@hivemagnus/magnus-server 2.0.0 → 2.1.0

package/dist/db/generated/prisma/internal/prismaNamespace.js

@@ -69,6 +69,7 @@ export const AnyNull = runtime.AnyNull;
 export const ModelName = {
     MagnusReleaseCanary: 'MagnusReleaseCanary',
     User: 'User',
+    ProductInitialization: 'ProductInitialization',
     Node: 'Node',
     ArdentInstallation: 'ArdentInstallation',
     ArdentProfile: 'ArdentProfile',
@@ -202,6 +203,10 @@ export const UserScalarFieldEnum = {
     createdAt: 'createdAt',
     updatedAt: 'updatedAt'
 };
+export const ProductInitializationScalarFieldEnum = {
+    id: 'id',
+    completedAt: 'completedAt'
+};
 export const NodeScalarFieldEnum = {
     id: 'id',
     name: 'name',

package/dist/db/generated/prisma/internal/prismaNamespaceBrowser.js

@@ -41,6 +41,7 @@ export const AnyNull = runtime.AnyNull;
 export const ModelName = {
     MagnusReleaseCanary: 'MagnusReleaseCanary',
     User: 'User',
+    ProductInitialization: 'ProductInitialization',
     Node: 'Node',
     ArdentInstallation: 'ArdentInstallation',
     ArdentProfile: 'ArdentProfile',
@@ -174,6 +175,10 @@ export const UserScalarFieldEnum = {
     createdAt: 'createdAt',
     updatedAt: 'updatedAt'
 };
+export const ProductInitializationScalarFieldEnum = {
+    id: 'id',
+    completedAt: 'completedAt'
+};
 export const NodeScalarFieldEnum = {
     id: 'id',
     name: 'name',

package/dist/db/generated/prisma/models/ProductInitialization.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ProductInitialization.js.map

package/dist/db/read-retry.js

@@ -29,7 +29,11 @@ export async function withReadRetry(label, fn, opts = {}) {
             await sleep(baseDelayMs * attempt);
         }
     }
+    // An error that retrying cannot help is not an outage: keep it, so its handler can classify it.
+    if (!isTransientReadError(lastErr))
+        throw lastErr;
     const message = lastErr instanceof Error ? lastErr.message : String(lastErr);
-    throw new Error(`${label} failed after ${attempts} read attempts: ${message}`);
+    console.error(`[db] ${label} failed after ${attempts} read attempts: ${message}`);
+    throw Object.assign(new Error('The database is temporarily unavailable. Try again shortly.'), { status: 503, code: 'DATABASE_UNAVAILABLE' });
 }
 //# sourceMappingURL=read-retry.js.map

package/dist/db/seed.js

@@ -18,6 +18,14 @@ async function hashPassword(password) {
 }
 /** Idempotently create the system actor, sentinel nodes and library content. */
 export async function seedDatabase(prisma, log = console.log) {
+    await prisma.$transaction(async (transaction) => {
+        await seedBaseData(transaction, log);
+        await transaction.productInitialization.upsert({
+            where: { id: 'base-data-v1' }, update: {}, create: { id: 'base-data-v1' },
+        });
+    }, { timeout: 60_000 });
+}
+async function seedBaseData(prisma, log) {
     log('🌱 Seeding database…');
     // ── System user (used by API-secret / agent auth) ──
     let systemUser = await prisma.user.findUnique({ where: { id: 'system' } });

