@coreplane/switchboard 1.250.0 → 1.252.0

package/dist/assets/deploy/cloudflare-sandbox/runtime-supervisor.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// The cold sandbox's process supervisor, run by tini (PID 1): keeps the
+// container alive across a crash of the SDK's container server
+// (/container-server/sandbox). That server calls process.exit(1) on any
+// uncaught exception, and the base image runs it as tini's one child — so one
+// uncaught error ended the whole container: /workspace gone, a detached pi
+// with it, every later /exec a failure until the platform noticed. Started
+// here as a child instead, the server's exit is a restart a second later; the
+// disk, the detached processes and the Durable Object's view of a running
+// container all survive, and the next command starts a fresh process on the
+// new server (docs/reference/specs/execution.md item 21).
+//
+// A stop from the platform is SIGTERM, which tini forwards here: forwarded to
+// the server, and nothing starts again — a stop that lands during the pause
+// between two starts still ends here — and the server's own exit status
+// becomes this process's (the shell convention, 128 + the signal's number,
+// when a signal ended it). A terminal's INT is forwarded as TERM too: one
+// stop path, whatever the signal. A server that cannot stay up —
+// QUICK_EXIT_LIMIT exits in a row, each within QUICK_EXIT_SECS of starting —
+// ends the container with the last status instead of looping forever.
+//
+// Dependency-free Node ESM on the Node the image ships; `supervise` takes its
+// process factory, clock, sleep and signal source as arguments, so
+// src/deploy/sandboxRuntimeSupervisor.test.ts drives it with a fake child and
+// a fake clock — no real process anywhere in the tests.
+import { spawn as nodeSpawn } from "node:child_process";
+import { constants } from "node:os";
+import { pathToFileURL } from "node:url";
+import { setTimeout as sleepFor } from "node:timers/promises";
+
+/** The SDK's container server, unless SANDBOX_RUNTIME names another. */
+export const DEFAULT_RUNTIME = "/container-server/sandbox";
+/** An exit within this many seconds of starting counts as a quick exit. */
+export const QUICK_EXIT_SECS = 10;
+/** This many quick exits in a row end the supervisor with the last status. */
+export const QUICK_EXIT_LIMIT = 5;
+/** The pause between an exit and the next start. */
+export const RESTART_PAUSE_MS = 1_000;
+
+/** One child's end as a shell would report it: its own exit code; 128 plus
+ *  the signal's number when a signal ended it; 127 when it never started. */
+export function endCode(code, signal) {
+  if (typeof code === "number") return code;
+  if (signal) return 128 + (constants.signals[signal] ?? 0);
+  return 127;
+}
+
+/**
+ * Start the runtime and start it again whenever it exits, until a stop signal
+ * or the quick-exit limit ends the loop; resolves with the exit status the
+ * whole process should carry. Every effect is an injected dependency:
+ * `spawn(runtime, args)` returns the child (a `kill(signal)` method and
+ * `exit`/`error` events are all it needs), `now()` is the clock in
+ * milliseconds, `sleep(ms)` the pause, `log(line)` the stderr line, and
+ * `signals` the emitter whose SIGTERM/SIGINT mean stop.
+ */
+export async function supervise({ runtime, args, spawn, now, sleep, log, signals }) {
+  let child;
+  let stopping = false;
+  let quick = 0;
+  let code;
+  const stop = () => {
+    stopping = true;
+    // Always TERM, whichever signal the stop arrived as: the server has one
+    // shutdown path and a terminal's INT should take it too.
+    if (child) child.kill("SIGTERM");
+  };
+  signals.on("SIGTERM", stop);
+  signals.on("SIGINT", stop);
+  try {
+    for (;;) {
+      const started = now();
+      child = spawn(runtime, args);
+      const ended = new Promise((resolve) => {
+        child.once("exit", (c, s) => resolve(endCode(c, s)));
+        // A runtime that cannot start (the path is wrong) never emits `exit`;
+        // 127 is what a shell would say, and the quick-exit limit ends the loop.
+        child.once("error", () => resolve(endCode(null, null)));
+      });
+      // A stop that landed before this start found no child to forward to;
+      // the one it missed gets it here.
+      if (stopping) child.kill("SIGTERM");
+      code = await ended;
+      child = undefined;
+      if (stopping) return code;
+      quick = now() - started < QUICK_EXIT_SECS * 1000 ? quick + 1 : 0;
+      if (quick >= QUICK_EXIT_LIMIT) {
+        log(
+          `sandbox-runtime-supervisor: the runtime exited with status ${code}, ` +
+            `${quick} times in a row within ${QUICK_EXIT_SECS}s of starting; giving up`,
+        );
+        return code;
+      }
+      log(`sandbox-runtime-supervisor: the runtime exited with status ${code}; starting it again`);
+      await sleep(RESTART_PAUSE_MS);
+      // A stop that landed during the pause: the last status is the answer,
+      // and nothing starts again.
+      if (stopping) return code;
+    }
+  } finally {
+    signals.removeListener("SIGTERM", stop);
+    signals.removeListener("SIGINT", stop);
+  }
+}
+
+// Run only when executed directly (tini runs this file), not when imported by
+// the tests.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const code = await supervise({
+    runtime: process.env.SANDBOX_RUNTIME || DEFAULT_RUNTIME,
+    args: process.argv.slice(2),
+    spawn: (runtime, args) => nodeSpawn(runtime, args, { stdio: "inherit" }),
+    now: () => Date.now(),
+    sleep: sleepFor,
+    log: (line) => process.stderr.write(line + "\n"),
+    signals: process,
+  });
+  process.exit(code);
+}

