@awebai/oats 0.22.3 → 0.22.4

package/capabilities/oats-aweb/oats.json

@@ -1,7 +1,7 @@
 {
   "capability": "oats.aweb",
   "command": "aweb",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "compatibility": {
     "oats": ">=0.22.3"
   },
@@ -42,6 +42,18 @@
       "why": "an ambient aweb pi extension, if one is installed, must honour AWEB_DELIVERY=session (0.3.10 and later); an older one would open a second event stream beside the wake broker; no extension at all is fine",
       "install": "pi install npm:@awebai/pi@latest",
       "ifInstalled": true
+    },
+    {
+      "runtime": "claude",
+      "package": "aweb-channel@awebai-marketplace",
+      "marketplace": "awebai/claude-plugins",
+      "minVersion": "1.7.9",
+      "when": {
+        "delivery": "session"
+      },
+      "why": "an ambient aweb-channel plugin for Claude Code, if one is installed, must honour AWEB_DELIVERY=session (1.7.9 and later); an older one starts its own channel server beside the wake broker and can fetch and acknowledge a message before the broker delivers it; no plugin at all is fine",
+      "install": "update the aweb-channel plugin from the awebai marketplace in Claude Code",
+      "ifInstalled": true
     }
   ],
   "skills": [

package/docs/integrations.md

@@ -148,8 +148,11 @@ soul through the binding's `settings:` map.
 - `delivery: channel | session` (default `channel`). `session` hands
   notification delivery to the host wake broker: `AWEB_DELIVERY=session` in
   the launch environment (declared by the manifest), no Claude channel flag,
-  a pi extension that honours the opt-out (`@awebai/pi` 0.3.10 or later,
-  enforced as a conditional requirement with a version floor), and a briefing
+  a pi extension that honours the opt-out (`@awebai/pi` 0.3.10 or later) and
+  a Claude Code channel plugin that does too (`aweb-channel` 1.7.9 or later),
+  both enforced as conditional requirements with a version floor when
+  installed (an older plugin starts its own channel server beside the broker
+  and can fetch a message before the broker delivers it), and a briefing
   and registration of the home with the host wake broker (`aw wake register`).
   Until an aw that ships `aw wake` exists (aweb-abil), session mode REFUSES
   to spawn rather than leave an instance that nothing wakes: it is for broker

package/docs/operating-team-migration.md

@@ -27,21 +27,25 @@ Every continuing seat must have a supported OATS launch, composition,
 status, handover and retirement path. Its outstanding work, knowledge and
 required skills must survive a change of runtime session; identity/address
 continuity follows the explicit policy for that seat.
-Every remembering role must have a tested learning path; reviewers retain
-their explicit exclusion from accumulated memory. Config discovery alone
-establishes none of this.
-
-The installed baseline is OATS 0.22.2, including native Pi/Claude/Codex,
-tmux/Herdr, shared `yolo`, remote CLI launch/terminals and deferred retirement.
-The Mac Desktop app is installed and passed packaged renderer/PTY launch checks.
-Official oats.okf 1.5.0 provides record-fed harvesting. A source candidate for
-0.22.3 adds the retained-authority binding, remote Desktop roster/actions and
-retirement corrections; that candidate is not yet a published release.
+Every remembering role must have a tested learning path. Preserve each role's
+explicit policy: Cjr reviewers exclude accumulated memory; Themis uses
+reviewed learning. Config discovery alone establishes none of this.
+
+The installed baseline is published OATS 0.22.3 on this Mac and `aweb-agents`,
+including native Pi/Claude/Codex, tmux/Herdr, shared `yolo`, remote Desktop
+roster/actions, retained-authority binding and corrected deferred retirement.
+The downloaded Mac Desktop app passed codesign, packaged renderer and PTY
+launch checks. Official oats.okf 1.5.0 provides record-fed harvesting; each
+deployment must select its authenticated provider. Version 1.5.1, adding
+harvest-runtime selection and detection of unadvanced record plans, remains
+under independent review and is not yet published.
 
