@cleocode/contracts 2026.5.130 → 2026.5.132

package/src/branch-lock.ts

@@ -309,13 +309,23 @@ export type BranchLockErrorCode =
  * Exported as a frozen const tuple so git-shim, harness adapters, and test
  * utilities can reference the authoritative key list without duplication.
  *
+ * `CLEO_SESSION_ID` + `CLEO_AGENT_ID` were added in T11343 (Epic T11284,
+ * SG-COGNITIVE-SUBSTRATE) so every spawned agent carries its OWN session and
+ * agent identity into the isolation shell. Before this, spawn injected only
+ * worktree-binding keys and every short-lived `cleo` call inside the worktree
+ * collapsed onto "whoever touched the DB last" via `getActiveSession()` —
+ * the root cause of multi-agent session-bleed AND memory scope-leakage.
+ *
  * @task T1759
+ * @task T11343
  */
 export const ISOLATION_ENV_KEYS = [
   'CLEO_WORKTREE_ROOT',
   'CLEO_AGENT_ROLE',
   'CLEO_WORKTREE_BRANCH',
   'CLEO_PROJECT_HASH',
+  'CLEO_SESSION_ID',
+  'CLEO_AGENT_ID',
 ] as const satisfies readonly string[];
 
 /** Union of all isolation env key strings. */
@@ -402,6 +412,32 @@ export interface IsolationOptions {
   role: 'worker' | 'orchestrator';
   /** Project hash scoping this worktree under the XDG root (sha256(projectRoot)[:16]). */
   projectHash: string;
+  /**
+   * Per-agent CLEO session id to bind to the isolation shell (T11343).
+   *
+   * Injected as `CLEO_SESSION_ID` so every short-lived `cleo` call inside the
+   * worktree resolves THIS agent's session via `resolveSessionIdFromEnv()`
+   * rather than collapsing onto the orchestrator's most-recent active row.
+   * When omitted, `CLEO_SESSION_ID` is set to the empty string and downstream
+   * resolution falls back to the legacy `getActiveSession()` path (backward
+   * compatible — no behaviour change for callers that do not yet allocate a
+   * per-agent session).
+   *
+   * @defaultValue '' (empty — falls back to active-session resolution)
+   * @task T11343
+   */
+  sessionId?: string;
+  /**
+   * Per-agent identity handle to bind to the isolation shell (T11343).
+   *
+   * Injected as `CLEO_AGENT_ID` so audit rows, conduit messages, and memory
+   * observations are attributed to the spawned agent rather than to the
+   * orchestrator. When omitted, `CLEO_AGENT_ID` is set to the empty string.
+   *
+   * @defaultValue '' (empty — no per-agent attribution)
+   * @task T11343
+   */
+  agentId?: string;
 }
 
 /**
@@ -468,17 +504,23 @@ export interface IsolationResult {
  * @task T1759
  */
 export function provisionIsolatedShell(options: IsolationOptions): IsolationResult {
-  const { worktreePath, branch, role, projectHash } = options;
+  const { worktreePath, branch, role, projectHash, sessionId, agentId } = options;
 
   // --- cwd -----------------------------------------------------------------
   const cwd = worktreePath;
 
   // --- env -----------------------------------------------------------------
+  // T11343: CLEO_SESSION_ID + CLEO_AGENT_ID bind the spawned agent's own
+  // identity into the shell. Empty-string default keeps backward compatibility
+  // — `resolveSessionIdFromEnv()` treats '' as absent and falls back to the
+  // legacy active-session resolution path.
   const env: Record<(typeof ISOLATION_ENV_KEYS)[number], string> = {
     CLEO_WORKTREE_ROOT: worktreePath,
     CLEO_AGENT_ROLE: role,
     CLEO_WORKTREE_BRANCH: branch,
     CLEO_PROJECT_HASH: projectHash,
+    CLEO_SESSION_ID: sessionId ?? '',
+    CLEO_AGENT_ID: agentId ?? '',
   };
 