package/dist/index.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'url';
 import { readFileSync, existsSync } from 'node:fs';
 import { createServer } from 'node:https';
 import { resolveListenerSecurity } from './config/listener-security.js';
+import { rehearsalEnabled, startLiveBackgroundServices } from './config/rehearsal.js';
 // Load the env file before any other imports read process.env. The CLI passes
 // `--env-file` through MAGNUS_ENV_FILE; otherwise the package-level .env is used
 // when present. Variables already set in the environment always win.
@@ -11,6 +12,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const envFile = process.env['MAGNUS_ENV_FILE'] ? resolve(process.env['MAGNUS_ENV_FILE']) : resolve(__dirname, '../.env');
 if (existsSync(envFile))
     config({ path: envFile, quiet: true });
+rehearsalEnabled(); // Invalid safety flags fail before opening any listener.
 // Validate required secrets before starting anything
 const { validateSecrets } = await import('./utils/env.js');
 validateSecrets();
@@ -48,24 +50,28 @@ const { writeRuntimeFile } = await import('./utils/runtime-file.js');
 const { CONTROL_API_VERSION } = await import('./config/version.js');
 /** Background services shared by the TLS and development listeners. */
 function startBackgroundServices(listenPort) {
-    writeRuntimeFile({ version: CONTROL_API_VERSION, port: listenPort, host: listener.hostname });
-    startNodeIssueMonitor();
-    startUpgradeReadinessMonitor();
-    startApplicationProbes();
-    startLogRetention();
-    startHealthRetention();
-    startNotificationRetention();
-    startSecurityExporter();
-    startCommandWorker();
-    startRolloutReconciler();
-    startWebhookWorker();
-    startCodexFleetMonitor();
-    startUpdateCheck();
-    if (features.hermesRegistry) {
-        startExtensionSourceMonitor();
-        void importPackageSkills().then(result => console.log(`[hermes-registry] catalog import: ${JSON.stringify(result)}`))
-            .catch(error => console.error('[hermes-registry] catalog import failed', error));
-    }
+    const started = startLiveBackgroundServices(() => {
+        writeRuntimeFile({ version: CONTROL_API_VERSION, port: listenPort, host: listener.hostname });
+        startNodeIssueMonitor();
+        startUpgradeReadinessMonitor();
+        startApplicationProbes();
+        startLogRetention();
+        startHealthRetention();
+        startNotificationRetention();
+        startSecurityExporter();
+        startCommandWorker();
+        startRolloutReconciler();
+        startWebhookWorker();
+        startCodexFleetMonitor();
+        startUpdateCheck();
+        if (features.hermesRegistry) {
+            startExtensionSourceMonitor();
+            void importPackageSkills().then(result => console.log(`[hermes-registry] catalog import: ${JSON.stringify(result)}`))
+                .catch(error => console.error('[hermes-registry] catalog import failed', error));
+        }
+    });
+    if (!started)
+        console.log('[startup] isolated rehearsal: background consumers and queue activation disabled');
 }
 // Relative TLS paths resolve against the working directory; prefer absolute paths.
 const repoRoot = process.cwd();
@@ -101,7 +107,7 @@ const server = listener.useTls
         console.log(`🚀 Magnus server listening on http://${listener.hostname}:${info.port} (development opt-in)`);
         startBackgroundServices(info.port);
     });
-const terminalWss = setupTerminalWebSocket(server);
+const terminalWss = rehearsalEnabled() ? undefined : setupTerminalWebSocket(server);
 // ── Graceful shutdown ──
 let shuttingDown = false;
 async function shutdown(signal) {
@@ -128,11 +134,11 @@ async function shutdown(signal) {
                 stopCodexFleetMonitor();
                 stopUpdateCheck();
                 stopExtensionSourceMonitor();
-                for (const client of terminalWss.clients)
+                for (const client of terminalWss?.clients ?? [])
                     client.terminate();
                 const httpClosed = new Promise((resolvePromise) => server.close(() => resolvePromise()));
                 server.closeAllConnections?.();
-                const webSocketsClosed = new Promise((resolvePromise) => terminalWss.close(() => resolvePromise()));
+                const webSocketsClosed = terminalWss ? new Promise((resolvePromise) => terminalWss.close(() => resolvePromise())) : Promise.resolve();
                 await Promise.all([httpClosed, webSocketsClosed]);
                 await closeCommandQueue();
                 await closeWebhookQueue();

