@gaia-ai/addon-gaia-ui 0.11.2 → 0.11.3

package/dist/src/Component/top-tabs/index.d.ts

@@ -17,7 +17,18 @@ export declare const ROOT_TABS: readonly [{
     readonly id: "teams";
     readonly label: "Teams";
 }];
-/** The project level: the tabs of an opened project. */
+/**
+ * The project level: the tabs of an opened project.
+ *
+ * GAIA-450 added `conductors` (`ProjectConductorsScreen`, `project.conductors`,
+ * order 50) — LAST, by the same "which project it serves is a COLUMN of that
+ * screen" argument GAIA-232 made for the root level, applied the other way:
+ * once a project IS chosen, seeing who serves it is a natural final stop
+ * beside Tickets, Ticket-Agents and Runs. Missing here — as it was for one
+ * `coding` pass, review B11 — makes the screen and its route entirely
+ * unreachable by Tab or click: `tabsOfLocation` reads this list, not the
+ * route registry's `tab` metadata, for what a level cycles through.
+ */
 export declare const PROJECT_TABS: readonly [{
     readonly id: "dashboard";
     readonly label: "Dashboard";
@@ -30,6 +41,9 @@ export declare const PROJECT_TABS: readonly [{
 }, {
     readonly id: "runs";
     readonly label: "Runs";
+}, {
+    readonly id: "conductors";
+    readonly label: "Conductors";
 }];
 /**
  * The ticket level: the sections of ONE OPEN TICKET — GAIA-346.
@@ -139,6 +153,9 @@ export declare const TAB_LEVELS: {
     }, {
         readonly id: "runs";
         readonly label: "Runs";
+    }, {
+        readonly id: "conductors";
+        readonly label: "Conductors";
     }];
     readonly ticket: readonly [{
         readonly id: "overview";

package/dist/src/Component/top-tabs/index.js

@@ -5,7 +5,8 @@
 //   root     dashboard, projects, project-picker  → Dashboard · Projects ·
 //                                                    Conductors · Teams
 //   project  dashboard, project, ticket-agents,   → Dashboard · Tickets ·
-//            project-runs                           Ticket-Agents · Runs
+//            project-runs, project-conductors       Ticket-Agents · Runs ·
+//                                                    Conductors
 //   ticket   overview, comments, related, runs    → the sections of one open
 //                                                    ticket, in the bar row every
 //                                                    other level uses (GAIA-346)
@@ -82,12 +83,24 @@ export const ROOT_TABS = [
     // rows still open one person directly.
     { id: 'teams', label: 'Teams' },
 ];
-/** The project level: the tabs of an opened project. */
+/**
+ * The project level: the tabs of an opened project.
+ *
+ * GAIA-450 added `conductors` (`ProjectConductorsScreen`, `project.conductors`,
+ * order 50) — LAST, by the same "which project it serves is a COLUMN of that
+ * screen" argument GAIA-232 made for the root level, applied the other way:
+ * once a project IS chosen, seeing who serves it is a natural final stop
+ * beside Tickets, Ticket-Agents and Runs. Missing here — as it was for one
+ * `coding` pass, review B11 — makes the screen and its route entirely
+ * unreachable by Tab or click: `tabsOfLocation` reads this list, not the
+ * route registry's `tab` metadata, for what a level cycles through.
+ */
 export const PROJECT_TABS = [
     { id: 'dashboard', label: 'Dashboard' },
     { id: 'tickets', label: 'Tickets' },
     { id: 'ticket-agents', label: 'Ticket-Agents' },
     { id: 'runs', label: 'Runs' },
+    { id: 'conductors', label: 'Conductors' },
 ];
 /**
  * The ticket level: the sections of ONE OPEN TICKET — GAIA-346.

