@hivemagnus/ardent 0.0.0-stage → 1.0.2

package/dist/magnus-node-dependency-impact.js

@@ -0,0 +1,126 @@
+/** Exact-node projection of the owning Control API's observed dependency graph. */
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { defineTool } from './tools.js';
+const nodeId = z.string().regex(/^[A-Za-z0-9_-]{1,128}$/);
+const count = z.number().int().nonnegative();
+const graph = z.object({
+    discoveredAt: z.string().datetime(),
+    status: z.enum(['complete', 'partial']),
+    nodes: z.array(z.object({
+        id: nodeId,
+        name: z.string().min(1).max(160),
+        collection: z.object({
+            status: z.enum(['pass', 'unknown']),
+            observedAt: z.string().datetime(),
+            reason: z.string().nullable(),
+        }).passthrough(),
+    }).passthrough()).max(100),
+    edges: z.array(z.object({
+        from: nodeId,
+        to: nodeId,
+        service: z.string().min(1).max(160),
+        connectionCount: count,
+    }).passthrough()).max(2_000),
+}).passthrough();
+const relatedNode = z.object({ node_id: nodeId, name: z.string(), service: z.string(),
+    observed_connection_count: count, collection_status: z.enum(['pass', 'unknown']) }).strict();
+const output = z.object({
+    source: z.string().url(), source_date: z.string().datetime().nullable(), observed_at: z.string().datetime(),
+    owner_response_sha256: z.string().regex(/^[a-f0-9]{64}$/), graph_discovered_at: z.string().datetime(),
+    graph_status: z.enum(['complete', 'partial']), node_id: nodeId, node_name: z.string(),
+    node_collection_status: z.enum(['pass', 'unknown']), node_collection_observed_at: z.string().datetime(),
+    node_collection_gap: z.string().nullable(), coverage: z.enum(['observed', 'partial']),
+    depends_on: z.array(relatedNode).max(2_000), dependents: z.array(relatedNode).max(2_000),
+}).strict();
+function ownerUrl(env) {
+    const base = env.ARDENT_MAGNUS_API_URL;
+    const token = env.ARDENT_MAGNUS_READ_TOKEN;
+    if (!base || !token)
+        throw Object.assign(new Error('Magnus read-only service binding is unavailable'), { code: 'SERVICE_BINDING_UNAVAILABLE' });
+    let url;
+    try {
+        url = new URL(base);
+    }
+    catch {
+        throw Object.assign(new Error('Invalid Magnus service origin'), { code: 'INVALID_SERVICE_BINDING' });
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/' ||
+        (url.protocol === 'http:' && !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)))
+        throw Object.assign(new Error('Magnus bearer token requires an HTTPS origin outside loopback'), { code: 'INVALID_SERVICE_BINDING' });
+    url.pathname = '/api/v1/dependencies';
+    return { url, token };
+}
+async function readBoundedResponse(response) {
+    if (!response.ok)
+        throw Object.assign(new Error(`Magnus dependency graph returned HTTP ${response.status}`), { code: 'SERVICE_READ_FAILED' });
+    if (Number(response.headers.get('content-length') ?? 0) > 512_000)
+        throw Object.assign(new Error('Magnus dependency graph exceeds limit'), { code: 'SERVICE_RESPONSE_TOO_LARGE' });
+    if (!response.body)
+        throw Object.assign(new Error('Magnus dependency graph has no body'), { code: 'SERVICE_READ_FAILED' });
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.byteLength;
+            if (size > 512_000) {
+                await reader.cancel();
+                throw Object.assign(new Error('Magnus dependency graph exceeds limit'), { code: 'SERVICE_RESPONSE_TOO_LARGE' });
+            }
+            chunks.push(Buffer.from(part.value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks, size);
+}
+async function readNodeImpact(env, requestedNodeId, signal) {
+    const { url, token } = ownerUrl(env);
+    const response = await fetch(url, { headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        signal, redirect: 'manual' });
+    const raw = await readBoundedResponse(response);
+    const data = z.object({ success: z.literal(true), data: graph }).passthrough()
+        .parse(JSON.parse(raw.toString('utf8'))).data;
+    const now = Date.now();
+    const discovered = Date.parse(data.discoveredAt);
+    if (discovered < now - 630_000 || discovered > now + 5_000)
+        throw Object.assign(new Error('Magnus dependency observation is stale or future dated'), { code: 'SOURCE_OBSERVATION_STALE' });
+    const nodes = new Map(data.nodes.map(item => [item.id, item]));
+    if (nodes.size !== data.nodes.length)
+        throw Object.assign(new Error('Magnus dependency graph contains duplicate node IDs'), { code: 'SOURCE_IDENTITY_MISMATCH' });
+    const requested = nodes.get(requestedNodeId);
+    if (!requested)
+        throw Object.assign(new Error('Requested node is absent from the observed dependency graph'), { code: 'SOURCE_NODE_UNAVAILABLE' });
+    if (data.edges.some(item => !nodes.has(item.from) || !nodes.has(item.to)))
+        throw Object.assign(new Error('Magnus dependency graph contains an unknown node reference'), { code: 'SOURCE_IDENTITY_MISMATCH' });
+    const project = (relatedId, service, connections) => {
+        const related = nodes.get(relatedId);
+        return { node_id: related.id, name: related.name, service,
+            observed_connection_count: connections, collection_status: related.collection.status };
+    };
+    const sort = (a, b) => a.node_id.localeCompare(b.node_id) || a.service.localeCompare(b.service);
+    const dependsOn = data.edges.filter(item => item.from === requestedNodeId)
+        .map(item => project(item.to, item.service, item.connectionCount)).sort(sort);
+    const dependents = data.edges.filter(item => item.to === requestedNodeId)
+        .map(item => project(item.from, item.service, item.connectionCount)).sort(sort);
+    const sourceDate = response.headers.get('date');
+    return output.parse({ source: url.toString(),
+        source_date: sourceDate && Number.isFinite(Date.parse(sourceDate)) ? new Date(sourceDate).toISOString() : null,
+        observed_at: new Date(now).toISOString(), owner_response_sha256: createHash('sha256').update(raw).digest('hex'),
+        graph_discovered_at: data.discoveredAt, graph_status: data.status, node_id: requested.id, node_name: requested.name,
+        node_collection_status: requested.collection.status, node_collection_observed_at: requested.collection.observedAt,
+        node_collection_gap: requested.collection.status === 'unknown' ? 'collection_unavailable' : null,
+        coverage: data.status === 'complete' && requested.collection.status === 'pass' ? 'observed' : 'partial',
+        depends_on: dependsOn, dependents });
+}
+export function magnusNodeDependencyImpactTool(env) {
+    return defineTool({ name: 'magnus_node_dependency_impact',
+        description: 'Read observed direct dependency edges for one exact Magnus node. Missing or partial collection is explicit; this is not a service inventory, causal proof, or remediation authority.',
+        input: z.object({ node_id: nodeId }).strict(), output, effect: 'read', contexts: ['direct', 'peer'], timeoutMs: 15_000,
+        handler: async ({ node_id }, signal) => readNodeImpact(env, node_id, signal) });
+}

