@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/environment/init-application.js

@@ -40,7 +40,8 @@ function result(stage, projection, ownerOutcome, greenfield) {
         ...(greenfield?.interview === undefined ? {} : { interview: greenfield.interview }),
         ...(greenfield?.cockpitRoot === undefined ? {} : { cockpitRoot: greenfield.cockpitRoot }),
         ...(greenfield?.resetAnswer === undefined ? {} : { resetAnswer: greenfield.resetAnswer }),
-        ...(greenfield?.unconfirmed === undefined ? {} : { unconfirmed: greenfield.unconfirmed }) };
+        ...(greenfield?.unconfirmed === undefined ? {} : { unconfirmed: greenfield.unconfirmed }),
+        ...(greenfield?.derived === undefined ? {} : { derived: greenfield.derived }) };
 }
 // The repository's directory name becomes the first sibling's slug and the cockpit's name stem.
 const SIBLING_DIRECTORY = /^[a-z][a-z0-9-]{0,63}$/;
@@ -78,24 +79,52 @@ function documentEstate(input) {
 }
 async function interviewPlan(input, adapters, classification, answered) {
     const planned = plannedGreenfieldQuestions({ root: input.root, classification: classification.classification, gaps: classification.gaps });
+    const outstanding = planned.slice(answered);
     const observedRoot = estateInput(input).root;
     const inference = await adapters.infer?.({ root: observedRoot, configurationRoot: input.root,
         repositories: classification.runnable.map(row => ({ slug: row.slug, path: relative(observedRoot, resolve(observedRoot, row.path)) || '.' })) });
+    const skipped = [...inference?.skipped ?? []];
+    // Each proposal is listed under every field it helps answer.
+    const proposals = [...nameProposal(input.root).map(row => ({ ...row, field: 'cockpit.name' })),
+        ...(inference?.facts ?? []).flatMap(({ fields, ...row }) => fields.map(field => ({ ...row, field })))];
+    if (adapters.measureMachine && outstanding.some(row => row.field === 'environment.machine')) {
+        const measured = await adapters.measureMachine({ root: input.root });
+        if (measured.kind === 'unavailable')
+            skipped.push({ source: 'container runtime', reason: `was not measured (${measured.reason}), so no machine floor is proposed from it` });
+        else
+            proposals.push(...machineProposals(measured, proposals).map(row => ({ ...row, field: 'environment.machine' })));
+    }
     return {
         answered: planned.slice(0, answered).map(row => row.field),
-        outstanding: planned.slice(answered).map(({ field, why }) => ({ field, why,
-            inferred: [...field === 'cockpit.name' ? nameProposal(input.root) : [],
-                ...(inference?.facts ?? []).filter(fact => fact.fields.includes(field))
-                    .map(({ target, value, provenance }) => ({ target, value, provenance }))] })),
-        inferenceSkipped: inference?.skipped ?? [],
+        outstanding: outstanding.map(({ field, why }) => {
+            const own = proposals.filter(row => row.field === field).map(({ target, value, provenance }) => ({ target, value, provenance }));
+            return { field, why, confirmedBy: own.some(row => row.target === field && row.provenance.kind === 'derived') ? 'agent' : 'person',
+                proposals: own };
+        }),
+        inferenceSkipped: skipped,
         ...(input.cockpitRoot === undefined ? {} : { cockpitRoot: input.cockpitRoot.kind }),
     };
 }
+/**
+ * This machine's runtime memory and CPUs, for each that no Compose limit records. It is what the
+ * machine offers, not what the product needs, so the reason says so; free disk is never proposed
+ * from a measurement, because what is free now shrinks with every image pulled and would make
+ * preflight refuse the next start.
+ */
+function machineProposals(measured, proposals) {
+    const date = measured.observedAt.slice(0, 10);
+    return [['runtime_memory_mb', measured.memoryMb, `${measured.memoryMb} MB of memory`],
+        ['runtime_cpus', measured.cpus, `${measured.cpus} CPUs`]]
+        .filter(([key]) => !proposals.some(row => row.target === `environment.machine.${key}`))
+        .map(([key, value, offered]) => ({ target: `environment.machine.${key}`, value,
+        provenance: { kind: 'measured', source: `container runtime, ${date}`,
+            reason: `the container runtime on this machine offered ${offered} on ${date}, and no Compose limit records what the product needs; a floor at this machine's capacity refuses a smaller machine until a person lowers it` } }));
+}
 // The cockpit root's directory name is the proposed cockpit name when it is a valid one.
 function nameProposal(root) {
     const name = basename(root);
     return /^[a-z0-9][a-z0-9-]*$/.test(name) ? [{ target: 'cockpit.name', value: name,
-            provenance: { kind: 'inferred', source: root, reason: 'the cockpit root directory name' } }] : [];
+            provenance: { kind: 'derived', source: root, reason: 'the cockpit root directory name' } }] : [];
 }
 function commandDigest(input) {
     return sha256(JSON.stringify({ root: input.root, target: input.target, tools: input.tools, registry: input.registry ?? null,
@@ -690,8 +719,8 @@ function resetUnavailableFix(input, current) {
             return `no answer is recorded yet: run ${resume('--json')} to preview, then answer the interview`;
     }
 }
-/** The review items a finished interview leaves: answers the setup agent chose or no one attributed. */
+/** How a finished interview's answers were established, beyond a person's word: chosen or unattributed, and derived. */
 function unconfirmedOf(document) {
-    const rows = document.kind === 'complete' ? document.result.unconfirmed : undefined;
-    return rows === undefined || rows.length === 0 ? {} : { unconfirmed: rows };
+    const { unconfirmed, derived } = document.kind === 'complete' ? document.result : {};
+    return { ...(unconfirmed?.length ? { unconfirmed } : {}), ...(derived?.length ? { derived } : {}) };
 }