package/dist/middleware/auth.js

@@ -6,6 +6,9 @@
  * happens in Hive IAM itself.
  *
  * If IAM_CORE_URL is not set, local Magnus HS256/API-secret auth remains active.
+ *
+ * When OATHWEAVE_ISSUER is configured instead, RS256 bearer tokens are Oathweave
+ * resource tokens (see oathweave.ts). The two RS256 verifiers refuse to coexist.
  */
 import { createHash } from 'node:crypto';
 import * as jose from 'jose';
@@ -15,6 +18,7 @@ import { verifyWithRotation } from '../services/credential-rotation-service.js';
 import { verifyIamAccessToken } from './iam-token.js';
 import { getCurrentUserStatus } from './user-status.js';
 import { safeEqual } from '../utils/safe-equal.js';
+import { OathweaveAccessDenied, oathweaveAuthentication } from './oathweave.js';
 /** Constant-time string comparison (re-exported for existing callers). */
 export { safeEqual };
 let cachedPublicKey = null;
@@ -260,6 +264,23 @@ export async function authMiddleware(c, next) {
             return;
         }
     }
+    // ── Oathweave resource tokens: RS256 ──────────────────
+    // A token this verifier claims is decided here. Failure never falls through.
+    let oathweaveUser;
+    try {
+        oathweaveUser = await oathweaveAuthentication(token);
+    }
+    catch (error) {
+        if (error instanceof OathweaveAccessDenied) {
+            throw new HttpError(403, 'FORBIDDEN', 'This identity has no linked Magnus account or permission');
+        }
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid or inactive identity session');
+    }
+    if (oathweaveUser) {
+        c.set('user', oathweaveUser);
+        await next();
+        return;
+    }
     // ── External Hive IAM verification mode: RS256 ────────
     if (IAM_CORE_URL) {
         let payload;

package/dist/middleware/error-handler.js

@@ -1,18 +1,18 @@
 import { redactSecretText } from '../utils/redact.js';
+import { containsDatabaseText, databaseFailure } from '../utils/safe-errors.js';
 /** Global error handler for Hono — returns structured ApiError JSON. */
 export function errorHandler(err, c) {
-    const status = 'status' in err ? err.status : 500;
-    const code = 'code' in err ? err.code : 'INTERNAL_ERROR';
+    const database = databaseFailure(err);
+    const status = database?.status ?? ('status' in err ? err.status : 500);
+    const code = database?.code ?? ('code' in err ? err.code : 'INTERNAL_ERROR');
     // Log only the error message and code — never the full error object,
     // which may contain request bodies, tokens, or other secrets.
-    console.error(`[ERROR] ${c.req.method} ${c.req.url} [${code}] ${redactSecretText(err.message)}`);
-    const body = {
-        success: false,
-        error: {
-            code: String(code),
-            message: redactSecretText(err.message || 'An unexpected error occurred'),
-        },
-    };
+    const loggedCode = 'code' in err ? err.code : code;
+    console.error(`[ERROR] ${c.req.method} ${c.req.url} [${loggedCode}] ${redactSecretText(err.message)}`);
+    // Database text quotes queries, arguments and addresses, so it stays in the log.
+    const message = database?.message
+        ?? (containsDatabaseText(err.message) ? 'An unexpected error occurred' : redactSecretText(err.message || 'An unexpected error occurred'));
+    const body = { success: false, error: { code: String(code), message } };
     return c.json(body, status);
 }
 /** Throw an HTTP error with a code. */

package/dist/middleware/oathweave-verifier.js

@@ -0,0 +1,23 @@
+import { createOathweaveVerifier, OATHWEAVE_AUDIENCE, } from '@hivemagnus/magnus-oathweave';
+export { createOathweaveVerifier, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from '@hivemagnus/magnus-oathweave';
+let verifier;
+/** Whether this server accepts Oathweave tokens. A partial configuration counts, and then fails closed. */
+export function oathweaveConfigured() {
+    return Boolean(process.env['OATHWEAVE_ISSUER'] || process.env['OATHWEAVE_JWKS_URL'] || process.env['OATHWEAVE_USERINFO_URL']);
+}
+export function configuredOathweaveVerifier() {
+    if (verifier)
+        return verifier;
+    const issuer = process.env['OATHWEAVE_ISSUER'];
+    const jwksUrl = process.env['OATHWEAVE_JWKS_URL'];
+    const userinfoUrl = process.env['OATHWEAVE_USERINFO_URL'];
+    if (!issuer || !jwksUrl || !userinfoUrl)
+        throw new Error('Oathweave configuration is incomplete');
+    verifier = createOathweaveVerifier({ issuer, jwksUrl, userinfoUrl, audience: OATHWEAVE_AUDIENCE });
+    return verifier;
+}
+/** Drop the memoized verifier so a test can reconfigure the environment. */
+export function resetOathweaveVerifier() {
+    verifier = undefined;
+}
+//# sourceMappingURL=oathweave-verifier.js.map

