@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/cohort-client.test.mjs

@@ -1,126 +0,0 @@
-/**
- * cohort-client.test.mjs — RETIRED shim re-exporting the aligned client.mjs.
- *
- * The old module spoke a defunct contract (PUT `${apiUrl}/{orgId}/agents/{id}`,
- * POST `${base}/agents/{id}/status`, GET `${base}/agents`). It is now a thin
- * re-export of lib/org/client.mjs, so these tests assert the NEW wire shape:
- *   - publishEntry   → POST /v1/registry.register (Bearer + x-idempotency-key)
- *   - fetchDirectory → GET  /v1/directory  (parses members/agents/array shapes)
- *   - heartbeat      → POST /v1/presence.beat (liveness snapshot)
- * and that the OLD `/{orgId}/agents` endpoints are NEVER hit.
- * Run: node --test lib/org/cohort-client.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { isEnabled, publishEntry, heartbeat, fetchDirectory } from "./cohort-client.mjs";
-import { PROTOCOL_VERSION } from "./protocol.mjs";
-
-// Ambient COHORT_* creds would leak into header assertions; clear them so the
-// tests are hermetic regardless of host env.
-delete process.env.COHORT_API_TOKEN;
-delete process.env.COHORT_TOKEN;
-delete process.env.COHORT_API_KEY;
-delete process.env.COHORT_ORG_ID;
-
-const BASE = "https://org.cohortapp.com";
-// New enablement contract: enabled + (base || apiUrl+orgId).
-const ON = { org: { cohort: { enabled: true, base: BASE, token: "tok-xyz" } } };
-const OFF = { org: { cohort: { enabled: false, base: BASE } } };
-
-/** A fake fetch that records calls and returns a canned res frame. */
-function fakeFetch(responder) {
-  const calls = [];
-  const impl = async (url, init) => {
-    calls.push({ url, init, headers: (init && init.headers) || {} });
-    const r = responder ? responder(url, init, calls.length - 1) : null;
-    const status = r && typeof r.status === "number" ? r.status : 200;
-    const ok = r && typeof r.ok === "boolean" ? r.ok : status >= 200 && status < 300;
-    const body = r ? r.body : { ok: true, result: null };
-    return { ok, status, headers: { get: () => undefined }, json: async () => body };
-  };
-  impl.calls = calls;
-  return impl;
-}
-
-test("isEnabled: requires enabled + (base or apiUrl+orgId)", () => {
-  assert.equal(isEnabled(ON), true);
-  assert.equal(isEnabled(OFF), false);
-  assert.equal(isEnabled({ org: { cohort: { enabled: true, apiUrl: "x", orgId: "o" } } }), true);
-  assert.equal(isEnabled(null), false);
-});
-
-test("publishEntry: no-op disabled; POSTs registry.register (NOT /agents) when enabled", async () => {
-  assert.deepEqual(await publishEntry({ cfg: OFF, entry: { id: "a" } }), { ok: false, skipped: true });
-  const f = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  const r = await publishEntry({ cfg: ON, entry: { id: "alex-ai", name: "Alex" }, fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/registry.register`);
-  assert.equal(f.calls[0].init.method, "POST");
-  assert.equal(f.calls[0].headers.authorization, "Bearer tok-xyz");
-  assert.equal(f.calls[0].headers["x-org-protocol"], String(PROTOCOL_VERSION));
-  assert.equal(f.calls[0].headers["x-idempotency-key"], "registry.register:alex-ai");
-  // the OLD /{orgId}/agents endpoint must NEVER be hit
-  assert.doesNotMatch(f.calls[0].url, /\/agents\//);
-});
-