package/dist/environment/lifecycle-composition.d.ts

@@ -4,7 +4,7 @@ import { type HolderProcess } from './claims.js';
 import { type ExecutionStep } from './contract.js';
 import { type PortLeaseProjection } from './ports.js';
 import { type RuntimeMeasurementProbeAuthority, type RuntimeLifecycleProjection, type RuntimeTopologyEvidence } from './runtime.js';
-export interface LifecycleCommandCompositionInput {
+interface LifecycleCommandCompositionInput {
     readonly configPath: string;
     readonly env: Readonly<Record<string, string | undefined>>;
     readonly sessionId: string;
@@ -13,8 +13,9 @@ export interface LifecycleCommandCompositionInput {
     readonly runtimeMeasurementProbeAuthority?: RuntimeMeasurementProbeAuthority | (() => RuntimeMeasurementProbeAuthority);
     readonly holderProcess?: HolderProcess;
 }
-export type LifecycleCommandAdapterComposition = Omit<UpCommandAdapters & SleepCommandAdapters, 'withRuntimeReadiness' | 'seed'> & {
+type LifecycleCommandAdapterComposition = Omit<UpCommandAdapters & SleepCommandAdapters, 'withRuntimeReadiness' | 'seed' | 'recordStackInputs'> & {
     seed: NonNullable<UpCommandAdapters['seed']>;
+    recordStackInputs: NonNullable<UpCommandAdapters['recordStackInputs']>;
     withMachineFloorReadiness<T>(context: LifecycleRunContext, use: (observations: readonly import('./contract.js').EnvironmentObservation[]) => Promise<T>, refuse?: ReadinessRefusal<T>): Promise<T | undefined>;
     withRuntimeReadiness<T>(context: LifecycleRunContext, use: (runtime: LifecycleRuntimeReadiness) => Promise<T>, ports?: PortLeaseProjection, refuse?: ReadinessRefusal<T>, purpose?: RuntimeReadinessPurpose): Promise<T | undefined>;
 };
@@ -24,6 +25,7 @@ interface LifecycleRuntimeReadiness {
     readonly hostObservations: readonly import('./contract.js').EnvironmentObservation[];
     readonly runtimeObservations: readonly import('./contract.js').EnvironmentObservation[];
     readonly inputs: Readonly<Record<string, string>>;
+    readonly activeProfiles: readonly string[];
 }
 export declare function createLifecycleCommandAdapters(rawInput: LifecycleCommandCompositionInput, execute: (step: ExecutionStep) => Promise<ExecuteProbeOutcome>): LifecycleCommandAdapterComposition;
 export {};

