@evomap/evolver 1.89.20 → 2.0.0-beta.0

package/src/adapters/scripts/evolver-task-recall.js

@@ -1,173 +0,0 @@
-#!/usr/bin/env node
-// evolver-task-recall.js
-// UserPromptSubmit hook: on each user prompt, find GEP assets (Hub genes +
-// local genes) that match the task and inject a distilled hint so a GENERAL
-// agent benefits from prior distilled capabilities without manually calling
-// MCP tools. This is the per-harness shell around src/gep/recallInject.js.
-//
-// Input  (stdin JSON, Claude Code UserPromptSubmit):
-//   { "prompt": "...", "session_id", "cwd", "transcript_path", ... }
-// Output (stdout JSON, exit 0 ALWAYS):
-//   enforce + match -> { agent_message, additionalContext,
-//                        hookSpecificOutput: { hookEventName, additionalContext } }
-//   everything else -> {}   (injects nothing)
-//
-// DESIGN CONTRACT (the fail-open core — see also recallInject.js invariants):
-//   - DEFAULT off. off finishes {} WITHOUT parsing the prompt body.
-//   - shadow computes + logs what WOULD inject but injects nothing.
-//   - enforce injects the distilled hint.
-//   - FAIL-OPEN: any error/timeout/empty -> exactly one finish({}). The hook
-//     blocks the user's prompt, so it must NEVER hang or crash the session.
-//     Claude Code's timeout fail-open behaviour is UNDOCUMENTED, so we own the
-//     deadline ourselves with a single watchdog + latch (never rely on the
-//     host to kill us gracefully).
-//   - STDOUT is a single JSON object. Any stray console.log() from a
-//     transitively-required module (e.g. signals._mergeSignals, hubSearch
-//     fetch-cost log, assetStore seeding) would corrupt it — so we redirect
-//     console.* to stderr before requiring anything heavy.
-
-'use strict';
-
-// --- stdout-poison defense: route all console.* to stderr ------------------
-// Modules we require (hubSearch, signals, assetStore, …) call console.log,
-// which writes to stdout. The hook contract is ONE JSON object on stdout, so
-// we redirect every console method to stderr. stderr on exit 0 is not fed to
-// the model for UserPromptSubmit; on non-2 exit only its first line shows in
-// the transcript as a hook-error notice — acceptable and we exit 0 anyway.
-for (const m of ['log', 'info', 'warn', 'error', 'debug']) {
-  try { console[m] = function () { try { process.stderr.write(''); } catch (_) {} }; } catch (_) {}
-}
-
-const path = require('path');
-
-// ---- Timing budget, coherent with the host kill ---------------------------
-// The host (Claude Code) kills this process at the hook's `timeout` (5s in
-// buildClaudeHooks -> 5000ms). Our OWN absolute watchdog MUST fire comfortably
-// BEFORE that, or the host could kill us mid-write and break the fail-open
-// stdout contract. So:
-//   ABSOLUTE_DEADLINE_MS (3300) < host 5000ms  -> ~1.7s headroom for finish().
-// EVOLVER_RECALL_TIMEOUT_MS is the Hub SEARCH budget only (clamped well under
-// the absolute deadline). The actual budget handed to the search is computed
-// DYNAMICALLY at search-start as (deadline - already-elapsed - safety), so
-// slow stdin/require can never let the search run past the watchdog (which
-// would otherwise spuriously return {} — Bugbot #183 medium findings).
-const T0 = Date.now();
-const ABSOLUTE_DEADLINE_MS = 3300;   // watchdog; strictly < host timeout (5000ms)
-const SEARCH_SAFETY_MS = 250;        // leave room for finish() after the search
-const MIN_SEARCH_MS = 300;           // below this, skip the search (finish {})
-
-function getSearchBudgetMs() {
-  const n = parseInt(process.env.EVOLVER_RECALL_TIMEOUT_MS, 10);
-  // Hard cap at 2800 so even a max-budget search starts and ends before the
-  // 3300ms watchdog under any realistic startup cost.
-  return Number.isFinite(n) && n >= 500 && n <= 2800 ? n : 2000;
-}
-
-function getMode() {
-  const v = String(process.env.EVOLVER_RECALL_MODE || '').toLowerCase().trim();
-  return v === 'shadow' || v === 'enforce' ? v : 'off';
-}
-
-let handled = false;
-let watchdog = null;
-
-// Single-writer latch: exactly one stdout write, exactly one exit. Mirrors the
-// proven pattern in evolver-signal-detect.js / evolver-session-end.js.