 No standing seat has transferred yet. Cjr's worker pilot has landed reviewed
 code and knowledge; ordinary retirement passed using the next-patch candidate.
-A real harvester's automatic deferred completion, successor knowledge use and
-session-broker delivery remain explicit acceptance checks.
+A real harvester's automatic deferred completion and successor knowledge use
+remain explicit acceptance checks. The reviewed aweb broker candidate passed
+real harness delivery; installation of its published release as the normal
+host service remains a prerequisite for standing cutover.
 
 ## Scope inventory
 
@@ -54,10 +58,10 @@ of continuing seats.
 | `~/awebai/oats` | Live Claude coordinator and Codex lead; managed review workers also running | Oats owns coordinator handover; lead owns lead handover; preserve established identities |
 | `~/cjr` | Preparation `5afb3e8b`; developer pilot landed on master `062e2c75`; legacy Merlin and Minerva live | Merlin owns safe handovers; preserve his DID/address; prove automatic harvest completion and successor use |
 | `~/awebai/aweb` | Live Claude coordinator and frontend in legacy homes | Oats owns coordinator handover; lead coordinates frontend with aweb after its current work; preserve identities and cover child repositories |
-| `~/tsm` | Five live seats: Zeus, Prometeo, Argos, Themis on Claude; Hermes on Codex. No OATS config/souls found | Zeus prepared the five-seat handover plan; begin with Themis at a safe boundary, Zeus last; preserve session-local schedules and production authority |
+| `~/tsm` | Five live seats: Zeus, Prometeo, Argos, Themis on Claude; Hermes on Codex. First-seat Themis config/soul packet under owner review | Zeus prepared the five-seat handover plan; begin with Themis at a safe boundary, Zeus last; preserve session-local schedules and production authority |
 | `~/prj/beadhub-all` | Live Codex session, despite stale offline roster | Beadhub accepted preparation and is at a safe boundary; retain its global identity, native Codex and separate canonical code roots under `~/awebai/beadhub`; billing remains separately gated |
 | `~/prj/docflow` | Live Claude seat identified itself as local `juan.aweb.ai/alice` on `docflow:juan.aweb.ai` | Owner Juan; finish running mail backfill and register checks before transfer; retain identity, memory and Minerva route; accountant-sync remains deliberately unloaded |
-| `ai.aweb` on `aweb-agents` | Athena last seen 53 days ago; remote legacy home exists in inventory | Aweb and oats own archival inspection; do not resurrect as a continuing seat |
+| `ai.aweb` on `aweb-agents` | Aweb confirms Athena intentionally inactive; remote legacy home retained | Aweb and oats own archival inspection; do not resurrect as a continuing seat |
 | `~/awebai/demo-aweb/bob` | Live Pi demo | Aweb owns safe stop and archival disposition; it is not an operating-team migration |
 | `~/.turn-record` | Live Pi capture service under launchd | Retain as infrastructure; qualify record capture separately from standing seats |
 
@@ -101,7 +105,9 @@ uniquely named so no existing address has to be removed for the experiment.
 
