@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/log-rotate.d.ts

@@ -1,67 +0,0 @@
-/**
- * DOD-M15-LOGBOUND-1 part B — bound `daemon.log` by rotating it at SPAWN.
- *
- * **The daemon does not own its log file, and that constraint decides the whole design.**
- * `spawnDaemon` does `openSync(logPath, "a")` and hands that descriptor to the child as stdout
- * and stderr. The daemon therefore writes to a file *handle*, not to a path: renaming the file
- * underneath it moves nothing, because the handle follows the inode and the daemon carries on
- * filling the renamed file.
- *
- * So the spawner is the only party that can rotate cleanly, and spawn is the only moment at
- * which nothing holds the handle. That is why this is here and not in the daemon, and it is why
- * {@link openLogHandle} does both steps in one function — the rotate-then-open ORDER is the
- * property, and a property split across two call sites is a property waiting to be reversed.
- *
- * **⚠️ WHAT THIS DOES NOT BOUND, and it is the machines that need it most.** Rotation fires only
- * on the `connectOrStart` path, which is how an operator's CLI starts the daemon. The demo box and
- * the Hermes box start it under systemd, running `dist/bin/cello-daemon.js` directly — that path
- * never reaches here, so **those two long-lived daemons are not bounded by this at all**. They are
- * also the ones that run for weeks without restarting, which is the case
- * `052-LOGCEILING` covers (suggested post-launch, not yet ruled). Stated here rather than left to
- * be discovered, because "rotation shipped" would otherwise read as a bound that those machines have.
- */
-/**
- * Cap for the live file: 64 MB. With one previous generation kept, the ceiling across restarts
- * is 128 MB.
- *
- * A starting point rather than a finding. For scale: the measured file was 180 MB, of which 168 MB
- * was one repeated line that part A of this unit now collapses, and the ordinary remainder grew at
- * roughly 3 MB/day under heavy development.
- */
-export declare const LOG_ROTATE_CAP_BYTES: number;
-/** What a rotation attempt did, so the caller can put it on the record either way. */
-export type RotateOutcome = {
-    rotated: true;
-    bytes: number;
-    rotatedTo: string;
-} | {
-    rotated: false;
-    reason: "under_cap" | "absent" | "raced" | "failed";
-    error?: string;
-};
-/**
- * Rename `logPath` to `logPath.1` if it is over `capBytes`, replacing any older `.1`.
- *
- * **Never throws**, and that is a contract rather than defensiveness: a daemon that refuses to
- * start because it could not tidy its log would be a strictly worse outcome than an oversized log.
- * It reports what happened instead of being silent about it — see {@link openLogHandle}, which is
- * where the reporting lands.
- *
- * **It never truncates.** A truncation of the live file either races the writer or throws away
- * the tail, and the tail is the only part anyone reads.
- */
-export declare function rotateLogIfOversized(logPath: string, capBytes?: number): RotateOutcome;
-/**
- * Rotate if needed, THEN open the log for append and return the descriptor.
- *
- * The ordering is the point. Open first and the rename moves only the name, leaving the daemon
- * writing into the renamed inode — the rotation would appear to work and bound nothing.
- *
- * **The outcome is written as the first line of the fresh file**, because the alternative is a log
- * that starts mid-story. Someone sent a 4 MB `daemon.log` to chase a failure that began before the
- * restart has no way to know that `daemon.log.1` exists unless the file says so. And a rotation
- * that FAILED has to say so loudest of all: it means the bound this unit ships does not exist on
- * this machine, and nothing else would ever mention it.
- */
-export declare function openLogHandle(logPath: string, capBytes?: number): number;
-//# sourceMappingURL=log-rotate.d.ts.map

package/dist/log-rotate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"log-rotate.d.ts","sourceRoot":"","sources":["../src/log-rotate.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAerD,sFAAsF;AACtF,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,aAAa,CAkC5G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,MAAM,CAiB9F"}