-function finish(obj) {
-  if (handled) return;
-  handled = true;
-  if (watchdog) { try { clearTimeout(watchdog); } catch (_) {} }
-  try { process.stdout.write(JSON.stringify(obj || {})); } catch (_) {}
-  process.exit(0);
-}
-
-function main() {
-  const mode = getMode();
-
-  // Absolute watchdog, armed at process entry and INDEPENDENT of the search
-  // budget. Fires at ABSOLUTE_DEADLINE_MS (3300ms) — strictly under the host's
-  // timeout (5000ms) so the host can never kill us mid-write. If stdin never
-  // closes OR anything hangs, we emit {} and exit cleanly first.
-  watchdog = setTimeout(() => finish({}), ABSOLUTE_DEADLINE_MS);
-
-  let buf = '';
-  try {
-    process.stdin.setEncoding('utf8');
-  } catch (_) { /* some hosts pass no stdin */ }
-  process.stdin.on('data', (c) => { buf += c; });
-  process.stdin.on('error', () => finish({}));
-  process.stdin.on('end', () => {
-    if (handled) return;
-
-    // off: do NOT even parse the prompt body (privacy: nothing read/sent).
-    if (mode === 'off') return finish({});
-
-    let prompt = '';
-    let sessionId = '';
-    try {
-      const input = buf.trim() ? JSON.parse(buf) : {};
-      prompt = String(input.prompt || '').trim();
-      sessionId = String(input.session_id || input.sessionId || '').trim();
-    } catch (_) {
-      return finish({});
-    }
-    if (prompt.length < 8) return finish({}); // trivial prompt -> skip
-
-    // Heavy require INSIDE try/catch: a broken require graph must fail open,
-    // not crash the user's prompt (this is also why the e2e test runs the
-    // copied hook with mode=off and asserts exit 0 + parseable stdout).
-    let core;
-    try {
-      const { findEvolverRoot } = require('./_runtimePaths');
-      const root = findEvolverRoot();
-      if (!root) return finish({});
-      core = require(path.join(root, 'src', 'gep', 'recallInject.js'));
-    } catch (_) {
-      return finish({});
-    }
-
-    // Pass the ABSOLUTE deadline (T0 + watchdog window) plus the configured
-    // search cap. The core bounds the Hub call by the time REMAINING to that
-    // deadline (minus its own post-await safety margin) and runs local-gene
-    // disk I/O BEFORE the Hub await — so neither the Hub search nor the
-    // post-processing can overrun the watchdog (Bugbot #183: slow startup or a
-    // budget-eating Hub call must not let the timer fire mid-work). If too
-    // little time remains even before starting, skip and fail open.
-    const elapsed = Date.now() - T0;
-    const remaining = ABSOLUTE_DEADLINE_MS - elapsed - SEARCH_SAFETY_MS;
-    if (remaining < MIN_SEARCH_MS) return finish({});
-    const deadlineMs = T0 + ABSOLUTE_DEADLINE_MS;
-
-    Promise.resolve()
-      .then(() => core.recallForTask({ prompt, mode, sessionId, timeoutMs: getSearchBudgetMs(), deadlineMs }))
-      .then((r) => {
-        if (r && r.inject && r.text) {
-          // Emit BOTH shapes:
-          //   - nested hookSpecificOutput.additionalContext is the DOCUMENTED
-          //     canonical UserPromptSubmit injection shape (system-reminder,
-          //     no transcript noise).
-          //   - flat additionalContext / agent_message match the in-repo
-          //     precedent (session-start.js) for hosts that read the flat key.
-          // Extra keys are tolerated/ignored by hosts; whichever wins, the
-          // other is harmless.
-          return finish({
-            agent_message: r.text,
-            additionalContext: r.text,
-            hookSpecificOutput: {
-              hookEventName: 'UserPromptSubmit',
-              additionalContext: r.text,
-            },
-          });
-        }
-        // shadow (logged inside the core) and no-match both inject nothing.
-        return finish({});
-      })
-      .catch(() => finish({}));
-  });
-}
-
-if (require.main === module) {
-  main();
-} else {
-  module.exports = { getMode, getSearchBudgetMs };
-}

package/src/atp/atpExecute.js

@@ -1,283 +0,0 @@
-// ATP end-to-end task completer.