package/dist/environment/lifecycle-composition.js

@@ -6,6 +6,7 @@ import { loadCockpitConfig, projectMachineFloorConfig } from '../config/load.js'
 import { cockpitCommand } from '../fix-catalogue.js';
 import { redirectedBindSources } from './compose-topology.js';
 import { authenticatedExecutionOutcome } from '../environment-exec/execute.js';
+import { mounted } from '../schema.js';
 import { COMPOSE_OWNERSHIP_FILE, renderComposeOwnership } from './compose-ownership.js';
 import { issueLifecycleRunContext, noticeLifecycleRun, } from './application/lifecycle-context.js';
 import { isProcessStart, observeProcessStart, processHost, releaseDeadSessionHolders } from './claims.js';
@@ -15,13 +16,16 @@ import { resolveDiskCapacityExecutable, resolveDockerExecutable, resolveExecutab
 import { readSeededAt, recordSeeded, seedDue } from './seed.js';
 import { observeHostCapacity } from './host-observation.js';
 import { composeProjectName, holderId, stackId } from './identity.js';
-import { projectLifecycleStage, resolveLifecycleStage, } from './lifecycle-stage.js';
+import { decodeLifecycleRecord, projectLifecycleStage, resolveLifecycleStage, } from './lifecycle-stage.js';
+import { readState } from './state.js';
 import { acquirePortProjection, compensateAcquiredPortHolder, } from './ports.js';
 import { admitRuntimeMeasurement, measureMachineFloor, createRuntimeAdapter, observeRuntimeTopology, issueMachineFloorAuthority, OBSERVATION_WINDOW_HEADROOM_MS, observeDockerRuntime, observeRuntimeMeasurement, projectRuntimeLifecycle, runtimeMeasurementProbeObservation, } from './runtime.js';
 import { readLocalRuntimeMeasurements } from './runtime-measurement-record.js';
 import { consumeSetupCheckoutProjection, observeSetupCheckout, withSetupCheckoutProjection, } from './setup-observation.js';
 import { selectStateRoot } from './state.js';
 import { readBoundedFile } from '../bounded-read.js';
+import { loadServedSiblings, missingServedCheckout, servedPath, servedSiblingVariables } from './sibling-checkouts.js';
+import { recordStackInputs } from './stack-inputs.js';
 const OWNER = 'lifecycle-adapter-composition';
 const COMPOSE_BYTE_LIMIT = 1_048_576;
 const LISTENER_CONCURRENCY = 16;
@@ -32,8 +36,19 @@ function runtimeUnavailable(reason, target) {
     return ownerDiagnostics(ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE, reason, target);
 }
 /** Names each mount difference by the row that declared it, so the refusal says what to edit. */
-function mountMismatchDiagnostics(mismatch, config, siblingsRoot) {
-    const bySource = new Map(config.sibling.map((sibling) => [resolve(siblingsRoot, sibling.dir), sibling]));
+function mountMismatchDiagnostics(mismatch, config, served) {
+    const bySource = new Map(config.sibling.map((sibling) => [servedPath(served, sibling.slug), sibling]));
+    // After `use` the running stack still mounts the checkout it started with: the sibling's served
+    // directory is missing and another one is mounted in its place. Compose is fine; the stack is old.
+    const switched = mismatch.unexpected.length === 0 ? undefined
+        : config.sibling.find((sibling) => mismatch.missing.includes(servedPath(served, sibling.slug)));
+    if (switched)
+        return [{
+                severity: 'error', code: ENVIRONMENT_CODES.MOUNT_POSTURE_UNAVAILABLE, target: `sibling:${switched.slug}`,
+                message: `sibling ${switched.slug} is served from ${servedPath(served, switched.slug)}, but the running stack mounts ${mismatch.unexpected.join(', ')} instead`,
+                fix: `if the stack started before use changed the checkout, run ${cockpitCommand('down')} and then ${cockpitCommand('up')}; `
+                    + `otherwise bind-mount \${${switched.var}} in a Compose service and run ${cockpitCommand('check')}`,
+            }];
     return [
         ...mismatch.missing.map((source) => {
             const sibling = bySource.get(source);
@@ -56,8 +71,8 @@ function mountMismatchDiagnostics(mismatch, config, siblingsRoot) {
     ];
 }
 /** Names the sibling a redirected bind sits in, so the refusal says which checkout holds the link. */
-function redirectedMountDiagnostics(redirected, config, siblingsRoot) {
-    const bySource = new Map(config.sibling.map((sibling) => [resolve(siblingsRoot, sibling.dir), sibling]));
+function redirectedMountDiagnostics(redirected, config, served) {
+    const bySource = new Map(config.sibling.map((sibling) => [servedPath(served, sibling.slug), sibling]));
     return redirected.map(({ bind, holder }) => {
         const sibling = bySource.get(holder);
         return {
@@ -67,6 +82,23 @@ function redirectedMountDiagnostics(redirected, config, siblingsRoot) {
         };
     });
 }
+// A profile no Compose service declares enables nothing, and Compose accepts it silently, so the
+// stack would start without the services the person asked for.
+function undefinedProfileDiagnostics(profiles, config, requested, configPath) {
+    return profiles.map((profile) => {
+        const source = config.environment.profiles.includes(profile) ? `environment.profiles in ${basename(configPath)}`
+            : requested.includes(profile) ? 'up --profile' : 'the profile set the running stack was started with';
+        return {
+            severity: 'error', code: 'COMPOSE_PROFILE_UNDEFINED',