package/dist/log-rotate.js

@@ -1,134 +0,0 @@
-import { openSync, renameSync, statSync, writeSync } from "node:fs";
-import { extractErrorMessage } from "./error-message.js";
-/**
- * DOD-M15-LOGBOUND-1 part B — bound `daemon.log` by rotating it at SPAWN.
- *
- * **The daemon does not own its log file, and that constraint decides the whole design.**
- * `spawnDaemon` does `openSync(logPath, "a")` and hands that descriptor to the child as stdout
- * and stderr. The daemon therefore writes to a file *handle*, not to a path: renaming the file
- * underneath it moves nothing, because the handle follows the inode and the daemon carries on
- * filling the renamed file.
- *
- * So the spawner is the only party that can rotate cleanly, and spawn is the only moment at
- * which nothing holds the handle. That is why this is here and not in the daemon, and it is why
- * {@link openLogHandle} does both steps in one function — the rotate-then-open ORDER is the
- * property, and a property split across two call sites is a property waiting to be reversed.
- *
- * **⚠️ WHAT THIS DOES NOT BOUND, and it is the machines that need it most.** Rotation fires only
- * on the `connectOrStart` path, which is how an operator's CLI starts the daemon. The demo box and
- * the Hermes box start it under systemd, running `dist/bin/cello-daemon.js` directly — that path
- * never reaches here, so **those two long-lived daemons are not bounded by this at all**. They are
- * also the ones that run for weeks without restarting, which is the case
- * `052-LOGCEILING` covers (suggested post-launch, not yet ruled). Stated here rather than left to
- * be discovered, because "rotation shipped" would otherwise read as a bound that those machines have.
- */
-/**
- * Cap for the live file: 64 MB. With one previous generation kept, the ceiling across restarts
- * is 128 MB.
- *
- * A starting point rather than a finding. For scale: the measured file was 180 MB, of which 168 MB
- * was one repeated line that part A of this unit now collapses, and the ordinary remainder grew at
- * roughly 3 MB/day under heavy development.
- */
-export const LOG_ROTATE_CAP_BYTES = 64 * 1024 * 1024;
-/** Name of the single previous generation. There is deliberately no `.2`. */
-function rotatedPathFor(logPath) {
-    return `${logPath}.1`;
-}
-function sizeOf(path) {
-    try {
-        return statSync(path).size;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Rename `logPath` to `logPath.1` if it is over `capBytes`, replacing any older `.1`.
- *
- * **Never throws**, and that is a contract rather than defensiveness: a daemon that refuses to
- * start because it could not tidy its log would be a strictly worse outcome than an oversized log.
- * It reports what happened instead of being silent about it — see {@link openLogHandle}, which is
- * where the reporting lands.
- *
- * **It never truncates.** A truncation of the live file either races the writer or throws away
- * the tail, and the tail is the only part anyone reads.
- */
-export function rotateLogIfOversized(logPath, capBytes = LOG_ROTATE_CAP_BYTES) {
-    const size = sizeOf(logPath);
-    if (size === null)
-        return { rotated: false, reason: "absent" };
-    if (size <= capBytes)
-        return { rotated: false, reason: "under_cap" };
-    /**
-     * ⚠️ RE-STAT IMMEDIATELY BEFORE THE RENAME, because rotation is the one thing on this path that
-     * the singleton lock does NOT cover. `connectOrStart` states plainly that two callers can probe
-     * the lock as free at the same instant and both spawn. Both then arrive here. The damaging
-     * interleaving is: B sees an oversized file, A renames it to `.1` and opens a fresh one, then B
-     * renames that fresh near-empty file over `.1` — and 64 MB of retained history is replaced by a
-     * few bytes, losing exactly the tail rotation exists to keep. The window is small and the loser
-     * exits seconds later, but the cost of losing is the whole point of the feature.
-     */
-    const stillOversized = sizeOf(logPath);
-    if (stillOversized === null || stillOversized <= capBytes)
-        return { rotated: false, reason: "raced" };
-    /**
-     * ⚠️ **THERE IS DELIBERATELY NO "don't let a smaller file replace a larger kept one" GUARD.** It
-     * was written, it looked prudent, and it silently turned the cap into a RATCHET: the kept file
-     * becomes the effective threshold, so once a 180 MB log has been rotated once, the live file has
-     * to exceed 180 MB — then more — before it will ever rotate again. The 128 MB ceiling this unit
-     * ships would not have existed on the first machine it ran on. The re-stat above already covers
-     * the race that guard was written for: in that interleaving the loser re-stats, finds the fresh
-     * near-empty file under the cap, and returns `raced` without renaming anything.
-     */
-    try {
-        renameSync(logPath, rotatedPathFor(logPath));
-        return { rotated: true, bytes: stillOversized, rotatedTo: rotatedPathFor(logPath) };
-    }
-    catch (err) {
-        // EACCES / EROFS / EXDEV — a read-only or wrong-owner ~/.cello. None of them is a reason to
-        // fail a daemon start, and all of them mean this machine has no bound at all.
-        return { rotated: false, reason: "failed", error: extractErrorMessage(err) };
-    }
-}
-/**
- * Rotate if needed, THEN open the log for append and return the descriptor.
- *
- * The ordering is the point. Open first and the rename moves only the name, leaving the daemon
- * writing into the renamed inode — the rotation would appear to work and bound nothing.
- *
- * **The outcome is written as the first line of the fresh file**, because the alternative is a log
- * that starts mid-story. Someone sent a 4 MB `daemon.log` to chase a failure that began before the
- * restart has no way to know that `daemon.log.1` exists unless the file says so. And a rotation
- * that FAILED has to say so loudest of all: it means the bound this unit ships does not exist on
- * this machine, and nothing else would ever mention it.
- */
-export function openLogHandle(logPath, capBytes = LOG_ROTATE_CAP_BYTES) {
-    const outcome = rotateLogIfOversized(logPath, capBytes);
-    const fd = openSync(logPath, "a");
-    if (outcome.rotated) {
-        writeNotice(fd, {
-            level: "info", event: "daemon.log.rotated",
-            bytes: outcome.bytes, rotatedTo: outcome.rotatedTo,
-            impact: "everything logged before this line is in the file named by rotatedTo",
-        });
-    }
-    else if (outcome.reason === "failed") {
-        writeNotice(fd, {
-            level: "warn", event: "daemon.log.rotate.failed",
-            reason: outcome.reason, error: outcome.error ?? "",
-            impact: "daemon.log is over its cap and could not be rotated, so it is unbounded on this machine",
-        });
-    }
-    return fd;
-}
-function writeNotice(fd, fields) {
-    try {
-        writeSync(fd, JSON.stringify({ ...fields, ts: new Date().toISOString() }) + "\n");
-    }
-    catch {
-        // The notice is the least important thing this function does. Failing to write it must not
-        // cost the caller its descriptor.
-    }
-}
-//# sourceMappingURL=log-rotate.js.map