 Merlin retains his identity; other continuing seats follow their accepted
 policy. Oats implemented explicit source-authority binding in oats.aweb 1.10.0,
-reviewed and pinned for the next kernel patch. A disposable rehearsal verified
+reviewed and shipped with OATS 0.22.3. Published oats.aweb 1.10.1 additionally
+requires an installed ambient Claude channel to be at least 1.7.9 for session
+delivery, matching the existing Pi extension floor of 0.3.10. A disposable rehearsal verified
 stable identity/address, existing conversations, heartbeat, exclusive holder
 refusal, rollback and authority-preserving retirement. Aweb supplied this
 supported handover:
@@ -249,9 +255,14 @@ the shared rollout record.
   session-local schedules. Production credentials remain solely with the
   authorized production operator. His plan reserves Zeus's final cutover
   for Juan's presence; the other seats can prepare in the meantime.
-- BeadHub supplied its retained-identity and source-root brief through aweb
-  mail. It awaits the reviewed declarative binding and cutover recipe.
-  Its Stripe-account dependency and production cutover gates remain separate.
+- BeadHub configuration/soul commit `3ee13a8` in `awebai/beadhub-saas`
+  (`~/awebai/beadhub/beadhub-saas`) was independently ACKed by lead and
+  landed on `main`. Its tracked deployment template is materialized at the canonical
+  parent workspace, with trusted official capabilities and a clean actual
+  doctor result. The soul retains SaaS Git provenance and uses workspace mode
+  as a coordinator across the three canonical repositories. Its legacy holder
+  remains live; authenticated harvest-model configuration and the published
+  broker service precede activation. Stripe and production gates remain separate.
 - Docflow supplied its own identity and handover through its terminal. Its
   backfill and register verification define the safe boundary. Preserve its
   Claude memory and existing credentials in place; verify filesystem/TCC
@@ -264,6 +275,23 @@ the shared rollout record.
   the cross-team coordinator identity/contact policy explicitly before
   relying on those routes; do not silently replace retained identities.
 - Real remote Claude launch, terminal input and detach survival passed.
-  Remote Desktop projection and exact-home lifecycle are under independent
-  review for the next patch. Remote harvester completion remains blocked by
-  provider authentication, and no standing remote seat is declared migrated.
+  Remote Desktop projection and exact-home lifecycle shipped in 0.22.3; the
+  installed remote CLI serves the real registered roster. Remote harvester
+  completion remains blocked by provider authentication, and no standing
+  remote seat is declared migrated.
+- The aweb broker candidate `30469e22` ran as a private launchd service against
+  published OATS 0.22.3. Real Claude and Codex sessions in tmux and Pi
+  in Herdr, with Claude channel 1.7.9 and Pi extension 0.3.10, fetched mail and replied with exact qualification tokens,
+  with all GUI viewers closed. Pi also answered a sender-waiting chat. Mail
+  sent while the broker was stopped was recovered after restart. After the
+  Codex harness stopped, its registration became inactive and a subsequent
+  message remained unread. Pause also survived a daemon restart, keeping mail
+  unread until resume, after which the agent replied. The candidate does not
+  fetch or acknowledge mail.
+  Published aw installation and standing-seat acceptance are still separate.
+- Qualification found that tmux output loses tab separators in a minimal
+  launchd environment without a UTF-8 locale. Independently reviewed kernel
+  fix `a0b0e14` adds tmux UTF-8 mode; until it ships, the host service specifies
+  `LC_ALL=en_US.UTF-8`. Existing Claude plugin 1.7.8 also consumed mail before
+  the broker wake; updating to 1.7.9 eliminated that competing delivery path.
+  The deployed oats.aweb 1.10.1 floor now rejects the incompatible version.

package/docs/release-notes/v0.22.4.md

@@ -0,0 +1,40 @@
+# OATS v0.22.4
+
+Two fixes found by running the wake broker and the record-fed harvester as
+real host services, the oats.aweb 1.10.1 floor, and the managed lead soul.
+
+## Session commands under a service locale
+
+launchd starts services without a UTF-8 locale, and tmux then replaces the
+tab delimiters in its list-panes output with underscores, so every session
+inspection from the wake broker reported an invalid pane. The shared session
+helper now runs tmux in UTF-8 mode (`-u`), which preserves the delimiters
+regardless of the service locale and makes typed input UTF-8-safe.
+
+## Record windows without the search index
+
+`recall --thread --json` used to open the record's SQLite search index just
+to extract turn text, and a capture indexing a large session cache could hold
+that database locked for longer than the harvester waits. Window reads now
+come from the journals alone; the search index opens only for indexed
+search, show and reindex.
+
+## Bundled: oats.aweb 1.10.1
+
+Session-mode delivery now requires an installed Claude Code channel plugin
+to be `aweb-channel` 1.7.9 or later (as it already required `@awebai/pi`
+0.3.10): an older plugin starts its own channel server beside the wake
+broker and can fetch a message before the broker delivers it.
+
+## Managed operating-lead soul
+
+`agents/lead/soul` is tracked: the operating lead's role instructions and
+two knowledge notes (runtime and messaging ownership; where rollout state
+lives), ready for a retained-identity binding at its cutover.
+
+## Also
+
+- `docs/operating-team-migration.md` records the published 0.22.3 rollout and
+  the live wake-broker acceptance on Claude, Codex and Pi.
+- oats.okf 1.5.1 (harvest-runtime, promotion exclusions, replan detector) is
+  not in this release; it ships when its independent review completes.

