@hivemagnus/magnus-server 1.1.8 → 1.1.12

package/agent-version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.1.8"
+  "version": "1.1.12"
 }

package/dist/openapi/spec.js

@@ -2571,12 +2571,24 @@ const paths = {
             responses: { 200: { description: 'Artifact bytes', content: { 'application/octet-stream': { schema: { type: 'string', format: 'binary' } } } },
                 401: err401, 403: err403, 404: err404, 503: { description: 'Node or profile API unavailable' } } },
     },
+    '/ardent/installations/{nodeId}/profiles/{name}/context-release': {
+        get: { tags: ['Magnus Ardent'], summary: 'Inspect the pinned context-only adoption payload without changing a profile',
+            security: apiSecretAuth, parameters: [pp('nodeId', 'Managed node ID'), pp('name', 'Profile name')],
+            responses: { 200: success('Context release digests and service compatibility'), 401: err401, 403: err403, 503: { description: 'Context release unavailable' } } },
+    },
+    '/ardent/installations/{nodeId}/profiles/{name}/context-adoptions/{releaseId}': {
+        get: { tags: ['Magnus Ardent'], summary: 'Inspect a retained context-adoption journal without retrying work',
+            description: 'A journal phase is diagnostic state, not a signed completion receipt or permission to clear an unsettled resource lease.',
+            security: apiSecretAuth, parameters: [pp('nodeId', 'Managed node ID'), pp('name', 'Profile name'), pp('releaseId', 'Adoption release UUID')],
+            responses: { 200: success('Retained revision pins, acceptance and phase'), 400: err400, 401: err401, 403: err403,
+                503: { description: 'Retained journal unavailable' } } },
+    },
     '/ardent/installations/{nodeId}/profiles/{name}/action': {
         post: { tags: ['Magnus Ardent'], summary: 'Run a finite node-scoped Ardent profile action',
-            description: 'The Control API dispatches through the node managed-mutation boundary. A task-submit result proves durable admission only; task completion is read from the Ardent task API.',
+            description: 'The Control API dispatches through the node managed-mutation boundary. A task-submit result proves durable admission only; task completion is read from the Ardent task API. Context-stage, context-adopt and context-rollback require a release UUID and exact bundle, base-runtime, policy and configuration SHA-256 pins in body, with no target. Context actions require a signed managed owner and return verified completion evidence. A timeout or failure after dispatch must be inspected, never automatically retried.',
             security: apiSecretAuth, parameters: [pp('nodeId', 'Managed node ID'), pp('name', 'Profile name')],
             requestBody: { required: true, content: { 'application/json': { schema: { type: 'object', required: ['action'],
-                            properties: { action: { type: 'string', enum: ['profile-create', 'config-validate', 'config-save', 'peer-validate', 'peer-save', 'identity-save', 'identity-restore', 'provider-test', 'channel-test', 'peer-test', 'memory-search', 'task-submit', 'task-cancel', 'skill-set', 'service-start', 'service-stop', 'service-restart', 'package-install'] },
+                            properties: { action: { type: 'string', enum: ['profile-create', 'config-validate', 'config-save', 'peer-validate', 'peer-save', 'identity-save', 'identity-restore', 'provider-test', 'channel-test', 'peer-test', 'memory-search', 'task-submit', 'task-cancel', 'skill-set', 'service-start', 'service-stop', 'service-restart', 'package-install', 'context-stage', 'context-adopt', 'context-rollback'] },
                                 target: { type: 'string' }, body: {} }, additionalProperties: false } } } },
             responses: { 200: success('Ardent action acknowledgement'), 400: err400, 401: err401, 403: err403,
                 503: { description: 'Node or Ardent action unavailable' } } },

