@cohortapp/agent-sdk 2.4.0 → 2.5.0

package/scripts/daemon/responder.mjs

@@ -37,6 +37,11 @@ import { screenOutbound } from "../../lib/comms/send-gate.mjs";
 import { emitEvent, EVENT_TYPES } from "../../lib/diagnostics/events.mjs";
 import * as counters from "../../lib/diagnostics/counters.mjs";
 import { getHookBus } from "../../lib/hooks/bus.mjs";
+// The execution ladder's rung vocabulary. This responder IS rungs 0-1
+// (`function_call` / `skill`); `isQuickReply` consults the ladder's routing
+// decision so a reply that needs a session, a plugin, a workflow or a team is
+// not answered here just because the classifier called it simple.
+import { rungById } from "../../lib/execution/route.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 const SONNET_MODEL = "claude-sonnet-4-6";
@@ -730,8 +735,23 @@ async function sendCohortReply(item, text) {
   }
 }
 
-export async function sendQuickResponse(item, classResult) {
+export async function sendQuickResponse(item, classResult, routed = null) {
   const startTime = Date.now();
+  // The ladder's decision, carried onto every log row this send writes, so
+  // `logs/daemon/*-responses.jsonl` and `state/execution/journal.jsonl` can be
+  // joined on the event key. Without it the journal says "react_now at rung 1"
+  // and the response log says "quick_response" and nothing ties them together.
+  const _routed = routed || item.execution || null;
+  const ladder = _routed
+    ? {
+        event_key: _routed.key || null,
+        surface: _routed.surface || null,
+        disposition: _routed.disposition || null,
+        rung: Number.isFinite(_routed.rung) ? _routed.rung : null,
+        mechanism: _routed.mechanism || null,
+        obligation_key: _routed.obligationKey || null,
+      }
+    : null;
 
   try {
     const text = await _generateResponse(item, classResult, false);
@@ -807,10 +827,14 @@ export async function sendQuickResponse(item, classResult) {
       service: item.service,
       duration_ms: duration,
       text_length: text.length,
+      ...(ladder ? { ladder } : {}),
       ...sendResult,
     });
 
-    console.log(`[responder] Quick reply to ${item.sender} (${duration}ms) — ${sendResult.via || "not_sent"}`);
+    console.log(
+      `[responder] Quick reply to ${item.sender} (${duration}ms) — ${sendResult.via || "not_sent"}` +
+        (ladder ? ` [rung ${ladder.rung} ${ladder.mechanism}${ladder.obligation_key ? ` · ${ladder.obligation_key}` : ""}]` : ""),
+    );
     return { sent: sendResult.sent, text, ...sendResult };
 
   } catch (err) {
@@ -888,7 +912,19 @@ export async function sendHoldingMessage(item, classResult) {
  * so they get tool access, conversation history, and memory lookup.
  * Quick replies are only for truly simple, low-stakes messages.
  */
-export function isQuickReply(classResult) {
+export function isQuickReply(classResult, routed = null) {
+  // ── the execution ladder's RUNG, applied first and as a VETO only ────────
+  // This responder is, mechanically, rungs 0 and 1: a single protocol/API call
+  // (`function_call`) or one bounded generation against a prompt (`skill`).
+  // Rung 2+ names machinery it does not have — an integration plugin, a Claude
+  // Code session, a durable workflow, a sub-agent team. Answering those here
+  // would be a wrong answer delivered quickly.
+  //
+  // A veto, never a promotion: a low rung does not make an `action: research`
+  // item quick-repliable. And a null `routed` (an item the ladder could not
+  // place, or a caller that has no ladder) leaves the original rules untouched.
+  if (!rungPermitsQuickReply(routed)) return false;
+
   // These always need full sessions — never quick reply
   if (classResult.action === "research") return false;
   if (classResult.action === "draft") return false;
@@ -908,3 +944,34 @@ export function isQuickReply(classResult) {
 