package/dist/magnus-owner-reads.d.ts

@@ -0,0 +1,4 @@
+import { type Tool } from './tools.js';
+export declare const MAGNUS_OWNER_READ_TOOLS: ReadonlySet<string>;
+export declare const MAGNUS_NODE_OWNER_READ_TOOLS: ReadonlySet<string>;
+export declare function magnusOwnerReadTools(env: NodeJS.ProcessEnv): Tool[];

package/dist/magnus-owner-reads.js

@@ -0,0 +1,99 @@
+/** Read-only Magnus Control API observations ported from the retired Hermes `magnus` plugin. No command, log-query, or remediation authority. */
+import { z } from 'zod';
+import { defineTool } from './tools.js';
+import { ownerReadOutput, ownerReadResult, readOwnedApi, withQuery } from './owner-read.js';
+const id = z.string().regex(/^[A-Za-z0-9_-]{1,128}$/);
+const bounded = (min, max) => z.number().int().min(min).max(max);
+const text = z.string().min(1).max(200);
+const API = '/api/v1';
+const str = (input, key) => typeof input[key] === 'string' ? input[key] : undefined;
+const num = (input, key) => typeof input[key] === 'number' ? input[key] : undefined;
+const fleet = (name, description, path) => ({ name, description, input: z.object({}).strict(), paths: () => [`${API}/${path}`] });
+const specs = [
+    { name: 'magnus_fleet_overview', description: 'Read Magnus fleet statistics and the latest fleet check run.', input: z.object({}).strict(),
+        paths: () => [`${API}/stats/overview`, `${API}/fleet-checks/latest`],
+        combine: values => ({ stats: values[0], latest_fleet_check: values[1] }) },
+    fleet('magnus_codex_fleet_status', 'Read cached per-installation Codex versions, available updates, and ChatGPT OAuth state.', 'ops/codex-fleet-status'),
+    { name: 'magnus_list_nodes', description: 'List Magnus inventory nodes with optional status, text query, or tag filters.',
+        input: z.object({ status: text.optional(), query: text.optional(), tag: text.optional(), page_size: bounded(1, 100).optional() }).strict(),
+        paths: input => [withQuery(`${API}/nodes`, { status: str(input, 'status'), query: str(input, 'query'), tag: str(input, 'tag'), pageSize: num(input, 'page_size') ?? 50 })],
+        rowLimit: input => num(input, 'page_size') ?? 50 },
+    { name: 'magnus_get_node', description: 'Read one Magnus inventory node record.', node: true, input: z.object({ node_id: id }).strict(),
+        paths: input => [`${API}/nodes/${str(input, 'node_id')}`] },
+    { name: 'magnus_hermes_installations', description: 'List retained Hermes/Ardent installation observations, optionally filtered by status, node, or hostname substring.',
+        input: z.object({ status: text.optional(), node_id: id.optional(), hostname: text.optional(), installed_only: z.boolean().optional(), page_size: bounded(1, 100).optional() }).strict(),
+        paths: () => [`${API}/hermes/installations`],
+        combine: (values, input) => {
+            const rows = z.array(z.record(z.string(), z.unknown())).parse(values[0]);
+            const host = str(input, 'hostname')?.toLowerCase();
+            return rows.filter(row => (!str(input, 'status') || row['status'] === str(input, 'status')) &&
+                (!str(input, 'node_id') || row['nodeId'] === str(input, 'node_id')) &&
+                (!host || String(row['hostname'] ?? '').toLowerCase().includes(host)) &&
+                (input['installed_only'] !== true || row['status'] !== 'not_installed')).slice(0, num(input, 'page_size') ?? 50);
+        },
+        rowLimit: input => num(input, 'page_size') ?? 50 },
+    { name: 'magnus_hermes_installation', description: 'Read one retained Hermes/Ardent installation observation by exact installation ID.', input: z.object({ installation_id: id }).strict(),
+        paths: input => [`${API}/hermes/installations/${str(input, 'installation_id')}`] },