package/dist/middleware/oathweave.js

@@ -0,0 +1,115 @@
+import { createHash } from 'node:crypto';
+import { decodeProtectedHeader } from 'jose';
+import { parseOathweaveLinks } from '../config/oathweave.js';
+import { configuredOathweaveVerifier, OATHWEAVE_STREAM_RECHECK_MS, oathweaveConfigured, } from './oathweave-verifier.js';
+/** Grants the web terminal, only to a person whose account link is ADMIN. No other route reads it. */
+export const OATHWEAVE_TERMINAL_PERMISSION = 'magnus:terminal';
+/** The token proved who the caller is, but that person has no access to Magnus. */
+export class OathweaveAccessDenied extends Error {
+}
+let parsedLinks;
+function identityLinks(raw) {
+    if (parsedLinks?.raw !== raw)
+        parsedLinks = { raw, links: parseOathweaveLinks(raw) };
+    return parsedLinks.links;
+}
+/**
+ * Map a verified identity through its one explicit account link. The link's role
+ * is a ceiling and the token's permissions grant within it, so neither alone
+ * confers privilege. IAM role names and email addresses are never consulted.
+ */
+export function linkedMagnusIdentity(identity, raw = process.env['MAGNUS_OATHWEAVE_IDENTITIES_JSON'] ?? '[]') {
+    let links;
+    try {
+        links = identityLinks(raw);
+    }
+    catch {
+        throw new OathweaveAccessDenied('Identity links are unreadable');
+    }
+    const matches = links.filter((link) => link.issuer === identity.issuer && link.subject === identity.subject);
+    if (matches.length !== 1)
+        throw new OathweaveAccessDenied('An explicit unique account link is required');
+    const link = matches[0];
+    let role;
+    if (link.role === 'ADMIN' && identity.permissions.includes('magnus:admin'))
+        role = 'ADMIN';
+    else if (link.role !== 'VIEWER' && identity.permissions.includes('magnus:operate'))
+        role = 'OPERATOR';
+    else if (identity.permissions.includes('magnus:view'))
+        role = 'VIEWER';
+    else
+        throw new OathweaveAccessDenied('Magnus permission required');
+    // `email` is an audit actor label across this server (often read as
+    // `user.email ?? user.userId`, and `??` keeps a blank), so it must not be empty.
+    return {
+        userId: link.localUserId, email: link.localUserId, role, iat: identity.issuedAt, exp: identity.expiresAt,
+        // The fleet gateway applies the same rule, and also requires recent identity verification.
+        terminal: link.role === 'ADMIN' && identity.permissions.includes(OATHWEAVE_TERMINAL_PERMISSION),
+    };
+}
+function isOathweaveToken(token) {
+    if (!oathweaveConfigured())
+        return false;
+    try {
+        return decodeProtectedHeader(token).alg === 'RS256';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Authenticate an Oathweave bearer token. Undefined means the token is not this
+ * verifier's to judge (Oathweave is off, or it is not an RS256 JWT). Any throw is
+ * final: the caller must reject the request rather than try another verifier.
+ */
+export async function oathweaveAuthentication(token) {
+    if (!isOathweaveToken(token))
+        return undefined;
+    return linkedMagnusIdentity(await configuredOathweaveVerifier()(token));
+}
+/**
+ * A stable rate-limit identity for a fully verified token, or undefined. Rate
+ * limiters run before route authentication, so they cannot read the context user
+ * and must not trust an unverified `sub` a caller could rotate. The answer comes
+ * from the same session cache authentication uses, so it adds no identity traffic.
+ */
+export async function oathweaveRateLimitSubject(token) {
+    if (!isOathweaveToken(token))
+        return undefined;
+    try {
+        const identity = await configuredOathweaveVerifier()(token);
+        return createHash('sha256').update(JSON.stringify([identity.issuer, identity.subject])).digest('hex');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** How often an open stream re-checks its token. See OATHWEAVE_SESSION_CACHE_TTL_MS. */
+export { OATHWEAVE_STREAM_RECHECK_MS };
+/**
+ * Authentication runs once when a stream opens, so a long-lived stream would
+ * otherwise outlive logout and token expiry. Calls onRevoked once the bearer
+ * token stops authenticating; the browser reconnects with a fresh token.
+ * Returns a function that stops watching. Other credentials are not watched.
+ */
+export function watchOathweaveStream(authorization, onRevoked) {
+    const token = authorization?.startsWith('Bearer ') ? authorization.slice(7) : '';
+    if (!isOathweaveToken(token))
+        return () => undefined;
+    let stopped = false;
+    const stop = () => {
+        stopped = true;
+        clearInterval(timer);
+    };
+    const timer = setInterval(() => {
+        oathweaveAuthentication(token).catch(() => {
+            if (stopped)
+                return;
+            stop();
+            onRevoked();
+        });
+    }, OATHWEAVE_STREAM_RECHECK_MS);
+    timer.unref();
+    return stop;
+}
+//# sourceMappingURL=oathweave.js.map