package/dist/routes/ardent.js

@@ -2,8 +2,9 @@ import { Hono } from 'hono';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { logAuditEvent } from '../services/audit-service.js';
-import { getArdentArtifact, getArdentInstallation, getArdentProfileResource, listArdentInstallations, performArdentAction } from '../services/ardent-service.js';
+import { getArdentArtifact, getArdentContextAdoption, getArdentContextRelease, getArdentInstallation, getArdentProfileResource, listArdentInstallations, performArdentAction } from '../services/ardent-service.js';
 import { z } from 'zod';
+import { ArdentContextAdoptionInputSchema } from '@hivemagnus/magnus-contracts';
 export const ardentRouter = new Hono();
 ardentRouter.use('*', authMiddleware);
 ardentRouter.use('*', requireRole('ADMIN'));
@@ -14,6 +15,15 @@ const id = (value) => {
 };
 ardentRouter.get('/installations', async (c) => c.json({ success: true, data: await listArdentInstallations() }));
 ardentRouter.get('/installations/:nodeId', async (c) => c.json({ success: true, data: await getArdentInstallation(id(c.req.param('nodeId'))) }));
+ardentRouter.get('/installations/:nodeId/profiles/:name/context-release', async (c) => {
+    return c.json({ success: true, data: await getArdentContextRelease(id(c.req.param('nodeId')), id(c.req.param('name'))) });
+});
+ardentRouter.get('/installations/:nodeId/profiles/:name/context-adoptions/:releaseId', async (c) => {
+    const releaseId = z.string().guid().safeParse(c.req.param('releaseId'));
+    if (!releaseId.success)
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Invalid context adoption release ID');
+    return c.json({ success: true, data: await getArdentContextAdoption(id(c.req.param('nodeId')), id(c.req.param('name')), releaseId.data) });
+});
 ardentRouter.get('/profiles', async (c) => {
     const installations = await listArdentInstallations();
     return c.json({ success: true, data: installations.flatMap(installation => installation.profiles.map(profile => ({ ...profile,
@@ -59,7 +69,7 @@ ardentRouter.get('/installations/:nodeId/profiles/:name/*', async (c) => {
     }
 });
 const Action = z.object({
-    action: z.enum(['profile-create', 'profile-import-hermes', 'config-validate', 'config-save', 'peer-validate', 'peer-save', 'identity-save', 'identity-restore', 'provider-test', 'channel-test', 'peer-test', 'memory-search', 'task-submit', 'task-cancel', 'skill-set', 'service-start', 'service-stop', 'service-restart', 'package-install']),
+    action: z.enum(['profile-create', 'profile-import-hermes', 'config-validate', 'config-save', 'peer-validate', 'peer-save', 'identity-save', 'identity-restore', 'provider-test', 'channel-test', 'peer-test', 'memory-search', 'task-submit', 'task-cancel', 'skill-set', 'service-start', 'service-stop', 'service-restart', 'package-install', 'context-stage', 'context-adopt', 'context-rollback']),
     target: z.string().min(1).max(128).optional(), body: z.unknown().optional(),
 }).strict();
 ardentRouter.post('/installations/:nodeId/profiles/:name/action', async (c) => {
@@ -69,10 +79,16 @@ ardentRouter.post('/installations/:nodeId/profiles/:name/action', async (c) => {
     if (!parsed.success)
         throw new HttpError(400, 'VALIDATION_ERROR', 'Invalid Ardent action');
     const { action, target, body } = parsed.data;
+    if (['context-stage', 'context-adopt', 'context-rollback'].includes(action)
+        && (target !== undefined || !ArdentContextAdoptionInputSchema.safeParse(body).success))
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Context adoption requires exact release, source and policy pins without an arbitrary target');
     try {
         const result = await performArdentAction(nodeId, profile, action, target, body);
         await logAuditEvent({ action: `ardent.${action}`, actorId: getUser(c).userId,
-            targetType: 'ardent-profile', targetId: `${nodeId}:${profile}`, details: { target: target ?? null } });
+            targetType: 'ardent-profile', targetId: `${nodeId}:${profile}`, details: {
+                target: target ?? null,
+                ...(['context-stage', 'context-adopt', 'context-rollback'].includes(action) ? ArdentContextAdoptionInputSchema.parse(body) : {})
+            } });
         return c.json({ success: true, data: result });
     }
     catch (error) {