   // --- preamble ------------------------------------------------------------
@@ -487,7 +529,12 @@ export function provisionIsolatedShell(options: IsolationOptions): IsolationResu
   //   - The worktree directory having been pruned before the agent starts.
   //   - A future change where cwd is silently coerced to something else.
   //   - Symlink traversal producing a path that doesn't share the prefix.
-  const exportBlock = ISOLATION_ENV_KEYS.map((k) => `export ${k}="${env[k]}"`).join('\n');
+  // T11343: skip empty values so an unallocated CLEO_SESSION_ID / CLEO_AGENT_ID
+  // does not emit a clobbering `export KEY=""` that would clear an inherited
+  // value. Worktree-binding keys are always non-empty so they always export.
+  const exportBlock = ISOLATION_ENV_KEYS.filter((k) => env[k] !== '')
+    .map((k) => `export ${k}="${env[k]}"`)
+    .join('\n');
 
   const preamble = [
     '## Worktree Isolation (REQUIRED — do not skip)',

package/src/daemon/__tests__/health-roundtrip.test.ts

@@ -0,0 +1,84 @@
+/**
+ * Round-trip guard for the daemon health contracts (T11366 AC5).
+ *
+ * Proves a {@link HealthStatus} aggregate projects onto the FROZEN
+ * `supervisor-ipc` {@link MonitorResponseSchema} shape **without a lossy cast**:
+ * `toMonitorChildren` yields rows that validate against the supervisor's own
+ * `MonitorResponse.children` schema, and a `monitor` response carrying them
+ * round-trips through `MonitorResponseSchema.parse`.
+ *
+ * @task T11366
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  type HealthStatus,
+  MonitorResponseSchema,
+  type SubsystemHealth,
+  SubsystemHealthSchema,
+  summarizeHealth,
+  toMonitorChildren,
+} from '../../index.js';
+
+describe('daemon HealthStatus ↔ supervisor-ipc MonitorResponse (T11366)', () => {
+  const rows: SubsystemHealth[] = [
+    { child_id: 'studio', pid: 4242, state: 'running', restart_count: 0 },
+    {
+      child_id: 'gc-cron',
+      pid: 0,
+      state: 'stopped',
+      restart_count: 2,
+      detail: 'awaiting next scheduled run',
+    },
+  ];
+
+  it('summarizeHealth computes allHealthy from row states', () => {
+    expect(summarizeHealth(rows).allHealthy).toBe(false);
+    expect(
+      summarizeHealth([{ child_id: 'studio', pid: 1, state: 'running', restart_count: 0 }])
+        .allHealthy,
+    ).toBe(true);
+  });
+
+  it('toMonitorChildren projects onto MonitorResponse.children without lossy casts', () => {
+    const health: HealthStatus = summarizeHealth(rows);
+    const children = toMonitorChildren(health);
+
+    // Each projected row must validate against the FROZEN supervisor schema.
+    const monitor = {
+      kind: 'monitor' as const,
+      children,
+    };
+    const parsed = MonitorResponseSchema.safeParse(monitor);
+    expect(parsed.success).toBe(true);
+    if (parsed.success) {
+      expect(parsed.data.children).toHaveLength(2);
+      // The daemon-only `detail` field is stripped on projection.
+      expect(parsed.data.children[1]).not.toHaveProperty('detail');
+      expect(parsed.data.children[0]?.child_id).toBe('studio');
+    }
+  });
+
+  it('a SubsystemHealth row is a structural superset of a supervisor ChildStatus', () => {
+    // Validating with the daemon schema accepts the supervisor fields verbatim.
+    const row = SubsystemHealthSchema.parse({
+      child_id: 'web',
+      pid: 9000,
+      state: 'running',
+      restart_count: 0,
+    });
+    expect(row.child_id).toBe('web');
+    // detail is optional and absent here.
+    expect(row.detail).toBeUndefined();
+  });
+
+  it('rejects a health row with a state outside the frozen ChildState enum', () => {
+    const bad = SubsystemHealthSchema.safeParse({
+      child_id: 'x',
+      pid: 0,
+      state: 'paused',
+      restart_count: 0,
+    });
+    expect(bad.success).toBe(false);
+  });
+});

