@catalyst-cloud/schema 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/schema",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "type": "module",
   "description": "Typed Drizzle schema = single source of truth for the per-tenant Mirror DO SQLite store (CTC-13 / ADR-0002). Shared by the mirror Worker, the host-sync replica, and the browser OPFS replica.",
   "license": "MIT",

package/src/events/registry.ts

@@ -791,6 +791,72 @@ export const durableEventTypes = {
     wakes: false,
     entity: "ticket",
   },
+  // ── CTC-1597 — `intake` is the renamed `triage` phase, ADDITIVE beside it (D4). Same shape as the
+  // `phase.triage.*` block below; nothing in this repo emits these yet (the phase is dormant, outside
+  // RELAY_PHASES), declared now so CTC-1530 can be re-cut under the right name.
+  "phase.intake.abandoned": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase's worker abandoned it — a lifecycle terminal fact. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.boot-resume": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the daemon restarted and resumed this phase — a real coordination fact about continuity across a restart. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.complete": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported success. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.escalated": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase escalated to a human. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: { consumerClass: "host-channel" },
+    entity: "ticket",
+  },
+  "phase.intake.failed": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported failure. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.failure-retracted": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a previously-reported failure was retracted (corrected) — a real correction fact. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.linear-transition": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase performed a real Linear ticket-state transition as part of its own execution. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.orphan-detected": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): an orphaned phase-agent worker was detected — a coordination fact (state discovered), not a sample. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
+  "phase.intake.revive": {
+    rationale:
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a parked phase was revived. CTC-1597 — the renamed `triage` phase.",
+    ingestVerb: "coordination.publish",
+    wakes: false,
+    entity: "ticket",
+  },
   "phase.merge.complete": {
     rationale:
       "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported success.",
@@ -1519,65 +1585,70 @@ export const durableEventTypes = {
     wakes: false,
     entity: "ticket",
   },
+  // ⛔ CTC-1597 — RETAINED, NOT DELETED (D4). These nine classify a real, committed August-2026 corpus
+  // (docs/event-backbone/observed-types-2026-08.json) produced by the sibling `catalyst` repo's now-
+  // retired daemon. Deleting them would make a legacy re-publish fall through to `unclassified`. The
+  // phase was renamed to `intake` (see the `phase.intake.*` block above) — nothing in this repo emits
+  // `phase.triage.*` going forward; each rationale below says so.
   "phase.triage.abandoned": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase's worker abandoned it — a lifecycle terminal fact.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase's worker abandoned it — a lifecycle terminal fact. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.boot-resume": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the daemon restarted and resumed this phase — a real coordination fact about continuity across a restart.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the daemon restarted and resumed this phase — a real coordination fact about continuity across a restart. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.complete": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported success.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported success. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.escalated": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase escalated to a human.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase escalated to a human. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: { consumerClass: "host-channel" },
     entity: "ticket",
   },
   "phase.triage.failed": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported failure.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase reported failure. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.failure-retracted": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a previously-reported failure was retracted (corrected) — a real correction fact.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a previously-reported failure was retracted (corrected) — a real correction fact. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.linear-transition": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase performed a real Linear ticket-state transition as part of its own execution.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): the phase performed a real Linear ticket-state transition as part of its own execution. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.orphan-detected": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): an orphaned phase-agent worker was detected — a coordination fact (state discovered), not a sample.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): an orphaned phase-agent worker was detected — a coordination fact (state discovered), not a sample. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",
   },
   "phase.triage.revive": {
     rationale:
-      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a parked phase was revived.",
+      "ADR-0039 durable-fact example ('a phase started, completed, failed, or was preempted'): a parked phase was revived. CTC-1597 renamed this phase to `intake`; this key is RETAINED to classify the historical corpus and any legacy re-publish — nothing emits it going forward.",
     ingestVerb: "coordination.publish",
     wakes: false,
     entity: "ticket",

