@cohortapp/agent-sdk 2.3.0

package/docs/runbooks/backup-restore.md

@@ -0,0 +1,205 @@
+# Runbook — Backup and Restore
+
+For an operator who must (a) confirm an agent's backups are real and current, or
+(b) rebuild a dead Mac mini and recover its secrets and state. A Maestro agent's
+durable state (`state/`: queues, cost ledger, learning DB, allowlists), its logs,
+and its `.env` secrets live on a single disk. Losing the disk without a working
+backup loses the agent's local history; this runbook is how you avoid that and
+how you recover when it happens.
+
+This complements `docs/runbooks/mac-mini-bootstrap.md` (fresh provisioning) and
+`docs/runbooks/incident-response.md` (a compromised, not dead, machine). For a
+compromised machine, do NOT restore onto the same hardware — rebuild on a clean
+box.
+
+## What is backed up, and the honest gaps
+
+Off-machine backup is driven by `scripts/maintenance/backup-to-cloud.sh`, reading
+`.maestro/backup-config.yaml`, run daily via launchd. Configure it with
+`maestro init backup-replication --apply` (`scripts/setup/init-backup.mjs`).
+
+Know these caveats before you rely on it:
+
+- **Backup is opt-in and silent when off.** If `.maestro/backup-config.yaml` is
+  missing or `enabled: false`, the script exits 0 and does nothing. An agent with
+  no backup configured looks identical to a healthy one in casual inspection —
+  check explicitly (below).
+- **Coverage historically excluded `logs/` and the audit records.** Confirm your
+  config's include paths cover `state/`, `logs/`, and `.maestro/`. If `logs/` is
+  excluded, a dead machine loses that agent's local compliance history — the
+  org-server export (next section) is your compensating control.
+- **`retention_days` may not be enforced** by older builds; do not assume old
+  archives are pruned.
+- **Archives may be unencrypted** unless you enabled client-side encryption.
+  Treat the backup bucket as sensitive, restrict access, and prefer an encrypted
+  bucket and encrypted archives.
+
+The org server is your fleet-as-DR layer for the audit record: every
+side-effecting action is a hash-chained `org_events` row at Cohort, exportable
+as OCSF/OTel (`cohort export-audit`). So even if a single mini's local `logs/`
+are lost, the authoritative cross-agent audit trail survives on the server. The
+local logs hold richer detail (transcripts, raw messages); the server holds the
+non-repudiable record.
+
+## Confirm a backup is real and current (do this before you need it)
+
+```bash
+cd ~/<agent>-ai
+
+# 1. Is backup configured and enabled?
+test -f .maestro/backup-config.yaml && grep -E '^enabled:' .maestro/backup-config.yaml
+
+# 2. Did the last run succeed, and when?
+tail -n 20 logs/maintenance/backup.log
+
+# 3. Does the configured destination actually have today's archive?
+#    (provider-specific; e.g. for GCS:)
+#    gcloud storage ls "gs://<bucket>/<prefix>/$(date -u +%F)/"
+
+# 4. doctor surfaces backup freshness in the governance posture.
+maestro doctor
+```
+
+If `maestro doctor` does not flag a missing/stale backup red, do not assume the
+backup is fine — verify the destination has a recent archive. A backup you have
+never restored from is a hypothesis, not a backup; periodically restore one agent
+into a scratch directory to prove the archive is usable.
+
+---
+
+## Restore a dead Mac mini
+
+You are rebuilding an agent on replacement hardware. The order matters: provision
+the host, recover secrets, restore state, re-establish org identity, then resume.
+
+### 1. Provision the replacement host
+
+Follow `docs/runbooks/mac-mini-bootstrap.md` to get a clean Mac mini to the point
+where `~/maestro` is available and the agent repo is cloned to `~/<agent>-ai`.
+Do not start the daemon yet.
+
+### 2. Recover secrets
+
+The `.env` is plaintext and there is no broker yet, so secret recovery is the
+hardest step. In priority order:
+
+- **From the backup archive**, if `.maestro/` and the agent's secret material
+  were included and the archive is encrypted at rest. Restore `.env` from the
+  archive, then immediately `chmod 600 .env`.
+- **From the operator's escrow**, if your deployment keeps a sealed copy (e.g. in
+  a password manager entry per agent). This is the recommended belt-and-braces
+  until the secrets broker ships.
