@coreplane/switchboard 1.254.1 → 1.255.0

package/dist/assets/.dockerignore

@@ -16,6 +16,9 @@ deploy
 # Which variables are credentials: src/secrets.ts reads the manifest at startup
 # (src/core/secretsManifest.test.ts holds this line and the Dockerfile's COPY in place).
 !deploy/secrets.manifest.json
+# The agent-trailer hook: the root Dockerfile COPYs it to /opt/switchboard/hooks
+# (src/execution/prepareCommitMsgHook.test.ts holds this line in place).
+!deploy/hooks/prepare-commit-msg
 docs
 !docs/package.json
 README.md

package/dist/assets/Dockerfile

@@ -125,11 +125,22 @@ COPY skills ./skills
 RUN mkdir -p /app/data /app/workspaces && chown -R switchboard:switchboard /app
 USER switchboard
 
+# The shared agent-trailer hook (deploy/hooks/prepare-commit-msg): every
+# commit made in this image gains the bot pair's Co-Authored-By trailer.
+COPY --chmod=755 deploy/hooks/prepare-commit-msg /opt/switchboard/hooks/prepare-commit-msg
+
 # gh auth: set GH_TOKEN (fine-grained PAT for a machine account); gh and git
 # (via gh's credential helper, configured below) pick it up automatically.
+# The fallback user.email stays OFF the GitHub domain (a noreply-shaped
+# address would render as a GitHub account it is not); the real pairs ride
+# the per-exec environment. The global core.hooksPath replaces repo-local
+# .git/hooks entirely — deliberate: an untrusted checkout's own hooks never
+# run here (a repo-local core.hooksPath still wins) —
+# docs/reference/specs/execution.md item 5.
 RUN git config --global credential.helper '!gh auth git-credential' \
   && git config --global user.name "switchboard-bot" \
-  && git config --global user.email "switchboard-bot@users.noreply.github.com"
+  && git config --global user.email "switchboard-bot@switchboard.invalid" \
+  && git config --global core.hooksPath /opt/switchboard/hooks
 
 ENV NODE_ENV=production
 # PORT enables the /healthz-style probe endpoint (any path returns 200).

package/dist/assets/config/config.example.yaml

@@ -515,10 +515,15 @@ workspaceDir: ./workspaces
 # object, which logs its decider's decision beside it — nothing runs from the
 # decider; `on` — a later release's flip (the decider's answer is what runs).
 # `reaskMinutes` (default 2) is the plane's one re-ask cadence, used only while
-# something waits on a reporter that fell silent; nothing reads it yet.
+# something waits on a reporter that fell silent — a queued run waiting on a
+# resident that has said nothing within the cadence gets one probe per cadence.
+# `coldFallback` (default false) flips write presets back to falling cold under
+# a resident condition instead of queueing at the resident stage — the rollback
+# lever for the resident conditions.
 # plane:
 #   admission: shadow
 #   reaskMinutes: 2
+#   coldFallback: false
 
 # Linked threads (docs/decisions/0037-a-linked-thread-is-quoted-not-joined.md;
 # docs/reference/specs/routing-and-config.md item 22). Off by default. On, a