package/dist/log-rotate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"log-rotate.js","sourceRoot":"","sources":["../src/log-rotate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,GAAG,OAAO,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAAmB,oBAAoB;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/D,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEtG;;;;;;;;OAQG;IACH,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4FAA4F;QAC5F,8EAA8E;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,WAAmB,oBAAoB;IACpF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,EAAE,EAAE;YACd,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YAClD,MAAM,EAAE,sEAAsE;SAC/E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,WAAW,CAAC,EAAE,EAAE;YACd,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAClD,MAAM,EAAE,yFAAyF;SAClG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,MAA+B;IAC9D,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,kCAAkC;IACpC,CAAC;AACH,CAAC"}

package/dist/manifest-deps.d.ts

@@ -1,25 +0,0 @@
-/**
- * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
- *
- * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
- * top-level main() (which spawns a live daemon on import).
- *
- * Two modes:
- *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
- *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
- *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
- *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
- *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
- */
-import { type IManifestProvider, type IDirectoryChallengeVerifier, type IManifestVersionStore, type IManifestPollScheduler } from "@cello-protocol/transport";
-import type { Logger } from "./types.js";
-export interface ManifestDeps {
-    manifestProvider?: IManifestProvider;
-    manifestRootKeys?: readonly string[];
-    manifestThreshold?: number;
-    challengeVerifier?: IDirectoryChallengeVerifier;
-    manifestVersionStore?: IManifestVersionStore;
-    manifestPollScheduler?: IManifestPollScheduler;
-}
-export declare function buildManifestDeps(logger: Logger): ManifestDeps;
-//# sourceMappingURL=manifest-deps.d.ts.map