package/dist/src/Entity/conductor/Data/conductors.d.ts

@@ -41,18 +41,39 @@ export interface ConductorRow extends Conductor {
     lastPid: number | undefined;
     /** The config stem it was started from, as `--conductor <name>` takes it. */
     conductorName: string | undefined;
+    /**
+     * The MachineContext host stem this record last heartbeat with (GAIA-450
+     * AC-4/B7) — what a stop compares against this machine's own before
+     * signalling. Resolved from the related `gaia_machine` (`host_key` is that
+     * entity's field, never `gaia_conductor`'s), never from the conductor row
+     * itself.
+     */
+    hostKey: string | undefined;
     /** Liveness, derived — never the raw `status`. */
     derivedStatus: ConductorStatus;
     /**
      * Whether this conductor's workspace exists on THIS machine.
      *
      * The control plane is user-scoped, not machine-scoped, so a user's other
-     * machines' conductors appear in this list. They are shown rather than hidden
-     * — filtering by machine_id would mean substring-matching a composed string —
-     * but only a local row can be started or stopped from here, because a pid
-     * from another machine means nothing on this one.
+     * machines' conductors appear in this list. They are shown rather than
+     * hidden — filtering by machine_id would mean substring-matching a composed
+     * string. This is a FILESYSTEM fact only (used to decide whether the log
+     * tail can read a local file); it is not an identity gate — see {@link mine}
+     * for that.
      */
     isLocal: boolean;
+    /**
+     * Whether this row's `hostKey` matches THIS machine's own (GAIA-450 B10) —
+     * the identity gate for starting/stopping and for the view-only marking.
+     *
+     * Deliberately distinct from {@link isLocal}: two `gaia_conductor` records
+     * can name the SAME `workspace_root` under different machines (GAIA-281
+     * Finding 2), which makes `isLocal` true for both — a path is not proof of
+     * identity, which is the whole thesis this ticket is built on. `false` when
+     * `hostKey` is absent (a record from before GAIA-450, or an unreadable
+     * machine): an unproven identity is never treated as this machine's own.
+     */
+    mine: boolean;
 }
 /** What a conductor ROW cannot know on its own, handed to the columns per frame. */
 export interface ConductorListContext {
@@ -65,12 +86,12 @@ export interface ConductorListContext {
     readonly projectNames: ReadonlyMap<string, string>;
 }
 /**
- * The conductors list, declared once (GAIA-345 D2/D10) — its eight columns, the
+ * The conductors list, declared once (GAIA-345 D2/D10) — its nine columns, the
  * noun every one of its node ids is prefixed with, and what it says when it is
  * empty.
  *
  * It GAINED A HEADER with this ticket (D6). This is the list a header earns its
- * keep in most: eight columns of ids, paths and numbers are not self-describing
+ * keep in most: nine columns of ids, paths and numbers are not self-describing
  * the way three named ones were. The consequence is stated because it is a
  * behaviour change — the list grows one row at the top and its selection
  * highlight moves down one physical row. Nothing computes that offset:
@@ -94,7 +115,7 @@ export interface ConductorListContext {
  * than as a bound, so a narrow terminal leaves it exactly the columns it had
  * before this ticket and a wide one hands it a share.
  *
- * The other six do not grow, and each for its own reason. `MACHINE` and
+ * The other seven do not grow, and each for its own reason. `MACHINE` and
  * `WORKSPACE` are free text too, and are the ONE exception to the rule: they
  * are elided from the LEFT (see {@link elideLeft}), which needs a declared
  * width to cut against and keeps the distinguishing tail — a grower would hand
@@ -102,7 +123,8 @@ export interface ConductorListContext {
  * elision preserves. `STATUS`, `AGE` and `PID` are closed vocabularies that
  * cannot use a surplus at all. `MARKS` is a closed vocabulary too and keeps a
  * real budget for a measured reason: `width: 0, grow: 0` collapses it to zero
- * columns and the mark vanishes.
+ * columns and the mark vanishes. `LOAD` (GAIA-450 AC-7) is a fixed `<current>/
+ * <max>` ratio, not free text, so it takes a budget rather than a share too.