package/src/migrations.generated.ts

@@ -270,6 +270,13 @@ export const MIRROR_MIGRATIONS = {
         tag: "0036_watery_hercules",
         breakpoints: true,
       },
+      {
+        idx: 37,
+        version: "6",
+        when: 1788479421934,
+        tag: "0037_ctc1597_workflow_slot_intake",
+        breakpoints: true,
+      },
     ],
   },
   migrations: {
@@ -344,5 +351,7 @@ export const MIRROR_MIGRATIONS = {
       "ALTER TABLE `agent_activities` ADD `action` text;--> statement-breakpoint\nALTER TABLE `agent_activities` ADD `parameter` text;--> statement-breakpoint\nALTER TABLE `agent_activities` ADD `result` text;--> statement-breakpoint\nUPDATE agent_activities\n   SET action    = json_extract(raw, '$.content.action'),\n       parameter = json_extract(raw, '$.content.parameter'),\n       result    = json_extract(raw, '$.content.result')\n WHERE raw IS NOT NULL\n   AND json_valid(raw)\n   AND json_extract(raw, '$.content.type') = 'action';\n",
     "0036_watery_hercules":
       "CREATE TABLE `fleet_activity_rate` (\n\t`host_id` text NOT NULL,\n\t`ticket` text NOT NULL,\n\t`bucket_start_ms` integer NOT NULL,\n\t`events` integer NOT NULL,\n\tPRIMARY KEY(`host_id`, `ticket`, `bucket_start_ms`)\n);\n--> statement-breakpoint\nCREATE TABLE `fleet_anomalies` (\n\t`kind` text NOT NULL,\n\t`host_id` text NOT NULL,\n\t`ticket` text NOT NULL,\n\t`detected_at_ms` integer NOT NULL,\n\t`observed` integer NOT NULL,\n\t`baseline` integer NOT NULL,\n\t`detail` text,\n\t`updated_at` integer NOT NULL,\n\tPRIMARY KEY(`kind`, `host_id`, `ticket`)\n);\n--> statement-breakpoint\nCREATE TABLE `fleet_health_sends` (\n\t`host_id` text NOT NULL,\n\t`status` text NOT NULL,\n\t`status_changed_at_ms` integer NOT NULL,\n\t`sent_at_ms` integer NOT NULL,\n\t`delivered` integer NOT NULL,\n\t`failed` integer NOT NULL,\n\tPRIMARY KEY(`host_id`, `status`, `status_changed_at_ms`)\n);\n--> statement-breakpoint\nCREATE TABLE `fleet_host_liveness` (\n\t`host_id` text PRIMARY KEY NOT NULL,\n\t`status` text NOT NULL,\n\t`reason` text,\n\t`last_heartbeat_ms` integer,\n\t`last_activity_ms` integer,\n\t`last_seen_ms` integer,\n\t`period_ms` integer,\n\t`grace_ms` integer,\n\t`agent_version` text,\n\t`status_changed_at_ms` integer,\n\t`updated_at` integer NOT NULL\n);\n",
+    "0037_ctc1597_workflow_slot_intake":
+      "-- CTC-1597 — rename the persisted workflow slot `triage` -> `intake`.\n--\n-- ⭐ Deliberately a DATA migration in the SHARED bundle (the 0014/0031 pattern): the DO and every\n-- host / OPFS replica apply the same MIRROR_MIGRATIONS through the same runner, so each side renames\n-- its OWN rows locally. That converges every replica WITHOUT emitting a change_log delta per row\n-- (migrations bypass appendChange), so no ring-buffer flood.\n--\n-- ⚠️ THE REGISTRY D1 IS THE AUTHORITY and gets its own migration\n-- (apps/mirror/src/registry/migrations/20260903T1928_workflow_slot_intake.sql); this one exists\n-- because a D1-only rewrite bumps no `workflow_rev` and pushes nothing, so a DO that is never\n-- re-saved would sit on the old value forever. THIS migration is what makes the rename correct on\n-- every DO/replica, including one offline at merge time. There is no separate re-projection script:\n-- an already-connected browser/host that needs to see the rename before its own next open converges\n-- the ordinary way — an operator re-saving that team's stage mapping calls the existing full-replace\n-- projection handler (`handleWorkflowMappingUpsert`, MirrorDO.ts), which DOES emit a change_log\n-- delta. No new production route was added for a one-time rename.