   return false;
 }
+
+/**
+ * Is this responder the mechanism the execution ladder routed to?
+ *
+ * Exported so the decision is testable on its own and so nothing has to
+ * re-derive "which rungs is the quick responder". NEVER SILENT: a rung the
+ * daemon has no mechanism for at all (4 = durable workflow, 5 = sub-agent team)
+ * is reported as the delivery gap it is rather than quietly running as an
+ * ordinary session and looking like a success.
+ *
+ * @param {object|null} routed a `lib/execution/disposition.decide` decision
+ * @returns {boolean}
+ */
+export function rungPermitsQuickReply(routed) {
+  if (!routed || !Number.isFinite(routed.rung)) return true;
+  if (routed.rung <= 1) return true;
+  const rung = rungById(routed.rung);
+  if (routed.rung >= 4) {
+    console.warn(
+      `[responder] the ladder routed this to rung ${routed.rung} (${rung ? rung.mechanism : "unknown"}), which no ` +
+        "mechanism in this daemon implements — it will run as a plain Claude session. The rung is journalled; " +
+        "the workflow-runner / subagent-fanout gap is real.",
+    );
+    return false;
+  }
+  console.log(
+    `[responder] rung ${routed.rung} (${rung ? rung.label : "?"}) needs more than an in-process reply — ` +
+      "vetoing the quick path",
+  );
+  return false;
+}

package/scripts/poller/imap-client.mjs

@@ -6,7 +6,6 @@
 // connect → search UNSEEN → fetch headers+body → write JSON → disconnect
 // flow is identical and lives here.
 
-import { ImapFlow } from "imapflow";
 import { writeFileSync, existsSync, readFileSync, mkdirSync } from "fs";
 import { join, dirname } from "path";
 import { createHash } from "crypto";
@@ -162,6 +161,26 @@ export async function pollImapInbox({
   let lastMid = cursor.last_message_id;
   let totalProcessed = cursor.messages_processed;
 
+  // `imapflow` is NOT a declared dependency of this package (package.json ships
+  // only better-sqlite3 + js-yaml), yet this module used to import it at the top
+  // level — and `scripts/daemon/agent-daemon.mjs` imports this module through
+  // gmail-poller. On any tree without a stray hoisted copy, importing the DAEMON
+  // therefore threw ERR_MODULE_NOT_FOUND before a single line of it ran: no
+  // inbox poll, no cadence bus, no execution ladder, nothing. Observed live
+  // mid-trace when a concurrent `npm` pruned node_modules.
+  //
+  // Loading it HERE means the whole daemon survives its absence and only the
+  // IMAP lane degrades — and says so.
+  let ImapFlow;
+  try {
+    ({ ImapFlow } = await import("imapflow"));
+  } catch (err) {
+    const msg = `${logPrefix} imapflow is not installed (${err && err.message ? err.message : err}) — IMAP polling is OFF for this account. Install it, or leave GMAIL_APP_PASSWORD unset to silence this lane.`;
+    console.warn(msg);
+    errors.push(msg);
+    return { newCount: 0, errors };
+  }
+
   const client = new ImapFlow({
     host: "imap.gmail.com",
     port: 993,

package/scripts/poller/inbox-scan-poller.mjs

@@ -111,6 +111,21 @@ export function parseInboxItemYaml(body) {
   if (channelType) item.channel_type = channelType;
   if (isPrivate !== undefined) item.is_private = isPrivate;
   if (isDm !== undefined) item.is_dm = isDm;
+  // The hq chain kind, when the org projection carried one through the writer.
+  // Attached only when present so a non-org item keeps exactly its old shape;
+  // `lib/execution/intake.fromInboxItem` prefers it over the surface so an
+  // obligation binds identically on the push and poll lanes.
+  const eventKind = scalar("event_kind");
+  if (eventKind) item.event_kind = eventKind;
+  // The directedness verdict's own reason, and the surface's subject id. Same
+  // rule as `event_kind`: attached only when the writer knew, so a non-org item
+  // keeps exactly its old shape. `intake.fromInboxItem` PREFERS `direct_reason`
+  // over its per-surface guess — the guess feeds `tierOf`, so getting it wrong
+  // is getting the tier and therefore the decision wrong.
+  const directReason = scalar("direct_reason");
+  if (directReason) item.direct_reason = directReason;
+  const scopeId = scalar("scope_id");
+  if (scopeId) item.scope_id = scopeId;
 
   return item;
 }

package/scripts/poller/utils.mjs

@@ -177,6 +177,57 @@ priority_signals:
 raw_ref: "${item.raw_ref || ""}"
 `;
 