-test("publishEntry: trims a rich entry to the strict registerSchema (archetype object → string)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  const entry = {
-    id: "robin-ai",
-    name: "Robin",
-    fullName: "Robin Vega",
-    archetype: { function: "engineering", altitude: "vp", label: "VP Eng" },
-    principal: { fullName: "Sam Human", title: "CEO" },
-    towers: [{ id: "t1", name: "Platform" }],
-    focus: [{ title: "ship the thing" }],
-  };
-  await publishEntry({ cfg: ON, entry, fetchImpl: f });
-  const sent = JSON.parse(f.calls[0].init.body);
-  assert.equal(sent.displayName, "Robin Vega");
-  assert.equal(sent.archetype, "VP Eng");
-  assert.equal(sent.humanSponsor, "Sam Human");
-  // the full rich entry rides under `card` (server chain-redacts to hasCard)
-  assert.equal(sent.card.id, "robin-ai");
-  assert.deepEqual(sent.card.archetype, entry.archetype);
-});
-
-test("publishEntry: server error frame → {ok:false} (fail-open shape preserved)", async () => {
-  const f = fakeFetch(() => ({ ok: false, status: 500, body: { ok: false, error: { code: "INTERNAL", message: "boom" } } }));
-  const r = await publishEntry({ cfg: ON, entry: { id: "x" }, fetchImpl: f });
-  assert.equal(r.ok, false);
-});
-
-test("heartbeat: no-op disabled; POSTs presence.beat (NOT /agents/{id}/status) when enabled", async () => {
-  assert.deepEqual(await heartbeat({ cfg: OFF, id: "a" }), { ok: false, skipped: true });
-  const f = fakeFetch(() => ({ body: { ok: true, result: { directives: [] } } }));
-  const r = await heartbeat({ cfg: ON, id: "alex-ai", status: "active", fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/presence.beat`);
-  assert.equal(f.calls[0].init.method, "POST");
-  assert.doesNotMatch(f.calls[0].url, /\/agents\//);
-  const sent = JSON.parse(f.calls[0].init.body);
-  assert.equal(sent.status.state, "active");
-});
-
-test("fetchDirectory: [] disabled; parses array + {members:[]} + {agents:[]} shapes", async () => {
-  assert.deepEqual(await fetchDirectory({ cfg: OFF }), []);
-  const arr = await fetchDirectory({ cfg: ON, fetchImpl: fakeFetch(() => ({ body: [{ id: "x" }] })) });
-  assert.equal(arr.length, 1);
-  const members = await fetchDirectory({ cfg: ON, fetchImpl: fakeFetch(() => ({ body: { members: [{ id: "m1" }, { id: "m2" }] } })) });
-  assert.equal(members.length, 2);
-  const agents = await fetchDirectory({ cfg: ON, fetchImpl: fakeFetch(() => ({ body: { agents: [{ id: "y" }] } })) });
-  assert.equal(agents.length, 1);
-  // GET /v1/directory, never the old /{orgId}/agents
-  const f = fakeFetch(() => ({ body: { members: [] } }));
-  await fetchDirectory({ cfg: ON, fetchImpl: f });
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/directory`);
-  assert.equal(f.calls[0].init.method, "GET");
-});
-
-test("fetchDirectory: network error → [] (fail-open)", async () => {
-  const arr = await fetchDirectory({ cfg: ON, fetchImpl: async () => { throw new Error("network down"); } });
-  assert.deepEqual(arr, []);
-});

package/lib/org/cost-sync.test.mjs

@@ -1,153 +0,0 @@
-/**
- * cost-sync.test.mjs — read today's router ledger and report rows to Cohort via
- * cost.report, idempotently and batched, preserving the G16 attribution fields,
- * reconciling with the local budget total. Tmp ledger dir + injected fetchImpl.