+    { name: 'magnus_list_anomalies', description: 'List fleet anomalies, optionally by resolved state, severity, or node.',
+        input: z.object({ resolved: z.boolean().optional(), severity: z.enum(['info', 'warning', 'critical']).optional(), node_id: id.optional(), page_size: bounded(1, 100).optional() }).strict(),
+        paths: input => [withQuery(`${API}/anomalies`, { resolved: typeof input['resolved'] === 'boolean' ? input['resolved'] : undefined, severity: str(input, 'severity'), nodeId: str(input, 'node_id'), pageSize: num(input, 'page_size') ?? 25 })],
+        rowLimit: input => num(input, 'page_size') ?? 25 },
+    { name: 'magnus_fleet_check_runs', description: 'List recent Magnus fleet check runs.', input: z.object({ kind: text.optional(), limit: bounded(1, 100).optional() }).strict(),
+        paths: input => [withQuery(`${API}/fleet-checks/runs`, { kind: str(input, 'kind'), limit: num(input, 'limit') ?? 10 })], rowLimit: input => num(input, 'limit') ?? 10 },
+    { name: 'magnus_cron_jobs', description: 'List managed cron job observations, optionally for one node.', input: z.object({ node_id: id.optional() }).strict(),
+        paths: input => [withQuery(`${API}/cron`, { nodeId: str(input, 'node_id') })] },
+    fleet('magnus_dependency_health', 'Read the fleet dependency-health summary.', 'ops/dependency-health'),
+    fleet('magnus_wazuh_fleet_status', 'Read the fleet Wazuh agent status summary.', 'nodes/wazuh/summary'),
+    fleet('magnus_system_update_status', 'Read the fleet operating-system update status summary.', 'nodes/system-updates/summary'),
+    { name: 'magnus_health_history', description: 'Read bounded health snapshot history for one node.', node: true,
+        input: z.object({ node_id: id, limit: bounded(1, 500).optional() }).strict(),
+        paths: input => [withQuery(`${API}/nodes/${str(input, 'node_id')}/health/history`, { limit: num(input, 'limit') ?? 100 })], rowLimit: input => num(input, 'limit') ?? 100 },
+    { name: 'magnus_active_alerts', description: 'List active alert-rule violations, optionally for one node.', input: z.object({ node_id: id.optional(), page_size: bounded(1, 100).optional() }).strict(),
+        bare: true, paths: input => [withQuery(`${API}/alerts/violations`, { nodeId: str(input, 'node_id'), status: 'active', pageSize: num(input, 'page_size') ?? 50 })],
+        combine: values => z.object({ violations: z.array(z.unknown()), total: z.number().int().nonnegative() }).passthrough().parse(values[0]).violations,
+        rowLimit: input => num(input, 'page_size') ?? 50 },
+    { name: 'magnus_recent_commands', description: 'List recent Magnus command lifecycle records. Command text, arguments, and output are redacted.',
+        input: z.object({ node_id: id.optional(), status: z.enum(['PENDING', 'QUEUED', 'RUNNING', 'COMPLETED', 'FAILED', 'TIMEOUT', 'CANCELLED']).optional(), hours: bounded(1, 720).optional(), page_size: bounded(1, 100).optional() }).strict(),
+        paths: input => [withQuery(`${API}/commands`, { nodeId: str(input, 'node_id'), status: str(input, 'status'), hours: num(input, 'hours') ?? 24, pageSize: num(input, 'page_size') ?? 25 })],
+        rowLimit: input => num(input, 'page_size') ?? 25 },
+    { name: 'magnus_audit_events', description: 'List Magnus audit events, optionally by date, action, or actor.',
+        input: z.object({ date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(), action: text.optional(), actor_id: text.optional(), page_size: bounded(1, 100).optional() }).strict(),
+        paths: input => [withQuery(`${API}/audit`, { date: str(input, 'date'), action: str(input, 'action'), actorId: str(input, 'actor_id'), pageSize: num(input, 'page_size') ?? 25 })],
+        rowLimit: input => num(input, 'page_size') ?? 25 },