+            target: `profile:${profile}`,
+            message: `profile ${profile}, from ${source}, is declared by no service in environment.compose_files, so it would start nothing`,
+            fix: 'add the profile to the services it should start in the Compose file, or stop requesting it: remove it from environment.profiles or --profile, and for a stack started with it run npx --no cockpit down --config <your cockpit.toml>',
+        };
+    });
+}
+// The runtime input naming the profile set, so `up` refuses to change the set under a running stack
+// as it refuses any other change to what the stack was started from.
+const ACTIVE_PROFILES_INPUT = 'active Compose profiles';
 function refusal(target, message = 'lifecycle composition authority is unavailable', code = ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID) {
     return {
         kind: 'refusal',
@@ -258,6 +290,9 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
         if (declaresNothingToRun(loaded.result.config.environment))
             return { kind: 'refusal',
                 status: 2, result: null, diagnostics: [runtimeNotDeclared(loaded.result.source.path)] };
+        const served = await loadServedSiblings(dirname(loaded.result.source.path), loaded.result.config);
+        if (served.kind === 'refusal')
+            return { kind: 'refusal', status: 2, result: null, diagnostics: [served.diagnostic] };
         const setupEnvironment = Object.fromEntries(Object.entries(input.env)
             .filter((entry) => typeof entry[1] === 'string'));
         const git = await resolveGitExecutable(input.env);
@@ -334,6 +369,7 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             config: loaded.result.config,
             checkoutRoot: dirname(loaded.result.source.path),
             siblingsRoot: resolve(dirname(loaded.result.source.path), loaded.result.config.cockpit.siblings_root),
+            served: served.siblings,
             ...(projected && 'authority' in projected ? { machineFloorAuthority: projected.authority } : {}),
         });
         return { ...issued, diagnostics: loaded.diagnostics };
@@ -417,7 +453,10 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
     const withRuntimeReadiness = (context, use, ports, refuse, purpose) => runtimeReadiness(context, use, ports, refuse, purpose);
     // `resolvedMounts` is set only on a teardown retry: stopping or removing a stack must not depend
     // on its mounts matching cockpit.toml, or a stack whose declaration drifted could never be retired.
-    const runtimeReadiness = async (context, use, ports, refuse, purpose, resolvedMounts) => {
+    const runtimeReadiness = async (context, use, ports, refuse, purpose, resolvedMounts, 
+    // Set only on a teardown retry, for the same reason: a recorded profile the Compose files no
+    // longer declare must not keep down and sleep from retiring the stack.
+    droppedProfiles = []) => {
         const binding = bindings.get(context);
         if (!input || !binding)
             return undefined;
@@ -428,6 +467,12 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
         if (!machine) {
             return refuse?.(ownerDiagnostics(ENVIRONMENT_CODES.CONFIG_SCHEMA_INVALID, 'cockpit.toml declares no [environment.machine] table; runtime commands need its runtime_memory_mb, runtime_cpus, free_disk_mb and cold_start_seconds', 'environment.machine'));
         }
+        // Teardown must reach a stack whatever it mounts; anything else would mount a directory that is gone.
+        if (purpose !== 'teardown') {
+            const gone = await missingServedCheckout(currentBinding.served);
+            if (gone)
+                return refuse?.([gone]);
+        }
         const env = runtimeEnvironment(input.env);
         const docker = await resolveDockerExecutable(input.env);
         if (docker.state !== 'available')
@@ -461,7 +506,18 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             ? observeRuntimeMeasurement(measured, context.stackId) : undefined;
         let artifacts;
         let inputs = { [basename(context.source.path)]: context.runtimeSha256 };
-        const activeProfiles = input.activeProfiles ?? [];
+        // A running stack keeps the profiles it started with, so every later command, down
+        // included, sees the services they enable; the run adds the declared default set and any
+        // profiles `up --profile` requested.
+        const recorded = await readState(context.namespace.paths.lifecycle(context.stackId));
+        if (recorded.kind !== 'complete' && recorded.kind !== 'missing')
+            return refuse?.(ownerDiagnostics(recorded.code, recorded.message, recorded.target));
+        const recordedValue = recorded.kind === 'complete' ? decodeLifecycleRecord(recorded.value, context)?.value : undefined;
+        if (recorded.kind === 'complete' && !recordedValue)
+            return refuse?.(ownerDiagnostics(ENVIRONMENT_CODES.STATE_RECORD_MALFORMED, 'lifecycle progress record is malformed', context.namespace.paths.lifecycle(context.stackId).path));
+        const recordedProfiles = recordedValue?.activeProfiles ?? [];
+        const activeProfiles = [...new Set([...currentBinding.config.environment.profiles,