package/dist/manifest-deps.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-deps.d.ts","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AASnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAazC,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;CAChD;AA4CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAgG9D"}

package/dist/manifest-deps.js

@@ -1,151 +0,0 @@
-/**
- * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
- *
- * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
- * top-level main() (which spawns a live daemon on import).
- *
- * Two modes:
- *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
- *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
- *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
- *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
- *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
- */
-import { ManifestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
-import { FileManifestProvider, EmbeddedManifestProvider } from "./file-manifest-provider.js";
-import { BUNDLED_CONSORTIUM_MANIFEST, BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD, } from "./bundled-consortium-manifest.js";
-import { resolveDirectoryUrl } from "./directory-bootstrap.js";
-import { RandomizedPollScheduler } from "./manifest-poll-scheduler.js";
-import { remedyFor } from "./manifest-validity.js";
-/** Normalize a directory URL for comparison (trim, drop trailing slashes, lowercase). */
-function normalizeUrl(u) {
-    return u.trim().replace(/\/+$/, "").toLowerCase();
-}
-/** The set of directory endpoints the bundled roster describes (normalized). */
-const BUNDLED_ENDPOINTS = new Set(BUNDLED_CONSORTIUM_MANIFEST.nodes.map((n) => normalizeUrl(String(n["endpoint"]))));
-/**
- * Build the consortium-manifest deps.
- *
- *   CELLO_CONSORTIUM_MANIFEST    absolute path to an override manifest JSON (opt-in)
- *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex) — override path only
- *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer) — override path only
- *   CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS   optional background poll window — override path only
- *
- * The single manifestProvider instance is shared between startDaemon's loadAndVerify call and the
- * ManifestDirectoryChallengeVerifier, so step-6 reads the same cached, verified manifest.
- */
-/**
- * DOD-M15-EXPIRY-CONSUMER-POLICY-1 — ONE callback, built per origin.
- *
- * It was duplicated verbatim across the bundled and file branches, and the one place the two copies
- * had to DIFFER was the one place they were identical: the remedy. "Install a current manifest and
- * restart" is advice that cannot be followed on the bundled path — the manifest is compiled in, that
- * branch wires no poll, so it can never self-heal — and the workaround an operator reaches for
- * instead (repointing CELLO_DIRECTORY_URL) starts the daemon with directory identity authentication
- * SILENTLY OFF. Guidance that routes a stuck operator into disabling a security control is a defect
- * in the guidance, which `remedyFor` already exists to prevent.
- */
-function lapsedManifestReporter(logger, origin) {
-    return (info) => {
-        logger.warn("directory.auth.manifest.lapsed", {
-            ...info,
-            origin,
-            impact: "a directory node was SUCCESSFULLY authenticated against a manifest whose validity window " +
-                "has closed, so its key was trusted on the strength of a check that has expired. If that " +
-                "node has been rotated or removed since, this daemon would not know.",
-            guidance: "Signaling was NOT blocked — refusing here would leave a long-running daemon unable to " +
-                "authenticate any directory, taking every agent offline. " + remedyFor(origin) +
-                " cello_status reports the expiry.",
-        });
-    };
-}
-export function buildManifestDeps(logger) {
-    const manifestPath = process.env.CELLO_CONSORTIUM_MANIFEST;
-    if (!manifestPath) {
-        // FINDING-4 default: load the COMPILED-IN consortium roster so the daemon already knows every
-        // sovereign directory — and can fail over to a reachable one — even when its primary is down
-        // (the redundancy invariant), AND enforces step-6 directory identity auth against the bundled
-        // node pubkeys (defeats a /bootstrap MITM redirecting failover to a rogue directory). This is
-        // the full production posture with zero operator config. The manifest is re-verified against the
-        // pinned root keys at load by startDaemon (ADV-002 — a corrupt embedded manifest fails CLOSED,
-        // never a silent downgrade). No poll scheduler: the bundled roster is static; adopting runtime
-        // manifest updates via the /manifest poll is a separate opt-in reachable through the env path.
-        //
-        // GATE (do NOT enable step-6 against a directory the bundle can't authenticate): the bundled
-        // manifest is the trust anchor for the PRODUCTION consortium ONLY (the mygentic.ai directories