- * Run: node --test lib/org/cost-sync.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { readLedgerRows, rowId, toReportRow, reportLedger } from "./cost-sync.mjs";
-
-const BASE = "https://org.cohortapp.com";
-const CFG = { org: { cohort: { enabled: true, base: BASE, token: "tok", orgId: "alex-ai" } } };
-const OFF = { org: { cohort: { enabled: false } } };
-const DAY = "2026-06-11";
-
-delete process.env.COHORT_API_TOKEN;
-delete process.env.COHORT_TOKEN;
-
-/** Write a JSONL ledger file for a day under a fresh tmp ledger dir. Returns dir. */
-function tmpLedger(rows, day = DAY) {
-  const dir = mkdtempSync(join(tmpdir(), "cost-sync-"));
-  mkdirSync(dir, { recursive: true });
-  const body = rows.map((r) => JSON.stringify(r)).join("\n") + "\n";
-  writeFileSync(join(dir, `${day}.jsonl`), body);
-  return dir;
-}
-
-function fakeFetch(responder) {
-  const calls = [];
-  const impl = async (url, init) => {
-    calls.push({ url, init, headers: (init && init.headers) || {}, body: init && init.body ? JSON.parse(init.body) : null });
-    const r = responder ? responder(url, init, calls.length - 1) : null;
-    const status = r && typeof r.status === "number" ? r.status : 200;
-    const ok = r && typeof r.ok === "boolean" ? r.ok : status >= 200 && status < 300;
-    const body = r ? r.body : { ok: true, result: null };
-    return { ok, status, headers: { get: () => undefined }, json: async () => body };
-  };
-  impl.calls = calls;
-  return impl;
-}
-
-const SAMPLE_ROWS = [
-  { ts: `${DAY}T01:00:00.000Z`, agent: "alex", model: "claude-opus-4", input_tokens: 1000, output_tokens: 200, estimated_usd: 0.05, decision_id: "d-1", session_id: "s-1", source: "router", cadence: null },
-  { ts: `${DAY}T02:00:00.000Z`, agent: "alex", model: "claude-haiku", input_tokens: 500, output_tokens: 50, estimated_usd: 0.001, session_id: "s-2", source: "cadence", lane: "org-sync" },
-];
-
-// --- read + normalise ------------------------------------------------------
-
-test("readLedgerRows: parses JSONL, skips blank/corrupt lines, [] when missing", () => {
-  const dir = tmpLedger(SAMPLE_ROWS);
-  const rows = readLedgerRows({ ledgerDir: dir, day: DAY });
-  assert.equal(rows.length, 2);
-  assert.equal(rows[0].decision_id, "d-1");
-  // missing file → []
-  assert.deepEqual(readLedgerRows({ ledgerDir: dir, day: "1999-01-01" }), []);
-  // corrupt line is skipped
-  const dir2 = mkdtempSync(join(tmpdir(), "cost-sync-corrupt-"));
-  writeFileSync(join(dir2, `${DAY}.jsonl`), '{"agent":"a","estimated_usd":1}\nnot json\n\n{"agent":"b","estimated_usd":2}\n');
-  assert.equal(readLedgerRows({ ledgerDir: dir2, day: DAY }).length, 2);
-});
-
-test("rowId: stable identity (id > natural keys > content hash)", () => {
-  assert.equal(rowId({ id: "explicit" }), "explicit");
-  assert.equal(rowId({ decision_id: "d", session_id: "s", ts: "t" }), "d:s:t");
-  const h1 = rowId({ agent: "a", estimated_usd: 1 });
-  const h2 = rowId({ estimated_usd: 1, agent: "a" }); // key order independent
-  assert.equal(h1, h2);
-  assert.notEqual(rowId({ agent: "a" }), rowId({ agent: "b" }));
-});
-
-test("toReportRow: preserves the G16 attribution fields (source/cadence) + budget figure", () => {
-  const wire = toReportRow(SAMPLE_ROWS[1], { day: DAY });
-  assert.equal(wire.source, "cadence");
-  assert.equal(wire.cadence, "org-sync");           // falls back to `lane`
-  assert.equal(wire.estimated_usd, 0.001);
-  assert.equal(wire.day, DAY);
-  assert.ok(wire.id);
-});
-
-// --- reportLedger: idempotent batched push ---------------------------------
-
-test("reportLedger: posts rows to cost.report, reconciles local USD total", async () => {
-  const dir = tmpLedger(SAMPLE_ROWS);
-  const f = fakeFetch((url) => (url.endsWith("/v1/cost.report") ? { body: { ok: true, result: { ingested: 2 } } } : null));
-  const out = await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, fetchImpl: f });
-  assert.equal(out.enabled, true);
-  assert.equal(out.rowsRead, 2);
-  assert.equal(out.reported, 2);
-  assert.equal(out.failed, 0);
-  // reconciles with budget-guard's view (sum of estimated_usd)
-  assert.equal(out.localUSD, 0.051);
-  // one batch (default batch size), routed to cost.report