+- **By re-issuing**, for anything you cannot recover: rotate the credential at
+  its source (Slack, WhatsApp, Gmail OAuth, relay) and write the new value. The
+  agent's Cohort device token specifically should be RE-MINTED, not restored —
+  see step 4.
+
+If you are recovering after a *theft* (not just a hardware failure), treat every
+secret as exposed and rotate per `docs/runbooks/incident-response.md` Scenario B
+rather than restoring the old values.
+
+```bash
+cd ~/<agent>-ai
+# after placing .env:
+chmod 600 .env
+stat -f '%Sp' .env       # confirm -rw------- (0600)
+```
+
+### 3. Restore state from the latest archive
+
+```bash
+cd ~/<agent>-ai
+# Pull the most recent archive from the configured destination into a temp dir,
+# then unpack into the repo root so state/, logs/, and .maestro/ land in place.
+# (provider-specific download; example for GCS:)
+#   gcloud storage cp "gs://<bucket>/<prefix>/<DATE>/<archive>" /tmp/restore.tar.gz
+mkdir -p /tmp/restore && tar -xzf /tmp/restore.tar.gz -C /tmp/restore
+# Inspect before overwriting:
+ls /tmp/restore
+# Then place state/ (and logs/ if backed up) into the repo:
+cp -R /tmp/restore/state ./
+cp -R /tmp/restore/logs ./ 2>/dev/null || true
+```
+
+Sanity-check the restored state: the cost ledger and learning DB are SQLite
+(`better-sqlite3`); a torn copy will fail to open. If `state/` is corrupt or
+incomplete, the agent can still start — its durable queues will be empty, and it
+re-establishes cursors — but you will have lost in-flight work. Note the gap in
+the rebuild ticket.
+
+### 4. Re-establish org-server identity
+
+Do NOT restore the old device token. Mint a fresh one so the rebuilt agent has a
+clean, attributable identity:
+
+```bash
+# On the operator station, against Cohort:
+cohort --db "$COHORT_DB" pair approve <agentId> --scopes <scopes>
+# This prints a new device token — write it into ~/<agent>-ai/.env on the mini.
+```
+
+If the dead agent was previously `admin.deactivate`d (e.g. it died during an
+incident), `admin.reactivate` it first. Confirm the agent appears in the registry
+with the expected owner, sponsor, autonomy tier, and scopes — a rebuild is a good
+moment to re-certify access.
+
+### 5. Resume operations
+
+```bash
+cd ~/<agent>-ai
+maestro doctor                 # green governance posture before going live
+./scripts/resume-operations.sh # health check, clear any stale .emergency-stop, load launchd
+```
+
+Watch the first cadence ticks and the first inbound message end-to-end. Confirm
+the agent heartbeats to the org server (`presence.beat`) and that its first
+side-effecting action lands a row in the audit chain (`cohort doctor` chain
+check passes).
+
+### 6. Re-arm backup on the new machine
+
+A rebuilt machine with no backup is the next dead machine.
+
+```bash
+cd ~/<agent>-ai
+maestro init backup-replication --apply   # if .maestro/backup-config.yaml absent
+# confirm include paths cover state/, logs/, .maestro/; confirm encryption on.
+maestro doctor                            # backup freshness should clear within a day
+```
+
+---
+
+## Cohort fleet-as-DR exports
+
+The org server is the disaster-recovery layer for the audit/compliance record and
+for fleet metadata, independent of any single mini's backup.
+
+- **Audit history** survives machine loss: `cohort export-audit --format ocsf`
+  (or `--format otel`) reconstructs every approval, decision, cost, and handoff
+  the lost agent participated in, with hash-chain provenance, from the server's
+  `org_events`. Run this as part of restore to confirm the lost agent's history
+  is intact server-side, and to fill any gap left by missing local `logs/`.
+- **Identity and registry** survive: the agent's owner, sponsor, tier, scopes,
+  and credential bindings are server-side records re-bound at re-pair time, not
+  reconstructed from the dead disk.
+- **Cost rollups** survive: per-agent/model/day spend reported via `cost.report`
+  is server-side, so financial accounting for the lost period is recoverable even
+  if the local ledger is gone.
+
+Back up the Cohort database itself on its own schedule — it is the single point
+whose loss takes the fleet's audit trail with it. Treat the Cohort DB and
+`COHORT_SIGNING_SECRET` as tier-zero: encrypted backups, restricted access,
+tested restore.