-        // it lists). When the operator has pointed CELLO_DIRECTORY_URL at a directory that is NOT in the
-        // bundle — local dev (`CELLO_ENV=local`) and the e2e spine harness both run their own local
-        // directory on 127.0.0.1 — the bundled node pubkeys don't describe it, so enforcing step-6 would
-        // wrongly reject every connection (key_not_in_manifest). In that case fall through to the M6
-        // backward-compat path (no roster, no step-6); those deployments opt into step-6 explicitly by
-        // supplying a matching manifest via CELLO_CONSORTIUM_MANIFEST. Unset URL → the production default,
-        // which is a bundled node's ADDRESS and so matches, giving real operators the full posture.
-        //
-        // The comparison is byte-equality against the roster, not "reaches the same machine". A DNS name
-        // for a bundled node does NOT match and lands here, in the branch that turns step-6 off — which
-        // is why PRODUCTION_DIRECTORY_URL is an address. Do not "tidy" either into a hostname.
-        const directoryUrl = normalizeUrl(resolveDirectoryUrl());
-        if (!BUNDLED_ENDPOINTS.has(directoryUrl)) {
-            // Two very different situations reach here and they must not log the same way. A loopback or
-            // private address is local dev or the e2e harness pointing at its own directory — designed and
-            // benign. Anything else is a client running against a PUBLIC directory with identity
-            // authentication off, which is a weaker client than the operator believes they have, and the
-            // only previous signal was the absence of a different log line.
-            const isLocal = /^https?:\/\/(localhost|127\.|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(directoryUrl);
-            const detail = { directoryUrl, reason: "directory_not_in_bundled_roster", step6: "disabled" };
-            if (isLocal)
-                logger.info("daemon.manifest.bundled.skipped", detail);
-            else
-                logger.warn("daemon.manifest.bundled.skipped", detail);
-            return {};
-        }
-        const manifestProvider = new EmbeddedManifestProvider(BUNDLED_CONSORTIUM_MANIFEST);
-        const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider, lapsedManifestReporter(logger, "bundled"));
-        logger.info("daemon.manifest.bundled", {
-            version: BUNDLED_CONSORTIUM_MANIFEST.version,
-            nodeCount: BUNDLED_CONSORTIUM_MANIFEST.nodes.length,
-            rootKeyCount: BUNDLED_CONSORTIUM_ROOT_KEYS.length,
-            threshold: BUNDLED_CONSORTIUM_THRESHOLD,
-        });
-        return {
-            manifestProvider,
-            manifestRootKeys: BUNDLED_CONSORTIUM_ROOT_KEYS,
-            manifestThreshold: BUNDLED_CONSORTIUM_THRESHOLD,
-            challengeVerifier,
-        };
-    }
-    const rootKeysRaw = process.env.CELLO_CONSORTIUM_ROOT_KEYS ?? "";
-    const manifestRootKeys = rootKeysRaw.split(",").map((k) => k.trim()).filter((k) => k.length > 0);
-    const manifestThreshold = Number.parseInt(process.env.CELLO_CONSORTIUM_THRESHOLD ?? "", 10);
-    if (manifestRootKeys.length === 0 || Number.isNaN(manifestThreshold)) {
-        throw new Error("CELLO_CONSORTIUM_MANIFEST is set but CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD are missing or invalid");
-    }
-    const manifestProvider = new FileManifestProvider({ path: manifestPath });
-    const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider, lapsedManifestReporter(logger, "file"));
-    // DOD-AUTH-2: background manifest poll. The directory is re-polled on a randomized 6–12h interval
-    // (thundering-herd avoidance) and a newer signed manifest is adopted. The interval is env-injectable
-    // so the live binary test can poll sub-second instead of waiting hours; production leaves these
-    // unset → the 6–12h default window. Both-or-neither, positive, min <= max — a partial/invalid
-    // override fails LOUDLY rather than silently reverting or producing a negative (tight-loop) delay.
-    const rawPollMin = process.env.CELLO_MANIFEST_POLL_MIN_MS;
-    const rawPollMax = process.env.CELLO_MANIFEST_POLL_MAX_MS;
-    let pollOpts;
-    if (rawPollMin !== undefined || rawPollMax !== undefined) {
-        const minMs = Number.parseInt(rawPollMin ?? "", 10);
-        const maxMs = Number.parseInt(rawPollMax ?? "", 10);
-        if (Number.isNaN(minMs) || Number.isNaN(maxMs) || minMs <= 0 || maxMs < minMs) {
-            throw new Error("CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS must BOTH be set to positive integers with min <= max");
-        }
-        pollOpts = { minMs, maxMs };
-    }
-    const manifestPollScheduler = new RandomizedPollScheduler(pollOpts);
-    logger.info("daemon.manifest.configured", {
-        manifestPath,
-        rootKeyCount: manifestRootKeys.length,
-        threshold: manifestThreshold,
-        pollMinMs: pollOpts?.minMs ?? null,
-        pollMaxMs: pollOpts?.maxMs ?? null,
-    });
-    return { manifestProvider, manifestRootKeys, manifestThreshold, challengeVerifier, manifestPollScheduler };
-}
-//# sourceMappingURL=manifest-deps.js.map