package/src/daemon/health.ts

@@ -0,0 +1,121 @@
+/**
+ * Daemon health contracts — the aggregate shape a subsystem's `healthProbe`
+ * produces and the Rust supervisor consumes.
+ *
+ * These types **compose** the FROZEN `supervisor-ipc` v1.0 contract
+ * ({@link ChildState}, {@link ChildStatus}, {@link MonitorResponse}) rather than
+ * redeclaring it: a single subsystem health row maps onto a supervised
+ * {@link ChildStatus}, and a {@link HealthStatus} aggregate projects losslessly
+ * onto the {@link MonitorResponse} shape the supervisor already aggregates. This
+ * keeps the daemon submodule's probe output on the same wire vocabulary the
+ * supervisor monitors with — no parallel health taxonomy.
+ *
+ * @packageDocumentation
+ * @module @cleocode/contracts/daemon
+ *
+ * @epic T11253 R2 — `@cleocode/runtime/daemon` submodule
+ * @task T11366 — daemon lifecycle + subsystem contracts
+ * @saga T11243 SG-RUNTIME-UNIFICATION
+ */
+
+import { z } from 'zod';
+import {
+  type ChildState,
+  ChildStateSchema,
+  type ChildStatus,
+  ChildStatusSchema,
+} from '../supervisor-ipc/messages.js';
+
+/**
+ * The liveness state of a single subsystem.
+ *
+ * This is the FROZEN `supervisor-ipc` {@link ChildState} (`running` |
+ * `restarting` | `stopped`) re-exported under a daemon-facing name so subsystem
+ * authors do not reach across into the IPC module. A subsystem maps onto a
+ * supervised child, so the two states are deliberately identical.
+ */
+export type SubsystemState = ChildState;
+
+/**
+ * Zod schema for {@link SubsystemState}. Aliases the FROZEN
+ * {@link ChildStateSchema} — additive only; never edit the underlying enum.
+ */
+export const SubsystemStateSchema = ChildStateSchema;
+
+/**
+ * A single subsystem's health row.
+ *
+ * Structurally a superset of the supervisor's {@link ChildStatus}: it carries
+ * the same `child_id`/`pid`/`state`/`restart_count` fields (so it projects onto
+ * a {@link ChildStatus} without a lossy cast) plus an optional human-readable
+ * `detail` for diagnostics that never crosses the IPC wire.
+ *
+ * The `child_id` is the subsystem's logical name, matching the id the
+ * supervisor tracks the corresponding child under.
+ */
+export const SubsystemHealthSchema = ChildStatusSchema.extend({
+  /**
+   * Optional human-readable detail (e.g. last error message, queue depth).
+   * Diagnostic only — not part of the supervisor wire contract.
+   */
+  detail: z.string().optional(),
+}).strict();
+
+/** A single subsystem's health row (inferred from {@link SubsystemHealthSchema}). */
+export type SubsystemHealth = z.infer<typeof SubsystemHealthSchema>;
+
+/**
+ * The aggregate health snapshot across every registered subsystem.
+ *
+ * Projects losslessly onto the supervisor's `monitor` snapshot: each
+ * {@link SubsystemHealth} row's supervisor-visible fields ARE a
+ * {@link ChildStatus}, so {@link toMonitorChildren} can hand the supervisor a
+ * `MonitorResponse.children` array with zero casts.
+ */
+export const HealthStatusSchema = z
+  .object({
+    /** One health row per registered subsystem. */
+    subsystems: z.array(SubsystemHealthSchema),
+    /**
+     * `true` iff every subsystem is in the `running` state. A convenience roll-up
+     * derived from {@link HealthStatusSchema.shape.subsystems}; recomputed by
+     * {@link summarizeHealth} so producers cannot desync it.
+     */
+    allHealthy: z.boolean(),
+  })
+  .strict();
+
+/** The aggregate daemon health snapshot (inferred from {@link HealthStatusSchema}). */
+export type HealthStatus = z.infer<typeof HealthStatusSchema>;
+
+/**
+ * Project a {@link HealthStatus} onto the FROZEN supervisor `monitor` row array
+ * (`MonitorResponse['children']`) without a lossy cast.
+ *
+ * Each {@link SubsystemHealth} already carries the four supervisor-visible
+ * fields of a {@link ChildStatus}; this strips the daemon-only `detail` so the
+ * result is byte-compatible with what `cleo-supervisor` aggregates.
+ *
+ * @param health - The aggregate daemon health snapshot.
+ * @returns An array of {@link ChildStatus} rows for a `MonitorResponse`.
+ */
+export function toMonitorChildren(health: HealthStatus): ChildStatus[] {
+  return health.subsystems.map((row): ChildStatus => {
+    const { detail: _detail, ...childStatus } = row;
+    return childStatus;
+  });
+}
+
+/**
+ * Build the aggregate {@link HealthStatus} from per-subsystem rows, computing
+ * the `allHealthy` roll-up so it can never desync from the row states.
+ *
+ * @param subsystems - One {@link SubsystemHealth} row per registered subsystem.
+ * @returns The aggregate health snapshot.
+ */
+export function summarizeHealth(subsystems: SubsystemHealth[]): HealthStatus {
+  return {
+    subsystems,
+    allHealthy: subsystems.every((row) => row.state === 'running'),
+  };
+}