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.250.0",
+  "version": "1.252.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.250.0",
+      "version": "1.252.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.250.0",
+      "version": "1.252.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.250.0",
+  "version": "1.252.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",
@@ -39,7 +39,7 @@
     "cli": "tsx src/cli.ts",
     "verify": "npm run verify:root && npm run verify --workspaces --if-present && npm run check:site",
     "verify:root": "npm run check:consistency && npm run typecheck && npm run lint && npm run format:check && npm test && npm run check:dist",
-    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run check:registry-drift && npm run agents:check && npm run clock:check && npm run screenshots:check",
+    "check:consistency": "npm run check:lockfile && npm run check:sandbox-pair && npm run skills:check && npm run check:deps-drift && npm run licenses:check && npm run docs:check && npm run pr-title:check && npm run specs:check && npm run decisions:check && npm run hygiene:check && npm run check:project-facts && npm run check:registry-drift && npm run agents:check && npm run clock:check && npm run screenshots:check",
     "ci:gate": "node scripts/ci-gate.mjs",
     "fix": "npm run docs:gen && npm run pr-title:gen && npm run agents:gen && npm run clock:gen && npm run hygiene:gen && npm run deploy:gen && npm run skills:sync && npm run lint:fix && npm run format",
     "deploy:gen": "npm run --silent cli -- deploy init",
@@ -65,6 +65,7 @@
     "skills:sync": "tsx scripts/skills-sync.ts",
     "skills:check": "tsx scripts/skills-sync.ts --check",
     "licenses:check": "node scripts/licenses-check.mjs",
+    "check:deps-drift": "node scripts/deps-drift-check.mjs",
     "docs:gen": "tsx scripts/docs-gen.ts",
     "docs:check": "tsx scripts/docs-gen.ts --check",
     "specs:check": "node scripts/specs-check.mjs",