+                ...input.activeProfiles ?? [], ...recordedProfiles])].filter((profile) => !droppedProfiles.includes(profile)).sort();
         let expectedMountSources;
         const declared = await composeArtifacts(currentBinding.checkoutRoot, currentBinding.config.environment.compose_files);
         if (!declared)
@@ -479,11 +535,13 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
         if (!override)
             return refuse?.(ownerDiagnostics(ENVIRONMENT_CODES.GENERATED_ENVIRONMENT_UNAVAILABLE, `${COMPOSE_OWNERSHIP_FILE} is missing or does not match the current Compose files and cockpit.toml; run ${cockpitCommand('sync')}`, COMPOSE_OWNERSHIP_FILE));
         artifacts = [...declared, override];
-        inputs = { ...inputs, ...Object.fromEntries(declared.map(({ reference, sha256 }) => [reference, sha256])) };
+        inputs = { ...inputs, ...Object.fromEntries(declared.map(({ reference, sha256 }) => [reference, sha256])),
+            ...(activeProfiles.length === 0 ? {} : {
+                [ACTIVE_PROFILES_INPUT]: createHash('sha256').update(activeProfiles.join('\n')).digest('hex')
+            }) };
         expectedMountSources = [...new Set([
-                ...currentBinding.config.sibling
-                    .filter((sibling) => sibling.mount === 'always')
-                    .map((sibling) => resolve(currentBinding.siblingsRoot, sibling.dir)),
+                ...mounted(currentBinding.config, activeProfiles)
+                    .map((sibling) => servedPath(currentBinding.served, sibling.slug)),
                 ...currentBinding.config.environment.generated_host_paths
                     .map((path) => resolve(currentBinding.checkoutRoot, path)),
             ])].sort();
@@ -491,8 +549,7 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             return undefined;
         if (resolvedMounts)
             expectedMountSources = resolvedMounts;
-        const siblingDirectories = Object.fromEntries(currentBinding.config.sibling
-            .map((sibling) => [sibling.var, resolve(currentBinding.siblingsRoot, sibling.dir)]));
+        const siblingDirectories = servedSiblingVariables(currentBinding.config, currentBinding.served);
         const batchId = randomBytes(32).toString('hex');
         const runtime = createRuntimeAdapter({
             runtime: observed.runtime,
@@ -530,19 +587,24 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             execute,
         });
         if (topology.kind !== 'complete') {
+            if (topology.undefinedProfiles && purpose === 'teardown') {
+                return runtimeReadiness(context, use, ports, refuse, purpose, resolvedMounts, [...droppedProfiles, ...topology.undefinedProfiles]);
+            }
+            if (topology.undefinedProfiles)
+                return refuse?.(undefinedProfileDiagnostics(topology.undefinedProfiles, currentBinding.config, input.activeProfiles ?? [], context.source.path));
             const mismatch = topology.mounts;
             if (!mismatch)
                 return undefined;
             if (purpose === 'teardown' && !resolvedMounts) {
                 const resolved = [...expectedMountSources.filter((source) => !mismatch.missing.includes(source)), ...mismatch.unexpected].sort();
-                return runtimeReadiness(context, use, ports, refuse, purpose, resolved);
+                return runtimeReadiness(context, use, ports, refuse, purpose, resolved, droppedProfiles);
             }
-            return refuse?.(mountMismatchDiagnostics(mismatch, currentBinding.config, currentBinding.siblingsRoot));
+            return refuse?.(mountMismatchDiagnostics(mismatch, currentBinding.config, currentBinding.served));
         }
         if (purpose !== 'teardown') {
             const redirected = await redirectedBindSources(topology.topology.services.flatMap(({ bindMountSources }) => bindMountSources), expectedMountSources);
             if (redirected.length > 0)
-                return refuse?.(redirectedMountDiagnostics(redirected, currentBinding.config, currentBinding.siblingsRoot));
+                return refuse?.(redirectedMountDiagnostics(redirected, currentBinding.config, currentBinding.served));
         }
         const disk = await resolveDiskCapacityExecutable();
         if (disk.state !== 'available')
@@ -566,6 +628,7 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             runtimeObservations: measurementObservation
                 ? [measurementObservation, ...topology.observations] : [...topology.observations],
             inputs,
+            activeProfiles,
         };
         issuedRuntimeReadiness.add(readiness);
         return use(readiness);
@@ -671,5 +734,9 @@ export function createLifecycleCommandAdapters(rawInput, execute) {
             throw error;
         }
     };
-    return { load, execute, seed, withRuntimeReadiness, withMachineFloorReadiness, withLifecycleStage, withAcquiredPorts };
+    const recordInputs = async (context, change) => {
+        const binding = bindings.get(context);
+        return binding ? recordStackInputs(binding.checkoutRoot, binding.config, binding.served, { keepExisting: change !== 'started' }) : [];
+    };
+    return { load, execute, seed, recordStackInputs: recordInputs, withRuntimeReadiness, withMachineFloorReadiness, withLifecycleStage, withAcquiredPorts };
 }