-  const reportCalls = f.calls.filter((c) => c.url.endsWith("/v1/cost.report"));
-  assert.equal(reportCalls.length, 1);
-  assert.equal(reportCalls[0].body.rows.length, 2);
-  // each wire row carried its stable id + attribution
-  assert.ok(reportCalls[0].body.rows[0].id);
-  assert.equal(reportCalls[0].body.rows[1].source, "cadence");
-});
-
-test("reportLedger: idempotency key is stable across re-runs of the same rows", async () => {
-  const dir = tmpLedger(SAMPLE_ROWS);
-  const f1 = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  const f2 = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, fetchImpl: f1 });
-  await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, fetchImpl: f2 });
-  const k1 = f1.calls.find((c) => c.url.endsWith("/v1/cost.report")).headers["x-idempotency-key"];
-  const k2 = f2.calls.find((c) => c.url.endsWith("/v1/cost.report")).headers["x-idempotency-key"];
-  assert.ok(k1);
-  assert.equal(k1, k2); // same rows → same key → server collapses the replay
-});
-
-test("reportLedger: batches by batchSize", async () => {
-  const many = Array.from({ length: 5 }, (_, i) => ({ id: `r-${i}`, agent: "a", estimated_usd: 0.01 }));
-  const dir = tmpLedger(many);
-  const f = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  const out = await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, batchSize: 2, fetchImpl: f });
-  assert.equal(out.reported, 5);
-  assert.equal(out.batches.length, 3); // 2 + 2 + 1
-  assert.deepEqual(out.batches.map((b) => b.count), [2, 2, 1]);
-});
-
-test("reportLedger: disabled org → reports nothing but still reconciles local total", async () => {
-  const dir = tmpLedger(SAMPLE_ROWS);
-  const out = await reportLedger({ cfg: OFF, ledgerDir: dir, day: DAY });
-  assert.equal(out.enabled, false);
-  assert.equal(out.reported, 0);
-  assert.equal(out.localUSD, 0.051);
-});
-
-test("reportLedger: server error → rows counted as failed, never throws", async () => {
-  const dir = tmpLedger(SAMPLE_ROWS);
-  const f = fakeFetch(() => ({ ok: false, status: 500, body: { ok: false, error: { code: "INTERNAL", message: "boom" } } }));
-  const out = await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, fetchImpl: f });
-  assert.equal(out.reported, 0);
-  assert.equal(out.failed, 2);
-  assert.equal(out.batches[0].code, "INTERNAL");
-});
-
-test("reportLedger: empty ledger → no call, zero totals", async () => {
-  const dir = mkdtempSync(join(tmpdir(), "cost-sync-empty-"));
-  const f = fakeFetch(() => ({ body: { ok: true, result: null } }));
-  const out = await reportLedger({ cfg: CFG, ledgerDir: dir, day: DAY, fetchImpl: f });
-  assert.equal(out.rowsRead, 0);
-  assert.equal(out.reported, 0);
-  assert.equal(f.calls.length, 0);
-});

package/lib/org/doctor.test.mjs

@@ -1,346 +0,0 @@
-/**
- * doctor.test.mjs — Cohort connectivity probes (lib/org/doctor.mjs).
- * All five probe outcomes with a stubbed fetch: not-enrolled short-circuit,
- * token-rejected fail, unreachable fail, drift-header warn/absent/aligned,
- * paired-ok vs unpaired-FORBIDDEN_SCOPE, and the orgmail mailbox probes.
- * Run: node --test lib/org/doctor.test.mjs
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { checkOrgConnectivity, checkReactiveLaneWiring } from "./doctor.mjs";
-import { PROTOCOL_VERSION } from "./protocol.mjs";
-
-// Ambient COHORT_* vars must not leak in.
-for (const k of ["COHORT_API_TOKEN", "COHORT_TOKEN", "COHORT_API_KEY", "COHORT_ORG_ID", "COHORT_BASE", "COHORT_API_URL", "COHORT_AGENT_ID", "COHORT_AGENT_EMAIL"]) delete process.env[k];
-
-function root({ enrolled = true, orgmail = false } = {}) {
-  const r = mkdtempSync(join(tmpdir(), "org-doctor-"));
-  mkdirSync(join(r, "config"), { recursive: true });
-  if (enrolled) {
-    writeFileSync(
-      join(r, "config", "org.yaml"),
-      ["org:", "  cohort:", "    enabled: true", "    base: https://org.example", "    orgId: acme", "    token: tok-doc"].join("\n"),
-    );
-  }
-  if (orgmail) writeFileSync(join(r, "config", "orgmail.yaml"), "orgmail:\n  enabled: true\n");
-  return r;
-}
-
-/**
- * A routed fetch stub. `routes` maps a URL suffix to a responder
- * ({status, body, headers}) or a function of (url, init).