package/dist/assets/deploy/cloudflare/worker.ts

@@ -94,6 +94,8 @@ export interface Env {
   GITHUB_WEBHOOK_SECRET?: string; // check-run intake: signs POST /webhooks/github; absent, the intake answers 503 disabled
   CF_ANALYTICS_TOKEN?: string; // costs dash: Cloudflare API token, Account Analytics:Read only
   ANTHROPIC_ADMIN_KEY?: string; // costs dash (optional): Anthropic Admin API key for the LLM cost report
+  OPENROUTER_MANAGEMENT_KEY?: string; // costs dash (optional): OpenRouter management key for the openrouter biller's invoice tie-out
+  OPENAI_ADMIN_KEY?: string; // costs dash (optional): OpenAI admin key for the openai biller's invoice tie-out
   MEMORY_TOKEN?: string; // durable memory + friction ledger + schedule firings + MCP registry: bearer for the state Worker
   MCP_CREDENTIAL_KEY?: string; // MCP registry: the bot-only key that seals server credentials before they reach the McpDO
   MCP_ACCESS_CLIENT_ID?: string; // MCP servers behind Cloudflare Access: the service token's client id, named by a server's `headersEnv`
@@ -129,6 +131,8 @@ const FORWARDED_OPTIONAL = [
   "DASHBOARD_TOKEN",
   "CF_ANALYTICS_TOKEN",
   "ANTHROPIC_ADMIN_KEY",
+  "OPENROUTER_MANAGEMENT_KEY",
+  "OPENAI_ADMIN_KEY",
   "SWITCHBOARD_INGRESS_TOKENS",
   "BRAVE_SEARCH_API_KEY",
   "GITHUB_WEBHOOK_SECRET",
@@ -504,29 +508,41 @@ export default {
       const eventsId = parseInstanceEventPath(pathname);
       const statusId = eventsId === undefined ? parseInstanceStatusPath(pathname) : undefined;
       const res =
-        pathname === "/admin/restart"
-          ? await handleAdminRestart(forwarded, env)
-          : pathname === COORDINATOR_INSTANCES_PATH
-            ? await handleCoordinatorInstances(forwarded, env)
-            : eventsId !== undefined
-              ? await handleCoordinatorInstanceEvent(forwarded, env, eventsId)
-              : statusId !== undefined
-                ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
-                : pathname === COPY_PATH
-                  ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
-                    // token are this Worker's; the bot only asks, with its copy bearer.
-                    // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
-                    // with `new Request(inbound, …)`, which takes the body stream with it —
-                    // `inbound.text()` is empty afterwards and the route read "not JSON" live.
-                    await handleArtifactsCopy(forwarded, {
-                      bucket: env.ARTIFACTS,
-                      bucketName: env.ARTIFACTS_BUCKET_NAME,
-                      copyToken: env.ARTIFACTS_COPY_TOKEN,
-                      slackToken: env.SLACK_BOT_TOKEN,
-                      fetch: (input, init) => fetch(input, init),
-                      lengthPipe: (size) => new FixedLengthStream(size),
-                    })
-                  : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
+        pathname === "/plane/effects"
+          ? // The plane's effect push (record 0064, "Where it lives"): the state
+            // Worker POSTs committed effects over its service binding with the
+            // shared bearer; the shim checks it and forwards to the container,
+            // which executes or defers each effect. A refused bearer never
+            // reaches the container.
+            request.headers.get("authorization") === `Bearer ${env.MEMORY_TOKEN}` && env.MEMORY_TOKEN
+            ? withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded))
+            : new Response(JSON.stringify({ error: "unauthorized" }), {
+                status: 401,
+                headers: { "content-type": "application/json" },
+              })
+          : pathname === "/admin/restart"
+            ? await handleAdminRestart(forwarded, env)
+            : pathname === COORDINATOR_INSTANCES_PATH
+              ? await handleCoordinatorInstances(forwarded, env)
+              : eventsId !== undefined
+                ? await handleCoordinatorInstanceEvent(forwarded, env, eventsId)
+                : statusId !== undefined
+                  ? await handleCoordinatorInstanceStatus(forwarded, env, statusId)
+                  : pathname === COPY_PATH
+                    ? // The artifact copy (artifactsCopy.ts): the R2 binding and the Slack
+                      // token are this Worker's; the bot only asks, with its copy bearer.
+                      // `forwarded`, never `inbound`: `withTraceContext` rebuilt the request
+                      // with `new Request(inbound, …)`, which takes the body stream with it —
+                      // `inbound.text()` is empty afterwards and the route read "not JSON" live.
+                      await handleArtifactsCopy(forwarded, {
+                        bucket: env.ARTIFACTS,
+                        bucketName: env.ARTIFACTS_BUCKET_NAME,
+                        copyToken: env.ARTIFACTS_COPY_TOKEN,
+                        slackToken: env.SLACK_BOT_TOKEN,
+                        fetch: (input, init) => fetch(input, init),
+                        lengthPipe: (size) => new FixedLengthStream(size),
+                      })
+                    : withLength(await getContainer(env.SWITCHBOARD, INSTANCE).fetch(forwarded));
       root.end(res.status >= 500 ? "error" : "ok", { httpStatus: res.status });
       return res;
     } catch (err) {