+  // THE SURFACE ROUTING HINT. `lib/channels/contract.mjs EVENT_KINDS` and
+  // `lib/org/inbound/surfaces.mjs` agree on thirteen inbound kinds
+  // (task_assigned, task_comment, approval, decision, escalation, handoff,
+  // calendar, file_comment, mention, thread_reply, …), `eventToInboxItem`
+  // stamps the right one, and `inbox-scan-poller.mjs parseInboxItemYaml` reads
+  // `kind:` back — but this writer never emitted the line, so EVERY wide-inbound
+  // surface came off disk as a plain "message".
+  //
+  // Traced end-to-end on a real board assignment: the item was delivered with
+  // `kind: "task_assigned"`, written here, scanned back as `kind: "message"`,
+  // and `lib/execution/intake.mjs` had to RECONSTRUCT the surface out of
+  // `raw_ref` — it logged `intake degraded: verdict_reconstructed:task_assigned`
+  // and wrote the plan-drift row with `kind: "message"`. It survived only
+  // because raw_ref happens to encode the surface; any producer that writes an
+  // item without one loses the surface completely and a task assignment is
+  // triaged as ordinary chat.
+  //
+  // Written only when it is not the default, exactly like `channel_type` /
+  // `is_private` below: an absent line already means "message" to the reader,
+  // so existing items are unchanged.
+  if (item.kind && item.kind !== "message") {
+    yaml += `kind: "${item.kind}"\n`;
+  }
+
+  // The hq chain kind (`item.blocked`, `item.commented`, …), when the org
+  // projection supplied one. See the note in lib/channels/inbox-item.mjs: ten
+  // board kinds share the surface `task_comment`, and without this line an
+  // obligation scoped to a specific kind binds on the push lane and reads
+  // uncovered on the poll lane.
+  if (item.event_kind) {
+    yaml += `event_kind: "${item.event_kind}"\n`;
+  }
+
+  // THE DIRECTEDNESS REASON and THE SURFACE'S SUBJECT ID, for exactly the reason
+  // above: this writer enumerates its fields, so anything not named here dies at
+  // the YAML boundary and the poll lane behaves differently from the push lane.
+  //
+  // `direct_reason` is WHY the wide reader decided this event is mine
+  // (`reviewer`, `waiting_on`, `mention`, …). `lib/execution/intake.mjs` used to
+  // re-guess it from a per-surface default and get it wrong — and the reason
+  // feeds `disposition.tierOf`, so a wrong guess is a wrong TIER and a wrong
+  // decision. `scope_id` is the task/decision/file the event is about, which
+  // `channel_id` deliberately never carries and which `effects.escalate` needs
+  // to satisfy hq's "an escalation must reference a task or a channel".
+  if (item.direct_reason) {
+    yaml += `direct_reason: "${item.direct_reason}"\n`;
+  }
+  if (item.scope_id) {
+    yaml += `scope_id: "${item.scope_id}"\n`;
+  }
+
   // Add thread context if present (conversation history before this message)
   if (item.thread_context) {
     const tc = item.thread_context.replace(/\n/g, "\n  ");

package/scripts/setup/generate-capability.mjs

@@ -27,6 +27,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { bodyTokens, normaliseModel, stringifyFrontmatter } from "../../lib/subagents/schema.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const MAESTRO_ROOT =
@@ -41,30 +42,136 @@ function write(rel, body) {
   writeFileSync(p, body, "utf-8");
 }
 
-function renderAgentMd(a, identity, profile) {
-  const towers = (a.towers || []).join(", ");
-  return `---
-name: ${a.id}
-description: ${a.role} — ${a.mandate}
-model: ${a.model || "sonnet"}
----
+/**
+ * Tool grants by capability-pack `tier`, least-privilege first.
+ *
+ * The packs (archetypes/capabilities/*.yaml) carry `tier` but NOT `tools`, and
+ * they are SDK-vendored data — adding a `tools:` key to each of ~400 pack agents
+ * would be overwritten on the next upgrade. So the grant policy lives here, in
+ * the generator that writes the frontmatter, and a pack MAY still override it
+ * per-agent by declaring its own `tools` (see {@link toolsForAgent}).
+ *
+ * The tiers, and why each gets what:
+ *   support — reads, writes and searches repo files. No shell: these are the
+ *             narrow analysts/stewards, and a tier that only ever edits YAML and
+ *             markdown has no business spawning processes.
+ *   core    — the above plus Bash, because the working agents run the repo's own
+ *             scripts (queue sweeps, PDF generation, healthchecks).
+ *   lead    — the above plus WebFetch, because leads are the ones doing external
+ *             research to brief a decision.
+ *
+ * Deliberately NOT granted at any tier: Task. A sub-agent that can spawn further
+ * sub-agents makes the delegation tree unbounded and unobservable, which is the
+ * opposite of what a supervised platform needs. Grant it explicitly, per agent,
+ * if a case ever justifies it.
+ *
+ * The vocabulary matches the tools the SDK-shipped agents in agents/ already
+ * declare — extend it in lockstep with those, not ad hoc.
+ * @type {Readonly<Record<string, readonly string[]>>}
+ */
+export const TOOLS_BY_TIER = Object.freeze({
+  lead: Object.freeze([
+    "Read",
+    "Write",
+    "Edit",
+    "Glob",
+    "Grep",
+    "Bash",
+    "WebFetch",
+  ]),
+  core: Object.freeze(["Read", "Write", "Edit", "Glob", "Grep", "Bash"]),
+  support: Object.freeze(["Read", "Write", "Edit", "Glob", "Grep"]),
+});
 