package/src/daemon/index.ts

@@ -0,0 +1,35 @@
+/**
+ * `@cleocode/contracts/daemon` — daemon lifecycle + subsystem type contracts.
+ *
+ * The shared, IO-free type vocabulary for the `@cleocode/runtime/daemon`
+ * submodule (R2, T11253): the {@link Subsystem} descriptor, the typed
+ * {@link DaemonLifecycleHooks}, and the {@link HealthStatus} aggregate that
+ * composes the FROZEN `supervisor-ipc` v1.0 contract.
+ *
+ * The implementation (`defineSubsystem`, registry, NDJSON client) lives in
+ * `@cleocode/runtime/daemon` and consumes these types — never redeclares them
+ * (Contracts Fan-Out gate, T10074).
+ *
+ * @packageDocumentation
+ * @module @cleocode/contracts/daemon
+ *
+ * @epic T11253 R2 — `@cleocode/runtime/daemon` submodule
+ * @task T11366 — daemon lifecycle + subsystem contracts
+ * @saga T11243 SG-RUNTIME-UNIFICATION
+ */
+
+export type { HealthStatus, SubsystemHealth, SubsystemState } from './health.js';
+export {
+  HealthStatusSchema,
+  SubsystemHealthSchema,
+  SubsystemStateSchema,
+  summarizeHealth,
+  toMonitorChildren,
+} from './health.js';
+export type {
+  DaemonLifecycleHooks,
+  Subsystem,
+  SubsystemDefinition,
+  SubsystemLifecyclePhase,
+} from './subsystem.js';
+export { SUBSYSTEM_LIFECYCLE_PHASES } from './subsystem.js';