package/dist/assets/project.json

@@ -33,7 +33,7 @@
     "$comment": "What each root npm script does and when to run it — the source of the Commands table in AGENTS.md (npm run agents:gen). A script without an entry fails agents:check, so a new script cannot ship undocumented.",
     "verify": {
       "does": "The whole gate: every root check, every workspace's verify, the site check — exactly what CI runs.",
-      "when": "Before requesting review. ~4 min."
+      "when": "Local sessions, before requesting review. ~4 min. A pipeline agent leaves it to CI."
     },
     "verify:root": {
       "does": "The bot package's gate: consistency checks, typecheck, lint, format, tests, dist.",
@@ -45,11 +45,11 @@
     },
     "test": {
       "does": "The whole vitest suite (bot, web, the plain-Node Worker tests) from one entry, after `deploy:gen`.",
-      "when": "Before pushing."
+      "when": "Local sessions, before pushing; a pipeline agent runs the changed set — the full suite is CI's."
     },
     "typecheck": {
       "does": "TypeScript over the bot and its scripts, no emit.",
-      "when": "After type-level changes; `verify:root` runs it."
+      "when": "After type-level changes; `verify:root` runs it. A pipeline agent scopes it to the touched tsconfig."
     },
     "lint": {
       "does": "ESLint over the whole tree.",
@@ -100,7 +100,7 @@
       "when": "After bumping either half of a pair."
     },
     "check:pr-title": {
-      "does": "Judges one PR title as the changelog line: grammar, type, scope, the `!` migration note.",
+      "does": "Judges one PR title as the changelog line: grammar, type, scope, `!`.",
       "when": "`-- \"feat(scope): …\"` before opening a PR; CI's `title` check."
     },
     "pr-title:gen": {
@@ -143,6 +143,10 @@
       "does": "Every production dependency's license is on the allowlist.",
       "when": "After adding a dependency."
     },
+    "check:deps-drift": {
+      "does": "Installed node_modules match the lockfile: drift fails by name.",
+      "when": "Part of `check:consistency`."
+    },
     "docs:gen": {
       "does": "Writes the generated regions of the reference docs from the command registry.",
       "when": "After changing a command, flag, route, or config key; part of `fix`."
@@ -160,12 +164,12 @@
       "when": "`-- --changed origin/main...HEAD [--test-guard]` before review; `-- --require` fails on an uncovered path; `-- --json` for machines."
     },
     "decisions:check": {
-      "does": "Every record under `docs/decisions/` and `docs/plans/` has a valid `status`, a superseded one names its successor, and an accepted body changes only by an appended `## Amended` re-evaluation.",
+      "does": "Every record under `docs/decisions/` and `docs/plans/` has a valid `status`, a superseded one names its successor, an accepted body only gains an appended `## Amended`.",
       "when": "Part of `check:consistency`; a failing record is superseded or amended by appending, never edited."
     },
     "hygiene:check": {
       "does": "The public tree's imprint (company, people, trackers, plan ids, ids, dates) equals the recorded list, which only shrinks.",
-      "when": "Part of `check:consistency`. New hit: rewrite the line or allow it by name in `scripts/public-hygiene.allow`; `-- --list <prefix>` shows the rest."
+      "when": "Part of `check:consistency`. New hit: rewrite the line or allow it in `scripts/public-hygiene.allow`."
     },
     "hygiene:gen": {
       "does": "Records the tree's remaining imprint after a scrub; refuses growth unless `-- --force`.",
@@ -180,7 +184,7 @@
       "when": "Part of `check:consistency`."
     },
     "clock:gen": {
-      "does": "Regenerates both clock allowlists from the tree: wall-clock reads (empty) and duration literals outside `src/core/budgets.ts`.",
+      "does": "Regenerates both clock allowlists: wall-clock reads (empty) and duration literals outside `src/core/budgets.ts`.",
       "when": "Part of `fix`."
     },
     "clock:check": {
@@ -217,14 +221,14 @@
     },
     "screenshots:gen": {
       "does": "Renders the dashboard screenshots whose inputs changed, both themes, recording each surface's input hashes in `docs/public/screenshots/manifest/` (`--force`: all).",
-      "when": "After a `web/` or fixture change, once `screenshots:check` names it; needs `npx playwright-core install chromium`, so it is not part of `fix`."
+      "when": "After a `web/` or fixture change, once `screenshots:check` names it; needs `npx playwright-core install chromium`, so not in `fix`."
     },
     "screenshots:check": {
       "does": "Each surface's inputs still hash to what its screenshots were rendered from — no browser.",
       "when": "Part of `check:consistency`."
     },
     "load": {
-      "does": "Load harness: `-- history|resident|sandbox|e2e|cards|provider|pi|route|door`.",
+      "does": "Load harness: `-- history|resident|sandbox|e2e|cards|provider|pi|route|intake|door`.",
       "when": "Capacity receipts (docs/reference/specs/load-harness.md)."
     }
   }