- */
-function stubFetch(routes) {
-  const calls = [];
-  const fn = async (url, init) => {
-    const u = String(url);
-    calls.push({ url: u, init: init || {} });
-    for (const [suffix, r] of Object.entries(routes)) {
-      if (u.endsWith(suffix)) {
-        const spec = typeof r === "function" ? r(u, init) : r;
-        if (spec === "throw") throw new Error("network down");
-        const status = spec.status ?? 200;
-        return {
-          ok: status >= 200 && status < 300,
-          status,
-          headers: { get: (k) => (spec.headers ? spec.headers[k.toLowerCase()] : undefined) },
-          json: async () => spec.body ?? {},
-        };
-      }
-    }
-    throw new Error(`unrouted ${u}`);
-  };
-  fn.calls = calls;
-  return fn;
-}
-
-const DIR_OK = { status: 200, body: { members: [] }, headers: { "x-org-protocol": String(PROTOCOL_VERSION) } };
-const HISTORY_OK = { status: 200, body: { ok: true, result: { messages: [] } } };
-const HISTORY_BAD_PARAMS = { status: 400, body: { ok: false, error: { code: "BAD_REQUEST", message: "channelId: Required" } } };
-const CHANNELS_OK = { status: 200, body: { ok: true, result: { channels: [{ id: "c1" }, { id: "c2" }] } } };
-
-const levelsOf = (rs) => rs.map((r) => r.level);
-const msgs = (rs) => rs.map((r) => r.msg).join("\n");
-
-test("probe 1: not enrolled → single ok line, no network", async () => {
-  const r = root({ enrolled: false });
-  const f = stubFetch({});
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  assert.equal(rs.length, 1);
-  assert.equal(rs[0].level, "ok");
-  assert.match(rs[0].msg, /not enrolled/);
-  assert.equal(f.calls.length, 0);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 2: happy path — reachable + latency + aligned protocol header + paired", async () => {
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/messaging.history": HISTORY_OK,
-  });
-  let t = 1000;
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {}, now: () => (t += 40) });
-  // …reachable, protocol, paired, INBOUND PATH, daemon-visible org config.
-  assert.deepEqual(levelsOf(rs), ["ok", "ok", "ok", "ok", "ok", "ok"]);
-  assert.match(msgs(rs), /inbound path works/);
-  assert.match(msgs(rs), /visible to the daemon cadences/);
-  assert.match(msgs(rs), /directory \d+ms/);
-  assert.match(msgs(rs), /protocol version aligned/);
-  assert.match(msgs(rs), /paired to a workforce member \(2 channel\(s\)\)/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 2: 401 → FAIL token rejected, remaining probes skipped", async () => {
-  const r = root();
-  const f = stubFetch({ "/api/v1/directory": { status: 401, body: {} } });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  assert.equal(rs.at(-1).level, "fail");
-  assert.match(rs.at(-1).msg, /token rejected .*Settings → API keys/i);
-  assert.equal(f.calls.length, 1, "no further probes after a rejected token");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 2: unreachable → FAIL (enrolled agent that cannot reach its org is broken)", async () => {
-  const r = root();
-  const f = stubFetch({ "/api/v1/directory": "throw" });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  assert.equal(rs.at(-1).level, "fail");
-  assert.match(rs.at(-1).msg, /unreachable/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 2 drift: header present ≠ local → warn `cohort upgrade`", async () => {
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": { status: 200, body: {}, headers: { "x-org-protocol": "99" } },
-    "/api/v1/messaging.channels": CHANNELS_OK,
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const drift = rs.find((x) => /protocol drift/.test(x.msg));
-  assert.ok(drift, "drift line present");
-  assert.equal(drift.level, "warn");
-  assert.match(drift.msg, /99 ≠ local 1/);
-  assert.match(drift.msg, /cohort upgrade/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 2 drift: header ABSENT → warn hq-predates-phase-1", async () => {
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": { status: 200, body: {} }, // no headers at all
-    "/api/v1/messaging.channels": CHANNELS_OK,
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const absent = rs.find((x) => /does not report protocol version/.test(x.msg));
-  assert.ok(absent);
-  assert.equal(absent.level, "warn");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 3: FORBIDDEN_SCOPE from messaging.channels → FAIL not-paired", async () => {
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": { status: 403, body: { ok: false, error: { code: "FORBIDDEN_SCOPE", message: "not paired to a workforce member" } } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const pair = rs.find((x) => /not paired/.test(x.msg));