package/src/daemon/subsystem.ts

@@ -0,0 +1,126 @@
+/**
+ * Daemon subsystem + lifecycle-hook contracts.
+ *
+ * A **subsystem** is one supervised unit of long-running work inside a CLEO
+ * daemon process — Studio supervision, the GC cron, the web server, the
+ * docs-viewer, the runtime poller. Each declares a uniform lifecycle
+ * (`start → healthProbe → shutdown`) so the `@cleocode/runtime/daemon`
+ * registry can drive them identically and the Rust `cleo-supervisor` can
+ * aggregate their health over the FROZEN `supervisor-ipc` v1.0 contract.
+ *
+ * These are **pure type contracts** (no runtime/IO). The implementation —
+ * `defineSubsystem()`, the registry, the NDJSON client — lives in
+ * `@cleocode/runtime/daemon` (R2 child T11367) and imports these types rather
+ * than redeclaring them (Contracts Fan-Out gate, T10074).
+ *
+ * @packageDocumentation
+ * @module @cleocode/contracts/daemon
+ *
+ * @epic T11253 R2 — `@cleocode/runtime/daemon` submodule
+ * @task T11366 — daemon lifecycle + subsystem contracts
+ * @saga T11243 SG-RUNTIME-UNIFICATION
+ */
+
+import type { SubsystemHealth } from './health.js';
+
+/**
+ * Lifecycle hooks fired by the subsystem registry around a subsystem's
+ * `start`/`shutdown` transitions.
+ *
+ * All hooks are optional and may be async. They are observational — a hook
+ * MUST NOT mutate registry state. `onError` is the single failure sink: a
+ * throwing `start` or `shutdown`, or a rejected `healthProbe`, surfaces here.
+ *
+ * Hooks fire in a defined order relative to the underlying transition:
+ * - `onStart`    — after the subsystem's `start()` resolves.
+ * - `onShutdown` — after the subsystem's `shutdown()` resolves.
+ * - `onError`    — when any lifecycle step throws/rejects (start, probe, or
+ *   shutdown), with the offending `error` and the `phase` it occurred in.
+ */
+export interface DaemonLifecycleHooks {
+  /**
+   * Fired after the subsystem has successfully started.
+   *
+   * @param name - The logical subsystem name.
+   */
+  onStart?: (name: string) => void | Promise<void>;
+  /**
+   * Fired after the subsystem has successfully shut down.
+   *
+   * @param name - The logical subsystem name.
+   */
+  onShutdown?: (name: string) => void | Promise<void>;
+  /**
+   * Fired when a lifecycle step throws or rejects. The single failure sink.
+   *
+   * @param name  - The logical subsystem name.
+   * @param error - The thrown value, normalized to an `Error`.
+   * @param phase - Which lifecycle step failed.
+   */
+  onError?: (name: string, error: Error, phase: SubsystemLifecyclePhase) => void | Promise<void>;
+}
+
+/**
+ * The lifecycle phase a subsystem transition is in, used to tag
+ * {@link DaemonLifecycleHooks.onError} and registry diagnostics.
+ */
+export type SubsystemLifecyclePhase = 'start' | 'healthProbe' | 'shutdown';
+
+/**
+ * The frozen, ordered set of lifecycle phases. Pinned by the daemon test suite
+ * so a phase cannot be silently added or removed.
+ */
+export const SUBSYSTEM_LIFECYCLE_PHASES = ['start', 'healthProbe', 'shutdown'] as const;
+
+/**
+ * A subsystem descriptor — the declarative unit `defineSubsystem()` produces
+ * and the registry drives.
+ *
+ * The three lifecycle methods are intentionally minimal and uniform so that
+ * every long-running concern (supervised child process, cron job, HTTP server)
+ * can be expressed identically:
+ *
+ * - `start`       — bring the subsystem up. May be async. Idempotent callers
+ *   should guard re-entry.
+ * - `healthProbe` — report current liveness as a {@link SubsystemHealth} row.
+ *   Maps onto a supervised `ChildStatus` the Rust supervisor aggregates.
+ * - `shutdown`    — bring the subsystem down gracefully. May be async.
+ *
+ * @typeParam TContext - Optional opaque context the registry threads through
+ *   `start`/`shutdown` (e.g. a resolved config or handle). Defaults to `void`.
+ */
+export interface Subsystem<TContext = void> {
+  /** Logical, stable subsystem name (matches the supervised `child_id`). */
+  readonly name: string;
+  /**
+   * Bring the subsystem up. The resolved value is threaded back into
+   * `shutdown` as its context argument.
+   *
+   * @returns The subsystem context (or `void`).
+   */
+  start: () => TContext | Promise<TContext>;
+  /**
+   * Report the subsystem's current health as a single
+   * {@link SubsystemHealth} row.
+   *
+   * @returns The current health row.
+   */
+  healthProbe: () => SubsystemHealth | Promise<SubsystemHealth>;
+  /**
+   * Bring the subsystem down gracefully.
+   *
+   * @param context - The value returned by `start`.
+   */
+  shutdown: (context: TContext) => void | Promise<void>;
+}
+
+/**
+ * The descriptor passed to `defineSubsystem()` — the same surface as
+ * {@link Subsystem} (a 1:1 mapping; `defineSubsystem` validates + freezes it).
+ *
+ * Exposed as a distinct name so call-sites can annotate the literal they pass
+ * without importing the post-construction {@link Subsystem} type.
+ *
+ * @typeParam TContext - See {@link Subsystem}.
+ */
+export type SubsystemDefinition<TContext = void> = Subsystem<TContext>;

