@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/log-rotate.d.ts

@@ -0,0 +1,67 @@
+/**
+ * DOD-M15-LOGBOUND-1 part B — bound `daemon.log` by rotating it at SPAWN.
+ *
+ * **The daemon does not own its log file, and that constraint decides the whole design.**
+ * `spawnDaemon` does `openSync(logPath, "a")` and hands that descriptor to the child as stdout
+ * and stderr. The daemon therefore writes to a file *handle*, not to a path: renaming the file
+ * underneath it moves nothing, because the handle follows the inode and the daemon carries on
+ * filling the renamed file.
+ *
+ * So the spawner is the only party that can rotate cleanly, and spawn is the only moment at
+ * which nothing holds the handle. That is why this is here and not in the daemon, and it is why
+ * {@link openLogHandle} does both steps in one function — the rotate-then-open ORDER is the
+ * property, and a property split across two call sites is a property waiting to be reversed.
+ *
+ * **⚠️ WHAT THIS DOES NOT BOUND, and it is the machines that need it most.** Rotation fires only
+ * on the `connectOrStart` path, which is how an operator's CLI starts the daemon. The demo box and
+ * the Hermes box start it under systemd, running `dist/bin/cello-daemon.js` directly — that path
+ * never reaches here, so **those two long-lived daemons are not bounded by this at all**. They are
+ * also the ones that run for weeks without restarting, which is the case
+ * `052-LOGCEILING` covers (suggested post-launch, not yet ruled). Stated here rather than left to
+ * be discovered, because "rotation shipped" would otherwise read as a bound that those machines have.
+ */
+/**
+ * Cap for the live file: 64 MB. With one previous generation kept, the ceiling across restarts
+ * is 128 MB.
+ *
+ * A starting point rather than a finding. For scale: the measured file was 180 MB, of which 168 MB
+ * was one repeated line that part A of this unit now collapses, and the ordinary remainder grew at
+ * roughly 3 MB/day under heavy development.
+ */
+export declare const LOG_ROTATE_CAP_BYTES: number;
+/** What a rotation attempt did, so the caller can put it on the record either way. */
+export type RotateOutcome = {
+    rotated: true;
+    bytes: number;
+    rotatedTo: string;
+} | {
+    rotated: false;
+    reason: "under_cap" | "absent" | "raced" | "failed";
+    error?: string;
+};
+/**
+ * Rename `logPath` to `logPath.1` if it is over `capBytes`, replacing any older `.1`.
+ *
+ * **Never throws**, and that is a contract rather than defensiveness: a daemon that refuses to
+ * start because it could not tidy its log would be a strictly worse outcome than an oversized log.
+ * It reports what happened instead of being silent about it — see {@link openLogHandle}, which is
+ * where the reporting lands.
+ *
+ * **It never truncates.** A truncation of the live file either races the writer or throws away
+ * the tail, and the tail is the only part anyone reads.
+ */
+export declare function rotateLogIfOversized(logPath: string, capBytes?: number): RotateOutcome;
+/**
+ * Rotate if needed, THEN open the log for append and return the descriptor.
+ *
+ * The ordering is the point. Open first and the rename moves only the name, leaving the daemon
+ * writing into the renamed inode — the rotation would appear to work and bound nothing.
+ *
+ * **The outcome is written as the first line of the fresh file**, because the alternative is a log
+ * that starts mid-story. Someone sent a 4 MB `daemon.log` to chase a failure that began before the
+ * restart has no way to know that `daemon.log.1` exists unless the file says so. And a rotation
+ * that FAILED has to say so loudest of all: it means the bound this unit ships does not exist on
+ * this machine, and nothing else would ever mention it.
+ */
+export declare function openLogHandle(logPath: string, capBytes?: number): number;
+//# sourceMappingURL=log-rotate.d.ts.map

package/dist/log-rotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-rotate.d.ts","sourceRoot":"","sources":["../src/log-rotate.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAerD,sFAAsF;AACtF,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,aAAa,CAkC5G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,MAAM,CAiB9F"}