package/dist/environment/lifecycle-stage.d.ts

@@ -24,13 +24,18 @@ export interface LifecycleRecordValue extends LifecycleProgress {
      * refused declaration change can say which one changed.
      */
     readonly runtimeInputs?: RuntimeInputs;
+    /**
+     * The Compose profiles the stack was started with, sorted, when it runs with any: every later
+     * command on the stack activates the same set, so down removes the profile services too.
+     */
+    readonly activeProfiles?: readonly string[];
 }
 export type RuntimeInputs = Readonly<Record<string, string>>;
 export interface CurrentLifecycleRecord {
     readonly record: StateRecord;
     readonly value: LifecycleRecordValue;
 }
-export type EarlierNameResult = Readonly<{
+type EarlierNameResult = Readonly<{
     kind: 'complete';
     name: string | undefined;
 }> | Readonly<{
@@ -59,11 +64,11 @@ declare const lifecycleStageProjectionBrand: unique symbol;
 export interface LifecycleStageProjection {
     readonly [lifecycleStageProjectionBrand]: true;
 }
-export interface LifecycleStageEvidence {
+interface LifecycleStageEvidence {
     readonly stackId: StackId;
     readonly stage: ObservationLifecycleStage;
 }
-export type LifecycleStageResolution = {
+type LifecycleStageResolution = {
     readonly kind: 'complete';
     readonly authority: LifecycleStageAuthority;
     readonly observation: EnvironmentObservation;

package/dist/environment/lifecycle-stage.js

@@ -69,7 +69,7 @@ export function earlierNameRefusalMessage(configPath, earlierName) {
 export function decodeLifecycleRecord(record, context) {
     const value = snapshotJson(record.value);
     if (!value || typeof value !== 'object' || Array.isArray(value)
-        || !exactKeys(value, ['completedServices', 'holderId', 'operationGeneration', 'workBasisSha256'], ['runtimeInputs', 'teardownComplete'])
+        || !exactKeys(value, ['completedServices', 'holderId', 'operationGeneration', 'workBasisSha256'], ['activeProfiles', 'runtimeInputs', 'teardownComplete'])
         || record.format !== 'cockpit-state/v1' || record.kind !== 'lifecycle'
         || record.cockpitId !== context.cockpitId || record.subjectId !== context.stackId)
         return undefined;
@@ -93,6 +93,15 @@ export function decodeLifecycleRecord(record, context) {
             return undefined;
         runtimeInputs = Object.fromEntries(entries);
     }
+    let activeProfiles;
+    if (Object.hasOwn(candidate, 'activeProfiles')) {
+        const value = candidate.activeProfiles;
+        if (teardownComplete || !Array.isArray(value) || value.length === 0 || value.length > 64
+            || value.some((profile, index) => typeof profile !== 'string' || !lifecycleService.test(profile)
+                || index > 0 && value[index - 1] >= profile))
+            return undefined;
+        activeProfiles = value;
+    }
     const completed = candidate.completedServices.map((item) => {
         if (!item || typeof item !== 'object' || Array.isArray(item)
             || !exactKeys(item, ['containerId', 'service']))
@@ -112,6 +121,7 @@ export function decodeLifecycleRecord(record, context) {
             holderId: candidate.holderId,
             ...(teardownComplete ? { teardownComplete: true } : {}),
             ...(runtimeInputs ? { runtimeInputs } : {}),
+            ...(activeProfiles ? { activeProfiles } : {}),
             workBasisSha256: candidate.workBasisSha256,
             operationGeneration: candidate.operationGeneration,
             completedServices: completed,

package/dist/environment/logs.d.ts

@@ -112,8 +112,8 @@ export declare function collectLogs(plan: Extract<LogPlan, {
     records: never[];
     truncated?: undefined;
 } | {
-    reason?: undefined;
     code?: undefined;
+    reason?: undefined;
     kind: "cancelled" | "complete";
     records: Readonly<{
         stackId: StackId;

package/dist/environment/map-limit.d.ts

@@ -0,0 +1,2 @@
+/** `Promise.all(items.map(run))` with at most `limit` runs in flight; results keep the items' order. */
+export declare function mapLimit<Item, Result>(items: readonly Item[], limit: number, run: (item: Item) => Promise<Result>): Promise<Result[]>;

package/dist/environment/map-limit.js

@@ -0,0 +1,13 @@
+/** `Promise.all(items.map(run))` with at most `limit` runs in flight; results keep the items' order. */
+export async function mapLimit(items, limit, run) {
+    const results = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await run(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return results;
+}

package/dist/environment/mcp-observation.d.ts

@@ -0,0 +1,9 @@
+import type { EnvironmentDiagnostic } from './contract.js';
+import type { McpServer } from '../surfaces/mcp.js';
+/**
+ * What each approved MCP server needs before a tool can start it, read without starting anything or
+ * touching the network: a local server's command and a remote server's headers helper resolve from
+ * where the wrapper runs them, and every environment name the server reads is set. A disabled server
+ * starts in no tool, so it is not checked. Diagnostics name variables, never their values.
+ */
+export declare function observeMcpStartup(servers: readonly McpServer[], env: Readonly<Record<string, string | undefined>>): Promise<readonly EnvironmentDiagnostic[]>;