package/src/daemon-ipc/__tests__/daemon-ipc-freeze.test.ts

@@ -0,0 +1,53 @@
+/**
+ * Freeze + AC8-alias guard for the `@cleocode/contracts/daemon-ipc` surface
+ * (T11369 — R2 gates R4-R7).
+ *
+ * Proves the AC8-named `daemon-ipc` barrel:
+ * 1. resolves and re-exports the FROZEN supervisor-ipc v1.0 schemas + version,
+ * 2. is byte-identical to the `supervisor-ipc` surface (one contract, two
+ *    names — no duplicate drift surface),
+ * 3. pins `DAEMON_IPC_PROTOCOL_VERSION === SUPERVISOR_IPC_PROTOCOL_VERSION ===
+ *    '1.0.0'` and the complete frozen message-kind tuple.
+ *
+ * @task T11369
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  SUPERVISOR_IPC_MESSAGE_KINDS,
+  SUPERVISOR_IPC_PROTOCOL_VERSION,
+  SupervisorIpcEnvelopeSchema as SupervisorEnvelopeFromRoot,
+} from '../../supervisor-ipc/index.js';
+import {
+  DAEMON_IPC_PROTOCOL_VERSION,
+  SUPERVISOR_IPC_MESSAGE_KINDS as MESSAGE_KINDS_VIA_DAEMON_IPC,
+  SupervisorIpcEnvelopeSchema as SupervisorEnvelopeFromDaemonIpc,
+  SUPERVISOR_IPC_PROTOCOL_VERSION as VERSION_VIA_DAEMON_IPC,
+} from '../index.js';
+
+describe('@cleocode/contracts/daemon-ipc AC8 alias surface (T11369)', () => {
+  it('re-exports the SAME frozen schema binding as supervisor-ipc', () => {
+    // Referential identity proves it is a re-export, not a duplicate schema.
+    expect(SupervisorEnvelopeFromDaemonIpc).toBe(SupervisorEnvelopeFromRoot);
+  });
+
+  it('pins the frozen protocol version through both names', () => {
+    expect(VERSION_VIA_DAEMON_IPC).toBe('1.0.0');
+    expect(DAEMON_IPC_PROTOCOL_VERSION).toBe('1.0.0');
+    expect(DAEMON_IPC_PROTOCOL_VERSION).toBe(SUPERVISOR_IPC_PROTOCOL_VERSION);
+  });
+
+  it('exposes the identical frozen message-kind set through the daemon-ipc name', () => {
+    expect([...MESSAGE_KINDS_VIA_DAEMON_IPC]).toEqual([...SUPERVISOR_IPC_MESSAGE_KINDS]);
+  });
+
+  it('validates a real Rust wire envelope through the daemon-ipc schema', () => {
+    const wire = {
+      protocol_version: '1.0.0',
+      id: 'abc',
+      direction: 'request',
+      request: { kind: 'health' },
+    };
+    expect(SupervisorEnvelopeFromDaemonIpc.safeParse(wire).success).toBe(true);
+  });
+});