package/dist/middleware/rate-limit.js

@@ -1,6 +1,7 @@
 import { Redis } from 'ioredis';
 import { incMetric } from '../routes/metrics.js';
 import { heartbeatPeerAddress } from '../utils/heartbeat-peer.js';
+import { oathweaveRateLimitSubject } from './oathweave.js';
 const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
 let _redis = null;
@@ -17,7 +18,8 @@ function getRedis() {
 }
 /**
  * Sliding-window rate limiter backed by Redis.
- * Keyed by client IP address. Falls through (allows) if Redis is unavailable.
+ * Keyed by the verified subject of an Oathweave token, otherwise by client IP
+ * address. Falls through (allows) if Redis is unavailable.
  *
  * @param opts.windowMs  Time window in milliseconds (default: 60_000 = 1 minute)
  * @param opts.max       Maximum requests per window (default: 100)
@@ -32,8 +34,15 @@ export function rateLimitMiddleware(opts = {}) {
         // forwarding header must not let login or mutation clients rotate their
         // rate-limit identity. The helper prefers the Node socket peer and only
         // falls back to forwarded metadata in adapter-free/test contexts.
-        const ip = heartbeatPeerAddress(c) || 'unknown-peer';
-        const key = `${REDIS_PREFIX}${prefix}:${ip}`;
+        const authorization = c.req.header('Authorization');
+        const subject = authorization?.startsWith('Bearer ')
+            ? await oathweaveRateLimitSubject(authorization.slice(7))
+            : undefined;
+        // Behind a same-origin ingress every browser shares one peer address, so a
+        // verified subject gets its own bucket. Anything else, including a token
+        // that failed verification, stays on the peer bucket.
+        const identity = subject ? `subject:${subject}` : heartbeatPeerAddress(c) || 'unknown-peer';
+        const key = `${REDIS_PREFIX}${prefix}:${identity}`;
         const now = Date.now();
         const windowStart = now - windowMs;
         try {