package/lib/session-input.mjs

@@ -6,7 +6,9 @@ import { inspectHerdr, inputHerdr, herdrCommand } from "./herdr.mjs";
 
 const shells = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "login"]);
 function tmux(target, args, { exec = execFileSync, input } = {}) {
-  return exec("tmux", ["-S", target.socket, ...args], {
+  // launchd does not supply a UTF-8 locale. In that environment tmux replaces
+  // the tab delimiters in list-panes output with underscores unless forced.
+  return exec("tmux", ["-u", "-S", target.socket, ...args], {
     encoding: "utf8", input, timeout: 10000, maxBuffer: 1024 * 1024,
     stdio: ["pipe", "pipe", "pipe"],
   });

package/lib/session-viewer.mjs

@@ -10,7 +10,9 @@ export function prepareSessionViewer(target, { exec = execFileSync } = {}) {
     delete env.HERDR_SESSION;
     return { binary: target.binary, args: ["terminal", "attach", target.terminalId], env, cleanup() {} };
   }
-  const run = (args) => exec("tmux", ["-S", target.socket, ...args], {
+  // UTF-8 mode (-u) like the shared session helper: a service without a
+  // UTF-8 locale (launchd) otherwise mangles tmux output.
+  const run = (args) => exec("tmux", ["-u", "-S", target.socket, ...args], {
     encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "pipe"],
   }).trim();
   const viewer = `oatsview-${process.pid}-${randomUUID().slice(0, 8)}`;
@@ -28,7 +30,7 @@ export function prepareSessionViewer(target, { exec = execFileSync } = {}) {
     run(["bind-key", "-T", "oatsview-locked", "WheelUpPane", "if-shell", "-F", "#{||:#{pane_in_mode},#{mouse_any_flag}}", "send-keys -M", "copy-mode -e; send-keys -M"]);
     run(["set-option", "-t", viewer, "mouse", "on"]);
     const env = { ...process.env }; delete env.TMUX;
-    return { binary: "tmux", args: ["-S", target.socket, "attach-session", "-t", `=${viewer}`], env, cleanup };
+    return { binary: "tmux", args: ["-u", "-S", target.socket, "attach-session", "-t", `=${viewer}`], env, cleanup };
   } catch (e) { cleanup(); throw e; }
 }
 

package/package-catalog.json

@@ -7,7 +7,7 @@
     },
     "oats.aweb": {
       "url": "https://github.com/awebai/oats-aweb.git",
-      "ref": "v1.10.0",
+      "ref": "v1.10.1",
       "path": "oats-package"
     },
     "oats.jira": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.22.3",
+  "version": "0.22.4",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/packages/record/bin/recall.mjs