-//
-// Invoked from the `atp-complete` subcommand (index.js). A spawned Cursor
-// sub-session answers an ATP task, writes the answer to disk, then runs:
-//
-//   node index.js atp-complete \
-//     --task-id=<tid> --order-id=<oid> --answer-file=<path> [--summary="..."]
-//
-// This module takes that answer and drives the full settlement path:
-//   1. Synthesize a minimal Gene + Capsule bundle wrapping the answer.
-//   2. POST /a2a/publish to register the Capsule asset on the Hub (signed).
-//   3. POST /a2a/task/complete to bind the resultAssetId to the claimed task.
-//   4. POST /a2a/atp/deliver to submit the proof_payload (asset_id + result).
-//
-// Autoverify (verifyMode=auto) on the Hub treats `payload.asset_id` and
-// `payload.result` as has_result=true with pass_rate=1.0, so a valid answer
-// immediately progresses the DeliveryProof from pending -> verified -> settled.
-//
-// Failures are returned as { ok:false, stage:..., error:... } so the caller can
-// retry per-stage without duplicating upstream effects (Gene/Capsule asset_ids
-// are deterministic content-hashes, so republish of the same bundle is
-// idempotent server-side).
-
-const fs = require('fs');
-const crypto = require('crypto');
-
-const { computeAssetId } = require('../gep/contentHash');
-const { hubFetch } = require('../gep/hubFetch');
-const {
-  getNodeId,
-  getHubUrl,
-  getHubNodeSecret,
-  buildHubHeaders,
-  buildNodeScopedHubHeaders,
-  sendHelloToHub,
-} = require('../gep/a2aProtocol');
-const { submitDelivery } = require('./hubClient');
-
-const MAX_ANSWER_CHARS = 32000; // cap capsule.content to protect Hub payload limits
-const PUBLISH_TIMEOUT_MS = 15000;
-
-function _readAnswer(answerFile) {
-  const raw = fs.readFileSync(answerFile, 'utf8');
-  const trimmed = String(raw || '').trim();
-  if (!trimmed) throw new Error('answer file is empty');
-  if (trimmed.length > MAX_ANSWER_CHARS) {
-    return trimmed.slice(0, MAX_ANSWER_CHARS - 40) + '\n...[TRUNCATED]...';
-  }
-  return trimmed;
-}
-
-function _buildGene(capabilities, signals) {
-  const caps = Array.isArray(capabilities) && capabilities.length > 0
-    ? capabilities.slice(0, 8)
-    : ['general'];
-  const sig = Array.isArray(signals) && signals.length > 0
-    ? signals.slice(0, 8)
-    : ['atp_task'];
-  const gene = {
-    type: 'Gene',
-    schema_version: '1.0.0',
-    id: 'gene_atp_answer_' + caps.sort().join('_').slice(0, 40),
-    summary: 'Deliver an ATP task answer for capabilities: ' + caps.join(', '),
-    signals_match: sig,
-    category: 'innovate',
-    strategy: [
-      'Read the buyer question carefully and identify the requested capability.',
-      'Produce a concrete, actionable answer addressing the question directly.',
-      'Return the answer as Capsule content for verifiable delivery.',
-    ],
-    // gep-sdk Gene schema requires `constraints`; an ATP answer edits no
-    // files, so the blast radius is empty rather than left unbounded.
-    constraints: { max_files: 0, forbidden_paths: [] },
-    validation: [
-      'Answer is non-empty and directly addresses the buyer question.',
-      'Answer references the requested capabilities where relevant.',
-    ],
-  };
-  gene.asset_id = computeAssetId(gene);
-  return gene;
-}
-
-function _buildCapsule({ gene, answer, summary, orderId, taskId, capabilities, signals }) {
-  const caps = Array.isArray(capabilities) ? capabilities.slice(0, 8) : [];
-  const sig = Array.isArray(signals) && signals.length > 0 ? signals.slice(0, 8) : ['atp_task'];
-  const confidence = 0.9; // merchant self-attested; buyer verify may override
-  const capsuleSummary = String(summary || '').trim()
-    || 'ATP merchant delivery for order ' + String(orderId || '').slice(0, 24);
-  const capsule = {
-    type: 'Capsule',
-    schema_version: '1.0.0',
-    id: 'capsule_atp_' + String(orderId || taskId || Date.now()).replace(/[^a-zA-Z0-9_\-]/g, '_').slice(0, 40),
-    trigger: sig,
-    gene: gene.id,
-    summary: capsuleSummary.slice(0, 200),
-    confidence,
-    blast_radius: { files: 0, lines: Math.min(1000, answer.split('\n').length) },
-    outcome: { status: 'success', score: confidence },
-    env_fingerprint: { platform: process.platform, arch: process.arch, runtime: 'evolver-atp' },
-    content: answer,
-    // 'generated' is the gep-sdk source_type enum value for a freshly
-    // produced asset; the ATP-specific provenance rides in `a2a.atp` below.