-You are the **${a.role}** sub-agent for ${identity.fullName} (${identity.title}${identity.company ? ` at ${identity.company}` : ""}), reporting into the ${a.team} team.
+/**
+ * The tool grant for one pack agent: an explicit pack-level `tools` wins,
+ * otherwise the tier policy, otherwise `core` (the safe middle — an unknown tier
+ * is a pack authoring slip, and failing closed to `support` would quietly strip
+ * Bash from an agent that needs it).
+ * @param {{tier?:string, tools?:string[]}} a
+ * @returns {string[]}
+ */
+export function toolsForAgent(a) {
+  const explicit = Array.isArray(a && a.tools)
+    ? a.tools.map((t) => String(t).trim()).filter(Boolean)
+    : null;
+  if (explicit && explicit.length) return explicit;
+  return [
+    ...(TOOLS_BY_TIER[String((a && a.tier) || "")] || TOOLS_BY_TIER.core),
+  ];
+}
+
+/**
+ * Flatten a pack string into a frontmatter-safe one-liner.
+ *
+ * `description` is a `key: scalar` in a CLOSED grammar (lib/subagents/schema.mjs):
+ * a newline would end the value mid-sentence and an unquoted " #" would be eaten
+ * as a comment. Pack mandates are hand-written prose, so neither is hypothetical.
+ * @param {string} s @returns {string}
+ */
+function oneLine(s) {
+  return String(s == null ? "" : s)
+    .replace(/\s+/g, " ")
+    .replace(/ #/g, " ")
+    .trim();
+}
+
+/**
+ * Render one `agents/<id>/agent.md`.
+ *
+ * Two rules this function exists to hold, both learned the hard way:
+ *
+ *  1. IDENTITY STAYS AS TOKENS. The body carries `{{agent.*}}` and lib/render.mjs
+ *     resolves them at LOAD time. Interpolating identity HERE bakes whatever
+ *     config/agent.json happened to hold at generation time into a file that then
+ *     never updates — which is how 57 agents shipped saying "sub-agent for ( at
+ *     UNCONFIGURED)". scripts/ci/check-unresolved-tokens.mjs scans agents/ for
+ *     exactly this reason, and lib/subagents/schema.mjs §3 states the rule.
+ *
+ *  2. THE FRONTMATTER MUST VALIDATE. Emitting name/description/model but no
+ *     `tools` produced a fleet that fails validateAgentMd() on every single
+ *     generated agent. Frontmatter is built as an object and emitted through the
+ *     registry's own stringifyFrontmatter() so key order and sequence shape match
+ *     the SDK-shipped files byte for byte.
+ *
+ * @param {object} a pack agent entry ({id, role, mandate, model, tier, towers, team})
+ * @param {{function:string, altitude:string}} profile resolved archetype
+ * @returns {string} full agent.md text
+ */
+export function renderAgentMd(a, profile) {
+  const towers = (a.towers || []).join(", ");
+  const body = `You are the **${a.role}** sub-agent for {{agent.fullName}}, {{agent.title}} at {{agent.company}}, reporting into the ${a.team} team.
 
 ## Mandate
+
 ${a.mandate}
 
 ## Towers served
+
 ${towers ? `- ${towers}` : "- (general)"}
 
 ## Operating rules
-- Act within ${identity.firstName}'s autonomy model and decision rights — see \`config/operating-charter.md\`.
+
+- Act within {{agent.firstName}}'s autonomy model and decision rights — see \`config/operating-charter.md\`.
 - Follow \`policies/communication-style.md\` for any outbound communication.
 - Update the backlog item you are working and log significant decisions to the decision log.
-- Escalate anything beyond your remit to ${identity.firstName} (and onward per the escalation protocol).
+- Escalate anything beyond your remit to {{agent.firstName}} (and onward per the escalation protocol).
 