@@ -23,7 +23,7 @@ import { join } from "node:path";
 import process from "node:process";
 
 import { RecordStore } from "../lib/store.mjs";
-import { RecordIndex } from "../lib/index-db.mjs";
+import { extractTurnText, RecordIndex } from "../lib/index-db.mjs";
 
 function parseArgs(argv) {
   const args = { _: [] };
@@ -40,16 +40,19 @@ function parseArgs(argv) {
 const args = parseArgs(process.argv.slice(2));
 const root = args.root ?? process.env.TURN_RECORD_ROOT ?? join(homedir(), ".turn-record");
 const store = new RecordStore(root, {});
-const index = new RecordIndex(store);
+let index;
+const getIndex = () => (index ??= new RecordIndex(store));
 
 try {
   if (args.reindex) {
+    const index = getIndex();
     index.rebuild();
     console.log(JSON.stringify(index.counts()));
     process.exit(0);
   }
 
   if (args.show) {
+    const index = getIndex();
     const { resolveTurn } = await import("../lib/index-db.mjs");
     const byId = store.readAll();
     const turn = resolveTurn(store, index, args.show, byId);
@@ -111,7 +114,7 @@ try {
     // A window is a bounded read: a consumer that plans one (the OKF
     // harvester) sizes it with --ids-only first, then reads exactly that.
     const out = window.map((t) => {
-      const docs = index.extractText(t);
+      const docs = extractTurnText(t);
       const base = { id: t.id, ts: t.ts, thread: t.thread, kind: t.kind, source: t.provenance?.source ?? null };
       const full = { ...base, text: docs.map((d) => ({ role: d.role, text: d.text })) };
       // bytes = what this turn occupies in the pretty-printed --json answer,
@@ -123,6 +126,7 @@ try {
     process.exit(0);
   }
 
+  const index = getIndex();
   const limit = args.limit ? Number(args.limit) : 20;
   let rows;
   if (query) {
@@ -164,5 +168,5 @@ try {
     console.log(`    ${r.id}`);
   }
 } finally {
-  index.close();
+  index?.close();
 }

package/packages/record/lib/index-db.mjs

@@ -413,20 +413,7 @@ export class RecordIndex {
   // Text documents for one turn. Mail/chat: one doc. Session: one doc per
   // conversational event extracted from the transcript blob.
   extractText(turn) {
-    if (turn.kind === "note" && turn.body?.segment) return []; // dedicated role "segment" row
-    if (turn.kind === "mail" || turn.kind === "chat" || turn.kind === "note") {
-      const subject = turn.body?.subject ?? "";
-      const text = turn.body?.text ?? "";
-      const joined = subject ? subject + "\n" + text : text;
-      return joined.trim() ? [{ loc: "", role: turn.kind, text: joined }] : [];
-    }
-    if (turn.kind === "session" && typeof turn.body?.line === "string") {
-      const loc = `line:${turn.provenance?.origin?.line ?? 0}`;
-      return extractSessionTextFor(turn.provenance?.source, Buffer.from(turn.body.line, "utf8")).map(
-        (d) => ({ ...d, loc }),
-      );
-    }
-    return [];
+    return extractTurnText(turn);
   }
 
   // FTS query with optional filters. Returns rows with turn metadata and a
@@ -502,6 +489,24 @@ export class RecordIndex {
   }
 }
 
+// Journal text extraction is independent of the derived search database.
+export function extractTurnText(turn) {
+  if (turn.kind === "note" && turn.body?.segment) return []; // dedicated role "segment" row
+  if (turn.kind === "mail" || turn.kind === "chat" || turn.kind === "note") {
+    const subject = turn.body?.subject ?? "";
+    const text = turn.body?.text ?? "";
+    const joined = subject ? subject + "\n" + text : text;
+    return joined.trim() ? [{ loc: "", role: turn.kind, text: joined }] : [];
+  }
+  if (turn.kind === "session" && typeof turn.body?.line === "string") {
+    const loc = `line:${turn.provenance?.origin?.line ?? 0}`;
+    return extractSessionTextFor(turn.provenance?.source, Buffer.from(turn.body.line, "utf8")).map(
+      (d) => ({ ...d, loc }),
+    );
+  }
+  return [];
+}
+
 // Claude Code text extraction, re-exported for compatibility; the
 // per-format extractors live in formats.mjs.
 export const extractSessionText = extractCcText;