package/dist/log-rotate.js

@@ -0,0 +1,134 @@
+import { openSync, renameSync, statSync, writeSync } from "node:fs";
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * DOD-M15-LOGBOUND-1 part B — bound `daemon.log` by rotating it at SPAWN.
+ *
+ * **The daemon does not own its log file, and that constraint decides the whole design.**
+ * `spawnDaemon` does `openSync(logPath, "a")` and hands that descriptor to the child as stdout
+ * and stderr. The daemon therefore writes to a file *handle*, not to a path: renaming the file
+ * underneath it moves nothing, because the handle follows the inode and the daemon carries on
+ * filling the renamed file.
+ *
+ * So the spawner is the only party that can rotate cleanly, and spawn is the only moment at
+ * which nothing holds the handle. That is why this is here and not in the daemon, and it is why
+ * {@link openLogHandle} does both steps in one function — the rotate-then-open ORDER is the
+ * property, and a property split across two call sites is a property waiting to be reversed.
+ *
+ * **⚠️ WHAT THIS DOES NOT BOUND, and it is the machines that need it most.** Rotation fires only
+ * on the `connectOrStart` path, which is how an operator's CLI starts the daemon. The demo box and
+ * the Hermes box start it under systemd, running `dist/bin/cello-daemon.js` directly — that path
+ * never reaches here, so **those two long-lived daemons are not bounded by this at all**. They are
+ * also the ones that run for weeks without restarting, which is the case
+ * `052-LOGCEILING` covers (suggested post-launch, not yet ruled). Stated here rather than left to
+ * be discovered, because "rotation shipped" would otherwise read as a bound that those machines have.
+ */
+/**
+ * Cap for the live file: 64 MB. With one previous generation kept, the ceiling across restarts
+ * is 128 MB.
+ *
+ * A starting point rather than a finding. For scale: the measured file was 180 MB, of which 168 MB
+ * was one repeated line that part A of this unit now collapses, and the ordinary remainder grew at
+ * roughly 3 MB/day under heavy development.
+ */
+export const LOG_ROTATE_CAP_BYTES = 64 * 1024 * 1024;
+/** Name of the single previous generation. There is deliberately no `.2`. */
+function rotatedPathFor(logPath) {
+    return `${logPath}.1`;
+}
+function sizeOf(path) {
+    try {
+        return statSync(path).size;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Rename `logPath` to `logPath.1` if it is over `capBytes`, replacing any older `.1`.
+ *
+ * **Never throws**, and that is a contract rather than defensiveness: a daemon that refuses to
+ * start because it could not tidy its log would be a strictly worse outcome than an oversized log.
+ * It reports what happened instead of being silent about it — see {@link openLogHandle}, which is
+ * where the reporting lands.
+ *
+ * **It never truncates.** A truncation of the live file either races the writer or throws away
+ * the tail, and the tail is the only part anyone reads.
+ */
+export function rotateLogIfOversized(logPath, capBytes = LOG_ROTATE_CAP_BYTES) {
+    const size = sizeOf(logPath);
+    if (size === null)
+        return { rotated: false, reason: "absent" };
+    if (size <= capBytes)
+        return { rotated: false, reason: "under_cap" };
+    /**
+     * ⚠️ RE-STAT IMMEDIATELY BEFORE THE RENAME, because rotation is the one thing on this path that
+     * the singleton lock does NOT cover. `connectOrStart` states plainly that two callers can probe
+     * the lock as free at the same instant and both spawn. Both then arrive here. The damaging
+     * interleaving is: B sees an oversized file, A renames it to `.1` and opens a fresh one, then B
+     * renames that fresh near-empty file over `.1` — and 64 MB of retained history is replaced by a
+     * few bytes, losing exactly the tail rotation exists to keep. The window is small and the loser
+     * exits seconds later, but the cost of losing is the whole point of the feature.
+     */
+    const stillOversized = sizeOf(logPath);
+    if (stillOversized === null || stillOversized <= capBytes)
+        return { rotated: false, reason: "raced" };
+    /**
+     * ⚠️ **THERE IS DELIBERATELY NO "don't let a smaller file replace a larger kept one" GUARD.** It
+     * was written, it looked prudent, and it silently turned the cap into a RATCHET: the kept file
+     * becomes the effective threshold, so once a 180 MB log has been rotated once, the live file has
+     * to exceed 180 MB — then more — before it will ever rotate again. The 128 MB ceiling this unit
+     * ships would not have existed on the first machine it ran on. The re-stat above already covers
+     * the race that guard was written for: in that interleaving the loser re-stats, finds the fresh
+     * near-empty file under the cap, and returns `raced` without renaming anything.
+     */
+    try {
+        renameSync(logPath, rotatedPathFor(logPath));
+        return { rotated: true, bytes: stillOversized, rotatedTo: rotatedPathFor(logPath) };
+    }
+    catch (err) {
+        // EACCES / EROFS / EXDEV — a read-only or wrong-owner ~/.cello. None of them is a reason to
+        // fail a daemon start, and all of them mean this machine has no bound at all.
+        return { rotated: false, reason: "failed", error: extractErrorMessage(err) };
+    }
+}
+/**
+ * Rotate if needed, THEN open the log for append and return the descriptor.
+ *
+ * The ordering is the point. Open first and the rename moves only the name, leaving the daemon
+ * writing into the renamed inode — the rotation would appear to work and bound nothing.
+ *
+ * **The outcome is written as the first line of the fresh file**, because the alternative is a log
+ * that starts mid-story. Someone sent a 4 MB `daemon.log` to chase a failure that began before the
+ * restart has no way to know that `daemon.log.1` exists unless the file says so. And a rotation
+ * that FAILED has to say so loudest of all: it means the bound this unit ships does not exist on
+ * this machine, and nothing else would ever mention it.
+ */
+export function openLogHandle(logPath, capBytes = LOG_ROTATE_CAP_BYTES) {
+    const outcome = rotateLogIfOversized(logPath, capBytes);
+    const fd = openSync(logPath, "a");
+    if (outcome.rotated) {
+        writeNotice(fd, {
+            level: "info", event: "daemon.log.rotated",
+            bytes: outcome.bytes, rotatedTo: outcome.rotatedTo,
+            impact: "everything logged before this line is in the file named by rotatedTo",
+        });
+    }
+    else if (outcome.reason === "failed") {
+        writeNotice(fd, {
+            level: "warn", event: "daemon.log.rotate.failed",
+            reason: outcome.reason, error: outcome.error ?? "",
+            impact: "daemon.log is over its cap and could not be rotated, so it is unbounded on this machine",
+        });
+    }
+    return fd;
+}
+function writeNotice(fd, fields) {
+    try {
+        writeSync(fd, JSON.stringify({ ...fields, ts: new Date().toISOString() }) + "\n");
+    }
+    catch {
+        // The notice is the least important thing this function does. Failing to write it must not
+        // cost the caller its descriptor.
+    }
+}
+//# sourceMappingURL=log-rotate.js.map