+    { name: 'magnus_fleet_timeline', description: 'Read the merged recent fleet event timeline.', input: z.object({ limit: bounded(1, 200).optional() }).strict(),
+        paths: input => [withQuery(`${API}/ops/timeline`, { limit: num(input, 'limit') ?? 80 })] },
+    { name: 'magnus_incident_summary', description: 'Read an incident summary for a bounded window, optionally for one node.', input: z.object({ node_id: id.optional(), hours: bounded(1, 168).optional() }).strict(),
+        paths: input => [withQuery(`${API}/ops/incident-summary`, { nodeId: str(input, 'node_id'), hours: num(input, 'hours') ?? 24 })] },
+    fleet('magnus_hermes_effective_state', 'Read effective Hermes/Ardent configuration state per installation.', 'ops/hermes-effective-state'),
+    fleet('magnus_package_security_posture', 'Read the fleet package security posture.', 'ops/package-security-posture'),
+    { name: 'magnus_correlate_anomalies', description: 'Group anomalies that occurred within a time window.', input: z.object({ window_minutes: bounded(1, 120).optional(), include_resolved: z.boolean().optional() }).strict(),
+        paths: input => [withQuery(`${API}/anomalies/correlations`, { windowMinutes: num(input, 'window_minutes') ?? 5, includeResolved: input['include_resolved'] === true })] },
+    { name: 'magnus_anomaly_timeline', description: 'Read the anomaly timeline for a bounded window, optionally for one node.', input: z.object({ node_id: id.optional(), hours: bounded(1, 720).optional() }).strict(),
+        paths: input => [withQuery(`${API}/anomalies/timeline`, { nodeId: str(input, 'node_id'), hours: num(input, 'hours') ?? 24 })] },
+    fleet('magnus_fleet_predictions', 'Read fleet capacity and failure predictions.', 'predictions'),
+    { name: 'magnus_node_predictions', description: 'Read capacity and failure predictions for one node.', node: true, input: z.object({ node_id: id }).strict(),
+        paths: input => [`${API}/predictions/${str(input, 'node_id')}`] },
+    fleet('magnus_skill_catalog', 'Read the Magnus skill catalogue.', 'skills'),
+    { name: 'magnus_skill_assignment_drift', description: 'List installations whose assigned skills drift from the catalogue.', input: z.object({}).strict(),
+        paths: () => [`${API}/ops/hermes-effective-state`],
+        combine: values => {
+            const state = z.object({ installations: z.array(z.record(z.string(), z.unknown())).default([]) }).passthrough().parse(values[0]);
+            const drifted = state.installations.filter(item => Array.isArray(item['driftedSkills']) && item['driftedSkills'].length > 0)
+                .map(item => ({ installation_id: item['id'], hostname: item['hostname'], status: item['status'], skills: item['driftedSkills'] }));
+            return { drifted_installations: drifted.length, installations: drifted };
+        } }
+];
+export const MAGNUS_OWNER_READ_TOOLS = new Set(specs.map(spec => spec.name));
+export const MAGNUS_NODE_OWNER_READ_TOOLS = new Set(specs.filter(spec => spec.node).map(spec => spec.name));
+export function magnusOwnerReadTools(env) {
+    return specs.map(spec => defineTool({
+        name: spec.name, description: `${spec.description} Owner observation only; it authorizes no command, deployment, or remediation.`,
+        input: spec.input, output: ownerReadOutput, effect: 'read', contexts: ['direct', 'peer'], timeoutMs: 20_000,
+        handler: async (input, signal) => {
+            const request = input;
+            const reads = await Promise.all(spec.paths(request).map(path => readOwnedApi('ARDENT_MAGNUS_API_URL', 'ARDENT_MAGNUS_READ_TOKEN', path, env, signal, {}, undefined, spec.bare === true)));
+            const data = spec.combine ? spec.combine(reads.map(read => read.value), request) : reads[0]?.value;
+            return ownerReadResult(reads, data, spec.rowLimit?.(request));
+        }
+    }));
+}