+
+## Quick reference
+
+| Need | Command |
+|---|---|
+| Is backup on? | `grep -E '^enabled:' .maestro/backup-config.yaml` |
+| Last backup status | `tail logs/maintenance/backup.log` |
+| Configure backup | `maestro init backup-replication --apply` |
+| Governance posture incl. backup freshness | `maestro doctor` |
+| Re-mint agent identity | `cohort pair approve <agentId> --scopes <...>` |
+| Recover audit history | `cohort export-audit --format ocsf` |
+| Resume after restore | `./scripts/resume-operations.sh` |
+| Lock down `.env` | `chmod 600 .env` |

package/docs/runbooks/cohort-cutover.md

@@ -0,0 +1,129 @@
+# Runbook — Cohort Cutover
+
+For the operator moving the org server and the agent fleet from the Neolith
+name to Cohort. The `cohort` branch of this repo carries the full text rename —
+`services/neolith` → `services/cohort`, package `@neolith/agent-sdk` →
+`@cohortapp/agent-sdk`, `COHORT_*` env names, `bin/cohort.mjs` — and this runbook
+is the infrastructure the code change cannot reach: the Railway repoint, the
+variable names, the npm scope, and the per-machine fleet update. The
+product-app side of the same cutover (domains, OAuth, app releases) lives in
+the `adapticai/hq` repo as `COHORT-RENAME.md`.
+
+Companion runbooks: `docs/runbooks/fleet-operations.md` (rollout rings — reuse
+them for every step here that touches minis), `docs/runbooks/backup-restore.md`,
+`docs/runbooks/incident-response.md`. `DEPLOYMENT.md` describes the org-server
+architecture this runbook repoints.
+
+Order: npm scope first (additive), then the org server, then the avatar
+worker, then the fleet, cleanup last.
+
+---
+
+## 1. Org server on Railway
+
+The service builds from this repo with the **repo root as build context** —
+the Dockerfile reaches up for `lib/` (`DEPLOYMENT.md` §2.1). The rename moved
+`services/neolith` → `services/cohort`, so make all of this **one** Settings
+visit, not three:
+
+1. **Variables.** `COHORT_*` is the canonical prefix, but every entry point —
+   `bin/maestro.mjs`, `bin/cohort-mcp.mjs`, `lib/org/client.mjs`, and the
+   server's own `bin/cohort.mjs` — first runs `applyBrandEnvCompat()`
+   (`lib/env-compat.mjs`), bridging `NEOLITH_*` ⇄ `COHORT_*`. The repoint
+   therefore works with the existing `NEOLITH_*` variables untouched. Add the
+   canonical spellings anyway and migrate onto them: `COHORT_ADMIN_TOKEN`,
+   `COHORT_SIGNING_KEY` / `COHORT_SIGNING_KEY_FILE`, `COHORT_CRED_KEY`,
+   `COHORT_DB` (SQLite pilot) or `DATABASE_URL` (Postgres), `COHORT_PORT`
+   (default 7470). Annotated list: `services/cohort/.env.example`. Delete the
+   legacy twins at cleanup (§5), not before.
+2. **Source → Branch:** `main` → `cohort`.
+3. **Config path, same action:** if the service pins a Railway Config File
+   (`services/neolith/railway.json`) or a Root Directory under
+   `services/neolith`, change it to `services/cohort/…` — otherwise the first
+   `cohort` build cannot find its config. The tracked
+   `services/cohort/railway.json` pins
+   `dockerfilePath: services/cohort/Dockerfile`,
+   `startCommand: node bin/cohort.mjs serve`, healthcheck `/v1/ops`.
+
+Verify after the deploy: build green, `/v1/ops` healthy, agent heartbeats
+landing, a `credential.lease` succeeds, and `org_events` keep chaining — the
+audit hash chain is content-based, so a branch or name change never breaks it.
+
+**Do not rename the Railway service in the same window.** Every fleet
+machine's `config/org.yaml` pins `server.url` (e.g.
+`https://neolith.up.railway.app`) plus the TLS fingerprint; renaming the
+service changes the `*.up.railway.app` host and strands the fleet. Move the
+fleet to a stable custom domain first (§2), then rename freely.