package/dist/log-rotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-rotate.js","sourceRoot":"","sources":["../src/log-rotate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,GAAG,OAAO,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAAmB,oBAAoB;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/D,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEtG;;;;;;;;OAQG;IACH,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4FAA4F;QAC5F,8EAA8E;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,WAAmB,oBAAoB;IACpF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,EAAE,EAAE;YACd,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YAClD,MAAM,EAAE,sEAAsE;SAC/E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,WAAW,CAAC,EAAE,EAAE;YACd,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAClD,MAAM,EAAE,yFAAyF;SAClG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,MAA+B;IAC9D,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,kCAAkC;IACpC,CAAC;AACH,CAAC"}

package/dist/manifest-deps.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
+ *
+ * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
+ * top-level main() (which spawns a live daemon on import).
+ *
+ * Two modes:
+ *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
+ *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
+ *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
+ *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
+ *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
+ */
+import { type IManifestProvider, type IDirectoryChallengeVerifier, type IManifestVersionStore, type IManifestPollScheduler } from "@cello-protocol/transport";
+import type { Logger } from "./types.js";
+export interface ManifestDeps {
+    manifestProvider?: IManifestProvider;
+    manifestRootKeys?: readonly string[];
+    manifestThreshold?: number;
+    challengeVerifier?: IDirectoryChallengeVerifier;
+    manifestVersionStore?: IManifestVersionStore;
+    manifestPollScheduler?: IManifestPollScheduler;
+}
+export declare function buildManifestDeps(logger: Logger): ManifestDeps;
+//# sourceMappingURL=manifest-deps.d.ts.map