  */
 export declare const CONDUCTOR_TABLE: {
     readonly noun: "conductor";
@@ -162,7 +184,7 @@ export declare const CONDUCTOR_TABLE: {
         readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
     }, {
         /** A CLOSED VOCABULARY. `ConductorStatus`'s reachable members here are
-         *  `running | stale | offline` — this screen can never produce
+         *  `online | stale | offline` — this screen can never produce
          *  `registry-only`, because every row IS a control-plane record — whose
          *  longest is 7, so 9 shows each of them whole. */
         readonly key: "status";
@@ -181,7 +203,7 @@ export declare const CONDUCTOR_TABLE: {
     }, {
         readonly key: "workspace";
         readonly label: "WORKSPACE";
-        readonly width: 24;
+        readonly width: 18;
         readonly fields: readonly ["workspace_root"];
         readonly get: (row: ConductorRow) => string;
     }, {
@@ -199,26 +221,159 @@ export declare const CONDUCTOR_TABLE: {
          * trailing slot it used to hold: everything it can say is `…`,
          * `elsewhere` or both, and 11 is `… elsewhere`.
          *
-         * A non-local conductor is MARKED rather than hidden. The control plane
-         * is user-scoped, not machine-scoped, so a user's other machines'
+         * A conductor that is not MINE is MARKED rather than hidden. The control
+         * plane is user-scoped, not machine-scoped, so a user's other machines'
          * conductors are legitimately in this list — and silently dropping them
          * would make the cockpit disagree with `gaia conductor ls` for no visible
-         * reason. The mark says why their actions are inert here: a pid from
-         * another machine means nothing on this one.
+         * reason. The mark says why their actions are inert here: an identity
+         * that is not this machine's own (GAIA-450 B10 — `mine`, not `isLocal`'s
+         * path check, since two records can share one `workspace_root` under
+         * different machines).
          */
         readonly key: "marks";
         readonly label: "MARKS";
         readonly width: 11;
         readonly fields: readonly ["workspace_root"];
         readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+    }, {
+        /**
+         * `<current>/<max>` (GAIA-450 AC-7) — the utilization `capacityOf()`
+         * already computes from the sideloaded machine, reaching the row but no
+         * column until this one. 5 fits every realistic pair (`max_parallel` is
+         * a small hand-set integer); a triple-digit load would overflow it, and
+         * that is a capacity-planning problem this list only reports, not one
+         * this column need budget for.
+         */
+        readonly key: "load";
+        readonly label: "LOAD";
+        readonly width: 5;
+        readonly fields: readonly ["current_load", "max_parallel"];
+        readonly get: (row: ConductorRow) => string;
     }];
 };
+/**
+ * The project-scoped Conductors tab's table (GAIA-450 D13) — the SAME column
+ * definitions as {@link CONDUCTOR_TABLE}, minus `project`: every row is
+ * already this one project's, so the column would repeat one value down the
+ * whole list. No new component or column is declared; this reuses the exact
+ * objects, so the two lists cannot drift out of step with each other.
+ */
+export declare const PROJECT_CONDUCTOR_TABLE: {
+    readonly columns: ({
+        /**
+         * A GROWER — free text, right-truncated, and the column an operator reads
+         * first. Declared FIRST and growing all the same: `flexGrow` is a
+         * property of the cell, not of its position in the row (measured, spec
+         * R2). Its `grow: 2` against `PROJECT`'s 1 is the identity column's larger
+         * claim on the surplus, argued above.
+         *
+         * `min: 20` is the ONE floor on this list, and it is preservation rather
+         * than invention: 20 is the budget this column has carried since
+         * GAIA-232, and without it a narrow terminal squeezes the grower to
+         * nothing while seven fixed budgets keep theirs — measured at 80 columns,
+         * NAME came out ONE column wide and the label read `c…`. The other seven
+         * columns need 106 columns between them, so below ~126 the row runs past
+         * the right edge and the renderer clips it there. That is exactly what
+         * this list did before this ticket, at every width; the floor keeps the
+         * narrow case as it was and lets the wide case improve.