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.250.0",
-  "commit": "4ac4b778bce59eddec48e214def56ad7aa7c62d2",
-  "builtAt": "2026-09-18T19:28:39.901Z"
+  "version": "1.252.0",
+  "commit": "0c2a0a9cdd4afd1a0def0d43ed7a14928c32101e",
+  "builtAt": "2026-09-19T03:40:43.236Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -238,7 +238,7 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // project's most expensive checks first; the rule is the runner's to hold, not
 // a line every requester remembers to paste. Stack-agnostic on purpose — the
 // classes are by duration, the project's own scripts and CI say which is which.
-export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Only then run the expensive checks, once, and fix forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS} The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
+export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope and scoped to the changed set — the tests nearest your change, the touched project's typecheck, the changed files' formatting, never the whole tree: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. Every CI pipeline runs the tests, the types, the formatting and the full verification on your push, so you never run them again: you validate and fix your own change before pushing, at the changed-set scope. Passing the full test suite and the full typecheck is NOT part of your criteria: CI is that gate and the only place they run — on a shared machine they cost minutes that every other run pays for. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Beyond the changed set, use judgement about what this change needs rather than a checklist, fixing forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS} The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
@@ -256,7 +256,7 @@ Workflow for shipping a PR:
 3. Implement the change. Match the surrounding code's style and conventions.
 4. Prove the change with the cheapest checks that can (CHECKS BY COST below): the linter and the tests nearest the files you touched, the documentation checks for a documentation change.
 5. Commit with a clear message and push the branch — before any full suite, build or full verification.
-6. Then, if the budget allows, run the project's expensive checks once and fix forward with further commits and pushes.
+6. CI runs the full suite, the typecheck and the full verification on that push — you never run them yourself; read CI's result if it lands within your budget and fix forward with further commits and pushes.
 7. Call the submit_pr_description tool with the typed description object (content contract below) — every time, bringing forward the context you gained while implementing. Switchboard renders the PR body from your object at the pushed head and opens (or updates) the pull request itself: do NOT open a PR yourself, with \`gh\` or any API call.
 8. Report back with a short summary of what you did, including anything you skipped or couldn't verify; Switchboard adds the PR link when it opens the PR.
 
@@ -302,7 +302,7 @@ Workflow for shipping a change:
 2. Implement the change. Match the surrounding code's style and conventions.
 3. Prove the change with the cheapest checks that can (CHECKS BY COST below): the linter and the tests nearest the files you touched, the documentation checks for a documentation change (dependencies are already present).
 4. Commit with a clear message and push the branch with \`git push -u origin <branch>\` — before any full suite, build or full verification.
-5. Then, if the budget allows, run the project's expensive checks once and fix forward with further commits and pushes.
+5. CI runs the full suite, the typecheck and the full verification on that push — you never run them yourself; read CI's result if it lands within your budget and fix forward with further commits and pushes.
 6. Call the \`diff_digest\` tool to get a distilled summary of your change — per-file churn, totals, and risky-file flags. It is a distilled summary, not the raw diff: use it to shape the description you submit next — which files the Tour must walk, what belongs in risks.
 7. Call the submit_pr_description tool with the typed description object (content contract below) — every time. Switchboard renders the PR body from your object at the pushed head and opens (or updates) the pull request itself: do NOT open a PR yourself, with any API call.
 8. Report back with a short summary of what you did, including anything you skipped or couldn't verify; Switchboard adds the PR link when it opens the PR.
@@ -345,7 +345,7 @@ Workflow for shipping a change:
 2. Implement the change. Match the surrounding code's style and conventions.
 3. Prove the change with the cheapest checks that can (CHECKS BY COST below): the linter and the tests nearest the files you touched, the documentation checks for a documentation change (dependencies are already present).
 4. Commit with a clear message and push the branch with \`git push -u origin <branch>\` — before any full suite, build or full verification.
-5. Then, if the budget allows, run the project's expensive checks once and fix forward with further commits and pushes.
+5. CI runs the full suite, the typecheck and the full verification on that push — you never run them yourself; read CI's result if it lands within your budget and fix forward with further commits and pushes.
 6. Call the \`diff_digest\` tool to get a distilled summary of your change — per-file churn, totals, and risky-file flags. It is a distilled summary, not the raw diff: use it to shape the description you submit next — which files the Tour must walk, what belongs in risks.
 7. Call the submit_pr_description tool with the typed description object (content contract below) — every time. Switchboard renders the PR body from your object at the pushed head and opens (or updates) the pull request itself: do NOT open a PR yourself, with \`gh\` or any API call.
 8. Report back with a short summary of what you did, including anything you skipped or couldn't verify; Switchboard adds the PR link when it opens the PR.
@@ -544,7 +544,7 @@ Your tools work without a workspace: the GitHub tools — \`github_repos\` (the
 
 ${statusCardRule('"Read the issue and its thread", "Post the comment"')} A one-step answer needs no checklist; post one when the request has steps the person would wait on.
 