 _Generated from the ${profile.function} × ${profile.altitude} capability pack — enrich this mandate with company-specific context at init._
 `;
+  // `model` normalises through the registry's alias map so a generated agent and
+  // a shipped one are byte-comparable — the packs say `sonnet`, the shipped files
+  // say `claude-sonnet-4-6`, and that drift is exactly what MODEL_ALIASES closes.
+  const frontmatter = {
+    name: a.id,
+    description: oneLine(`${a.role} — ${a.mandate}`),
+    model: normaliseModel(a.model || "sonnet") || "claude-sonnet-4-6",
+    tools: toolsForAgent(a),
+    // Derived from the body, never hand-listed: validateAgentMd errors if the
+    // body uses a token the list omits, so the two must be generated together.
+    tokens: bodyTokens(body),
+  };
+  return `---\n${stringifyFrontmatter(frontmatter)}---\n\n${body}`;
 }
 
 function renderSkillMd(s, identity) {
@@ -117,7 +224,7 @@ async function main() {
 
   // 1. role sub-agent definitions (standard defaults already ship in ~/maestro/agents/)
   for (const a of surface.roleAgents) {
-    write(join("agents", a.id, "agent.md"), renderAgentMd(a, identity, profile));
+    write(join("agents", a.id, "agent.md"), renderAgentMd(a, profile));
   }
 
   // 2. skills + manifest
@@ -157,6 +264,8 @@ async function main() {
   return 0;
 }
 
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
 main()
   .then((c) => process.exit(c))
   .catch((e) => { console.error(`[generate-capability] FAILED: ${e && e.message ? e.message : e}`); process.exit(1); });
+}

package/scripts/setup/generate-capability.test.mjs

@@ -0,0 +1,134 @@
+/**
+ * Tests for generate-capability.mjs — the sub-agent definition renderer.
+ *
+ * These exist because the module had NO tests and could not have had any: it
+ * called main() at module scope, so importing it regenerated the entire
+ * capability surface across the repo. The direct-invocation guard that made this
+ * file possible is itself part of the fix.
+ *
+ * Run: node --test scripts/setup/generate-capability.test.mjs
+ * @module scripts/setup/generate-capability.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  TOOLS_BY_TIER,
+  renderAgentMd,
+  toolsForAgent,
+} from "./generate-capability.mjs";
+import { checkAgentFile, parseAgentMd } from "../../lib/subagents/schema.mjs";
+
+const PROFILE = { function: "executive-operator", altitude: "c-suite" };
+const AGENT = {
+  id: "chief-of-staff",
+  role: "Chief of Staff",
+  mandate: "Run the principal's office so nothing is dropped.",
+  model: "opus",
+  tier: "lead",
+  towers: ["executive-office"],
+  team: "executive-office",
+};
+
+describe("toolsForAgent", () => {
+  it("grants by tier, least privilege at support", () => {
+    assert.deepEqual(toolsForAgent({ tier: "support" }), [
+      ...TOOLS_BY_TIER.support,
+    ]);
+    assert.ok(!toolsForAgent({ tier: "support" }).includes("Bash"));
+    assert.ok(toolsForAgent({ tier: "core" }).includes("Bash"));
+    assert.ok(toolsForAgent({ tier: "lead" }).includes("WebFetch"));
+  });
+
+  it("never grants Task at any tier (delegation must stay observable)", () => {
+    for (const tier of Object.keys(TOOLS_BY_TIER)) {
+      assert.ok(
+        !toolsForAgent({ tier }).includes("Task"),
+        `${tier} must not carry Task`,
+      );
+    }
+  });
+
+  it("falls back to core for an unknown or missing tier", () => {
+    assert.deepEqual(toolsForAgent({}), [...TOOLS_BY_TIER.core]);
+    assert.deepEqual(toolsForAgent({ tier: "nonsense" }), [
+      ...TOOLS_BY_TIER.core,
+    ]);
+  });
+
+  it("lets a pack override the tier policy explicitly", () => {
+    assert.deepEqual(toolsForAgent({ tier: "support", tools: ["Read"] }), [
+      "Read",
+    ]);
+  });
+
+  it("returns a fresh array so a caller cannot mutate the policy", () => {
+    const got = toolsForAgent({ tier: "core" });
+    got.push("Task");
+    assert.ok(!TOOLS_BY_TIER.core.includes("Task"));
+  });
+});
+
+describe("renderAgentMd", () => {
+  it("produces a definition the registry validator accepts", () => {
+    const res = checkAgentFile(renderAgentMd(AGENT, PROFILE), AGENT.id);
+    assert.equal(res.ok, true, res.errors.join("; "));
+  });
+
+  it("emits tools — the key whose absence broke 57 of 70 agents", () => {
+    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
+    assert.ok(Array.isArray(frontmatter.tools));
+    assert.ok(frontmatter.tools.length > 0);
+  });
+
+  it("normalises the model alias to the full id the runtime dispatches on", () => {
+    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
+    assert.equal(frontmatter.model, "claude-opus-4-8");
+  });
+
+  it("leaves identity as {{agent.*}} tokens rather than baking it in", () => {
+    // The regression this guards: generating before config/agent.json was
+    // populated baked the empty values in permanently, shipping 57 agents that
+    // said "sub-agent for ( at UNCONFIGURED)".
+    const text = renderAgentMd(AGENT, PROFILE);
+    assert.match(text, /\{\{agent\.fullName\}\}/);
+    assert.match(text, /\{\{agent\.firstName\}\}/);
+    assert.doesNotMatch(text, /UNCONFIGURED/);
+  });
+
+  it("declares exactly the tokens the body uses", () => {
+    const { frontmatter } = parseAgentMd(renderAgentMd(AGENT, PROFILE));
+    assert.deepEqual(frontmatter.tokens, [
+      "agent.company",
+      "agent.firstName",
+      "agent.fullName",
+      "agent.title",
+    ]);
+  });
+
+  it("keeps description on one line even when the mandate would break the grammar", () => {
+    const nasty = {
+      ...AGENT,
+      mandate: "Own the thing.\nAlso: the # other thing.",
+    };
+    const res = checkAgentFile(renderAgentMd(nasty, PROFILE), nasty.id);
+    assert.equal(res.ok, true, res.errors.join("; "));
+    const { frontmatter } = parseAgentMd(renderAgentMd(nasty, PROFILE));
+    assert.ok(!frontmatter.description.includes("\n"));
+  });
+
+  it("is deterministic — re-rendering yields identical bytes", () => {
+    // Non-determinism here would move hashFile() on every regeneration and make
+    // the registry's local-edit detection permanently wrong.
+    assert.equal(renderAgentMd(AGENT, PROFILE), renderAgentMd(AGENT, PROFILE));
+  });
+
+  it("handles an agent serving no towers", () => {
+    const res = checkAgentFile(
+      renderAgentMd({ ...AGENT, towers: [] }, PROFILE),
+      AGENT.id,
+    );
+    assert.equal(res.ok, true, res.errors.join("; "));
+  });
+});