-  assert.ok(pair);
-  assert.equal(pair.level, "fail");
-  assert.match(pair.msg, /cohort pair/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 3 garnish: identity hint appends the member slug; hint failure never degrades", async () => {
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/org/members/astra?orgId=acme": { status: 200, body: { slug: "astra", displayName: "Astra" } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: { COHORT_AGENT_ID: "astra" } });
-  const paired = rs.find((x) => /paired to a workforce member/.test(x.msg));
-  assert.match(paired.msg, /member astra/);
-  // hint present but whoami fails → still ok, no garnish
-  const f2 = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/org/members/astra?orgId=acme": { status: 404, body: {} },
-  });
-  const rs2 = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f2, env: { COHORT_AGENT_ID: "astra" } });
-  const paired2 = rs2.find((x) => /paired to a workforce member/.test(x.msg));
-  assert.equal(paired2.level, "ok");
-  assert.ok(!/member astra/.test(paired2.msg));
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 4: orgmail gate + family vendored → mailbox probe surfaces the address", async () => {
-  const r = root({ orgmail: true });
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/email.inbox": { status: 200, body: { ok: true, result: { mailbox: { address: "astra@agents.example" }, messages: [] } } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const mail = rs.find((x) => /workspace mailbox/.test(x.msg));
-  assert.equal(mail.level, "ok");
-  assert.match(mail.msg, /astra@agents\.example/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 4: NO mailbox FAILS and names who does what (it is a dead lane, not a degraded one)", async () => {
-  const r = root({ orgmail: true });
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/email.inbox": { status: 404, body: { ok: false, error: { code: "NOT_FOUND", message: "no mailbox for member" } } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const mail = rs.find((x) => /Workspace mailbox/.test(x.msg));
-  assert.equal(mail.level, "fail");
-  // The whole point: an ACTOR and an ACT, not just a state.
-  assert.match(mail.msg, /workspace ADMIN/);
-  assert.match(mail.msg, /Settings → Email → Mailboxes/);
-  assert.match(mail.msg, /Settings → Email → Domains/);
-  // The server's own words survive, so the operator can tell the two apart.
-  assert.match(mail.msg, /no mailbox for member/);
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 4: an unpaired/unscoped key is a DIFFERENT fail with a different remedy", async () => {
-  const r = root({ orgmail: true });
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/email.inbox": { status: 403, body: { ok: false, error: { code: "FORBIDDEN_SCOPE", message: "not paired" } } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const mail = rs.find((x) => /Workspace mailbox/.test(x.msg));
-  assert.equal(mail.level, "fail");
-  assert.match(mail.msg, /Settings → API keys/);
-  assert.ok(!/Settings → Email → Mailboxes/.test(mail.msg), "wrong remedy for this cause");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("probe 4: an unknown error stays a WARN (fail-open on the unclassified)", async () => {
-  const r = root({ orgmail: true });
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/email.inbox": { status: 500, body: { ok: false, error: { code: "INTERNAL", message: "boom" } } },
-  });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  const mail = rs.find((x) => /mailbox probe inconclusive/.test(x.msg));
-  assert.equal(mail.level, "warn");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("no orgmail gate file → no mailbox probe at all", async () => {
-  const r = root();
-  const f = stubFetch({ "/api/v1/directory": DIR_OK, "/api/v1/messaging.channels": CHANNELS_OK });
-  const rs = await checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} });
-  assert.ok(!rs.some((x) => /mailbox/.test(x.msg)));
-  assert.ok(!f.calls.some((c) => c.url.includes("email.inbox")));
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("inbound probe FAILS loudly when the server rejects this SDK's params", () => {
-  // The real incident: fetchHistory sent `channel`, hq validates `channelId`,
-  // so the agent could not read a single message sent to it — while every other
-  // doctor line stayed green. Protocol drift must be a FAIL, not a shrug.