-You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web. Other Switchboard agents can, and a plain message reaches them by itself: for a code change or a pull request, say what you found and that the change is not yours to make, and that asking for it in plain words in a new message — "in acme/api: fix the failing login test" — starts the agent that makes the change, opens the PR and loops review; the same for a PR review ("review <PR URL>") and a web-research question ("compare X and Y on the web"). Never hand back a command or an \`agent:…\` line for the person to type: describe the ask in their words. Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
+You cannot run commands, clone repositories, edit code, or review pull requests, and you cannot search the web — and you cannot hand off, route, forward or start another run: never say you will hand off, route, forward or start anything, because you cannot start another agent's run. Other Switchboard agents can do those things, and a plain message reaches them by itself — but only a new top-level message in the channel reaches the router; a reply in this thread comes back to you. For a code change or a pull request, say what you found and that the change is not yours to make, and that asking for it in plain words in a new top-level message in the channel — not a reply in this thread — like "in acme/api: fix the failing login test" starts the agent that makes the change, opens the PR and loops review; the same for a PR review ("review <PR URL>") and a web-research question ("compare X and Y on the web"). Never hand back a command or an \`agent:…\` line for the person to type: describe the ask in their words. Delete an issue only when the user explicitly asked to delete it (closing is an update).`;
 
 // The explore agent (docs/reference/specs/agent-explore.md): a long, read-only
 // investigation — "run our CI locally and validate the claims", "how long does

package/dist/assets/src/core/authz/policy.ts

@@ -135,6 +135,10 @@ export const POLICY: readonly Rule[] = [
   // scope from anywhere, a private one only from inside it, `unknown` never.
   { action: "config:read", resource: "config-scope", resourceKind: "channel", when: [grant("config:write")] },
   { action: "config:read", resource: "config-scope", resourceKind: "channel", when: [MEMBER_OF] },
+  // A THREAD's scope (`config set thread`, routing-and-config item 27): the
+  // channel-config right — whoever may set the channel may set a thread in it;
+  // never a baseline, so membership alone admits nobody.
+  { action: "config:write", resource: "config-scope", resourceKind: "thread", when: [grant("config:write")] },
   // A user edits only their own scope.
   { action: "config:write", resource: "config-scope", resourceKind: "user", when: [IS_SELF] },
 

package/dist/assets/src/core/authz/resource.ts

@@ -31,14 +31,14 @@ export type AttributeName = Exclude<keyof ResourceAttributes, "visibility">;
 /** The kinds each kinded resource type takes. Types absent here are not kinded. */
 export const RESOURCE_KINDS: { readonly [T in ResourceType]?: readonly KindOf<T>[] } = {
   "memory-scope": ["org", "user", "repo", "channel"],
-  "config-scope": ["channel", "user", "org"],
+  "config-scope": ["channel", "user", "thread", "org"],
 };
 
 /** A resource type, or `type/kind` for the kinded ones — the unit a rule row targets. */
 export type Target =
   | Exclude<ResourceType, "memory-scope" | "config-scope">
   | `memory-scope/${"org" | "user" | "repo" | "channel"}`
-  | `config-scope/${"channel" | "user" | "org"}`;
+  | `config-scope/${"channel" | "user" | "thread" | "org"}`;
 