\n--\n-- PK-safe: (team_id, slot) — and the PK does NOT consider `removed_at`, so a SOFT-DELETED `intake`\n-- row still occupies the slot. Drop a stale `triage` row for a team that already holds ANY `intake`\n-- row — live or soft-deleted — then rename what is left. Idempotent under execReplaySafe replay — a\n-- row already renamed to `intake` no longer matches `slot = 'triage'` on a re-run.\n--\n-- ⛔ CTC-1597 remediate (C2): an earlier draft of the EXISTS guard filtered `removed_at IS NULL`,\n-- reasoning that a soft-deleted `intake` row should never cause a still-live `triage` row to be\n-- dropped instead of renamed. That reasoning had it backwards — the PK collision this guard exists\n-- to prevent happens precisely BECAUSE `removed_at` is not part of the primary key: a host that\n-- receives a soft-deleted `intake` row via replication (from a DO that already renamed and was then\n-- unmapped) before it has applied this migration locally still has its own live `triage` row: the\n-- DELETE's old filter left the `triage` row in place, and the following blind UPDATE then tried to\n-- rename it to a slot value a row already occupies, violating the PK and aborting the whole bundle.\n-- Matching on ANY `intake` row (regardless of `removed_at`) fixes it: the stale `triage` row is\n-- dropped, not renamed, whenever the slot is already spoken for.\n--\n-- ⛔ CTC-1597 remediate (validate-plan finding 1) — a `triage`-slot row whose OWN mapped state is\n-- ITSELF type='triage' (Linear's reserved Triage inbox, legally name-matched into the OLD\n-- `RECOMMENDED_STAGES` entry before this ticket) must NOT be renamed blind: `SLOT_STATE_TYPES.intake`\n-- no longer accepts that type (Scope B), so renaming it in place would silently flip the team's\n-- `types_compatible` check from pass to a blocking fail with no data fix and no recourse — the write\n-- path's own validation (the same narrowing) would refuse a re-save of the identical row. Soft-delete\n-- it instead, via `removed_at` — this table's own convention for \"this slot is unmapped\" (see the\n-- table's doc comment in packages/schema/src/mirror.ts) — so the team lands in the ordinary,\n-- already-actionable \"needs a stage\" state a brand-new team starts in, which Scope C's per-team\n-- runbook resolves. Runs BEFORE the final rename so no live-or-dead row anywhere keeps the retired\n-- `triage` slot value; guarded by `removed_at IS NULL` so a replay is a no-op.\nUPDATE `team_workflow_mapping`\n   SET `removed_at` = CAST(unixepoch() AS INTEGER) * 1000\n WHERE `slot` = 'triage' AND `linear_state_type` = 'triage' AND `removed_at` IS NULL;\n--> statement-breakpoint\nDELETE FROM `team_workflow_mapping`\n WHERE `slot` = 'triage'\n   AND EXISTS (SELECT 1 FROM `team_workflow_mapping` m2\n                WHERE m2.`team_id` = `team_workflow_mapping`.`team_id` AND m2.`slot` = 'intake');\n--> statement-breakpoint\nUPDATE `team_workflow_mapping` SET `slot` = 'intake' WHERE `slot` = 'triage';\n",
   },
 } as const;