package/dist/openapi/spec.js

@@ -1,3 +1,4 @@
+import { skillJobRequest } from '../routes/hiveskills.js';
 import { z as zSchema } from 'zod';
 import { dashboardReserveSchema, dashboardStartSchema, dashboardFinishSchema, apiDrainAttestationSchema, schedulerBoundaryAttestationSchema } from '../services/resource-enrollment.js';
 import { ardentScopeActivationSchema } from '../services/ardent-scope-enrollment.js';
@@ -217,6 +218,7 @@ const componentSchemas = {
             createdAt: { type: 'string', format: 'date-time' },
             updatedAt: { type: 'string', format: 'date-time' },
             agent: { type: 'object', nullable: true, properties: { version: { type: 'string' }, status: { type: 'string' } } },
+            health: { type: 'object', nullable: true, description: 'GET /nodes only: headline figures of the newest snapshot, null until the node reports one', properties: { timestamp: { type: 'string', format: 'date-time' }, cpuUsagePercent: { type: 'number' }, cpuCores: { type: 'integer' }, memoryTotalBytes: { type: 'number' }, memoryUsedBytes: { type: 'number' }, memoryPercent: { type: 'number' }, swapTotalBytes: { type: 'number' }, swapUsedBytes: { type: 'number' }, disks: { type: 'string', description: 'JSON-encoded disk array' } } },
         },
     },
     User: {
@@ -655,7 +657,7 @@ const paths = {
         get: {
             tags: ['Nodes'],
             summary: 'List nodes',
-            description: 'Returns all fleet nodes with agent info and health metadata. Supports pagination and status filtering. Each node has `upgradeReadiness`: `status` (ok, not-ready, or unknown for agents that do not report it) and `problems` with a code, a detail, a cause and a remedy, such as an enrollment stuck draining, a marker the server does not share, a fence ahead of the server, an unresolved ledger, low disk or missing npm.',
+            description: 'Returns all fleet nodes with agent info and health metadata. Supports pagination and status filtering. Each node has `upgradeReadiness`: `status` (ok, not-ready, or unknown for agents that do not report it) and `problems` with a code, a detail, a cause and a remedy, such as an enrollment stuck draining, a marker the server does not share, a fence ahead of the server, an unresolved ledger, low disk or missing npm. Each node also has `health`, the headline figures of its newest snapshot, or null when it has none, so a list needs no request per row.',
             security: apiSecretAuth,
             parameters: [
                 qp('page', 'Page number (1-based)', { type: 'integer' }),
@@ -2106,6 +2108,36 @@ const paths = {
         },
     },
     // ──────────────── Stats ────────────────
+    '/console/session': {
+        get: {
+            tags: ['Stats'],
+            summary: 'Role and capabilities of the signed-in browser console user',
+            security: [{ bearerAuth: [] }, { apiSecret: [] }],
+            responses: {
+                '200': success('Mapped role and console capabilities', {
+                    type: 'object',
+                    required: ['userId', 'role', 'capabilities'],
+                    properties: {
+                        userId: { type: 'string' },
+                        role: { type: 'string', enum: ['ADMIN', 'OPERATOR', 'VIEWER'] },
+                        capabilities: {
+                            type: 'object',
+                            required: ['hermes', 'terminal', 'agentVersion', 'magnusVersion', 'securityConsoleUrl'],
+                            properties: {
+                                hermes: { type: 'boolean' },
+                                terminal: { type: 'boolean', description: 'The fleet gateway is deployed and this person may use it.' },
+                                agentVersion: { type: 'string' },
+                                magnusVersion: { type: 'string' },
+                                securityConsoleUrl: { type: ['string', 'null'] },
+                            },
+                        },
+                    },
+                }),
+                '401': err401,
+                '403': err403,
+            },
+        },
+    },
     '/stats/overview': {
         get: {
             tags: ['Stats'],
@@ -2387,7 +2419,8 @@ const paths = {
                         enabled: { type: 'boolean' },
                         host: { type: 'string' },
                         port: { type: 'integer', nullable: true },
-                        keyFingerprint: { type: 'string', nullable: true },
+                        keyConfigured: { type: 'boolean' },
+                        keyFingerprint: { type: 'string', nullable: true, description: 'Present for ADMIN only.' },
                         lastSyncedAt: { type: 'string', format: 'date-time', nullable: true },
                     },
                 }),
@@ -2703,6 +2736,7 @@ export function buildOpenApiSpec() {
         tags,
         components: {
             securitySchemes: {
+                skillsExecutorBearer: { type: 'http', scheme: 'bearer', bearerFormat: 'opaque', description: 'Dedicated endpoint-scoped registry credential; only configured targets and exact native sync operations, never general commands.' },
                 cindertraceSignature: { type: 'apiKey', in: 'header', name: 'x-cindertrace-signature', description: 'Dedicated response HMAC bound to method, path, exact body, x-cindertrace-time and x-cindertrace-nonce. Responses are signed against the same request binding.' },
                 apiSecret: {
                     type: 'apiKey',
@@ -2736,6 +2770,8 @@ export function buildOpenApiSpec() {
             schemas: componentSchemas,
         },
         paths: { ...paths,
+            '/api/v1/hiveskills/targets/{target}': { get: { summary: 'Verify exact enrolled native target and immutable client without dispatch', tags: ['Skills'], security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'target', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Read-only enrolled target posture; ready false retains operator review' }, 401: { description: 'Dedicated executor credential required' }, 403: { description: 'Target outside exact registry grant' } } } },
+            '/api/v1/hiveskills/jobs/{id}': { post: { summary: 'Execute one exact approved HiveSkills publication through enrolled native admission', tags: ['Skills'], requestBody: { required: true, content: { 'application/json': { schema: zSchema.toJSONSchema(skillJobRequest) } } }, security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }], responses: { 200: { description: 'Bounded durable outcome; admitted operations are never replayed' }, 409: { description: 'Publication conflict, not admitted or uncertain' } } }, get: { summary: 'Reconcile only the original signed HiveSkills operation receipt', tags: ['Skills'], security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }, { name: 'target', in: 'query', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Existing durable outcome' } } } },
             '/api/v1/security-integration/response/execute': { post: { summary: 'Execute an exact Cindertrace-approved response through managed node admission', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], requestBody: { required: true, content: { 'application/json': { schema: zSchema.toJSONSchema(responseRequestSchema) } } }, responses: { 200: { description: 'Signed completion receipt' }, 409: { description: 'Expired, already claimed, blocked, or uncertain execution' } } } },
             '/api/v1/security-integration/response/{id}': { get: { summary: 'Read an existing Cindertrace execution without replay', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed existing execution status' } } } },
             '/api/v1/security-integration/response/targets/{id}/health': { get: { summary: 'Read fresh target health for Cindertrace', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed minimal health snapshot' } } } },