 export const TARGET_ATTRIBUTES: Readonly<Record<Target, readonly AttributeName[]>> = {
   run: ["channelId", "userId", "repo"],
@@ -50,6 +50,9 @@ export const TARGET_ATTRIBUTES: Readonly<Record<Target, readonly AttributeName[]
   repo: ["repo"],
   "config-scope/channel": ["channelId"],
   "config-scope/user": ["userId"],
+  // A thread key carries no attribute a condition reads: the one row on it is
+  // a bare grant check (the channel-config right, `config set thread`).
+  "config-scope/thread": [],
   "config-scope/org": [],
   agent: ["name"],
   command: [],
@@ -136,6 +139,7 @@ export function attributesOf(resource: Resource): ResourceAttributes {
           return { channelId: resource.id, visibility: "unknown", channelVisibility: resource.visibility ?? "unknown" };
         case "user":
           return { userId: resource.id, visibility: "unknown" };
+        case "thread":
         case "org":
           return { visibility: "unknown" };
       }

package/dist/assets/src/core/authz/types.ts

@@ -114,6 +114,8 @@ export type Resource =
       readonly visibility?: ChannelVisibility;
     }
   | { readonly type: "config-scope"; readonly kind: "user"; readonly id: string }
+  /** A thread's runtime scope (`config set thread`, routing-and-config item 27); `id` is the thread key. */
+  | { readonly type: "config-scope"; readonly kind: "thread"; readonly id: string }
   | { readonly type: "config-scope"; readonly kind: "org" }
   | { readonly type: "agent"; readonly name: string }
   /** List-shaped actions with no single resource (`runs.list`, `friction.report`). */

package/dist/assets/src/core/budgets.ts

@@ -28,6 +28,10 @@ export const minutesToMs = (minutes: number): number => minutes * MINUTE_MS;
  *  as a literal where it is used. */
 export const DAY_MS = 24 * 60 * MINUTE_MS;
 
+/** One calendar week in milliseconds: the bucket the live false-silence ratio
+ *  is printed per (docs/reference/specs/load-harness.md item 20). */
+export const WEEK_MS = 7 * DAY_MS;
+
 /** How long the confirmation a routed write is offered as stays pending
  *  (docs/decisions/0044; docs/reference/specs/routing-and-config.md item 25):
  *  the connect ticket's ten minutes. The bot passes it to the config object,
@@ -98,6 +102,13 @@ export function intakeReceiptRetentionMs(catchUpWindowMs: number): number {
   return Math.max(DAY_MS, window + minutesToMs(DRAIN.maxMinutes));
 }
 
+/** The live false-silence join's recovery window (docs/reference/specs/load-harness.md
+ *  item 20; docs/decisions/0058): a `silent` intake receipt counts as a false
+ *  silence when the same person mentions the bot in the same thread within
+ *  this window — the mention is the ignored person's recovery move, so a
+ *  prompt one bounds the ratio the gate is judged by. */
+export const INTAKE_RECOVERY_WINDOW_MS = 10 * MINUTE_MS;
+
 /** The presets that run the tool loop, and the one pipeline preset. */
 export const LOOP_PRESETS = ["general", "coding", "review", "research", "explore", "conductor"] as const;
 export type LoopPreset = (typeof LOOP_PRESETS)[number];
@@ -153,6 +164,12 @@ export const FLOORS: Readonly<Record<RoundKind, number>> = {
  *  when the remainder allows it. */
 export const MERGE_WAIT_ASK_MINUTES = 60;
 
+/** A hosted ship parent's deadline margin past the pipeline's wall clock
+ *  (record 0060): the row's `state.hosting.until` is the hand-off time plus
+ *  the instance's `caps.maxMinutes` plus this hour, absorbing the runner's own
+ *  scheduling slack before a reclaim closes the row `interrupted`. */
+export const HOSTED_DEADLINE_MARGIN_MINUTES = 60;
+
 /** The ship runner's waits, in minutes: the margin a child's wait allows past
  *  its budget, the slice a wait is asked in, the merge door's re-ask cadence,
  *  and the pause before a busy spawn is asked again. */
@@ -164,6 +181,11 @@ export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes:
  *  `commandWriteUp` is what the last command leaves for that answer; `execCall`
  *  is the exec client's wait past a command's own budget; `bearerGrace` is how
  *  far past the lease the model bearer stays valid for the last call's tail. */
+/** The stall signal's window in minutes (docs/reference/specs/live-view.md
+ *  item 32): a run's pace is counted over the last this-many minutes, and a
+ *  run with no tool call for a whole window reads as stalled. */
+export const PACE_WINDOW_MINUTES = 5;
+
 export const ALLOWANCES = {
   provision: 3,
   writeUp: 3,

package/dist/assets/src/core/coordinator/contract.ts

@@ -9,6 +9,7 @@
 // routes decide on.
 //
 import type { Grant, GrantSource } from "../budgets.js";
+import { isVerbosity, type Verbosity } from "../verbosity.js";
 import { isAddressSeverity, type AddressSeverity, type AddressSeveritySource } from "../ship/coordinator.js";
 