package/dist/manifest-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-deps.d.ts","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AASnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAazC,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;CAChD;AA4CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAgG9D"}

package/dist/manifest-deps.js

@@ -0,0 +1,151 @@
+/**
+ * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
+ *
+ * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
+ * top-level main() (which spawns a live daemon on import).
+ *
+ * Two modes:
+ *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
+ *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
+ *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
+ *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
+ *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
+ */
+import { ManifestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+import { FileManifestProvider, EmbeddedManifestProvider } from "./file-manifest-provider.js";
+import { BUNDLED_CONSORTIUM_MANIFEST, BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD, } from "./bundled-consortium-manifest.js";
+import { resolveDirectoryUrl } from "./directory-bootstrap.js";
+import { RandomizedPollScheduler } from "./manifest-poll-scheduler.js";
+import { remedyFor } from "./manifest-validity.js";
+/** Normalize a directory URL for comparison (trim, drop trailing slashes, lowercase). */
+function normalizeUrl(u) {
+    return u.trim().replace(/\/+$/, "").toLowerCase();
+}
+/** The set of directory endpoints the bundled roster describes (normalized). */
+const BUNDLED_ENDPOINTS = new Set(BUNDLED_CONSORTIUM_MANIFEST.nodes.map((n) => normalizeUrl(String(n["endpoint"]))));
+/**
+ * Build the consortium-manifest deps.
+ *
+ *   CELLO_CONSORTIUM_MANIFEST    absolute path to an override manifest JSON (opt-in)
+ *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex) — override path only
+ *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer) — override path only
+ *   CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS   optional background poll window — override path only
+ *
+ * The single manifestProvider instance is shared between startDaemon's loadAndVerify call and the
+ * ManifestDirectoryChallengeVerifier, so step-6 reads the same cached, verified manifest.
+ */
+/**
+ * DOD-M15-EXPIRY-CONSUMER-POLICY-1 — ONE callback, built per origin.
+ *
+ * It was duplicated verbatim across the bundled and file branches, and the one place the two copies
+ * had to DIFFER was the one place they were identical: the remedy. "Install a current manifest and
+ * restart" is advice that cannot be followed on the bundled path — the manifest is compiled in, that
+ * branch wires no poll, so it can never self-heal — and the workaround an operator reaches for
+ * instead (repointing CELLO_DIRECTORY_URL) starts the daemon with directory identity authentication
+ * SILENTLY OFF. Guidance that routes a stuck operator into disabling a security control is a defect
+ * in the guidance, which `remedyFor` already exists to prevent.
+ */
+function lapsedManifestReporter(logger, origin) {
+    return (info) => {
+        logger.warn("directory.auth.manifest.lapsed", {
+            ...info,
+            origin,
+            impact: "a directory node was SUCCESSFULLY authenticated against a manifest whose validity window " +
+                "has closed, so its key was trusted on the strength of a check that has expired. If that " +
+                "node has been rotated or removed since, this daemon would not know.",
+            guidance: "Signaling was NOT blocked — refusing here would leave a long-running daemon unable to " +
+                "authenticate any directory, taking every agent offline. " + remedyFor(origin) +
+                " cello_status reports the expiry.",
+        });
+    };
+}
+export function buildManifestDeps(logger) {
+    const manifestPath = process.env.CELLO_CONSORTIUM_MANIFEST;
+    if (!manifestPath) {
+        // FINDING-4 default: load the COMPILED-IN consortium roster so the daemon already knows every
+        // sovereign directory — and can fail over to a reachable one — even when its primary is down
+        // (the redundancy invariant), AND enforces step-6 directory identity auth against the bundled
+        // node pubkeys (defeats a /bootstrap MITM redirecting failover to a rogue directory). This is
+        // the full production posture with zero operator config. The manifest is re-verified against the
+        // pinned root keys at load by startDaemon (ADV-002 — a corrupt embedded manifest fails CLOSED,
+        // never a silent downgrade). No poll scheduler: the bundled roster is static; adopting runtime
+        // manifest updates via the /manifest poll is a separate opt-in reachable through the env path.
+        //
+        // GATE (do NOT enable step-6 against a directory the bundle can't authenticate): the bundled
+        // manifest is the trust anchor for the PRODUCTION consortium ONLY (the mygentic.ai directories
+        // it lists). When the operator has pointed CELLO_DIRECTORY_URL at a directory that is NOT in the