package/src/daemon-ipc/index.ts

@@ -0,0 +1,90 @@
+/**
+ * `@cleocode/contracts/daemon-ipc` — the FROZEN v1.0 daemon-IPC surface
+ * R4-R7 adapt against (T11253 AC8).
+ *
+ * ## AC8 reconciliation (T11369)
+ *
+ * Epic T11253 AC8 specifies the frozen surface is published under the name
+ * `@cleocode/contracts/daemon-ipc/`. R1 (T11339) had already shipped the
+ * byte-for-byte Rust mirror under `@cleocode/contracts/supervisor-ipc/`. Rather
+ * than DUPLICATE the contract (which would create two drift surfaces), this
+ * module is a **thin re-export barrel**: `supervisor-ipc` IS the frozen v1.0
+ * contract, and `daemon-ipc` is the AC8-named alias the R2 epic promised.
+ *
+ * Both import sites resolve to the same FROZEN schemas + version constant:
+ *
+ * ```ts
+ * import { SupervisorIpcEnvelopeSchema } from '@cleocode/contracts/daemon-ipc';
+ * import { SupervisorIpcEnvelopeSchema } from '@cleocode/contracts/supervisor-ipc';
+ * // identical binding — one frozen contract, two names.
+ * ```
+ *
+ * R4-R7 are **pure adapters** against this frozen surface (see the
+ * contract-evolution policy doc, slug `daemon-ipc-contract-evolution-policy`).
+ * Breaking changes require a NEW versioned directory + a version-negotiation
+ * shim + an R2 amendment task — never an in-place edit to the v1.0 schemas.
+ *
+ * @packageDocumentation
+ * @module @cleocode/contracts/daemon-ipc
+ *
+ * @epic T11253 R2 — `@cleocode/runtime/daemon` submodule
+ * @task T11369 — freeze + publish v1.0 daemon-IPC contract surface (AC8 + AC9)
+ * @saga T11243 SG-RUNTIME-UNIFICATION
+ */
+
+export type {
+  ChildState,
+  ChildStatus,
+  EnvPair,
+  ErrorResponse,
+  HealthRequest,
+  HealthResponse,
+  LifecycleEventKind,
+  LifecycleEventResponse,
+  MonitorRequest,
+  MonitorResponse,
+  RestartedResponse,
+  RestartRequest,
+  SpawnedResponse,
+  SpawnRequest,
+  SupervisorIpcEnvelope,
+  SupervisorIpcRequest,
+  SupervisorIpcRequestEnvelope,
+  SupervisorIpcResponse,
+  SupervisorIpcResponseEnvelope,
+} from '../supervisor-ipc/index.js';
+export {
+  ChildStateSchema,
+  ChildStatusSchema,
+  EnvPairSchema,
+  ErrorResponseSchema,
+  HealthRequestSchema,
+  HealthResponseSchema,
+  LifecycleEventKindSchema,
+  LifecycleEventResponseSchema,
+  MonitorRequestSchema,
+  MonitorResponseSchema,
+  RestartedResponseSchema,
+  RestartRequestSchema,
+  SpawnedResponseSchema,
+  SpawnRequestSchema,
+  SUPERVISOR_IPC_CHANNEL_BASENAME,
+  SUPERVISOR_IPC_MESSAGE_KINDS,
+  SUPERVISOR_IPC_PROTOCOL_VERSION,
+  SUPERVISOR_IPC_REQUEST_KINDS,
+  SUPERVISOR_IPC_RESPONSE_KINDS,
+  SupervisorIpcEnvelopeSchema,
+  SupervisorIpcRequestEnvelopeSchema,
+  SupervisorIpcRequestSchema,
+  SupervisorIpcResponseEnvelopeSchema,
+  SupervisorIpcResponseSchema,
+} from '../supervisor-ipc/index.js';
+
+/**
+ * The AC8-canonical name for the frozen daemon-IPC protocol version.
+ *
+ * Alias of `SUPERVISOR_IPC_PROTOCOL_VERSION` — re-exported so the freeze/drift
+ * test (T11369) can pin the value through the `daemon-ipc` surface name AC8
+ * specifies. Both constants are the SAME frozen `'1.0.0'`.
+ */
+export { SUPERVISOR_IPC_PROTOCOL_VERSION as DAEMON_IPC_PROTOCOL_VERSION } from '../supervisor-ipc/version.js';