+
+---
+
+## 2. Custom domain for the org server
+
+Railway → service → Settings → Networking: add `org.cohortapp.com`; create the
+CNAME Railway displays at the `cohortapp.com` DNS host. Old and new hosts
+serve in parallel — there is no flag day for the fleet.
+
+Then roll `config/org.yaml` across machines through rings, never all at once:
+
+- `server.url` → `https://org.cohortapp.com`
+- `server.fingerprint` → re-pin against the new host's TLS cert
+
+Pairing survives the move — agent identity is the device keypair, not the URL.
+
+---
+
+## 3. Avatar worker
+
+`services/avatar` kept its name. The Railway avatars service needs only
+**Source → Branch: `main` → `cohort`** — Root Directory stays
+`services/avatar` and its `railway.json` (`dockerfilePath: Dockerfile`,
+`startCommand: node bin/avatar-worker.mjs start`) is unchanged.
+
+---
+
+## 4. npm scope and the fleet
+
+The package is now `@cohortapp/agent-sdk` (bins: `maestro`, `cohort`,
+`cohort-mcp`, plus legacy aliases `neolith` and `neolith-mcp` so installed
+launchd jobs survive the bump; `.npmrc` keeps the `@neolith:registry` mapping).
+
+1. Create the npm org/scope **`cohort`** on npmjs.com.
+2. First publish is manual — Trusted Publishing is configured on an existing
+   package's settings page. From a `cohort`-branch checkout:
+   `npm publish --access public` as an org member.
+3. Wire Trusted Publishing: npmjs.com → `@cohortapp/agent-sdk` → Settings →
+   Trusted Publisher → GitHub Actions, org `adapticai`, repo `maestro`,
+   workflow `auto-publish-npm.yml`. The workflow is already OIDC-ready
+   (`id-token: write`, npm ≥ 11.5.1, strips the `.npmrc` authToken line,
+   no-ops on already-published versions).
+4. Bump each mini through rings (`docs/runbooks/fleet-operations.md`), canary
+   first:
+
+   ```bash
+   cd ~/<agent>-ai
+   maestro doctor                        # BEFORE posture
+   npm install @cohortapp/agent-sdk@latest
+   maestro doctor                        # AFTER must be no worse
+   ./scripts/resume-operations.sh
+   ```
+
+Machines still on `@neolith/agent-sdk` keep working against the repointed
+server — the org protocol is frozen and name-agnostic, and `config/org.yaml`
+pins the URL, not the package name — so the fleet bump can trail the server
+cutover by days.
+
+---
+
+## 5. Cleanup
+
+- Delete the `NEOLITH_*` variables from the Railway services once the
+  `COHORT_*` twins are set and a deploy has been verified reading them (the
+  env-compat bridge makes the overlap safe, not permanent).
+- `npm deprecate @neolith/agent-sdk "renamed to @cohortapp/agent-sdk"` — if the
+  old scope was ever published.
+- After the fleet is on `org.cohortapp.com`: optionally rename the Railway
+  service, then sweep anything pinned to the old `*.up.railway.app` host
+  (monitors, webhooks, stray `org.yaml` stragglers — the registry's presence
+  view shows who stopped heartbeating).
+- Merge `cohort` → `main` and point the services back at `main`, mirroring the
+  hq-side sequence.

package/docs/runbooks/fleet-operations.md

@@ -0,0 +1,200 @@
+# Runbook — Fleet Operations
+
+For an operator running 40–60 Maestro agents as a fleet. Covers rollout rings,
+version skew, cross-agent triage, fleet-wide pause, and decommissioning an agent.
+Maestro's per-machine substrate is strong; the fleet layer is the part you
+operate by convention plus the Cohort org server. Where a fleet primitive is
+still maturing, this runbook says so and gives the manual procedure.
+
+Companion runbooks: `docs/runbooks/incident-response.md` (one bad agent),
+`docs/runbooks/backup-restore.md` (one dead agent),
+`docs/runbooks/recovery-and-failover.md` (operational recovery).
+
+## The fleet is vendored per machine
+
+Each agent runs `~/maestro` as a checkout/package on its own Mac mini. There is
+no central push that updates all of them at once — upgrades are per machine and
+drift is the default unless you manage it. This is why rings, a version floor, and
+skew-watching matter operationally rather than as nice-to-haves.