+        // bundle — local dev (`CELLO_ENV=local`) and the e2e spine harness both run their own local
+        // directory on 127.0.0.1 — the bundled node pubkeys don't describe it, so enforcing step-6 would
+        // wrongly reject every connection (key_not_in_manifest). In that case fall through to the M6
+        // backward-compat path (no roster, no step-6); those deployments opt into step-6 explicitly by
+        // supplying a matching manifest via CELLO_CONSORTIUM_MANIFEST. Unset URL → the production default,
+        // which is a bundled node's ADDRESS and so matches, giving real operators the full posture.
+        //
+        // The comparison is byte-equality against the roster, not "reaches the same machine". A DNS name
+        // for a bundled node does NOT match and lands here, in the branch that turns step-6 off — which
+        // is why PRODUCTION_DIRECTORY_URL is an address. Do not "tidy" either into a hostname.
+        const directoryUrl = normalizeUrl(resolveDirectoryUrl());
+        if (!BUNDLED_ENDPOINTS.has(directoryUrl)) {
+            // Two very different situations reach here and they must not log the same way. A loopback or
+            // private address is local dev or the e2e harness pointing at its own directory — designed and
+            // benign. Anything else is a client running against a PUBLIC directory with identity
+            // authentication off, which is a weaker client than the operator believes they have, and the
+            // only previous signal was the absence of a different log line.
+            const isLocal = /^https?:\/\/(localhost|127\.|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(directoryUrl);
+            const detail = { directoryUrl, reason: "directory_not_in_bundled_roster", step6: "disabled" };
+            if (isLocal)
+                logger.info("daemon.manifest.bundled.skipped", detail);
+            else
+                logger.warn("daemon.manifest.bundled.skipped", detail);
+            return {};
+        }
+        const manifestProvider = new EmbeddedManifestProvider(BUNDLED_CONSORTIUM_MANIFEST);
+        const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider, lapsedManifestReporter(logger, "bundled"));
+        logger.info("daemon.manifest.bundled", {
+            version: BUNDLED_CONSORTIUM_MANIFEST.version,
+            nodeCount: BUNDLED_CONSORTIUM_MANIFEST.nodes.length,
+            rootKeyCount: BUNDLED_CONSORTIUM_ROOT_KEYS.length,
+            threshold: BUNDLED_CONSORTIUM_THRESHOLD,
+        });
+        return {
+            manifestProvider,
+            manifestRootKeys: BUNDLED_CONSORTIUM_ROOT_KEYS,
+            manifestThreshold: BUNDLED_CONSORTIUM_THRESHOLD,
+            challengeVerifier,
+        };
+    }
+    const rootKeysRaw = process.env.CELLO_CONSORTIUM_ROOT_KEYS ?? "";
+    const manifestRootKeys = rootKeysRaw.split(",").map((k) => k.trim()).filter((k) => k.length > 0);
+    const manifestThreshold = Number.parseInt(process.env.CELLO_CONSORTIUM_THRESHOLD ?? "", 10);
+    if (manifestRootKeys.length === 0 || Number.isNaN(manifestThreshold)) {
+        throw new Error("CELLO_CONSORTIUM_MANIFEST is set but CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD are missing or invalid");
+    }
+    const manifestProvider = new FileManifestProvider({ path: manifestPath });
+    const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider, lapsedManifestReporter(logger, "file"));
+    // DOD-AUTH-2: background manifest poll. The directory is re-polled on a randomized 6–12h interval
+    // (thundering-herd avoidance) and a newer signed manifest is adopted. The interval is env-injectable
+    // so the live binary test can poll sub-second instead of waiting hours; production leaves these
+    // unset → the 6–12h default window. Both-or-neither, positive, min <= max — a partial/invalid
+    // override fails LOUDLY rather than silently reverting or producing a negative (tight-loop) delay.
+    const rawPollMin = process.env.CELLO_MANIFEST_POLL_MIN_MS;
+    const rawPollMax = process.env.CELLO_MANIFEST_POLL_MAX_MS;
+    let pollOpts;
+    if (rawPollMin !== undefined || rawPollMax !== undefined) {
+        const minMs = Number.parseInt(rawPollMin ?? "", 10);
+        const maxMs = Number.parseInt(rawPollMax ?? "", 10);
+        if (Number.isNaN(minMs) || Number.isNaN(maxMs) || minMs <= 0 || maxMs < minMs) {
+            throw new Error("CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS must BOTH be set to positive integers with min <= max");
+        }
+        pollOpts = { minMs, maxMs };
+    }
+    const manifestPollScheduler = new RandomizedPollScheduler(pollOpts);
+    logger.info("daemon.manifest.configured", {
+        manifestPath,
+        rootKeyCount: manifestRootKeys.length,
+        threshold: manifestThreshold,
+        pollMinMs: pollOpts?.minMs ?? null,
+        pollMaxMs: pollOpts?.maxMs ?? null,
+    });
+    return { manifestProvider, manifestRootKeys, manifestThreshold, challengeVerifier, manifestPollScheduler };
+}
+//# sourceMappingURL=manifest-deps.js.map