-    source_type: 'generated',
-    // The order/task association MUST live under `a2a`, not as a top-level
-    // `atp` key: the Hub's payload sanitizer allow-lists `a2a` but not `atp`
-    // (CAPSULE_ALLOWED_FIELDS), so a top-level `atp` was being silently
-    // stripped on publish and the association never reached the Hub. `a2a`
-    // is also an open object in gep-sdk's Capsule schema, so this keeps the
-    // bundle GEP-valid.
-    a2a: {
-      atp: {
-        order_id: orderId || null,
-        task_id: taskId || null,
-        capabilities: caps,
-      },
-    },
-  };
-  capsule.asset_id = computeAssetId(capsule);
-  return capsule;
-}
-
-function _publishUrl() {
-  const base = String(getHubUrl() || '').replace(/\/+$/, '');
-  if (!base) throw new Error('hub url not configured');
-  return base + '/a2a/publish';
-}
-
-async function _postJson(urlStr, body, timeoutMs) {
-  const payload = JSON.stringify(body || {});
-  const buildHeaders = buildNodeScopedHubHeaders || buildHubHeaders;
-  const headers = Object.assign(
-    { 'Content-Type': 'application/json' },
-    buildHeaders() || {},
-  );
-
-  try {
-    const res = await hubFetch(urlStr, {
-      method: 'POST',
-      headers: headers,
-      body: payload,
-      signal: AbortSignal.timeout(timeoutMs || PUBLISH_TIMEOUT_MS),
-    });
-    const text = await res.text();
-    let data = null;
-    try { data = text ? JSON.parse(text) : null; } catch (e) { data = { raw: text }; }
-    if (res.status >= 200 && res.status < 300) {
-      return { ok: true, status: res.status, data };
-    }
-    return { ok: false, status: res.status, data, error: 'http_' + res.status };
-  } catch (err) {
-    const msg = (err && err.message) || String(err);
-    if (msg.indexOf('[hubFetch]') !== -1) {
-      if (/not a valid URL/i.test(msg)) return { ok: false, error: 'invalid_url: ' + msg };
-      return { ok: false, error: 'tls_refused: ' + msg };
-    }
-    return { ok: false, error: msg };
-  }
-}
-
-async function _ensureNodeSecret() {
-  if (getHubNodeSecret()) return true;
-  try {
-    const hello = await sendHelloToHub();
-    return !!(hello && hello.ok);
-  } catch (e) {
-    return false;
-  }
-}
-
-async function _publishBundle(gene, capsule) {
-  const nodeSecret = getHubNodeSecret();
-  if (!nodeSecret) return { ok: false, error: 'missing_node_secret_after_hello' };
-  const signatureInput = [gene.asset_id, capsule.asset_id].sort().join('|');
-  const signature = crypto.createHmac('sha256', nodeSecret).update(signatureInput).digest('hex');
-  const msg = {
-    protocol: 'gep-a2a',
-    protocol_version: '1.0.0',
-    message_type: 'publish',
-    message_id: 'msg_atp_' + crypto.randomBytes(8).toString('hex'),
-    timestamp: new Date().toISOString(),
-    sender_id: getNodeId(),
-    payload: { assets: [gene, capsule], signature: signature },
-  };
-  return _postJson(_publishUrl(), msg, PUBLISH_TIMEOUT_MS);
-}
-
-async function _completeTaskOnHub(taskId, assetId) {
-  const base = String(getHubUrl() || '').replace(/\/+$/, '');
-  if (!base) return { ok: false, error: 'hub_url_missing' };
-  return _postJson(base + '/a2a/task/complete', {
-    task_id: taskId,
-    asset_id: assetId,
-    node_id: getNodeId(),
-  }, PUBLISH_TIMEOUT_MS);
-}
-
-/**
- * End-to-end ATP task completion driver.