package/dist/environment/mcp-observation.js

@@ -0,0 +1,46 @@
+import { locateExecutable } from './executable.js';
+// Presence only: the doctor needs to know a command can be started, not its identity, so it
+// does not hash the binary the way a verified spawn does.
+async function commandReason(command, cwd, env) {
+    const located = await locateExecutable(command, env, cwd);
+    return located.state === 'present' ? undefined : located.reason;
+}
+/**
+ * What each approved MCP server needs before a tool can start it, read without starting anything or
+ * touching the network: a local server's command and a remote server's headers helper resolve from
+ * where the wrapper runs them, and every environment name the server reads is set. A disabled server
+ * starts in no tool, so it is not checked. Diagnostics name variables, never their values.
+ */
+export async function observeMcpStartup(servers, env) {
+    const diagnostics = [];
+    const launches = new Map();
+    for (const server of servers.filter(row => row.enabled)) {
+        const launch = 'transport' in server ? server.helper : server;
+        if (launch !== null)
+            launches.set(JSON.stringify([launch.command, launch.cwd]), commandReason(launch.command, launch.cwd, env));
+    }
+    for (const server of servers.filter(row => row.enabled)) {
+        const launch = 'transport' in server ? server.helper : server;
+        if (launch !== null) {
+            const reason = await launches.get(JSON.stringify([launch.command, launch.cwd]));
+            if (reason !== undefined)
+                diagnostics.push({
+                    severity: 'warning',
+                    code: 'MCP_COMMAND_UNRESOLVED',
+                    target: server.name,
+                    message: `the ${'transport' in server ? 'headers helper' : 'command'} of MCP server ${server.name}, ${launch.command} in ${launch.cwd}, does not resolve to an executable file (${reason}), so no tool can start ${'transport' in server ? 'its connection' : 'it'}`,
+                    fix: 'install the command or correct it in the sibling\'s MCP declaration, then run npx --no cockpit sync --config <your cockpit.toml>; a changed declaration needs a person to approve its new sha256 under [mcp.approved]',
+                });
+        }
+        const unset = server.envNames.filter(name => !env[name]);
+        if (unset.length > 0)
+            diagnostics.push({
+                severity: 'warning',
+                code: 'MCP_ENVIRONMENT_UNSET',
+                target: server.name,
+                message: `MCP server ${server.name} reads ${unset.join(', ')}, which ${unset.length === 1 ? 'is' : 'are'} unset or empty here, so a tool started from this environment ${'transport' in server ? 'cannot send the server its credential' : 'cannot start it'}`,
+                fix: `set each named variable in the environment the agent tool is started from${'transport' in server ? ', or give the server a headersHelper that reads the credential when the tool connects' : ''}`,
+            });
+    }
+    return diagnostics;
+}

package/dist/environment/observations.d.ts

@@ -22,7 +22,7 @@ export interface PreflightEvaluation {
 export interface DoctorCheck extends EvaluatedObservation {
     readonly evidence: string;
 }
-export interface DoctorProjection {
+interface DoctorProjection {
     readonly verdict: PreflightEvaluation['verdict'];
     readonly checks: readonly DoctorCheck[];
 }

package/dist/environment/observations.js

@@ -7,6 +7,7 @@ import { observationDeclarations as envSchemaDeclarations } from './env-schema-o
 import { observationDeclarations as gitDeclarations } from './git-observation.js';
 import { observationDeclarations as hostDeclarations } from './host-observation.js';
 import { observationDeclarations as lifecycleStageDeclarations } from './lifecycle-stage.js';
+import { observationDeclarations as siblingDeclarations } from './sibling-observation.js';
 import { observationDeclarations as runtimeDeclarations, runtimeHealthObservationDeclarations } from './runtime.js';
 import { observationDeclarations as stateDeclarations } from './state.js';
 import { observationDeclarations as templateDeclarations } from './templates.js';
@@ -33,6 +34,7 @@ export const allObservationDeclarations = Object.freeze([
     ...hostDeclarations,
     ...lifecycleStageDeclarations,
     ...runtimeDeclarations,
+    ...siblingDeclarations,
     ...stateDeclarations,
     ...templateDeclarations,
     ...surfaceObservationDeclarations,