+         */
+        readonly key: "name";
+        readonly label: "NAME";
+        readonly width: 0;
+        readonly min: 20;
+        readonly grow: 2;
+        readonly fields: readonly ["label", "machine_id"];
+        readonly get: (row: ConductorRow) => string;
+    } | {
+        readonly key: "machine";
+        readonly label: "MACHINE";
+        readonly width: 20;
+        readonly fields: readonly ["machine_id"];
+        readonly get: (row: ConductorRow) => string;
+    } | {
+        /** A CLOSED VOCABULARY. `ConductorStatus`'s reachable members here are
+         *  `online | stale | offline` — this screen can never produce
+         *  `registry-only`, because every row IS a control-plane record — whose
+         *  longest is 7, so 9 shows each of them whole. */
+        readonly key: "status";
+        readonly label: "STATUS";
+        readonly width: 9;
+        readonly fields: readonly ["status", "lease_expires_at", "last_seen"];
+        readonly get: (row: ConductorRow) => ConductorStatus;
+    } | {
+        /** `humanizeAge`'s own vocabulary, exactly as on the projects list: `—`,
+         *  `just now`, `<n>m|h|d ago`. 8 is the longest of them. */
+        readonly key: "age";
+        readonly label: "AGE";
+        readonly width: 8;
+        readonly fields: readonly ["last_seen"];
+        readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+    } | {
+        readonly key: "workspace";
+        readonly label: "WORKSPACE";
+        readonly width: 18;
+        readonly fields: readonly ["workspace_root"];
+        readonly get: (row: ConductorRow) => string;
+    } | {
+        /** A pid is at most 7 digits — Linux's `pid_max` ceiling is 4 194 304 —
+         *  and a conductor that never reported one shows `-` rather than a
+         *  fabricated number. */
+        readonly key: "pid";
+        readonly label: "PID";
+        readonly width: 7;
+        readonly fields: readonly ["last_pid"];
+        readonly get: (row: ConductorRow) => string;
+    } | {
+        /**
+         * A closed vocabulary too, which is why it takes a budget instead of the
+         * trailing slot it used to hold: everything it can say is `…`,
+         * `elsewhere` or both, and 11 is `… elsewhere`.
+         *
+         * A conductor that is not MINE is MARKED rather than hidden. The control
+         * plane is user-scoped, not machine-scoped, so a user's other machines'
+         * conductors are legitimately in this list — and silently dropping them
+         * would make the cockpit disagree with `gaia conductor ls` for no visible
+         * reason. The mark says why their actions are inert here: an identity
+         * that is not this machine's own (GAIA-450 B10 — `mine`, not `isLocal`'s
+         * path check, since two records can share one `workspace_root` under
+         * different machines).
+         */
+        readonly key: "marks";
+        readonly label: "MARKS";
+        readonly width: 11;
+        readonly fields: readonly ["workspace_root"];
+        readonly get: (row: ConductorRow, ctx: ConductorListContext) => string;
+    } | {
+        /**
+         * `<current>/<max>` (GAIA-450 AC-7) — the utilization `capacityOf()`
+         * already computes from the sideloaded machine, reaching the row but no
+         * column until this one. 5 fits every realistic pair (`max_parallel` is
+         * a small hand-set integer); a triple-digit load would overflow it, and
+         * that is a capacity-planning problem this list only reports, not one
+         * this column need budget for.
+         */
+        readonly key: "load";
+        readonly label: "LOAD";
+        readonly width: 5;
+        readonly fields: readonly ["current_load", "max_parallel"];
+        readonly get: (row: ConductorRow) => string;
+    })[];
+    readonly noun: "conductor";
+    readonly emptyMessage: "No conductors on this control plane.";
+};
 /** What the row projection needs from the outside world, injected for tests. */
 export interface ConductorRowContext {
     /** Unix seconds; the liveness derivation's clock. */
     now: number;
     /** Whether a path exists on this machine. */
     exists: (path: string) => boolean;
+    /**
+     * THIS machine's own `host_key` (GAIA-450 B10), resolved once by the caller
+     * before the read — the same MachineContext value `signalVerifiedProcess`
+     * and the CLI's `hostKeyOf(config)` compare against. Compared against each
+     * row's own `hostKey` to derive {@link ConductorRow.mine}.