-  const r = root();
-  const f = stubFetch({
-    "/api/v1/directory": DIR_OK,
-    "/api/v1/messaging.channels": CHANNELS_OK,
-    "/api/v1/messaging.history": HISTORY_BAD_PARAMS,
-  });
-  return checkOrgConnectivity({ agentRoot: r, fetchImpl: f, env: {} }).then((rs) => {
-    const bad = rs.find((x) => /inbound path BROKEN/.test(x.msg));
-    assert.ok(bad, "a rejected inbound probe must surface");
-    assert.equal(bad.level, "fail");
-    assert.match(bad.msg, /protocol drift/);
-    assert.match(bad.msg, /upgrade/);
-    rmSync(r, { recursive: true, force: true });
-  });
-});
-
-/* ── probe 0: reactive-lane wiring (local, no network) ─────────────────────
- * REGRESSION — observed live 2026-08-11 on a real seat. The agent repo carried
- * a CURRENT lib/execution/ and a STALE scripts/daemon/agent-daemon.mjs, so
- * `maestro-daemon.mjs` (which resolves ./agent-daemon.mjs from the agent's own
- * dir) ran a build with no `runExecutionLadder` call. The wide inbound was
- * current to within one ledger row and every event was still answered, so the
- * agent looked healthy — while intake / obligation-match / rung / journal never
- * ran at all and state/execution/journal.jsonl stayed empty. Nothing detected
- * it, because the new build cannot warn about the old one.
- */
-
-function laneRoot({ daemon, pipeline = true }) {
-  const r = mkdtempSync(join(tmpdir(), "org-doctor-lane-"));
-  if (pipeline) {
-    mkdirSync(join(r, "lib", "execution"), { recursive: true });
-    writeFileSync(join(r, "lib", "execution", "pipeline.mjs"), "export const processOne = () => {};\n");
-  }
-  if (daemon !== undefined) {
-    mkdirSync(join(r, "scripts", "daemon"), { recursive: true });
-    writeFileSync(join(r, "scripts", "daemon", "agent-daemon.mjs"), daemon);
-  }
-  return r;
-}
-
-test("reactive-lane probe FAILS when the daemon copy predates the execution ladder", () => {
-  const r = laneRoot({ daemon: "async function processItemTraced(){ return classifyItem(item); }\n" });
-  const v = checkReactiveLaneWiring(r);
-  assert.equal(v.level, "fail");
-  assert.match(v.msg, /never calls runExecutionLadder/);
-  assert.match(v.msg, /journal\.jsonl will stay empty/);
-  assert.match(v.msg, /upgrade/, "must tell the operator what to DO");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("reactive-lane probe is OK when the daemon does call the ladder", () => {
-  const r = laneRoot({ daemon: "const gate = await runExecutionLadder(item, service, itemId, trace_id, deps);\n" });
-  const v = checkReactiveLaneWiring(r);
-  assert.equal(v.level, "ok");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("reactive-lane probe stays silent when the repo is not an agent layout", () => {
-  // No lib/execution → the framework is not vendored here; nothing to compare.
-  const r = laneRoot({ daemon: "whatever\n", pipeline: false });
-  assert.equal(checkReactiveLaneWiring(r), null);
-  // …and no daemon at all is equally not-applicable.
-  const r2 = laneRoot({});
-  assert.equal(checkReactiveLaneWiring(r2), null);
-  rmSync(r, { recursive: true, force: true });
-  rmSync(r2, { recursive: true, force: true });
-});
-
-test("reactive-lane probe fails OPEN (warn, never throw) on an unreadable daemon", () => {
-  const r = laneRoot({ daemon: "runExecutionLadder\n" });
-  const v = checkReactiveLaneWiring(r, {
-    existsSync: () => true,
-    readFileSync: () => { throw new Error("EACCES"); },
-  });
-  assert.equal(v.level, "warn");
-  assert.match(v.msg, /EACCES/, "the cause must be named, not swallowed");
-  rmSync(r, { recursive: true, force: true });
-});
-
-test("checkOrgConnectivity surfaces the lane probe even for an un-enrolled agent", async () => {
-  const r = laneRoot({ daemon: "processItemTraced\n" });
-  const rs = await checkOrgConnectivity({ agentRoot: r, env: {}, fetchImpl: () => { throw new Error("no network"); } });
-  const lane = rs.find((x) => /Reactive lane/.test(x.msg));
-  assert.ok(lane, "the lane probe must run before the not-enrolled short-circuit");
-  assert.equal(lane.level, "fail");
-  rmSync(r, { recursive: true, force: true });
-});