+
+The org server gives you the cross-machine views that the minis cannot give
+themselves: registry/identity, presence/heartbeat, approvals, decisions, cost
+rollups, policy distribution, and the audit export. Use it as the fleet's control
+and observation plane; use SSH/runbooks on individual minis for anything the
+server does not yet do remotely.
+
+---
+
+## Rollout rings
+
+Never upgrade all 40–60 agents at once. Promote through rings and let each ring
+bake before the next.
+
+1. **Canary (1–2 agents).** Pick low-stakes agents (not the CEO's, not a
+   compliance-adjacent one). Upgrade, then watch a full day of real traffic:
+   inbound handled, cadences firing, sends going out, heartbeats green, no new
+   doctor red flags, cost in band.
+2. **Early ring (~10%).** A representative spread of archetypes. Bake 1–2 days.
+   Watch for archetype-specific breakage (a tool one role uses heavily that the
+   canary did not exercise).
+3. **Broad ring (~50%).** Bake a day.
+4. **Fleet (remainder).** Only after the broad ring is clean.
+
+Per-agent upgrade on a mini:
+
+```bash
+cd ~/<agent>-ai
+maestro doctor                 # capture the BEFORE posture
+npm update @cohortapp/agent-sdk    # or: git -C ~/maestro pull, for direct checkouts
+maestro doctor                 # AFTER posture must be no worse
+./scripts/resume-operations.sh # restart cleanly so the daemon picks up the new code
+```
+
+Promotion gate between rings: zero new doctor red flags, heartbeats present for
+every upgraded agent, no spike in the audit export's failure/refusal families, and
+cost-per-session unchanged. If any ring regresses, STOP promoting and roll back
+that ring before touching the next.
+
+### Rollback
+
+Pin the agent back to the last-known-good version and restart:
+
+```bash
+cd ~/<agent>-ai
+npm install @cohortapp/agent-sdk@<last-good-version>   # or: git -C ~/maestro checkout <good-sha>
+./scripts/resume-operations.sh
+maestro doctor
+```
+
+For a direct `~/maestro` checkout, rollback is a `git checkout` of the known-good
+SHA followed by a restart. Record the rollback and the regression in the rollout
+ticket so the canary catches it next time.
+
+---
+
+## Version skew
+
+A fleet mid-rollout is heterogeneous by design; the risk is *unbounded* skew and
+agents below the floor.
+
+- **Take inventory.** The registry should carry each agent's `maestroVersion` via
+  its heartbeat. Where that field is not yet populated, collect it manually:
+  `for a in <agents>; do ssh "$a" 'cd ~/<repo> && node -p "require(\"@cohortapp/agent-sdk/package.json\").version"'; done`.
+- **Hold a version floor.** Define the minimum version any agent may run
+  (typically the last version that fixed a security or durability bug). Agents
+  below the floor are upgraded out of band, not left to the normal ring cadence —
+  a below-floor agent is an exposure, not just stale.
+- **Bound the spread.** Do not let the newest and oldest agents differ by more
+  than one minor version in steady state. If a rollout stalls, either finish it
+  or roll the leading ring back to close the gap.
+- **Watch for protocol skew with the server.** The agent↔Cohort protocol is
+  versioned. If you upgrade the server, confirm the oldest agent in the fleet
+  still speaks the protocol before you cut over; if not, raise the floor first.
+
+---
+
+## Cross-agent triage
+
+With 40–60 agents you cannot watch 40–60 Slack DM streams. Triage from the org
+server's aggregate views, then drill into the one machine that needs it.
+
+1. **Fleet health at a glance.** Presence/heartbeat tells you who is alive. A
+   stale heartbeat is the first signal — an agent that stopped beating is either
+   wedged, off, or its machine is down. (Where a `maestro fleet status` rollup is
+   available, use it; otherwise read presence from the server and `maestro
+   doctor` on suspects.)
+2. **Behavioral signals, not single failures.** Agents fail silently by
+   completing with wrong output, so triage on patterns from the audit/cost
+   export: refusal spikes, per-tool failure rates above baseline, cost-per-session
+   p99 climbing, an agent that has gone quiet (no events) during its active hours.
+   Pull these from `cohort export-audit --format otel` (spans carry the
+   `gen_ai.*` and cost attributes) and the cost rollup.