+     */
+    thisHostKey: string;
 }
 /**
  * The conductor collection as cockpit rows, in server order.
@@ -227,8 +382,12 @@ export interface ConductorRowContext {
  * not removed conductor fields. Swallows a read failure into an empty list on
  * purpose: the Conductors screen re-reads every 5 s, so one failed poll must
  * leave the screen navigable rather than replace it with an error.
+ *
+ * GAIA-450 D13: an optional `projectId` narrows the read to the project's own
+ * conductors — the project-scoped Conductors tab's whole filter, applied at
+ * the query rather than client-side so the read stays one round trip.
  */
-export declare const listConductorRows: (client: DropshClient, ctx: ConductorRowContext) => Promise<ConductorRow[]>;
+export declare const listConductorRows: (client: DropshClient, ctx: ConductorRowContext, projectId?: string) => Promise<ConductorRow[]>;
 /**
  * Project uuid → name, for the Conductors screen's project column.
  *

package/dist/src/Entity/conductor/Data/conductors.js

@@ -65,31 +65,37 @@ const MACHINE_ID_WIDTH = 20;
  * STATUS 9, AGE 8, WORKSPACE 30, PID 7, MARKS 11, plus seven separators) while
  * `gaia ui` opens at 120, so the terminal cut the LAST column: measured on a
  * real pty, the header ended `PID     MAR` and a non-local conductor's
- * `elsewhere` came out `elsew`. 24 brings the row to exactly 120.
+ * `elsewhere` came out `elsew`. GAIA-345 brought it to 24, fitting exactly 120.
+ *
+ * GAIA-450 AC-7 spent six of those back: adding `LOAD` (its own 5-wide budget
+ * plus the separator every column past the first pays) reopened the same
+ * 126-column overrun this constant exists to close, so `WORKSPACE` pays the
+ * same six columns again — 18, not 24 — to keep the row at exactly 120.
  *
  * WHY THIS COLUMN GIVES THE SIX. `WORKSPACE` is the only column in the row whose
  * cut is free: it is elided from the LEFT, so it loses six columns of the HEAD —
  * the `/home/<user>/projects/…` prefix every conductor workspace on a machine
  * shares — and keeps the distinguishing tail either way. Every other column
  * would pay in information: `MACHINE` elides left too but is already the
- * narrower of the pair, the three closed vocabularies are sized to their own
- * longest member, and `NAME`/`PROJECT` are the growers this ticket widened.
+ * narrower of the pair, the three closed vocabularies (and `LOAD`'s fixed
+ * ratio) are sized to their own longest member, and `NAME`/`PROJECT` are the
+ * growers this ticket widened.
  *
- * A DECLARED BUDGET, never a measurement (spec D4). 24 is not the width of
+ * A DECLARED BUDGET, never a measurement (spec D4). 18 is not the width of
  * anyone's path — no page's data is consulted to arrive at it, so the columns do
  * not move when the list does. It is shared by the column's `width` and by the
  * {@link elideLeft} its accessor applies for exactly that reason: two numbers
  * could drift, and a marker cut at one width inside a cell laid out at another
  * is the defect the single constant makes unspellable.
  */
-const PATH_WIDTH = 24;
+const PATH_WIDTH = 18;
 /**
- * The conductors list, declared once (GAIA-345 D2/D10) — its eight columns, the
+ * The conductors list, declared once (GAIA-345 D2/D10) — its nine columns, the
  * noun every one of its node ids is prefixed with, and what it says when it is
  * empty.
  *
  * It GAINED A HEADER with this ticket (D6). This is the list a header earns its
- * keep in most: eight columns of ids, paths and numbers are not self-describing
+ * keep in most: nine columns of ids, paths and numbers are not self-describing
  * the way three named ones were. The consequence is stated because it is a
  * behaviour change — the list grows one row at the top and its selection
  * highlight moves down one physical row. Nothing computes that offset:
@@ -113,7 +119,7 @@ const PATH_WIDTH = 24;
  * than as a bound, so a narrow terminal leaves it exactly the columns it had
  * before this ticket and a wide one hands it a share.