package/dist/manifest-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-deps.js","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kCAAkC,GAKnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,SAAS,EAAuB,MAAM,wBAAwB,CAAC;AAExE,yFAAyF;AACzF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAE,CAA6B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC/G,CAAC;AAWF;;;;;;;;;;GAUG;AACH;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,MAAc,EACd,MAAsB;IAEtB,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,GAAG,IAAI;YACP,MAAM;YACN,MAAM,EACJ,2FAA2F;gBAC3F,0FAA0F;gBAC1F,qEAAqE;YACvE,QAAQ,EACN,wFAAwF;gBACxF,0DAA0D,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC9E,mCAAmC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,4FAA4F;QAC5F,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,mGAAmG;QACnG,4FAA4F;QAC5F,EAAE;QACF,iGAAiG;QACjG,gGAAgG;QAChG,uFAAuF;QACvF,MAAM,YAAY,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,6FAA6F;YAC7F,+FAA+F;YAC/F,qFAAqF;YACrF,6FAA6F;YAC7F,gEAAgE;YAChE,MAAM,OAAO,GAAG,iFAAiF,CAAC,IAAI,CACpG,YAAY,CACb,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC9F,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;;gBAC/D,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;QACnF,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAC9D,gBAAgB,EAAE,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,OAAO,EAAE,2BAA2B,CAAC,OAAO;YAC5C,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACnD,YAAY,EAAE,4BAA4B,CAAC,MAAM;YACjD,SAAS,EAAE,4BAA4B;SACxC,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB;YAChB,gBAAgB,EAAE,4BAA4B;YAC9C,iBAAiB,EAAE,4BAA4B;YAC/C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAC9D,gBAAgB,EAAE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,IAAI,QAAsD,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,YAAY;QACZ,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AAC7G,CAAC"}

package/dist/manifest-poll-scheduler.d.ts

@@ -0,0 +1,31 @@
+/**
+ * M7-MANIFEST-002 — Manifest poll scheduler implementations.
+ *
+ * IManifestPollScheduler schedules the background manifest poll that keeps the
+ * in-memory manifest current over long-lived daemon sessions.
+ *
+ * RandomizedPollScheduler: production implementation — fires after a random delay
+ * in the 6-12 hour window (prevents thundering-herd against the directory).
+ *
+ * ImmediatePollScheduler: test stub — fires once with a configurable delay (0ms default).
+ * Exported from @cello-protocol/transport.
+ */
+import type { IManifestPollScheduler } from "@cello-protocol/transport";
+export { ImmediatePollScheduler } from "@cello-protocol/transport";
+export type { IManifestPollScheduler };
+/**
+ * RandomizedPollScheduler — fires after a random interval between 6 and 12 hours.
+ *
+ * The randomization window prevents thundering-herd scenarios where many agents
+ * all poll simultaneously. Each agent picks an independent random delay.
+ */
+export declare class RandomizedPollScheduler implements IManifestPollScheduler {
+    #private;
+    constructor(opts?: {
+        minMs?: number;
+        maxMs?: number;
+    });
+    scheduleNext(callbackFn: () => Promise<void>): void;
+    cancel(): void;
+}
+//# sourceMappingURL=manifest-poll-scheduler.d.ts.map