+3. **Correlate one interaction.** To reconstruct a single user interaction across
+   item → classification → session → send, follow the trace/decision identifiers:
+   the model-router `decision_id` joins a routing decision to its ledger row to
+   its resume marker, and the audit chain's `seq`/`row_hash` order the events.
+   This is how you answer "what did agent X actually do at 14:05" authoritatively.
+4. **Drill to the machine.** Once you have the suspect, SSH in and run `maestro
+   doctor` for the one-screen governance posture (heartbeats, throttle, breaker,
+   budget band, stuck markers, permissions hygiene), then read its `logs/`.
+
+---
+
+## Fleet-wide pause (break-glass)
+
+When you need everything to stop — a fleet-level security event, a bad upgrade
+caught mid-rollout, a provider outage causing runaway retries.
+
+There is no single command that pauses all minis today; pause is the sum of
+per-agent kill switches plus server-side deactivation. Sequence:
+
+1. **Cut coordination at the server.** Deactivate each agent (or, if your build
+   supports it, suspend the fleet); a deactivated agent's tokens are revoked and
+   it cannot coordinate or be impersonated:
+   ```bash
+   for a in $(cat fleet-roster.txt); do
+     cohort --db "$COHORT_DB" admin deactivate "$a" --reason "fleet pause <ticket>"
+   done
+   ```
+2. **Halt execution on each mini** (the local break-glass), in parallel where you
+   have fan-out SSH:
+   ```bash
+   # per machine:
+   cd ~/<agent>-ai && ./scripts/emergency-stop.sh
+   ```
+   This drops `.emergency-stop`, unloads launchd jobs, and kills running sessions.
+3. **Confirm silence.** Heartbeats stop; the audit export shows no new
+   side-effecting events. If any agent is still acting, it did not honor the stop
+   — investigate that machine directly.
+
+Resume is deliberate and per agent (see "Resume" below). Do not script a
+fleet-wide auto-resume; a pause exists because something needed a human decision.
+
+Resume after the cause is cleared:
+
+```bash
+# per machine:
+cd ~/<agent>-ai && ./scripts/resume-operations.sh
+# then on the operator station, per agent:
+cohort --db "$COHORT_DB" admin reactivate "$a"
+```
+
+---
+
+## Decommissioning an agent
+
+Retiring an agent permanently. The goal is no orphaned identity, no live
+credentials, and a preserved audit trail.
+
+1. **Stop it.** Local break-glass plus server deactivation:
+   ```bash
+   cd ~/<agent>-ai && ./scripts/emergency-stop.sh
+   cohort --db "$COHORT_DB" admin deactivate <agentId> --reason "decommission"
+   ```
+   Deactivation revokes its tokens — the identity-side half of the kill switch.
+2. **Preserve its history before you touch the machine.** Export its audit trail
+   from the server (`cohort export-audit --format ocsf`, filtered to the agent)
+   and take a final off-machine backup of its `state/` and `logs/`
+   (`docs/runbooks/backup-restore.md`). A decommissioned agent's compliance
+   record must outlive the agent — retain per `docs/compliance/evidence-map.md`.
+3. **Revoke channel access at the source.** Slack token, WhatsApp session, Gmail
+   OAuth, Telegram bot, relay secrets — revoke each in its provider so the retired
+   identity cannot send even if a credential lingers.
+4. **Drain in-flight obligations.** Check the audit export's `handoff` and
+   `approval` families for anything the agent owed another agent or a human;
+   reassign or close those before the agent is gone, or they become orphaned.
+5. **Wipe the machine.** Securely erase `.env` and `state/` on the mini (the
+   plaintext secrets especially). If the hardware is being redeployed for a new
+   agent, treat it as a fresh provision (`docs/runbooks/mac-mini-bootstrap.md`),
+   not a rename of the old one.
+6. **Close the identity.** Mark the registry record decommissioned (its lifecycle
+   state), with the date and the operator who did it. Do not delete the record —
+   the audit trail references it; a deleted identity makes its history
+   un-attributable.
+7. **Notify.** If the agent was HR-adjacent or interacted with people who relied
+   on it, tell those people it is retired (and who to talk to instead) — the
+   deployer's transparency duty does not end when the agent does.
+
+A decommissioning is done when: the agent cannot authenticate, cannot send on any
+channel, has no live launchd jobs, its history is exported and retained, its
+registry record is marked retired (not deleted), and affected humans are notified.