package/dist/manifest-deps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-deps.js","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kCAAkC,GAKnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAuB,MAAM,wBAAwB,CAAC;AAExE,yFAAyF;AACzF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAE,CAA6B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC/G,CAAC;AAWF;;;;;;;;;;GAUG;AACH;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,MAAc,EACd,MAAsB;IAEtB,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,GAAG,IAAI;YACP,MAAM;YACN,MAAM,EACJ,2FAA2F;gBAC3F,0FAA0F;gBAC1F,qEAAqE;YACvE,QAAQ,EACN,wFAAwF;gBACxF,0DAA0D,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC9E,mCAAmC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,4FAA4F;QAC5F,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,mGAAmG;QACnG,4FAA4F;QAC5F,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,uFAAuF;QACvF,MAAM,YAAY,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,6FAA6F;YAC7F,+FAA+F;YAC/F,qFAAqF;YACrF,6FAA6F;YAC7F,gEAAgE;YAChE,MAAM,OAAO,GAAG,iFAAiF,CAAC,IAAI,CACpG,YAAY,CACb,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC9F,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;;gBAC/D,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;QACnF,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAC9D,gBAAgB,EAAE,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,OAAO,EAAE,2BAA2B,CAAC,OAAO;YAC5C,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACnD,YAAY,EAAE,4BAA4B,CAAC,MAAM;YACjD,SAAS,EAAE,4BAA4B;SACxC,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB;YAChB,gBAAgB,EAAE,4BAA4B;YAC9C,iBAAiB,EAAE,4BAA4B;YAC/C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAC9D,gBAAgB,EAAE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,IAAI,QAAsD,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,YAAY;QACZ,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AAC7G,CAAC"}

package/dist/manifest-poll-scheduler.d.ts

@@ -1,31 +0,0 @@
-/**
- * M7-MANIFEST-002 — Manifest poll scheduler implementations.
- *
- * IManifestPollScheduler schedules the background manifest poll that keeps the
- * in-memory manifest current over long-lived daemon sessions.
- *
- * RandomizedPollScheduler: production implementation — fires after a random delay
- * in the 6-12 hour window (prevents thundering-herd against the directory).
- *
- * ImmediatePollScheduler: test stub — fires once with a configurable delay (0ms default).
- * Exported from @cello-protocol/transport.
- */
-import type { IManifestPollScheduler } from "@cello-protocol/transport";
-export { ImmediatePollScheduler } from "@cello-protocol/transport";
-export type { IManifestPollScheduler };
-/**
- * RandomizedPollScheduler — fires after a random interval between 6 and 12 hours.
- *
- * The randomization window prevents thundering-herd scenarios where many agents
- * all poll simultaneously. Each agent picks an independent random delay.
- */
-export declare class RandomizedPollScheduler implements IManifestPollScheduler {
-    #private;
-    constructor(opts?: {
-        minMs?: number;
-        maxMs?: number;
-    });
-    scheduleNext(callbackFn: () => Promise<void>): void;
-    cancel(): void;
-}
-//# sourceMappingURL=manifest-poll-scheduler.d.ts.map