package/src/db-inventory.json

@@ -22,7 +22,7 @@
       "role": "brain",
       "tier": "project",
       "filePathTemplate": "<projectRoot>/.cleo/brain.db",
-      "drizzleSchemaPath": "packages/core/src/store/memory-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/memory-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-brain/",
       "ownerPackage": "@cleocode/brain",
       "openedVia": "openCleoDb('brain', cwd)",
@@ -35,7 +35,7 @@
       "role": "conduit",
       "tier": "project",
       "filePathTemplate": "<projectRoot>/.cleo/conduit.db",
-      "drizzleSchemaPath": "packages/core/src/store/conduit-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/conduit-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-conduit/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "openCleoDb('conduit', cwd)",
@@ -74,7 +74,7 @@
       "role": "nexus",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/nexus.db",
-      "drizzleSchemaPath": "packages/core/src/store/nexus-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/nexus-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-nexus/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "openCleoDb('nexus')",
@@ -87,7 +87,7 @@
       "role": "signaldock-project",
       "tier": "project",
       "filePathTemplate": "<projectRoot>/.cleo/signaldock.db",
-      "drizzleSchemaPath": "packages/core/src/store/signaldock-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/signaldock-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-signaldock/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "HISTORICAL — project-tier signaldock.db was migrated into conduit.db post-T310/ADR-037. No live opener; charter row retained for migration provenance and legacy backup detection.",
@@ -100,7 +100,7 @@
       "role": "signaldock-global",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/signaldock.db",
-      "drizzleSchemaPath": "packages/core/src/store/signaldock-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/signaldock-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-signaldock/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "openCleoDb('signaldock')",
@@ -113,7 +113,7 @@
       "role": "telemetry",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/telemetry.db",
-      "drizzleSchemaPath": "packages/core/src/telemetry/schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/telemetry-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-telemetry/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "@cleocode/core telemetry/sqlite.ts — lazy open on first event when opted-in; not yet registered as openCleoDb role",
@@ -126,7 +126,7 @@
       "role": "skills",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/skills.db",
-      "drizzleSchemaPath": "packages/core/src/store/skills-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/skills-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-skills/",
       "ownerPackage": "@cleocode/core",
       "openedVia": "openCleoDb('skills')",
@@ -139,7 +139,7 @@
       "role": "global-brain",
       "tier": "global",
       "filePathTemplate": "$XDG_DATA_HOME/cleo/brain.db",
-      "drizzleSchemaPath": "packages/core/src/store/memory-schema.ts",
+      "drizzleSchemaPath": "packages/core/src/store/schema/memory-schema.ts",
       "migrationsDir": "packages/core/migrations/drizzle-brain/",
       "ownerPackage": "@cleocode/brain",
       "openedVia": "UNREGISTERED — file exists on disk (audit §1.2 row 3) but no live opener. Provenance unclear; likely orphan from a getCleoHome()-vs-project-resolution path bug. Tracked for cleanup decision under T10282/T10307.",