package/dist/magnus-readiness.d.ts

@@ -0,0 +1 @@
+export declare function magnusFleetReadinessTool(env: NodeJS.ProcessEnv): import("./tools.js").Tool;

package/dist/magnus-readiness.js

@@ -0,0 +1,108 @@
+/** Bounded projection of Magnus-owned fleet readiness; no action authority. */
+import { z } from 'zod';
+import { defineTool } from './tools.js';
+const count = z.number().int().nonnegative();
+const node = z.object({
+    id: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/),
+    name: z.string().min(1).max(160),
+    hostname: z.string().max(253).nullable(),
+    operationalStatus: z.string().min(1).max(40),
+    heartbeatAgeMs: count.nullable(),
+    stale: z.boolean(),
+    health: z.object({
+        timestamp: z.string().datetime(),
+        cpuUsagePercent: z.number().finite().nullable(),
+        memoryPercent: z.number().finite().nullable(),
+        diskWarnings: z.array(z.object({ mountPoint: z.string(), usagePercent: z.number() }).passthrough()).max(100),
+    }).passthrough().nullable(),
+}).passthrough();
+const readiness = z.object({
+    generatedAt: z.string().datetime(),
+    thresholds: z.object({ staleNodeMs: count }).passthrough(),
+    nodes: z.array(node).max(100),
+}).passthrough();
+const output = z.object({
+    source: z.string().url(), source_date: z.string().datetime().nullable(), observed_at: z.string().datetime(),
+    generated_at: z.string().datetime(), stale_threshold_ms: count, node_count: count, stale_count: count,
+    nodes: z.array(z.object({
+        node_id: z.string(), name: z.string(), hostname: z.string().nullable(),
+        operational_status: z.string(), heartbeat_age_ms: count.nullable(), stale: z.boolean(),
+        health_snapshot_at: z.string().datetime().nullable(), cpu_usage_percent: z.number().nullable(),
+        memory_percent: z.number().nullable(), disk_warning_count: count,
+    }).strict()).max(100),
+}).strict();
+function binding(env) {
+    const base = env.ARDENT_MAGNUS_API_URL;
+    const token = env.ARDENT_MAGNUS_READ_TOKEN;
+    if (!base || !token)
+        throw Object.assign(new Error('Magnus read-only service binding is unavailable'), { code: 'SERVICE_BINDING_UNAVAILABLE' });
+    let url;
+    try {
+        url = new URL(base);
+    }
+    catch {
+        throw Object.assign(new Error('Invalid Magnus service origin'), { code: 'INVALID_SERVICE_BINDING' });
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/' ||
+        (url.protocol === 'http:' && !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)))
+        throw Object.assign(new Error('Magnus bearer token requires an HTTPS origin outside loopback'), { code: 'INVALID_SERVICE_BINDING' });
+    url.pathname = '/api/v1/ops/readiness';
+    return { url, token };
+}
+async function read(env, signal) {
+    const { url, token } = binding(env);
+    const response = await fetch(url, { headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        signal, redirect: 'manual' });
+    if (!response.ok)
+        throw Object.assign(new Error(`Magnus readiness returned HTTP ${response.status}`), { code: 'SERVICE_READ_FAILED' });
+    if (Number(response.headers.get('content-length') ?? 0) > 512_000)
+        throw Object.assign(new Error('Magnus readiness response exceeds limit'), { code: 'SERVICE_RESPONSE_TOO_LARGE' });
+    if (!response.body)
+        throw Object.assign(new Error('Magnus readiness response has no body'), { code: 'SERVICE_READ_FAILED' });
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.byteLength;