package/dist/sdk/node-api-client.js

@@ -11,7 +11,7 @@ import ky, { HTTPError } from 'ky';
 import { HttpError } from '../middleware/error-handler.js';
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { z } from 'zod';
-import { agentUpgradePreflightSchema } from '@hivemagnus/magnus-contracts';
+import { agentUpgradePreflightSchema, ArdentContextAdoptionInputSchema } from '@hivemagnus/magnus-contracts';
 import { RESULT_SIGNING_PREVIOUS_SECRET, RESULT_SIGNING_SECRET } from '../utils/env.js';
 import { correlateSkillPublicationNoEffect } from '../services/skill-publication-settlement.js';
 import { commandResultSigningPayload, verifyCommandResultSignature, } from '../security/command-result-signature.js';
@@ -636,6 +636,25 @@ export class NodeApiClient {
         const timeout = action === 'package-install' ? 600_000 : action === 'profile-import-hermes' ? 90_000 : action.startsWith('service-') ? 115_000 : 45_000;
         return this.mutate('POST', 'ardent/action', { profile, action, ...(target ? { target } : {}), body: body ?? {} }, timeout);
     }
+    async getArdentContextRelease(profile) {
+        if (!/^[A-Za-z0-9_-]{1,64}$/.test(profile))
+            throw new Error('Invalid Ardent context profile');
+        return this.api.get(`ardent/profiles/${profile}/context`, { timeout: 15000, retry: 0 }).json();
+    }
+    async getArdentContextAdoption(profile, releaseId) {
+        if (!/^[A-Za-z0-9_-]{1,64}$/.test(profile) || !/^[a-f0-9-]{36}$/i.test(releaseId))
+            throw new Error('Invalid context adoption journal target');
+        return this.api.get(`ardent/profiles/${profile}/context/${releaseId}`, { timeout: 15000, retry: 0 }).json();
+    }
+    async performArdentContextAction(profile, action, body) {
+        if (!/^[A-Za-z0-9_-]{1,64}$/.test(profile) || !['context-stage', 'context-adopt', 'context-rollback'].includes(action))
+            throw new Error('Invalid context adoption action');
+        const input = ArdentContextAdoptionInputSchema.parse(body);
+        const result = await this.mutateWithEvidence('POST', 'ardent/action', { profile, action, body: input }, 850000, undefined, undefined, true);
+        if (!result.evidence)
+            throw new Error('Context adoption requires a signed managed mutation receipt');
+        return { response: result.response, evidence: result.evidence };
+    }
     async updateCodex() {
         return this.mutate('POST', 'codex/update', undefined, 11 * 60_000);
     }

package/dist/services/ardent-service.js

@@ -1,4 +1,4 @@
-import { ArdentNodeStateSchema } from '@hivemagnus/magnus-contracts';
+import { ArdentNodeStateSchema, ArdentContextReleaseSchema, ArdentContextAdoptionInputSchema } from '@hivemagnus/magnus-contracts';
 import { getDb } from '../db/index.js';
 import { NodeApiClient } from '../sdk/index.js';
 import { getNodeBaseUrl } from '../utils/node-url.js';
@@ -81,6 +81,23 @@ export async function getArdentArtifact(nodeId, profile, artifactId) {
     return clientFor(await nodeTarget(nodeId)).getArdentArtifact(profile, artifactId);
 }
 export async function performArdentAction(nodeId, profile, action, target, body) {
+    if (['context-stage', 'context-adopt', 'context-rollback'].includes(action)) {
+        if (target !== undefined)
+            throw new Error('Context adoption does not accept an arbitrary target');
+        const input = ArdentContextAdoptionInputSchema.parse(body);
+        const node = await nodeTarget(nodeId);
+        const enrollment = await getDb().resourceEnrollment.findUnique({ where: { nodeId } });
+        const client = enrollment?.state === 'enrolled'
+            ? new NodeApiClient({ baseUrl: getNodeBaseUrl(node.ipAddress, node.port), resourceNodeId: node.id,
+                resourceActorId: 'system:ardent-context-adoption', nodeToken: getNodeManagerSecret() }) : clientFor(node);
+        return client.performArdentContextAction(profile, action, input);
+    }
     return clientFor(await nodeTarget(nodeId)).performArdentAction(profile, action, target, body);
 }
+export async function getArdentContextRelease(nodeId, profile) {
+    return ArdentContextReleaseSchema.parse(await clientFor(await nodeTarget(nodeId)).getArdentContextRelease(profile));
+}
+export async function getArdentContextAdoption(nodeId, profile, releaseId) {
+    return clientFor(await nodeTarget(nodeId)).getArdentContextAdoption(profile, releaseId);
+}
 //# sourceMappingURL=ardent-service.js.map

