agent_role: input.agentRole,
+      session_id: input.sessionId,
+      tool_name: "auto-decision",
+      project_name: input.projectName,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      importance: 8,
+      memory_type: "decision"
+    });
+  }
+  return result;
+}
+
 // src/adapters/claude/hooks/summary-worker.ts
 async function main() {
   const agentId = process.env.AGENT_ID ?? "default";
@@ -7157,15 +7623,8 @@ async function main() {
     taskRows = tasks.rows;
   } catch {
   }
-  const { checkpointText: summaryText, decisionTexts } = buildAutoCheckpoint({
-    agentId,
-    agentRole,
-    sessionId: `auto-summary-${Date.now()}`,
-    projectName: primaryProject,
-    reason: "periodic",
-    memories: result.rows,
-    tasks: taskRows
-  });
+  const summarySessionId = `auto-summary-${Date.now()}`;
+  let summaryText = "";
   let limitReached = false;
   try {
     const { assertMemoryLimit: assertMemoryLimit2 } = await Promise.resolve().then(() => (init_plan_limits(), plan_limits_exports));
@@ -7183,30 +7642,16 @@ async function main() {
   }
   if (limitReached) {
   } else {
-    await writeMemoryViaDaemon({
-      raw_text: summaryText,
-      agent_id: agentId,
-      agent_role: agentRole,
-      session_id: `auto-summary-${Date.now()}`,
-      tool_name: "auto-summary",
-      project_name: primaryProject,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      importance: 7,
-      memory_type: "checkpoint"
+    const checkpointResult = await writeContinuityCheckpoint({
+      agentId,
+      agentRole,
+      sessionId: summarySessionId,
+      projectName: primaryProject,
+      reason: "periodic",
+      memories: result.rows,
+      tasks: taskRows
     });
-    for (const decisionText of decisionTexts.slice(0, 3)) {
-      await writeMemoryViaDaemon({
-        raw_text: decisionText,
-        agent_id: agentId,
-        agent_role: agentRole,
-        session_id: `auto-decision-${Date.now()}`,
-        tool_name: "auto-decision",
-        project_name: primaryProject,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        importance: 8,
-        memory_type: "decision"
-      });
-    }
+    summaryText = checkpointResult.checkpointText;
     if (!canCoordinate(agentId, agentRole)) {
       let totalErrors = 0;
       for (const [, data] of projects) {