  *
- * The other six do not grow, and each for its own reason. `MACHINE` and
+ * The other seven do not grow, and each for its own reason. `MACHINE` and
  * `WORKSPACE` are free text too, and are the ONE exception to the rule: they
  * are elided from the LEFT (see {@link elideLeft}), which needs a declared
  * width to cut against and keeps the distinguishing tail — a grower would hand
@@ -121,7 +127,8 @@ const PATH_WIDTH = 24;
  * elision preserves. `STATUS`, `AGE` and `PID` are closed vocabularies that
  * cannot use a surplus at all. `MARKS` is a closed vocabulary too and keeps a
  * real budget for a measured reason: `width: 0, grow: 0` collapses it to zero
- * columns and the mark vanishes.
+ * columns and the mark vanishes. `LOAD` (GAIA-450 AC-7) is a fixed `<current>/
+ * <max>` ratio, not free text, so it takes a budget rather than a share too.
  */
 export const CONDUCTOR_TABLE = {
     noun: 'conductor',
@@ -188,7 +195,7 @@ export const CONDUCTOR_TABLE = {
         },
         {
             /** A CLOSED VOCABULARY. `ConductorStatus`'s reachable members here are
-             *  `running | stale | offline` — this screen can never produce
+             *  `online | stale | offline` — this screen can never produce
              *  `registry-only`, because every row IS a control-plane record — whose
              *  longest is 7, so 9 shows each of them whole. */
             key: 'status',
@@ -229,23 +236,51 @@ export const CONDUCTOR_TABLE = {
              * trailing slot it used to hold: everything it can say is `…`,
              * `elsewhere` or both, and 11 is `… elsewhere`.
              *
-             * A non-local conductor is MARKED rather than hidden. The control plane
-             * is user-scoped, not machine-scoped, so a user's other machines'
+             * A conductor that is not MINE is MARKED rather than hidden. The control
+             * plane is user-scoped, not machine-scoped, so a user's other machines'
              * conductors are legitimately in this list — and silently dropping them
              * would make the cockpit disagree with `gaia conductor ls` for no visible
-             * reason. The mark says why their actions are inert here: a pid from
-             * another machine means nothing on this one.
+             * reason. The mark says why their actions are inert here: an identity
+             * that is not this machine's own (GAIA-450 B10 — `mine`, not `isLocal`'s
+             * path check, since two records can share one `workspace_root` under
+             * different machines).
              */
             key: 'marks',
             label: 'MARKS',
             width: 11,
             fields: ['workspace_root'],
-            get: (row, ctx) => [ctx.busyIds.has(row.id) ? '…' : '', row.isLocal ? '' : 'elsewhere']
+            get: (row, ctx) => [ctx.busyIds.has(row.id) ? '…' : '', row.mine ? '' : 'elsewhere']
                 .filter((mark) => mark !== '')
                 .join(' '),
         },
+        {
+            /**
+             * `<current>/<max>` (GAIA-450 AC-7) — the utilization `capacityOf()`
+             * already computes from the sideloaded machine, reaching the row but no
+             * column until this one. 5 fits every realistic pair (`max_parallel` is
+             * a small hand-set integer); a triple-digit load would overflow it, and
+             * that is a capacity-planning problem this list only reports, not one
+             * this column need budget for.
+             */
+            key: 'load',
+            label: 'LOAD',
+            width: 5,
+            fields: ['current_load', 'max_parallel'],
+            get: (row) => `${row.currentLoad}/${row.maxParallel}`,
+        },
     ],
 };
+/**
+ * The project-scoped Conductors tab's table (GAIA-450 D13) — the SAME column
+ * definitions as {@link CONDUCTOR_TABLE}, minus `project`: every row is
+ * already this one project's, so the column would repeat one value down the
+ * whole list. No new component or column is declared; this reuses the exact
+ * objects, so the two lists cannot drift out of step with each other.