+            if (size > 512_000) {
+                await reader.cancel();
+                throw Object.assign(new Error('Magnus readiness response exceeds limit'), { code: 'SERVICE_RESPONSE_TOO_LARGE' });
+            }
+            chunks.push(Buffer.from(part.value));
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const parsed = z.object({ success: z.literal(true), data: readiness }).passthrough()
+        .parse(JSON.parse(Buffer.concat(chunks, size).toString('utf8'))).data;
+    const observed = Date.now();
+    const generated = Date.parse(parsed.generatedAt);
+    if (!Number.isFinite(generated) || generated < observed - 60_000 || generated > observed + 5_000)
+        throw Object.assign(new Error('Magnus readiness observation is stale or future dated'), { code: 'SOURCE_OBSERVATION_STALE' });
+    const ids = new Set(parsed.nodes.map(item => item.id));
+    if (ids.size !== parsed.nodes.length)
+        throw Object.assign(new Error('Magnus readiness contains duplicate node IDs'), { code: 'SOURCE_IDENTITY_MISMATCH' });
+    const date = response.headers.get('date');
+    // These records represent service audit actors, not heartbeat-producing hosts.
+    // Match only the two reserved IDs; real offline nodes remain in the projection.
+    const hosts = parsed.nodes.filter(item => !['__control-api__', '__dashboard__'].includes(item.id));
+    return output.parse({ source: url.toString(), source_date: date && Number.isFinite(Date.parse(date)) ? new Date(date).toISOString() : null,
+        observed_at: new Date(observed).toISOString(), generated_at: parsed.generatedAt,
+        stale_threshold_ms: parsed.thresholds.staleNodeMs, node_count: hosts.length,
+        stale_count: hosts.filter(item => item.stale).length,
+        nodes: hosts.map(item => ({ node_id: item.id, name: item.name, hostname: item.hostname,
+            operational_status: item.operationalStatus, heartbeat_age_ms: item.heartbeatAgeMs, stale: item.stale,
+            health_snapshot_at: item.health?.timestamp ?? null, cpu_usage_percent: item.health?.cpuUsagePercent ?? null,
+            memory_percent: item.health?.memoryPercent ?? null, disk_warning_count: item.health?.diskWarnings.length ?? 0 })) });
+}
+export function magnusFleetReadinessTool(env) {
+    return defineTool({ name: 'magnus_fleet_readiness',
+        description: 'Read the owning Control API fleet readiness, stale heartbeat posture, and bounded health timestamps. No deployment or remediation authority.',
+        input: z.object({}).strict(), output, effect: 'read', contexts: ['direct', 'peer'], timeoutMs: 15_000,
+        handler: async (_input, signal) => read(env, signal) });
+}

package/dist/mattermost.d.ts

@@ -0,0 +1,18 @@
+import type { ArdentRuntime } from './runtime.js';
+import type { JobEngine } from './job-engine.js';
+type MattermostConfig = ArdentRuntime['config']['channels']['mattermost'];
+export declare class MattermostAdapter {
+    #private;
+    readonly runtime: ArdentRuntime;
+    readonly config: MattermostConfig;
+    constructor(runtime: ArdentRuntime, config: MattermostConfig, env?: NodeJS.ProcessEnv, jobs?: JobEngine);
+    initialize(): Promise<{
+        botId: string;
+        username: string;
+    }>;
+    handlePost(raw: unknown, channelType: string, signal?: AbortSignal, freshOnly?: boolean): Promise<void>;
+    reconcile(freshOnly?: boolean, signal?: AbortSignal): Promise<number>;
+    connectOnce(signal: AbortSignal): Promise<void>;
+    run(signal: AbortSignal): Promise<void>;
+}
+export {};