package/dist/queue/names.js

@@ -0,0 +1,9 @@
+/** BullMQ rejects colons in queue names. Split the legacy logical name without
+ * changing a single Redis key: default "bull:<logical>:<suffix>" stays identical. */
+export function bullQueueIdentity(namespace, queue) {
+    const logical = namespace + queue, index = logical.lastIndexOf(':');
+    return index < 0
+        ? { name: logical, prefix: 'bull' }
+        : { name: logical.slice(index + 1), prefix: 'bull:' + logical.slice(0, index) };
+}
+//# sourceMappingURL=names.js.map

package/dist/queue/workers.js

@@ -1,6 +1,8 @@
 import { ResourceLeaseConflict } from '../services/command-resource-leases.js';
 import { recordMonitorPulse } from '../services/monitor-pulse.js';
 import { Queue, Worker } from 'bullmq';
+import { bullQueueIdentity } from './names.js';
+import { assertLiveExecution } from '../config/rehearsal.js';
 import { addDurableJob } from './requeue.js';
 import { validateRemediationCommandForDispatch } from '../services/remediation-service.js';
 import { reconcileCommands } from '../services/command-lifecycle.js';
@@ -15,7 +17,7 @@ import { incMetric } from '../routes/metrics.js';
 import { verifyCommandResultSignature } from '../security/command-result-signature.js';
 // ─── Command execution queue ───
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
-const COMMAND_QUEUE = `${REDIS_PREFIX}commands`;
+const COMMAND_QUEUE = bullQueueIdentity(REDIS_PREFIX, 'commands');
 const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
 let _commandQueue = null;
 let _commandWorker = null;
@@ -25,8 +27,10 @@ const COMMAND_EXECUTION_LEASE_MS = 5 * 60 * 1_000;
 const NODE_HEARTBEAT_FRESHNESS_MS = Number(process.env['STALE_NODE_THRESHOLD_MS'] ?? 120_000);
 /** Get the singleton command queue instance. */
 export function getCommandQueue() {
+    assertLiveExecution();
     if (!_commandQueue) {
-        _commandQueue = new Queue(COMMAND_QUEUE, {
+        _commandQueue = new Queue(COMMAND_QUEUE.name, {
+            prefix: COMMAND_QUEUE.prefix,
             connection: { url: REDIS_URL },
             defaultJobOptions: {
                 attempts: 1,
@@ -68,9 +72,10 @@ export async function enqueueCommand(commandId) {
 }
 /** Start the command execution worker. */
 export function startCommandWorker() {
+    assertLiveExecution();
     if (_commandWorker)
         return _commandWorker;
-    const worker = new Worker(COMMAND_QUEUE, async (job) => {
+    const worker = new Worker(COMMAND_QUEUE.name, async (job) => {
         const db = getDb();
         const { commandId } = job.data;
         const now = new Date();
@@ -245,6 +250,7 @@ export function startCommandWorker() {
     }, {
         connection: { url: REDIS_URL },
         concurrency: 10,
+        prefix: COMMAND_QUEUE.prefix,
     });
     worker.on('failed', (job, err) => {
         console.error(`[CommandWorker] Job ${job?.id} failed:`, err.message);