 // A coordinator is a Workflow instance in the shim Worker whose children are
@@ -81,6 +82,22 @@ export function runFinishedEventType(runId: string): string {
   return `${RUN_FINISHED_EVENT_PREFIX}${runId}`;
 }
 
+/** The deploy-roll signals a child's reattach path sends its parent
+ *  (run-history item 47a): `child-interrupted-<runId>` — the child closed
+ *  `interrupted` for a restart from its request, so the wait settles at once
+ *  beside `run-finished-<runId>` and the round ends with the child's own
+ *  reason; `child-resumed-<runId>` — the same run carries on after a roll, so
+ *  the wait keeps waiting. Same alphabet as the finish event; the parent
+ *  confirms either by `read-record` before it acts. */
+export const CHILD_INTERRUPTED_EVENT_PREFIX = "child-interrupted-";
+export function childInterruptedEventType(runId: string): string {
+  return `${CHILD_INTERRUPTED_EVENT_PREFIX}${runId}`;
+}
+export const CHILD_RESUMED_EVENT_PREFIX = "child-resumed-";
+export function childResumedEventType(runId: string): string {
+  return `${CHILD_RESUMED_EVENT_PREFIX}${runId}`;
+}
+
 /** A message into a thread an unfinished unit owns (record 0051's reply-as-event rule): one row
  *  of the unit's event list, appended by the dispatcher, folded into the
  *  unit's next coding spawn — or run as one fresh turn at the unit's end.
@@ -307,6 +324,11 @@ export interface CoordinatorInstance {
    *  decision reads it. */
   grant?: Grant;
   grantSource?: GrantSource;
+  /** The request's verbosity (routing-and-config item 28), resolved once by
+   *  the ship fork and written here beside `merge`: what the runner says in
+   *  the unit threads it owns — the unit-ending report's asides and the
+   *  segment lines are `verbose` material. Absent reads as `quiet`. */
+  verbosity?: Verbosity;
   /** The pipeline's caps as the profile gate clipped them: the rounds cap and the wall clock per unit. */
   caps?: { maxRounds: number; maxMinutes: number };
   /** The status card in the requesting thread, when the channel has one — what
@@ -429,6 +451,7 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
     return false;
   if (r.card !== undefined && !(isObject(r.card) && isText(r.card.channel) && isText(r.card.ts))) return false;
   if (!isOptionalText(r.runId) || !isOptionalText(r.label)) return false;
+  if (r.verbosity !== undefined && !isVerbosity(r.verbosity)) return false;
   if (r.attempt !== undefined && !(Number.isInteger(r.attempt) && (r.attempt as number) >= 2)) return false;
   return true;
 }
@@ -527,6 +550,25 @@ export async function sendChecksSettled(
   }
 }
 
+/** One deploy-roll signal to the child's parent (run-history item 47a): best
+ *  effort like `sendRunFinished` — a refusal is answered, never thrown; a lost
+ *  send costs the wait a chunk, never the round. */
+export async function sendChildSignal(
+  workflow: WorkflowSender | undefined,
+  signal: { runId: string; parentInstanceId: string; kind: "interrupted" | "resumed"; reason: string; at: number },
+): Promise<RunFinishedSend> {
+  const { runId, parentInstanceId: instance, kind, reason, at } = signal;
+  if (!workflow) return { kind: "no-binding", instance };
+  const type = kind === "interrupted" ? childInterruptedEventType(runId) : childResumedEventType(runId);
+  try {
+    const handle = await workflow.get(instance);
+    await handle.sendEvent({ type, payload: { runId, kind, reason, at, parentInstanceId: instance } });
+    return { kind: "sent", instance, type };
+  } catch (err) {
+    return { kind: "failed", instance, type, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /** The one send per committed terminal record (run-history item 47). */
 export async function sendRunFinished(
   workflow: WorkflowSender | undefined,