- *
- * @param {object} opts
- * @param {string} opts.taskId     - Hub task row id (required)
- * @param {string} opts.orderId    - ATP DeliveryProof id (required)
- * @param {string} opts.answerFile - Path to file holding the merchant answer (required)
- * @param {string} [opts.summary]  - Short summary for capsule.summary
- * @param {string[]} [opts.capabilities] - Listing capabilities (metadata only)
- * @param {string[]} [opts.signals]      - Task signals (metadata only)
- * @returns {Promise<{ok:boolean, stage?:string, error?:string, assetId?:string}>}
- */
-async function completeAtpTask(opts) {
-  const taskId = opts && opts.taskId;
-  const orderId = opts && opts.orderId;
-  const answerFile = opts && opts.answerFile;
-  if (!taskId || !orderId || !answerFile) {
-    return { ok: false, stage: 'input', error: 'taskId, orderId, answerFile are required' };
-  }
-
-  let answer;
-  try {
-    answer = _readAnswer(answerFile);
-  } catch (e) {
-    return { ok: false, stage: 'read_answer', error: e && e.message };
-  }
-
-  const handshakeOk = await _ensureNodeSecret();
-  if (!handshakeOk) {
-    return { ok: false, stage: 'hello', error: 'failed to register with hub; node_secret missing' };
-  }
-
-  const gene = _buildGene(opts.capabilities, opts.signals);
-  const capsule = _buildCapsule({
-    gene,
-    answer,
-    summary: opts.summary,
-    orderId,
-    taskId,
-    capabilities: opts.capabilities,
-    signals: opts.signals,
-  });
-
-  const pub = await _publishBundle(gene, capsule);
-  if (!pub.ok) {
-    return { ok: false, stage: 'publish', error: pub.error || 'publish_failed', details: pub };
-  }
-  const decision = pub.data && pub.data.payload && pub.data.payload.decision;
-  if (decision && decision !== 'accept') {
-    const reason = pub.data.payload.reason || 'unknown';
-    return { ok: false, stage: 'publish', error: 'publish_rejected: ' + reason, details: pub.data };
-  }
-
-  const complete = await _completeTaskOnHub(taskId, capsule.asset_id);
-  if (!complete.ok) {
-    return { ok: false, stage: 'complete', error: complete.error || 'complete_failed', details: complete };
-  }
-
-  const proofPayload = {
-    asset_id: capsule.asset_id,
-    result: capsule.summary,
-    content_hash: capsule.asset_id,
-    pass_rate: 1.0,
-    delivered_by: getNodeId(),
-    task_id: taskId,
-  };
-
-  const delivery = await submitDelivery(orderId, proofPayload);
-  if (!delivery || !delivery.ok) {
-    return {
-      ok: false,
-      stage: 'deliver',
-      error: (delivery && delivery.error) || 'deliver_failed',
-      assetId: capsule.asset_id,
-      details: delivery,
-    };
-  }
-
-  return { ok: true, assetId: capsule.asset_id, deliveryId: delivery.data && delivery.data.proof_id };
-}
-
-module.exports = {
-  completeAtpTask,
-  // exported for tests
-  _buildGene,
-  _buildCapsule,
-};

package/src/atp/atpTaskPickup.js

@@ -1,233 +0,0 @@
-// ATP Task Pickup (merchant-side)
-//
-// When a buyer places an ATP order, the Hub creates a Task row in status
-// "claimed" already bound to a target merchant node (see orderRouterService).
-// That Task never appears in /a2a/fetch (which only returns status="open"
-// tasks), so without this module the merchant's Evolver runtime never knows
-// it has work to do, no resultAssetId is ever written, autoDeliver never
-// runs, and the DeliveryProof expires after 7 days.
-//
-// This module bridges the gap by:
-//   1. Polling /a2a/task/my for tasks with atp_order_id set and no
-//      result_asset_id yet (the "merchant owes work" shape).
-//   2. Producing a renderable sessions_spawn(...) prompt that the main loop
-//      can emit to stdout. The Evolver wrapper (Cursor/Claude Code hook)
-//      picks that up and launches a sub-session that answers the question
-//      and runs `node index.js atp-complete` to settle the order.
-//   3. Deduping via a local ledger so the same task is never spawned twice,
-//      even across restarts.
-//
-// The module never *itself* prints sessions_spawn. It only PROVIDES the
-// spawn string to whoever orchestrates stdout (evolve.js main loop), so the
-// existing "one sessions_spawn per cycle" contract with the wrapper is
-// preserved and evolve's normal bridge is not interfered with.