package/dist/manifest-poll-scheduler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-poll-scheduler.d.ts","sourceRoot":"","sources":["../src/manifest-poll-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,CAAC;AAOvC;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,sBAAsB;;gBAMxD,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAKrD,YAAY,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAkBnD,MAAM,IAAI,IAAI;CAOf"}

package/dist/manifest-poll-scheduler.js

@@ -1,59 +0,0 @@
-/**
- * M7-MANIFEST-002 — Manifest poll scheduler implementations.
- *
- * IManifestPollScheduler schedules the background manifest poll that keeps the
- * in-memory manifest current over long-lived daemon sessions.
- *
- * RandomizedPollScheduler: production implementation — fires after a random delay
- * in the 6-12 hour window (prevents thundering-herd against the directory).
- *
- * ImmediatePollScheduler: test stub — fires once with a configurable delay (0ms default).
- * Exported from @cello-protocol/transport.
- */
-// Re-export the test stub for convenience
-export { ImmediatePollScheduler } from "@cello-protocol/transport";
-// ─── RandomizedPollScheduler (production) ─────────────────────────────────────
-const POLL_MIN_MS = 6 * 60 * 60 * 1000; // 6 hours
-const POLL_MAX_MS = 12 * 60 * 60 * 1000; // 12 hours
-/**
- * RandomizedPollScheduler — fires after a random interval between 6 and 12 hours.
- *
- * The randomization window prevents thundering-herd scenarios where many agents
- * all poll simultaneously. Each agent picks an independent random delay.
- */
-export class RandomizedPollScheduler {
-    #timer = null;
-    #cancelled = false;
-    #minMs;
-    #maxMs;
-    constructor(opts) {
-        this.#minMs = opts?.minMs ?? POLL_MIN_MS;
-        this.#maxMs = opts?.maxMs ?? POLL_MAX_MS;
-    }
-    scheduleNext(callbackFn) {
-        this.cancel();
-        // ADV-003: Reset cancelled flag when scheduling a new callback (cancel() sets it).
-        // If cancel() was called to clear a previous timer before scheduling the next one,
-        // the flag must be reset so the new callback can fire.
-        this.#cancelled = false;
-        const delay = this.#minMs + Math.random() * (this.#maxMs - this.#minMs);
-        this.#timer = setTimeout(() => {
-            this.#timer = null;
-            // ADV-003: Check cancelled flag at callback entry point. If cancel() was called
-            // between timer fire and callback execution, do not run the callback.
-            if (this.#cancelled)
-                return;
-            callbackFn().catch(() => {
-                // Poll errors are logged by the caller; scheduling errors don't crash the daemon
-            });
-        }, delay);
-    }
-    cancel() {
-        this.#cancelled = true;
-        if (this.#timer !== null) {
-            clearTimeout(this.#timer);
-            this.#timer = null;
-        }
-    }
-}
-//# sourceMappingURL=manifest-poll-scheduler.js.map

package/dist/manifest-poll-scheduler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-poll-scheduler.js","sourceRoot":"","sources":["../src/manifest-poll-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,0CAA0C;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,iFAAiF;AAEjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAE,UAAU;AACnD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAClC,MAAM,GAAyC,IAAI,CAAC;IACpD,UAAU,GAAG,KAAK,CAAC;IACV,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,IAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,WAAW,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,WAAW,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,UAA+B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,mFAAmF;QACnF,mFAAmF;QACnF,uDAAuD;QACvD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC5B,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBACtB,iFAAiF;YACnF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}