package/dist/environment/operator-application.d.ts

@@ -1,8 +1,9 @@
 import { type EffectivePolicy, type PolicyWeakening } from '../autonomy.js';
 import { type Diagnostic } from './contract.js';
 import type { ResetCommandInput } from './application/lifecycle-context.js';
+import type { StacksPruneScope } from './stack-inventory-prune.js';
 import type { GeneratedEnvironmentCommandInput, GeneratedEnvironmentSyncInput, GeneratedStaleRemovalApproval, GeneratedStaleRemovalApprovalRequest } from './generated-application/shared.js';
-export interface OperatorAdmission {
+interface OperatorAdmission {
     readonly interactive: boolean;
     readonly json: boolean;
     readonly ci: string | undefined;
@@ -10,21 +11,21 @@ export interface OperatorAdmission {
     readonly apply?: boolean;
 }
 /** The autonomy policy a gated command reads, or the refusal that it could not be read. */
-export type OperatorPolicy = Readonly<{
+type OperatorPolicy = Readonly<{
     current: EffectivePolicy;
     recorded?: EffectivePolicy;
     record: () => Promise<void>;
 }>;
-export interface OperatorCommandOutcome {
+interface OperatorCommandOutcome {
     readonly status: number;
     readonly diagnostics: readonly Diagnostic[];
     readonly result: unknown;
 }
-export interface OperatorSession {
+interface OperatorSession {
     readonly preview: OperatorCommandOutcome;
     decide(decision: 'approve' | 'decline'): Promise<OperatorCommandOutcome>;
 }
-export interface ResetOperatorApplicationAdapters {
+interface ResetOperatorApplicationAdapters {
     readonly preview: (input: ResetCommandInput) => Promise<OperatorCommandOutcome>;
     readonly begin: (input: ResetCommandInput) => Promise<OperatorSession | OperatorCommandOutcome>;
     readonly confirm: (preview: OperatorCommandOutcome) => Promise<boolean>;
@@ -33,7 +34,7 @@ export interface ResetOperatorApplicationAdapters {
 export type GeneratedEnvironmentSyncHandlerInput = GeneratedEnvironmentSyncInput & Readonly<{
     authorizeStaleRemoval?: (request: GeneratedStaleRemovalApprovalRequest) => Promise<GeneratedStaleRemovalApproval | undefined>;
 }>;
-export interface SyncOperatorApplicationAdapters {
+interface SyncOperatorApplicationAdapters {
     readonly synchronize: (input: GeneratedEnvironmentSyncHandlerInput) => Promise<OperatorCommandOutcome>;
     readonly confirmStaleRemoval: (request: GeneratedStaleRemovalApprovalRequest) => Promise<string | undefined>;
     readonly policy: (configPath: string) => Promise<OperatorPolicy | OperatorCommandOutcome>;
@@ -45,6 +46,34 @@ export interface SyncOperatorApplicationAdapters {
 /** The production policy adapter: cockpit.toml's policy now, the recorded one, and how to record the current one. */
 export declare function loadOperatorPolicy(configPath: string): Promise<OperatorPolicy | OperatorCommandOutcome>;
 export declare function runResetOperatorApplication(input: ResetCommandInput, admission: OperatorAdmission, adapters: ResetOperatorApplicationAdapters): Promise<OperatorCommandOutcome>;
+export interface StacksPruneOperatorSession {
+    readonly preview: OperatorCommandOutcome;
+    readonly digest: string;
+    readonly empty: boolean;
+    readonly deletesData: boolean;
+    apply(): Promise<OperatorCommandOutcome>;
+}
+interface StacksPruneOperatorAdapters {
+    readonly begin: (input: Readonly<{
+        configPath: string;
+        scope: StacksPruneScope;
+    }>) => Promise<StacksPruneOperatorSession | OperatorCommandOutcome>;
+    /** Shows the preview to a person at a terminal and returns the digest they typed. */
+    readonly confirm: (preview: OperatorCommandOutcome) => Promise<string | undefined>;
+    readonly policy: (configPath: string) => Promise<OperatorPolicy | OperatorCommandOutcome>;
+}
+/**
+ * `stacks prune`: a preview by default. Removing an orphan whose checkout is gone is housekeeping
+ * anyone can undo by bringing the stack up again, so `--apply` passes for an agent; a prune that
+ * deletes volumes deletes data, and passes only where `[autonomy] reset` lets this run reset. That
+ * policy is this cockpit's, so an agent's `--apply` covers only this cockpit's stacks: another
+ * cockpit may require a person for the same removal. `--interactive` is a person's approval of the
+ * exact preview by its digest, and covers every stack on the machine.
+ */
+export declare function runStacksPruneOperatorApplication(input: Readonly<{
+    configPath: string;
+}>, admission: OperatorAdmission, adapters: StacksPruneOperatorAdapters): Promise<OperatorCommandOutcome>;
 export declare function runSyncOperatorApplication(input: GeneratedEnvironmentCommandInput & Readonly<{
     dryRun?: boolean;
 }>, admission: OperatorAdmission, adapters: SyncOperatorApplicationAdapters): Promise<OperatorCommandOutcome>;
+export {};