-
-const fs = require('fs');
-const path = require('path');
-
-const { getMemoryDir } = require('../gep/paths');
-const { renderSessionsSpawnCall } = require('../gep/bridge');
-const hubClient = require('./hubClient');
-
-const LEDGER_FILENAME = 'atp-pickup-ledger.json';
-const LEDGER_MAX_ENTRIES = 500;
-const SPAWN_COOLDOWN_MS = 5 * 60 * 1000; // do not respawn the same task within 5 min
-const MAX_ANSWER_PROMPT_CHARS = 12000;
-
-function _isEnabled() {
-  const raw = (process.env.EVOLVER_ATP_PICKUP || 'on').toLowerCase().trim();
-  return raw !== 'off' && raw !== '0' && raw !== 'false';
-}
-
-function _ledgerPath() {
-  return path.join(getMemoryDir(), LEDGER_FILENAME);
-}
-
-function _emptyLedger() {
-  return { version: 1, spawned: {} };
-}
-
-function _readLedger() {
-  try {
-    const p = _ledgerPath();
-    if (!fs.existsSync(p)) return _emptyLedger();
-    const raw = fs.readFileSync(p, 'utf8');
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== 'object' || !parsed.spawned) return _emptyLedger();
-    return parsed;
-  } catch (_) {
-    return _emptyLedger();
-  }
-}
-
-function _writeLedger(ledger) {
-  try {
-    const dir = getMemoryDir();
-    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-    const entries = Object.entries(ledger.spawned || {});
-    if (entries.length > LEDGER_MAX_ENTRIES) {
-      ledger.spawned = Object.fromEntries(entries.slice(-LEDGER_MAX_ENTRIES));
-    }
-    const tmp = _ledgerPath() + '.tmp';
-    fs.writeFileSync(tmp, JSON.stringify(ledger, null, 2));
-    fs.renameSync(tmp, _ledgerPath());
-  } catch (_) {
-    // Non-fatal: next tick will re-read Hub state. Stale ledger at worst
-    // causes a duplicate spawn, which the Hub will 409 on already-completed
-    // tasks without side effects.
-  }
-}
-
-function _isEligible(task) {
-  if (!task || typeof task !== 'object') return false;
-  if (!task.atp_order_id) return false;
-  if (task.result_asset_id) return false;
-  if (task.status && task.status !== 'claimed' && task.status !== 'open') return false;
-  if (!task.id) return false;
-  return true;
-}
-
-function _recentlySpawned(ledger, taskId) {
-  const entry = ledger.spawned && ledger.spawned[taskId];
-  if (!entry || typeof entry !== 'object') return false;
-  const ts = Number(entry.at) || 0;
-  return Date.now() - ts < SPAWN_COOLDOWN_MS;
-}
-
-function _clipQuestion(q) {
-  const s = String(q || '').trim();
-  if (!s) return '(buyer did not provide a question body)';
-  if (s.length <= MAX_ANSWER_PROMPT_CHARS) return s;
-  return s.slice(0, MAX_ANSWER_PROMPT_CHARS - 40) + '\n...[TRUNCATED]...';
-}
-
-function _answerFilePath(taskId) {
-  const safe = String(taskId || 'task').replace(/[^a-zA-Z0-9_\-]/g, '_').slice(0, 64);
-  return path.join(getMemoryDir(), 'atp_answer_' + safe + '.md');
-}
-
-function _buildSpawnTask(task, opts) {
-  const capabilities = Array.isArray(task.capabilities) ? task.capabilities.slice(0, 8) : [];
-  const signalsCsv = task.signals ? String(task.signals) : '';
-  const answerPath = _answerFilePath(task.id);
-  const question = _clipQuestion(task.user_question_body || task.description || task.title);
-
-  const evolverExec = opts && opts.evolverExec ? opts.evolverExec : 'node index.js';
-
-  const lines = [
-    'You are an ATP merchant sub-agent. A buyer has paid credits for your node to answer their request.',
-    '',
-    '# Task',
-    '- Task ID: ' + task.id,
-    '- ATP Order ID: ' + task.atp_order_id,
-    '- Title: ' + String(task.title || '(no title)').slice(0, 200),
-    '- Capabilities requested: ' + (capabilities.length ? capabilities.join(', ') : '(none)'),
-    '- Signals: ' + (signalsCsv || '(none)'),
-    '',
-    '# Buyer question',
-    question,
-    '',
-    '# Your job',
-    '1. Produce a concrete, useful answer to the buyer question above.',