package/src/mirror.ts

@@ -383,7 +383,11 @@ export const team_workflow_mapping = sqliteTable(
   "team_workflow_mapping",
   {
     team_id: text("team_id").notNull(),
-    /** One of the eleven Catalyst slots; the five load-bearing ones gate the fleet. */
+    /** One of the eleven Catalyst slots; the five load-bearing ones gate the fleet. CTC-1597 renamed
+     *  the `triage` slot to `intake` — migration 0037 rewrites `slot='triage'` rows in place, except a
+     *  row whose OWN `linear_state_type` is itself `'triage'`, which it soft-deletes rather than
+     *  renames (that type is no longer valid for `intake` — see `SLOT_STATE_TYPES` in
+     *  `@catalyst-cloud/types`). */
     slot: text("slot").notNull(),
     /** THE AUTHORITY — joined against workflow_states.id by every consumer. */
     linear_state_id: text("linear_state_id").notNull(),

package/src/telemetry/phase-lifecycle-point.ts

@@ -62,6 +62,88 @@ export function teamFromTicket(ticket: string): string | null {
   return m === null ? null : m[1]!;
 }
 
+/**
+ * CTC-1776 — THE ONE DOCUMENTED ORDER of `detail`'s `key=` tokens, and the reason there is one.
+ *
+ * `detail` is an APPEND-ONLY, fixed-order sequence so an operator's `blob5 LIKE '%status=…%phase=…%'`
+ * predicate keeps matching as fields are added (docs/devops.md's own recipe is written against it).
+ * A new optional field goes at the END of `buildPhaseLifecyclePoint`'s array AND at the end of this
+ * list — never inserted in the middle.
+ *
+ * `failure_class` and `round` are RESERVED here, ahead of CTC-1771 building them, so that ticket's
+ * fields land after `reason=` by construction rather than by anyone remembering to. The subsequence
+ * test in this module's spec is what enforces it.
+ *
+ * ⛔ `reason` is the ONE token whose value may contain spaces and its own `key=value` pairs — a
+ * validate row's `reason=ladder:plan-conformance=PASS type-safety=FAIL …` digest (CTC-1541/CTC-1776).
+ * A naive space-split therefore sees the digest's `step=verdict` pairs as fields of their own, which
+ * is exactly what the round-1 subsequence test missed (CTC-1776 validate round 2, CR-C). Two rules
+ * follow. (1) `reason` renders LAST of the free-text-capable tokens, so everything after it up to
+ * the next key REGISTERED HERE belongs to its value — a reader (the spec's `parseDetail`, an
+ * operator's `LIKE`) can only tell a digest pair from a field by consulting this list. (2) A field
+ * appended after `reason` MUST be registered here first: an unregistered one is indistinguishable
+ * from a digest token and is swallowed into `reason`'s value, which the spec's round-trip assertion
+ * turns into a red test rather than a silent census skew.
+ */
+export const PHASE_LIFECYCLE_DETAIL_ORDER = [
+  "status",
+  "ticket",
+  "phase",
+  "nonce",
+  "executor",
+  "substrate",
+  "provider",
+  "branch",
+  "base_sha",
+  "pr_number",
+  "artifact_key",
+  "reason",
+  // Reserved — CTC-1771 Phase 5.
+  "failure_class",
+  "round",
+] as const;
+
+/** CTC-1541/CTC-1776 — the `reason=` value a validate row carries for its per-step ladder digest.
+ *  Used by BOTH the succeeded-receipt site and the failed-release site in MirrorDO.ts, so "exactly
+ *  as a succeeded row does" is a shared function rather than two string literals. */
+export const LADDER_REASON_PREFIX = "ladder:";
+export function ladderReason(digest: string): string {
+  return `${LADDER_REASON_PREFIX}${digest}`;
+}
+
+/** CTC-1776 — the `reason=` value for a validate row whose ladder block could not be parsed at all.
+ *  Deliberately NOT a `ladder:` digest: five UNREPORTED verdicts read as a verdict set, and the
+ *  census must count "I could not look" apart from a real FAIL. Bare, with no cause suffix — the
+ *  five causes are named in the runner's own log line (loop.ts), keyed by ticket and phase. */
+export const VALIDATION_LADDER_UNPARSED_REASON = "validation-ladder-unparsed";
+
+/** CTC-1776 — the one verdict that means "I could not look", mirrored from `LADDER_VERDICTS`
+ *  (`apps/runner/src/validation-ladder.ts`); this package stays runner-free, same posture
+ *  `apps/mirror/src/artifacts/relay-receipt.ts` already takes for the ladder's other bounds. */
+export const UNREPORTED_LADDER_VERDICT = "UNREPORTED";
+
+/**
+ * CTC-1776 remediate (validate round 1, CR-3) — is every `step=verdict` token in an already-rendered
+ * digest `UNREPORTED`?
+ *
+ * The succeeded-receipt site answers the same question from the parsed `RelayReceiptLadder` it holds;
+ * the FAILED-release site only ever holds the rendered digest string the runner wrote, so it needs
+ * this form. Both then map to {@link VALIDATION_LADDER_UNPARSED_REASON} rather than publishing five
+ * UNREPORTED verdicts as if they were a verdict set — the census has to count "I could not look"
+ * apart from a real FAIL on BOTH row statuses, not just on `succeeded`.
+ *
+ * An empty digest is `false`, never a vacuous `true`: `[].every(…)` is the exact shape AGENTS.md's
+ * false-clean-result rule names, and a summary with no tokens at all is not evidence of anything.
+ */
+export function isAllUnreportedLadderDigest(digest: string): boolean {
+  const tokens = digest.split(/\s+/).filter((token) => token.length > 0);
+  if (tokens.length === 0) return false;
+  return tokens.every((token) => {
+    const eq = token.lastIndexOf("=");
+    return eq !== -1 && token.slice(eq + 1) === UNREPORTED_LADDER_VERDICT;
+  });
+}
+
 /**
  * Build one `phase.lifecycle` TelemetryPoint. Throws (never a falsy sentinel) on an unrecognized
  * `status` — the same posture as `assertEmittable` for the event name.