package/dist/services/command-resource-leases.js

@@ -17,7 +17,7 @@ import { RESULT_SIGNING_SECRET, RESULT_SIGNING_PREVIOUS_SECRET } from '../utils/
 import { getNodeBaseUrl } from '../utils/node-url.js';
 import { COMMAND_COMPLETION_REGISTRY, COMMAND_COMPLETION_REGISTRY_SHA256, commandCompletionDescriptor } from '../security/command-completion-registry.js';
 import { MANAGED_HTTP_COMMAND } from '../security/managed-http.js';
-import { NATIVE_COMPLETION_REGISTRY, NATIVE_COMPLETION_REGISTRY_SHA256, nativeCompletionDescriptor } from '../security/native-completion-registry.js';
+import { NATIVE_COMPLETION_REGISTRY, NATIVE_COMPLETION_REGISTRY_SHA256, nativeCompletionDescriptor, nativeCompletionResourceKey } from '../security/native-completion-registry.js';
 import { logAuditEvent } from './audit-service.js';
 const HELD = ['reserved', 'running', 'unknown'];
 export class ResourceLeaseConflict extends HttpError {
@@ -147,7 +147,9 @@ export async function admitResourceCommand(context, raw) {
         }
         const resourceKey = scopedArdent ? `node:${node.id}:ardent`
             : serviceUnit ? `node:${node.id}:system-service:${serviceUnit}` : `node:${node.id}:all`;
-        const coordinationKey = scopedArdent ? resourceKey : `node:${node.id}`;
+        const native = payload.command === MANAGED_HTTP_COMMAND && payload.args.length === 3 && /^[a-f0-9]{64}$/.test(payload.args[2])
+            ? nativeCompletionDescriptor(payload.args[0], payload.args[1]) : undefined;
+        const coordinationKey = native ? nativeCompletionResourceKey(native, node.id) : `node:${node.id}`;
         // The node ledger has one execution slot: service metadata never promises parallel fences.
         const conflict = await tx.commandResourceLease.findFirst({ where: { nodeId: node.id, state: { in: HELD } } });
         if (conflict)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-server",
-  "version": "1.1.8",
+  "version": "1.1.12",
   "description": "Magnus server: the fleet control plane API (Hono, PostgreSQL, Redis) for nodes running magnus-agent, with optional Hive IAM, Hive Router, HiveMem, Hermes Agent and external security console integrations.",
   "keywords": [
     "magnus",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run db:generate && npm run clean && npm run build"
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.1.8",
+    "@hivemagnus/magnus-contracts": "1.1.12",
     "@hono/node-server": "^2.1.5",
     "@hono/swagger-ui": "^0.6.2",
     "@prisma/adapter-pg": "7.10.1",
@@ -102,7 +102,7 @@
     "ws": "^8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7",
-    "@hivemagnus/magnus-skills": "1.1.8",
+    "@hivemagnus/magnus-skills": "1.1.12",
     "prisma": "^7.10.1"
   },
   "devDependencies": {