+ */
+export const PROJECT_CONDUCTOR_TABLE = {
+    ...CONDUCTOR_TABLE,
+    columns: CONDUCTOR_TABLE.columns.filter((column) => column.key !== 'project'),
+};
 const num = (v) => typeof v === 'number' && Number.isFinite(v) ? v : undefined;
 /** Id of a single-valued relationship linkage (`data` object), or null. */
 function singleRelId(rel) {
@@ -294,6 +329,18 @@ function capacityOf(raw, machinesById) {
         maxParallel: num(machine?.attributes?.max_parallel) ?? num(attrs.max_parallel) ?? 0,
     };
 }
+/**
+ * `host_key` from the sideloaded machine (GAIA-450 B7) — `gaia_conductor`
+ * carries no such field at all; `filter[host_key]` against it is a
+ * server-side 400. Reading `raw.attributes.host_key` here would repeat the
+ * exact defect the CLI's `listConductors()` had: always `undefined` in
+ * reality, present only in a fixture that hand-writes it on the wrong entity.
+ */
+function hostKeyOf(raw, machinesById) {
+    const machineId = singleRelId(raw.relationships?.machine);
+    const machine = machineId ? machinesById.get(machineId) : undefined;
+    return str(machine?.attributes?.host_key);
+}
 const toConductorRow = (raw, ctx, machinesById) => {
     const r = asResource(raw);
     const workspaceRoot = str(r.attr('workspace_root')) ?? '';
@@ -302,6 +349,7 @@ const toConductorRow = (raw, ctx, machinesById) => {
     const lastSeen = toUnixSeconds(r.attr('last_seen')) ?? 0;
     const leaseExpiresAt = toUnixSeconds(r.attr('lease_expires_at')) ?? 0;
     const { currentLoad, maxParallel } = capacityOf(raw, machinesById);
+    const hostKey = hostKeyOf(raw, machinesById);
     return {
         ...toConductor(r),
         workspaceRoot,
@@ -311,6 +359,7 @@ const toConductorRow = (raw, ctx, machinesById) => {
         maxParallel,
         lastPid: num(r.attr('last_pid')),
         conductorName: str(r.attr('conductor_name')),
+        hostKey,
         // `present: true` because the row IS a control-plane record — which is why
         // `registry-only` can never come out of this screen.
         derivedStatus: deriveConductorStatus({
@@ -322,6 +371,9 @@ const toConductorRow = (raw, ctx, machinesById) => {
         // A conductor that never reported a workspace cannot be local, whatever the
         // filesystem would say about an empty path.
         isLocal: workspaceRoot !== '' && ctx.exists(workspaceRoot),
+        // GAIA-450 B10: an absent hostKey is never waved through as "mine" — an
+        // unproven identity is refused, the same rule signalVerifiedProcess uses.
+        mine: hostKey !== undefined && hostKey === ctx.thisHostKey,
     };
 };
 /**
@@ -331,9 +383,15 @@ const toConductorRow = (raw, ctx, machinesById) => {
  * not removed conductor fields. Swallows a read failure into an empty list on
  * purpose: the Conductors screen re-reads every 5 s, so one failed poll must
  * leave the screen navigable rather than replace it with an error.
+ *
+ * GAIA-450 D13: an optional `projectId` narrows the read to the project's own
+ * conductors — the project-scoped Conductors tab's whole filter, applied at
+ * the query rather than client-side so the read stays one round trip.
  */
-export const listConductorRows = async (client, ctx) => {
+export const listConductorRows = async (client, ctx, projectId) => {
     const params = new DrupalJsonApiParams().addInclude(['machine']);
+    if (projectId)
+        params.addFilter('project_id.id', projectId);
     try {
         const doc = (await client.get('gaia_conductor/gaia_conductor', params));
         const machinesById = new Map();

package/dist/src/Entity/conductor/Data/own-conductor.js

@@ -14,7 +14,14 @@
 // path comparison, never a longest-prefix walk. So a worktree — which has its
 // own `.gaia` — resolves to no conductor rather than quietly inheriting its
 // parent checkout's project, exactly as before.