package/scripts/setup/generate-plan.mjs

@@ -65,12 +65,17 @@ async function main() {
       mandate: record.body || {}, mandateVersion: record.version || 0,
       manifest: inputs.manifest || { entries: [] }, profile: inputs.profile, orgContext: inputs.orgContext,
       standardCadences: inputs.standardCadences, archetypeCadences: inputs.archetypeCadences,
+      log: (level, msg) => (level === "error" ? console.error : console.warn)(`[generate-plan] ${msg}`),
     });
     for (const ob of plan.obligations) {
       const when = ob.schedule ? (ob.schedule.interval != null ? `every ${ob.schedule.interval}s` : JSON.stringify(ob.schedule.calendar)) : (ob.trigger ? `on ${ob.trigger.topic}.${ob.trigger.kind || "*"}` : "-");
-      console.log(`  ${ob.kind.padEnd(9)} ${ob.key.padEnd(40)} ${String(when).padEnd(34)} uses=[${(ob.uses || []).join(",")}]`);
+      // `budget=—` is a real reading, not a blank: it means hq published no
+      // funding for this obligation. It used to read `500` on every single line.
+      const budget = Number.isFinite(ob.budget_cents_per_period) ? `${ob.budget_cents_per_period}c` : "—";
+      console.log(`  ${ob.kind.padEnd(9)} ${ob.key.padEnd(40)} ${String(when).padEnd(34)} budget=${budget.padEnd(8)} uses=[${(ob.uses || []).join(",")}]`);
     }
     console.log(`[generate-plan] ${plan.counts.total} obligations · obligationsHash ${plan.obligationsHash.slice(0, 16)} (dry run — nothing written)`);
+    console.log(`[generate-plan] budget: ${plan.contract.unmetered ? "UNMETERED (hq published no funding)" : `metered, contract v${plan.contract.version}`}`);
     return 0;
   }