-    '   - Use your existing tools (web search, code read, reasoning) as appropriate.',
-    '   - Keep the answer focused and actionable; do not invent facts.',
-    '   - If the question is ambiguous, answer the most reasonable interpretation and state your assumption.',
-    '2. Write the full answer to this file (plain text or markdown):',
-    '     ' + answerPath,
-    '3. Settle the order by running EXACTLY this command from the Evolver install dir:',
-    '     ' + evolverExec + ' atp-complete \\',
-    '       --task-id=' + task.id + ' \\',
-    '       --order-id=' + task.atp_order_id + ' \\',
-    '       --answer-file=' + answerPath +
-      (capabilities.length ? ' \\\n       --capabilities=' + capabilities.join(',') : '') +
-      (signalsCsv ? ' \\\n       --signals=' + signalsCsv : ''),
-    '4. If atp-complete prints "[ATP-Complete] OK asset_id=...", you are done.',
-    '   If it prints "FAILED", read the stage= field. Safe to retry the same command.',
-    '',
-    '# Hard rules',
-    '- Do NOT commit or push any repo changes -- this is a per-order side task, not a code evolution.',
-    '- Do NOT run `node index.js solidify` or `node index.js run`.',
-    '- Do NOT fabricate the answer; if you cannot answer, still run atp-complete with a short',
-    '  honest explanation so the buyer is not left waiting for 7 days.',
-    '- Keep the answer under 12k characters.',
-  ];
-  return lines.join('\n');
-}
-
-/**
- * Fetch a pickup action if one is due. Idempotent -- safe to call from the
- * main loop every cycle.
- *
- * @param {object} [opts]
- * @param {number} [opts.limit=5] -- how many Hub tasks to consider per call
- * @param {string} [opts.evolverExec] -- how the wrapper should invoke Evolver
- * @returns {Promise<null | { spawnCall: string, task: object }>}
- *   null when there is nothing to do; otherwise a sessions_spawn() string
- *   the caller SHOULD print to stdout on its next cycle output and the task
- *   we picked so the caller can log it.
- */
-async function pickOne(opts) {
-  if (!_isEnabled()) return null;
-  const limit = Math.max(1, Math.min(20, Number(opts && opts.limit) || 5));
-
-  let listResult;
-  try {
-    listResult = await hubClient.listMyTasks(limit);
-  } catch (_) {
-    return null;
-  }
-  if (!listResult || !listResult.ok) return null;
-
-  const tasks = (listResult.data && Array.isArray(listResult.data.tasks))
-    ? listResult.data.tasks
-    : (Array.isArray(listResult.data) ? listResult.data : []);
-  if (!tasks.length) return null;
-
-  const ledger = _readLedger();
-  let picked = null;
-  for (const t of tasks) {
-    if (!_isEligible(t)) continue;
-    if (_recentlySpawned(ledger, t.id)) continue;
-    picked = t;
-    break;
-  }
-  if (!picked) return null;
-
-  const spawnTask = _buildSpawnTask(picked, opts);
-  const spawnCall = renderSessionsSpawnCall({
-    task: spawnTask,
-    agentId: 'atp_pickup',
-    cleanup: 'delete',
-    label: 'atp_pickup_' + String(picked.id).slice(0, 32),
-  });
-
-  ledger.spawned = ledger.spawned || {};
-  ledger.spawned[picked.id] = { at: Date.now(), order_id: picked.atp_order_id };
-  _writeLedger(ledger);
-
-  return { spawnCall, task: picked };
-}
-
-/**
- * Forget a previously-spawned task so the main loop will retry it next cycle.
- * Called by callers that detected the spawn channel was unavailable (e.g.
- * wrapper not attached) so we do not burn the cooldown on a no-op spawn.
- */
-function forget(taskId) {
-  if (!taskId) return;
-  const ledger = _readLedger();
-  if (ledger.spawned && ledger.spawned[taskId]) {
-    delete ledger.spawned[taskId];
-    _writeLedger(ledger);
-  }
-}
-
-module.exports = {
-  pickOne,
-  forget,
-  _isEnabled,
-  _isEligible,
-  _buildSpawnTask,
-  _recentlySpawned,
-  _answerFilePath,
-};