-import { resolve } from 'node:path';
+//
+// GAIA-450 D3/D15: `workspace_root` now holds the checkout root, not this
+// `.gaia` config directory, because every heartbeat rewrites the field going
+// forward. A record written before that change still carries the legacy
+// `.gaia` value until its next heartbeat, so the match accepts EITHER form —
+// the derived checkout root (`dirname(gaiaDir)`) or the legacy `gaiaDir`
+// itself — so a cockpit opened against an un-healed record still resolves.
+import { dirname, resolve } from 'node:path';
 import { DrupalJsonApiParams } from 'drupal-jsonapi-params';
 const NOTHING = { machineId: undefined, project: undefined };
 /** Id of a single-valued relationship linkage (`data` object), or null. */
@@ -35,12 +42,19 @@ const str = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
  * which the writer sees and can change.
  */
 export function selectOwnConductor(doc, gaiaDir) {
-    const target = resolve(gaiaDir);
+    // The current form (GAIA-450 D3): workspace_root is the checkout root.
+    const checkoutRoot = resolve(dirname(gaiaDir));
+    // The legacy form: a record whose heartbeat has not yet rewritten the
+    // field still carries the `.gaia` config directory itself.
+    const legacyTarget = resolve(gaiaDir);
     const own = (doc.data ?? []).find((c) => {
         const root = str(c.attributes?.workspace_root);
         // A conductor that never reported a workspace matches no directory,
         // whatever `resolve('')` would make of an empty path.
-        return root !== undefined && resolve(root) === target;
+        if (root === undefined)
+            return false;
+        const resolved = resolve(root);
+        return resolved === checkoutRoot || resolved === legacyTarget;
     });
     if (own === undefined)
         return NOTHING;

package/dist/src/Entity/conductor/Data/process.d.ts

@@ -24,20 +24,47 @@ export interface ConductorProcessDeps {
     spawn?: (request: SpawnRequest) => void | Promise<void>;
     signal?: (input: {
         pid: number | undefined;
-        workspaceRoot: string;
+        hostKey: string | undefined;
+        thisHostKey: string;
         signal: NodeJS.Signals;
     }) => SignalOutcome;
+    /**
+     * This machine's own host_key (MachineContext.machine_id), read once per
+     * stop. Injected for tests; defaults to the real `~/.gaia/machine.config.js`
+     * (GAIA-450 D1 — `signalVerifiedProcess` refuses a `host_key` mismatch, so a
+     * stop needs this machine's own value to compare against).
+     */
+    thisHostKey?: () => Promise<string>;
 }
 export interface ConductorProcessHost {
     start(input: {
         workspaceRoot: string;
         conductorName: string | undefined;
+        /** The row's `host_key` (GAIA-450 review B5) — verified against this
+         *  machine's own before anything is spawned. */
+        hostKey: string | undefined;
     }): Promise<ConductorActionResult>;
     stop(input: {
         pid: number | undefined;
-        workspaceRoot: string;
+        hostKey: string | undefined;
     }): Promise<ConductorActionResult>;
+    /**
+     * THIS machine's own `host_key` (GAIA-450 B10) — the same value `start`/
+     * `stop` already verify against, exposed so the Conductors screens can key
+     * their `mine` row projection and their `actions()` gate on the identical
+     * seam rather than resolving it a second, divergent way.
+     */
+    thisHostKey(): Promise<string>;
 }
+/**
+ * This machine's host_key, from the same MachineContext the CLI reads.
+ *
+ * Exported so the Conductors screens (GAIA-450 B10) can key their view-only
+ * marking and their `actions()` gate on IDENTITY — this row's `host_key`
+ * against this machine's own — rather than on `isLocal`'s filesystem check,
+ * which two machines whose checkouts share a path can both satisfy.
+ */
+export declare function defaultThisHostKey(): Promise<string>;
 /**
  * Start and stop a conductor from the cockpit.
  *