package/dist/manifest-poll-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-poll-scheduler.d.ts","sourceRoot":"","sources":["../src/manifest-poll-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,CAAC;AAOvC;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,sBAAsB;;gBAMxD,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAKrD,YAAY,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAkBnD,MAAM,IAAI,IAAI;CAOf"}

package/dist/manifest-poll-scheduler.js

@@ -0,0 +1,59 @@
+/**
+ * M7-MANIFEST-002 — Manifest poll scheduler implementations.
+ *
+ * IManifestPollScheduler schedules the background manifest poll that keeps the
+ * in-memory manifest current over long-lived daemon sessions.
+ *
+ * RandomizedPollScheduler: production implementation — fires after a random delay
+ * in the 6-12 hour window (prevents thundering-herd against the directory).
+ *
+ * ImmediatePollScheduler: test stub — fires once with a configurable delay (0ms default).
+ * Exported from @cello-protocol/transport.
+ */
+// Re-export the test stub for convenience
+export { ImmediatePollScheduler } from "@cello-protocol/transport";
+// ─── RandomizedPollScheduler (production) ─────────────────────────────────────
+const POLL_MIN_MS = 6 * 60 * 60 * 1000; // 6 hours
+const POLL_MAX_MS = 12 * 60 * 60 * 1000; // 12 hours
+/**
+ * RandomizedPollScheduler — fires after a random interval between 6 and 12 hours.
+ *
+ * The randomization window prevents thundering-herd scenarios where many agents
+ * all poll simultaneously. Each agent picks an independent random delay.
+ */
+export class RandomizedPollScheduler {
+    #timer = null;
+    #cancelled = false;
+    #minMs;
+    #maxMs;
+    constructor(opts) {
+        this.#minMs = opts?.minMs ?? POLL_MIN_MS;
+        this.#maxMs = opts?.maxMs ?? POLL_MAX_MS;
+    }
+    scheduleNext(callbackFn) {
+        this.cancel();
+        // ADV-003: Reset cancelled flag when scheduling a new callback (cancel() sets it).
+        // If cancel() was called to clear a previous timer before scheduling the next one,
+        // the flag must be reset so the new callback can fire.
+        this.#cancelled = false;
+        const delay = this.#minMs + Math.random() * (this.#maxMs - this.#minMs);
+        this.#timer = setTimeout(() => {
+            this.#timer = null;
+            // ADV-003: Check cancelled flag at callback entry point. If cancel() was called
+            // between timer fire and callback execution, do not run the callback.
+            if (this.#cancelled)
+                return;
+            callbackFn().catch(() => {
+                // Poll errors are logged by the caller; scheduling errors don't crash the daemon
+            });
+        }, delay);
+    }
+    cancel() {
+        this.#cancelled = true;
+        if (this.#timer !== null) {
+            clearTimeout(this.#timer);
+            this.#timer = null;
+        }
+    }
+}
+//# sourceMappingURL=manifest-poll-scheduler.js.map

package/dist/manifest-poll-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-poll-scheduler.js","sourceRoot":"","sources":["../src/manifest-poll-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,0CAA0C;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,iFAAiF;AAEjF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAE,UAAU;AACnD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAClC,MAAM,GAAyC,IAAI,CAAC;IACpD,UAAU,GAAG,KAAK,CAAC;IACV,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,IAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,WAAW,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,WAAW,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,UAA+B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,mFAAmF;QACnF,mFAAmF;QACnF,uDAAuD;QACvD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC5B,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBACtB,iFAAiF;YACnF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}